Repository navigation
Conversation
RFC v3 Phase 6 (§12). Every caller reaches the backend in-cluster, and the backend has no login of its own anymore: - remove the Ingress for api.polinetwork.org and backend.polinetwork.org - add a NetworkPolicy that admits only admin, web, bot-ts and auth on port 3000 - drop PUBLIC_URL, TRUSTED_ORIGINS, BETTER_AUTH_SECRET and the unused GITHUB_CLIENT_* settings, and their Key Vault mappings
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
RFC v3 Phase 6 (§12) for the backend deployment.
Removes
apps/backend/ingress.yaml.api.polinetwork.organdbackend.polinetwork.orgno longer reach the backend. Every caller uses the in-cluster Service (backend-service.backend.svc.cluster.local:3000):BACKEND_URL, also for the esign agent proxyBACKEND_URLBACKEND_URL, for tRPC and the socketOAUTH_BACKEND_EVENTS_URLThe only thing that needed the public hostnames was the backend's better-auth, which feat(auth)!: drop better-auth and the legacy permission tables (RFC v3 Phase 6) backend#93 removes.
Adds
apps/backend/network-policy.yaml. It allows ingress toapp: backendonly fromapp: admin,app: web,app: bot-tsandapp: authin their namespaces, on TCP 3000. Redis sidecars and Traefik are excluded. Kubelet TCP probes are not affected. The policy follows the style ofinfrastructure/flux-web/network-policy.yaml. The cluster enforces it through the k3s network policy controller.Removes
PUBLIC_URL,TRUSTED_ORIGINSandBETTER_AUTH_SECRET, which only better-auth read. Also removesGITHUB_CLIENT_ID/GITHUB_CLIENT_SECRET, which the backend no longer reads at all, and theirazure-kvmappings.Order: merge after PoliNetworkOrg/backend#93 is running
The backend image currently in production still requires
BETTER_AUTH_SECRET. If this PR rolls out first, the pod restarts on the old image and fails at startup.latestdigest.[DB] Migration completed).Outside git (manual)
api.polinetwork.organdbackend.polinetwork.orgfrom thek3s01tunnel, and their DNS records. Until then the requests reach Traefik and get a 404.api.polinetwork.org, remove it or point it elsewhere.backend-auth-secret,backend-auth-github-idandbackend-auth-github-secretare no longer used and can be deleted.Verification
kustomize build apps/backend(v5.4.3): Namespace, Service, Deployment, ExternalSecret, NetworkPolicy.kubeconform -strict: the 4 core resources are valid. ExternalSecret has no schema, since it is a CRD.ruby tests/workload-manifests.test.rb: passed.Not verified: the policy against the live cluster, because I have no cluster access. After the merge, check that admin, web, the bot and the IdP events still reach the backend.