From 875529f260a08aff14e589d38ec7011d0c9595ed Mon Sep 17 00:00:00 2001 From: Levi van Noort <73097785+levivannoort@users.noreply.github.com> Date: Wed, 14 Oct 2026 13:33:16 +0200 Subject: [PATCH] ci: allow Appwrite's URL resolver in the hardened scenario With the browser on by default, the smoke test takes a screenshot in every scenario. Under restricted egress the API refused it with 400 ("Hostname example.com does not resolve"): Appwrite 2.4.0 and later check avatar and screenshot URLs through _APP_DNS_EXTERNAL (8.8.8.8), which the policy blocked. The hardened values now allow it, as docs/networking.md tells users to, and troubleshooting names the error. --- charts/appwrite/ci/hardened-values.yaml | 6 ++++++ docs/troubleshooting.md | 5 +++++ 2 files changed, 11 insertions(+) diff --git a/charts/appwrite/ci/hardened-values.yaml b/charts/appwrite/ci/hardened-values.yaml index 9bb3a8f..670e1ad 100644 --- a/charts/appwrite/ci/hardened-values.yaml +++ b/charts/appwrite/ci/hardened-values.yaml @@ -26,6 +26,12 @@ networkPolicy: enabled: true egress: enabled: true + # Appwrite checks avatar, screenshot and migration URLs through its own + # resolver (_APP_DNS_EXTERNAL, by default 8.8.8.8), as docs/networking.md + # tells users to allow. + extraRules: + - to: [{ipBlock: {cidr: 8.8.8.8/32}}] + ports: [{port: 53, protocol: UDP}, {port: 53, protocol: TCP}] metrics: from: - namespaceSelector: diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md index 9e63c76..5ccf8f9 100644 --- a/docs/troubleshooting.md +++ b/docs/troubleshooting.md @@ -335,6 +335,11 @@ kubectl -n appwrite logs -l appwrite/role=worker --prefix --tail=2000 | grep -i (`browser.enabled: false`). Turn it on and redeploy the site; screenshots are only taken during a deployment ([optional-components.md](optional-components.md#browser)). +- `Hostname ... does not resolve` (in the API's log for + `/v1/avatars/screenshots`): with `networkPolicy.egress.enabled`, Appwrite + can't reach the resolver it checks URLs with (`_APP_DNS_EXTERNAL`, by + default 8.8.8.8). Allow it + ([networking.md](networking.md#requests-to-private-addresses)). - A timeout, or a refused connection to the API: with `networkPolicy.enabled`, the browser may only reach DNS, the API and public addresses ([security.md](security.md#network-policies)); check that its egress