- Shipped
- September 23, 2026 at 10:44 AM UTC
- Author
- Kamo
- Commit
- 28ba91b
The conversion-api.kamocrm.com IngressRoute sent anyone on the internet to this service, where several endpoints (/image/resize-bg, /favicon/generate, /convert-to-pdf, /generate-thumbnails, /page-count, /render-page) run ffmpeg, LibreOffice and Batik on uploaded bytes and authenticate nobody — their callers are in-cluster Java services that send no credential. A sweep of every repo found no client of the public host: kamo-internal, SecurityService, DocsService, MediaService and DaemonService all use **************** - k8s/conversion-ingress.yaml is deleted, and the deploy now runs `kubectl delete ingressroute conversion-api-ingress --ignore-not-found` instead of applying it (apply never prunes, and a hand-applied copy must not come back). The live route was deleted by hand on 2026-09-23: the host now answers Traefik's 404, while the in-cluster health check still answers {"status":"UP"}. - NoPublicRouteTest pins both: no IngressRoute in k8s/, and the workflow deletes rather than applies. Requiring X-Internal-Auth from the in-cluster callers (then gating the endpoints) remains the second layer.