- Shipped
- September 23, 2026 at 11:46 AM UTC
- Author
- Kamo
- Commit
- 8643cf0
The `kamo` Redis holds every *** session and OTK and has no password. Nothing restricted who could connect to it: from a pod in the `desktop` namespace (where the KubeVirt desktops run on the cluster network, with no NetworkPolicies of their own) an unauthenticated PING returned +PONG on 2026-09-23 — i.e. anyone with a shell on a desktop could read or forge any member's session, god accounts included. redis/networkpolicy.yaml (applied by the existing `kubectl apply -f redis/`) admits only the namespaces a sweep of every workload, ConfigMap and Secret found using it: `kamo`, and rspamd in `mail`. Applied by hand the same day and verified: desktop → timeout; kamo-internal → +PONG; mail/rspamd → +PONG, no Redis errors.