Before anything else: NetworkPolicy really is enforced here. k3s runs flannel and the
policy controller inside its own process, so the absence of pods in kube-system
proves nothing - measured instead, with a counter-probe. synapse-main reaches
matrix's postgres and authentik-server does not, exactly as allow-ingress-postgres
says. So the existing ingress rules are real protection and egress rules will bite.
The textbook first step - allow 0.0.0.0/0 but except RFC1918 and the metadata
service - would have cut two things here, both over 10.0.0.3, CFGMON on the private
Hetzner network. Alloy remote-writes metrics and logs there, so monitoring would have
gone silent, and nothing reports the failure of the reporting path. And the TURN
rotation reaches Gitea through a hostAlias to that address because the public route
was unreliable, so the rotation push would have died a day after we got it working
again.
That also settles #0008 harder than the absence of a firewall rule could: the cluster
reaches Prometheus and Loki privately, so 9090 and 3100 are demonstrably not needed
publicly.
Proposed step 2 is therefore narrower and nearly risk-free: block only the metadata
service, 169.254.0.0/16, while leaving federation, ACME, SMTP, registries and the
private path open. Nobody here needs the metadata service, and the hard part of this
issue - federation to arbitrary servers - is not touched at all.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Thore CimbalandClaude Opus 5
9816d16c6f