feat(security): allow mendys-prod ingress to fuzefront-security:3002 - #497
Merged
Conversation
…nt-security:3002 mendys-prod's datasets-service authenticates against FuzeFront's Security API in-cluster (session verify + authz check/grants). Adds an ingress NetworkPolicy for fuzefront-security that allows Traefik, intra-fuzefront pods, and mendys-prod on TCP 3002 — enumerated together because matching the pod's podSelector flips it from implicit-allow-all to explicit-allow-list under k3s's NetworkPolicy controller, so the existing traffic paths must be listed alongside the new one. Gated by securityService.networkPolicy.enabled (default true). Closes #493. Origin: FuzeInfra#339.
izzywdev
added
the
auto-merge
Claude
Contributor
Automated code review (gate-code-review)Credit balance is too low Report-only — this check never blocks merge. |
Contributor
Automated code review (gate-code-review)Credit balance is too low Report-only — this check never blocks merge. |
Contributor
Automated code review (gate-code-review)Credit balance is too low Report-only — this check never blocks merge. |
izzywdev
added a commit
that referenced
this pull request
Aug 4, 2026
… (#534) `authentik.networkPolicy` and `securityService.networkPolicy` each lost their `port` / `ingressControllerNamespace` / `fuzeagentNamespace` / `mendysProdNamespace` keys in the wholesale values.yaml rewrite in 8dedb86 (#523, +141/-397 in a commit about consumer-registration tokens). values-prod.yaml sets `authentik.networkPolicy.enabled: true`, so the template then rendered port: 0 which the API server rejects. That failed the Argo sync of the ENTIRE fuzefront Application, and Argo's automated-sync guard ("failed previous sync attempt to [rev] and will not retry") made the failure sticky per revision — so every release since reported green and shipped nothing. See FuzeInfra#501. - Restore the deleted values (verified identical to the live in-cluster policy: kube-system / intra-namespace / fuzeagent on TCP 9000). - Give every $np lookup in both NetworkPolicy templates an inline `default`, so a future values edit can never again turn a dropped key into a manifest that blocks the whole application from deploying. `securityService.networkPolicy.enabled` was ALSO silently flipped true -> false by 8dedb86. Left false here on purpose: that policy (#497) has never actually been applied in prod, because syncs were already failing when it landed, so enabling it is a deliberate deploy-window change and not part of an outage fix. Verified: `helm template -f values-prod.yaml` renders port 9000 on all three ingress rules, and `kubectl apply --dry-run=server` against prod is accepted ("configured") — a no-op diff versus the live policy. Claude-Session-Id: 94bc36eb-1f92-4270-8c73-085913a64127 Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
10 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📋 Description
Adds an ingress
NetworkPolicyforfuzefront-security(port 3002) that allows themendys-prodnamespace to reach it in-cluster. Mendys'datasets-serviceauthenticates against FuzeFront's Security API via server-side calls tohttp://fuzefront-security.fuzefront.svc.cluster.local:3002/api/v1/security/session(and/authz/check+/authz/grants); today that path is only implicitly reachable, and would fail closed if thefuzefrontnamespace ever gained a default-deny NetworkPolicy.Fixes #493
🔄 Type of Change
🔧 Implementation Details
Changes Made
deploy/helm/fuzefront/templates/security-networkpolicy.yaml— an ingressNetworkPolicyselecting thefuzefront-securitypods (app.kubernetes.io/part-of: fuzefront,app.kubernetes.io/component: security-service), mirroring the existingauthentik-networkpolicy.yamlpattern.deploy/helm/fuzefront/values.yaml— newsecurityService.networkPolicyblock (enabled: trueby default,port: 3002,ingressControllerNamespace: kube-system,mendysProdNamespace: mendys-prod).Why the policy allows more than just
mendys-prod: FuzeFront ships no default-deny ingressNetworkPolicytoday, sofuzefront-securitycurrently accepts all ingress. Under k3s'sNetworkPolicycontroller, the moment any policy'spodSelectormatches a pod, that pod flips to deny-all-except-explicitly-allowed. A standalonemendys-prod→3002 rule would therefore silently break the existing Traefik reverse-proxy path (ingress.yaml:/api/v1/security,/api/auth,/api/organizations,/api/internal) and intra-namespace calls (e.g.provisioning-service→http://fuzefront-security:3002). So this policy enumerates Traefik (kube-system) + intra-fuzefrontpods +mendys-prod, all at once — additive to who can already reach the service, not a lockdown.Gated by
securityService.networkPolicy.enabled(defaulttrue, per the issue's acceptance criteria), and only renders whensecurityService.enabledis also true.🧪 Testing
helm lint,helm template(rendered againstvalues.yaml+values-prod.yaml), andkubeconform -ignore-missing-schemasall pass on the rendered manifests.mendys-prodpod,curl -s http://fuzefront-security.fuzefront.svc.cluster.local:3002/api/v1/security/sessionshould no longer be blocked.Code Quality
🔗 Related Issues and PRs
📝 Additional Notes
Deployment Notes
main/masterautomatically per this repo's GitOps model)No FuzeInfra-side change needed, per the issue's acceptance criteria.
Generated by Claude Code