fix(ai2/hermes): permit post-dnat apiserver egress on port 6443 in networkpolicy #16

Open

hermes wants to merge 0 commits from hermes/k3s-manifests:feat/clone-hermes-and-tools-ai2 into main

pull from: hermes/k3s-manifests:feat/clone-hermes-and-tools-ai2

merge into: Mitko:main

Mitko:main

Conversation 0 Commits - Files changed 16 +251 -75

hermes commented 2026-10-11 21:51:16 +00:00

Contributor

Copy link

In k3s, requests to the Kubernetes Service ClusterIP (10.43.0.1:443) are DNATed by Flannel/kube-proxy to node IPs on port 6443 (10.0.0.0/16:6443). The previous NetworkPolicy egress rule excluded RFC1918 addresses from port 443 egress, which caused apiserver connections to be refused post-DNAT. This fix adds explicit egress rules for 10.43.0.0/16 and 10.0.0.0/16 on both ports 443 and 6443.

In k3s, requests to the Kubernetes Service ClusterIP (`10.43.0.1:443`) are DNATed by Flannel/kube-proxy to node IPs on port 6443 (`10.0.0.0/16:6443`). The previous NetworkPolicy egress rule excluded RFC1918 addresses from port 443 egress, which caused apiserver connections to be refused post-DNAT. This fix adds explicit egress rules for `10.43.0.0/16` and `10.0.0.0/16` on both ports 443 and 6443.

hermes added 1 commit 2026-10-11 21:51:17 +00:00

fix(ai2/hermes): permit post-dnat apiserver egress on port 6443 in networkpolicy 02cb03a918

hermes added 1 commit 2026-10-11 22:27:31 +00:00

fix(ai2-work/rbac): add patch verb to configmaps for kubectl apply support 1657d3ca11

hermes added 1 commit 2026-10-11 23:46:30 +00:00

fix(ai2/hermes): permit egress to local firecrawl-api on port 3002 1adc5a8c36

hermes added 1 commit 2026-10-12 00:30:08 +00:00

feat(ai2): add official blender deployment with mcp bridge and ingress 8d1ebbcea2

hermes added 1 commit 2026-10-12 00:32:14 +00:00

fix(ai2/blender): store compressed addon in configmap to avoid kubernetes annotation limit 0f690729dd

hermes added 1 commit 2026-10-12 00:51:32 +00:00

feat(ai2/obsidian): expose web ui, add private ingress with tls secret obsidian2.mitko.sh, and allow hermes egress 37a721b9a9

hermes added 1 commit 2026-10-12 00:54:57 +00:00

fix(ai2/obsidian): route ingress to plain http port 3000 to resolve 400 bad request 496c3e09c0

hermes added 1 commit 2026-10-12 02:04:36 +00:00

fix(ai2/blender): set probes, restart watchdog, and autostart display env 0eff3a04ea

hermes added 1 commit 2026-10-12 02:41:20 +00:00

fix(ai2/hermes): isolate egress to namespace ai2 and external https, dropping k8s apiserver and other cluster services 42737b2b25

This pull request can be merged automatically.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u feat/clone-hermes-and-tools-ai2:hermes-feat/clone-hermes-and-tools-ai2

git switch hermes-feat/clone-hermes-and-tools-ai2

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff hermes-feat/clone-hermes-and-tools-ai2

git switch hermes-feat/clone-hermes-and-tools-ai2

git rebase main

git switch main

git merge --ff-only hermes-feat/clone-hermes-and-tools-ai2

git switch hermes-feat/clone-hermes-and-tools-ai2

git rebase main

git switch main

git merge --no-ff hermes-feat/clone-hermes-and-tools-ai2

git switch main

git merge --squash hermes-feat/clone-hermes-and-tools-ai2

git switch main

git merge --ff-only hermes-feat/clone-hermes-and-tools-ai2

git switch main

git merge hermes-feat/clone-hermes-and-tools-ai2

git push origin main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Mitko/k3s-manifests!16

No description provided.