The operator's managed policy is default-deny with egress limited to DNS
and TCP 443, so reaching a LAN service on any other port is dropped.
Measured against 10.4.1.222 from inside the pod: 443 returns RST while
7020 times out, so routing is fine and the port is what gets refused.
Add a supplementary egress policy admitting 10.0.0.0/8, excluding the
service (10.96.0.0/12) and pod (10.244.0.0/16) CIDRs so this does not
grant every pod a path out. No port list: the point is arbitrary LAN
services. Registered in the directory kustomization alongside the
existing mail and radicale egress policies.
- Pin gateway image to immutable tag 2026.9.3: the stale node-cached
'latest' (old build, state schema v1) crash-looped against the PVC's
DB already migrated to schema v15/16.
- Add fix-data-owner init container: the operator mounts the PVC root
at /home/openclaw/.openclaw with fsGroup only, leaving the mount root
owned by root; OpenClaw >= 2026.9 fchmods its config dir on write and
fails with EPERM (paperclipinc/openclaw-operator#607).
- Ran one-time 'openclaw doctor --fix --non-interactive' against the
PVC to complete the 2.0 workspace-state migration.
Allow the openclaw pod to reach the Radicale CalDAV/CardDAV server
(namespace: radicale, port 5232) so Kosmos can read/write Valentin's
calendar via the in-cluster service. Mirrors networkpolicy-mail-egress.yaml.
Workaround for spec.networkPolicy.additionalEgress not being in the CRD
bundled with operator chart 0.39.0 yet (silently pruned).
kosmosandvhaudiquet