From 0d8ce554a347c7fc84415bd29aa410cb5eabb6da Mon Sep 17 00:00:00 2001 From: Jeroen Grusewski Date: Tue, 21 Jul 2026 12:27:00 +0000 Subject: [PATCH] fix(dashboard): allow tailscale sidecar egress to kube-apiserver The dashboard NetworkPolicy blocked egress to the kube-apiserver (kube-proxy DNATs kubernetes.default.svc 10.32.0.1:443 -> 172.16.0.11:6443, and both 10.32/16 and 100.64/15 were excepted). On a FRESH sidecar start (e.g. after the CI deploy's scale-0->1) tailscale must read its ts-state Secret via the apiserver -> without the allow it crashlooped 'context deadline exceeded' -> bad gateway on dashboard.fxhnt.ai. Adds the 6443->172.16.0.11/32 egress rule, mirroring the dagster NP fix (06d12fd). Pre-existing gap, surfaced by the first pipeline deploy that recreated the dashboard pod. --- infra/k8s/network-policies/fxhnt-cockpit.yaml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/infra/k8s/network-policies/fxhnt-cockpit.yaml b/infra/k8s/network-policies/fxhnt-cockpit.yaml index 443bcc4..a9a8970 100644 --- a/infra/k8s/network-policies/fxhnt-cockpit.yaml +++ b/infra/k8s/network-policies/fxhnt-cockpit.yaml @@ -28,8 +28,10 @@ spec: - ports: # DNS - { port: 53, protocol: UDP } - { port: 53, protocol: TCP } - - to: # tailscale sidecar -> coordination/DERP (public internet) - - ipBlock: { cidr: 0.0.0.0/0, except: [10.32.0.0/16, 100.64.0.0/15] } + - to: [{ ipBlock: { cidr: 172.16.0.11/32 } }] # kube-apiserver REAL endpoint (kube-proxy DNATs kubernetes.default.svc 10.32.0.1:443 -> this before NP eval). The tailscale sidecar reads/writes its ts-state Secret via the apiserver — WITHOUT this it crashloops "context deadline exceeded" on a fresh start (e.g. after the deploy scale-0->1), causing a bad gateway. Mirrors the dagster NP fix (06d12fd). + ports: [{ port: 6443, protocol: TCP }] + - to: # tailscale sidecar -> coordination/DERP (public internet). except now includes 172.16.0.0/16 so the apiserver rule above is the only cluster-internal path. + - ipBlock: { cidr: 0.0.0.0/0, except: [10.32.0.0/16, 100.64.0.0/15, 172.16.0.0/16] } ports: - { port: 443, protocol: TCP } - { port: 3478, protocol: UDP }