Thore CimbalandClaude Opus 5
e7469a36b8
First egress rule in matrix, authentik and monitoring. It allows DNS, the cluster ranges and the whole internet, and denies only 169.254.0.0/16 - link-local, where Hetzner serves instance metadata unauthenticated to any pod. Deliberately narrow. The textbook cut, 0.0.0.0/0 except RFC1918, would have severed two things here, both over 10.0.0.3 on the private Hetzner network: Alloy writes metrics and logs there, and the TURN rotation reaches Gitea through a hostAlias to that address. Private ranges therefore stay open. The payoff is modest and should be stated as such: measured from a pod, the service answers with instance-id, hostname, region, MAC and network config, while userdata and public-keys are empty. No credentials are exposed here, unlike the AWS case this hardening usually targets. It costs nothing though, and it closes the class. Two preconditions checked rather than assumed, because both are the usual way this breaks: kube-system carries kubernetes.io/metadata.name so the DNS rule actually matches, and the cluster is IPv4-only so 0.0.0.0/0 really does cover everything. Rollback is deleting the one policy per namespace. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
10 lines
202 B
YAML
10 lines
202 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- namespace.yaml
|
|
- helm-repos.yaml
|
|
- kube-state-metrics.yaml
|
|
- alloy-config.yaml
|
|
- alloy.yaml
|
|
- networkpolicy.yaml
|