- Shipped
- September 23, 2026 at 1:16 PM UTC
- Author
- Kamo
- Commit
- 61305e4
YugabyteDB and NATS run on k1m1's host network, so every pod in every namespace could open every port they listen on. The client ports authenticate (YSQL :5433 password + TLS, NATS :4222 kamo_svc since 216f6bb) and stay open. The rest do not: yb-master RPC :7100 and yb-tserver RPC :9110 take TLS without a client certificate — yb-admin/yb-client get the whole database without a password — YCQL :9042 has no authentication, and the web ports (:7000, :9010, :12000, :13000, NATS :8222) publish flags, metadata and the text of running SQL. A pod in mail/, traefik-system/, kamo-universe/, cluster-services/, ratestack/ or a hosted computer had a direct path to all of it. **************** is a CiliumClusterwideNetworkPolicy that denies those ports towards the node identities for every namespace except kamo, kube-system, monitoring (Prometheus scrapes :9010 and :13000) and desktop (the owner's admin VM). enableDefaultDeny false keeps it a pure subtraction. Canary-verified, then verified live from `default` (blocked) and `kamo` (open); every pod in the affected namespaces stayed ready and all 55 NATS connections held. Applied by hand before this commit. The LAN is not covered by any pod policy — binding these ports to loopback needs a YugabyteDB restart and is left for a maintenance window.