netpol(gitea): let the notes push webhook reach the wiki service #941

2026-09-24T10:46:20Z

claude-bot commented

2026-09-24 10:46:20 +00:00

Gitea's egress rule into ai named only the wiki-index pod, so the new webhook (hook 17 on k.renner/notes → wiki.ai.svc:8080/webhook) timed out: Post ... context deadline exceeded (Client.Timeout exceeded while awaiting headers) in Gitea's log. The rule now also admits the wiki pod on 8080. The service itself answers (a signed request through the ingress gets the expected 403 on a bad signature).

Verification after merge: POST /repos/k.renner/notes/hooks/17/tests and a sync done ... Skipped = True line in the wiki pod log.

🤖 Generated with Claude Code

Gitea's egress rule into `ai` named only the `wiki-index` pod, so the new webhook (hook 17 on k.renner/notes → `wiki.ai.svc:8080/webhook`) timed out: `Post ... context deadline exceeded (Client.Timeout exceeded while awaiting headers)` in Gitea's log. The rule now also admits the `wiki` pod on 8080. The service itself answers (a signed request through the ingress gets the expected 403 on a bad signature). Verification after merge: `POST /repos/k.renner/notes/hooks/17/tests` and a `sync done ... Skipped = True` line in the wiki pod log. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-09-24 10:46:21 +00:00

netpol(gitea): let the notes push webhook reach the wiki service

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

ci/woodpecker/pr/pr-review Pipeline was successful

Details

3b0c42473a

Gitea's egress to ai was scoped to the wiki-index pod; deliveries to
wiki.ai.svc timed out (hook 17, 2026-09-24).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

review-bot reviewed

2026-09-24 10:49:03 +00:00

review-bot left a comment

🤖 Automated review — model CLI default (complexity: unknown), commit 3b0c42473aa40d03aaa3f283750e385006797614.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

Summary

Adds a second matchLabels entry (app.kubernetes.io/name: wiki) to the existing egress rule in gitea-ns.yaml's default-deny policy, alongside the pre-existing wiki-index entry, so pods in the gitea namespace can reach the wiki pod on port 8080. No blocking issues.

Tests

No automated tests apply to network-policy manifests in this repo (none exist for the sibling policies either). The PR body describes concrete post-merge verification (POST /repos/k.renner/notes/hooks/17/tests returning success and a sync done ... Skipped = True line in the wiki pod log), which is the appropriate way to validate a CiliumNetworkPolicy change like this — I can't execute it from a static review, but the described check is the right one.

Verification performed

Confirmed the ingress side already permits this traffic: kubernetes/infrastructure/network-policies/ai-ns.yaml:154-174 (the wiki CiliumNetworkPolicy) already allows ingress from namespace: gitea, app.kubernetes.io/name: gitea on port 8080 — this PR closes the missing egress half of that path, matching the bug description exactly.
Confirmed port 8080 matches the wiki deployment's container/service port (kubernetes/apps/wiki/deployment.yaml:77,129).
Confirmed the multi-entry matchLabels list under a single toEndpoints rule is valid Cilium OR-semantics and matches the repo's own established idiom for this exact case — the wiki and wiki-index ingress rules in ai-ns.yaml:164-170 and :189-196 already combine two matchLabels entries (traefik, gitea) under one fromEndpoints list rather than as two separate top-level rules.
The edit is minimal and doesn't touch the wiki-index entry or any unrelated rule.

Recommendation

Looks reasonable — no blocking issues; comments above are optional.

🤖 **Automated review** — model `CLI default` (complexity: unknown), commit `3b0c42473aa40d03aaa3f283750e385006797614`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary Adds a second `matchLabels` entry (`app.kubernetes.io/name: wiki`) to the existing egress rule in `gitea-ns.yaml`'s `default-deny` policy, alongside the pre-existing `wiki-index` entry, so pods in the `gitea` namespace can reach the `wiki` pod on port 8080. No blocking issues. ## Tests No automated tests apply to network-policy manifests in this repo (none exist for the sibling policies either). The PR body describes concrete post-merge verification (`POST /repos/k.renner/notes/hooks/17/tests` returning success and a `sync done ... Skipped = True` line in the wiki pod log), which is the appropriate way to validate a CiliumNetworkPolicy change like this — I can't execute it from a static review, but the described check is the right one. ## Verification performed - Confirmed the ingress side already permits this traffic: `kubernetes/infrastructure/network-policies/ai-ns.yaml:154-174` (the `wiki` CiliumNetworkPolicy) already allows ingress from `namespace: gitea, app.kubernetes.io/name: gitea` on port 8080 — this PR closes the missing egress half of that path, matching the bug description exactly. - Confirmed port 8080 matches the `wiki` deployment's container/service port (`kubernetes/apps/wiki/deployment.yaml:77,129`). - Confirmed the multi-entry `matchLabels` list under a single `toEndpoints` rule is valid Cilium OR-semantics and matches the repo's own established idiom for this exact case — the `wiki` and `wiki-index` ingress rules in `ai-ns.yaml:164-170` and `:189-196` already combine two `matchLabels` entries (traefik, gitea) under one `fromEndpoints` list rather than as two separate top-level rules. - The edit is minimal and doesn't touch the `wiki-index` entry or any unrelated rule. ## Recommendation Looks reasonable — no blocking issues; comments above are optional.

k.renner merged commit 21c4c8c96b into master

2026-09-24 11:18:33 +00:00

k.renner referenced this issue from a commit

2026-09-24 11:18:34 +00:00

Merge pull request 'netpol(gitea): let the notes push webhook reach the wiki service' (#941) from fix/gitea-egress-wiki into master

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#941