feat(mosquitto): restrict LB ingress to the IoT network

mosquitto-iot accepted MQTT from any world source. Over the last 7 days the mosquitto log shows client connections from 10.2.30.0/24 only. The LB is ETP=Local, so the client address reaches the pod. Refs S28-19 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-07 11:16:07 +01:00
1 changed files with 2 additions and 2 deletions
@@ -186,8 +186,8 @@ spec:
    matchLabels:
      app.kubernetes.io/name: mosquitto
  ingress:
-    - fromEntities:
-        - world
+    - fromCIDRSet:
+        - cidrGroupRef: net-iot
      toPorts:
        - ports:
            - port: "1883"