network-policies: let paperclip agents reach edge-1 SSH on 10.2.30.108:22 (REN-627)

Scoped access for the zwave-js restart (REN-628): forced-command user atlas-zwave on edge-1. One /32, TCP 22 only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-04 15:19:06 +00:00
parent 573bd670d5
commit d04546382d
1 changed files with 8 additions and 0 deletions
@@ -92,6 +92,14 @@ spec:
        - ports:
            - port: "4245"
              protocol: TCP
+    # edge-1 SSH as the forced-command user atlas-zwave (zwave-js restart and
+    # logs only; REN-627, access REN-628). Not a node IP, so toCIDRSet matches.
+    - toCIDRSet:
+        - cidr: 10.2.30.108/32
+      toPorts:
+        - ports:
+            - port: "22"
+              protocol: TCP
    - toEntities:
        - kube-apiserver
      toPorts: