From df14d7290e4e710a7724fb589b750d5c50b2ba7c Mon Sep 17 00:00:00 2001 From: deploy Date: Thu, 1 Oct 2026 14:05:17 +0000 Subject: [PATCH] =?UTF-8?q?fix(backup):=20saida=20443=20so=20para=20o=20po?= =?UTF-8?q?d=20do=20backup=20em=20acme/piloto/escolinha=20=E2=80=94=20o=20?= =?UTF-8?q?envio=20ao=20B2=20era=20recusado=20e=20o=20job=20de=2001/10=20f?= =?UTF-8?q?alhou?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- tenants/acme/19-netpol-backup-offsite.yaml | 24 +++++++++++++++++++ tenants/acme/50-backup.yaml | 4 ++++ .../escolinha/19-netpol-backup-offsite.yaml | 24 +++++++++++++++++++ tenants/escolinha/50-backup.yaml | 4 ++++ tenants/piloto/19-netpol-backup-offsite.yaml | 24 +++++++++++++++++++ tenants/piloto/50-backup.yaml | 4 ++++ 6 files changed, 84 insertions(+) create mode 100644 tenants/acme/19-netpol-backup-offsite.yaml create mode 100644 tenants/escolinha/19-netpol-backup-offsite.yaml create mode 100644 tenants/piloto/19-netpol-backup-offsite.yaml diff --git a/tenants/acme/19-netpol-backup-offsite.yaml b/tenants/acme/19-netpol-backup-offsite.yaml new file mode 100644 index 0000000..8f8a7c3 --- /dev/null +++ b/tenants/acme/19-netpol-backup-offsite.yaml @@ -0,0 +1,24 @@ +# Offsite no Backblaze B2 (30/09/2026): o pod do backup precisa sair para a internet +# na 443 para mandar o dump CIFRADO ao bucket. SO ELE: o seletor e o label +# `app: pg-backup`, que o 50-backup.yaml poe no pod. +# +# Sem esta regra o envio e recusado ("connection refused") e o job falha — foi o que +# derrubou o backup de 01/10/2026 em acme, piloto e escolinha (o dump local foi +# feito; so o envio falhou). demo e plataforma nao precisaram: ja tinham saida 443 +# para todos os pods, por outra regra. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: egress-backup-offsite + namespace: acme-prod +spec: + podSelector: + matchLabels: { app: pg-backup } + policyTypes: [Egress] + egress: + - to: + - ipBlock: + cidr: 0.0.0.0/0 + except: [10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16] + ports: + - { protocol: TCP, port: 443 } diff --git a/tenants/acme/50-backup.yaml b/tenants/acme/50-backup.yaml index be12cef..ad253fe 100644 --- a/tenants/acme/50-backup.yaml +++ b/tenants/acme/50-backup.yaml @@ -44,6 +44,10 @@ spec: jobTemplate: spec: template: + # O label e o que a 19-netpol-backup-offsite seleciona: so o pod do backup + # sai para a internet (443), para mandar o dump cifrado ao bucket. + metadata: + labels: { app: pg-backup } spec: restartPolicy: OnFailure containers: diff --git a/tenants/escolinha/19-netpol-backup-offsite.yaml b/tenants/escolinha/19-netpol-backup-offsite.yaml new file mode 100644 index 0000000..4fe716d --- /dev/null +++ b/tenants/escolinha/19-netpol-backup-offsite.yaml @@ -0,0 +1,24 @@ +# Offsite no Backblaze B2 (30/09/2026): o pod do backup precisa sair para a internet +# na 443 para mandar o dump CIFRADO ao bucket. SO ELE: o seletor e o label +# `app: pg-backup`, que o 50-backup.yaml poe no pod. +# +# Sem esta regra o envio e recusado ("connection refused") e o job falha — foi o que +# derrubou o backup de 01/10/2026 em acme, piloto e escolinha (o dump local foi +# feito; so o envio falhou). demo e plataforma nao precisaram: ja tinham saida 443 +# para todos os pods, por outra regra. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: egress-backup-offsite + namespace: escolinha-prod +spec: + podSelector: + matchLabels: { app: pg-backup } + policyTypes: [Egress] + egress: + - to: + - ipBlock: + cidr: 0.0.0.0/0 + except: [10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16] + ports: + - { protocol: TCP, port: 443 } diff --git a/tenants/escolinha/50-backup.yaml b/tenants/escolinha/50-backup.yaml index b185c43..9f0bed5 100644 --- a/tenants/escolinha/50-backup.yaml +++ b/tenants/escolinha/50-backup.yaml @@ -39,6 +39,10 @@ spec: jobTemplate: spec: template: + # O label e o que a 19-netpol-backup-offsite seleciona: so o pod do backup + # sai para a internet (443), para mandar o dump cifrado ao bucket. + metadata: + labels: { app: pg-backup } spec: restartPolicy: OnFailure containers: diff --git a/tenants/piloto/19-netpol-backup-offsite.yaml b/tenants/piloto/19-netpol-backup-offsite.yaml new file mode 100644 index 0000000..d0c0393 --- /dev/null +++ b/tenants/piloto/19-netpol-backup-offsite.yaml @@ -0,0 +1,24 @@ +# Offsite no Backblaze B2 (30/09/2026): o pod do backup precisa sair para a internet +# na 443 para mandar o dump CIFRADO ao bucket. SO ELE: o seletor e o label +# `app: pg-backup`, que o 50-backup.yaml poe no pod. +# +# Sem esta regra o envio e recusado ("connection refused") e o job falha — foi o que +# derrubou o backup de 01/10/2026 em acme, piloto e escolinha (o dump local foi +# feito; so o envio falhou). demo e plataforma nao precisaram: ja tinham saida 443 +# para todos os pods, por outra regra. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: egress-backup-offsite + namespace: piloto-prod +spec: + podSelector: + matchLabels: { app: pg-backup } + policyTypes: [Egress] + egress: + - to: + - ipBlock: + cidr: 0.0.0.0/0 + except: [10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16] + ports: + - { protocol: TCP, port: 443 } diff --git a/tenants/piloto/50-backup.yaml b/tenants/piloto/50-backup.yaml index 0ac0880..e6af2fe 100644 --- a/tenants/piloto/50-backup.yaml +++ b/tenants/piloto/50-backup.yaml @@ -44,6 +44,10 @@ spec: jobTemplate: spec: template: + # O label e o que a 19-netpol-backup-offsite seleciona: so o pod do backup + # sai para a internet (443), para mandar o dump cifrado ao bucket. + metadata: + labels: { app: pg-backup } spec: restartPolicy: OnFailure containers: