- Shipped
- September 23, 2026 at 1:35 PM UTC
- Author
- Kamo
- Commit
- 243a7f7
The public route is gone (28ba91b), but inside the cluster any pod could still reach this service, and several endpoints take no credential because none of its callers send one yet: ffmpeg, LibreOffice and Batik run on whatever a pod in mail/ (untrusted email), the internet edge, cluster-services, ratestack or a hosted computer handed them. k8s/networkpolicy.yaml admits port 4210 only from the `kamo` namespace and from `kamo-universe` (universe-gateway's image/resize-bg call — the one caller outside kamo, found by sweeping every workload and ConfigMap), and the deploy applies it. Applied by hand and verified: `default` is refused, `kamo` and `kamo-universe` connect, both pods stayed ready (kubelet probes come from the node). Authenticating the callers themselves remains the second layer.