37cafb2b75
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
The build Job's pods carried `app: hush`, which is the podSelector on hush's NetworkPolicy — a default-deny policy that permits egress to DNS and Redis and nothing else. That is a true statement about the server and a false one about a build, which needs Gitea, the registry, Docker Hub and gcr.io. kube-router REJECTS rather than drops, so the symptom was `connection refused` from whichever host the build reached for next: four pushes to registry.threesix.ai, then a blob fetch from production.cloudfront.docker.com. Intermittently, because policy sync leaves windows where the rules are briefly absent — which is why an earlier build pushed successfully and read as normal. Measured 2026-09-05 from pods in this namespace: `app=hush` reached Docker Hub 10 of 12 times, `app=hush-build` 12 of 12, and in-cluster destinations 16 of 16 under both. The Job is now `app: hush-build`, so hush's policy no longer selects it, and the Service selector no longer matches it either. |
||
|---|---|---|
| .. | ||
| alerts-check.sh | ||
| format-logs.py | ||
| install-mcp.sh | ||
| logs.sh | ||
| release.sh | ||
| smoke.sh | ||