docs(netpol): deduplicate the home-assistant policy comments #684
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: konairius/homelab#684
Reference in New Issue
Block a user
152 → 125 Kommentarzeilen — ein deutlich kleinerer Schnitt als in den letzten Chargen, und zwar mit Absicht.
Der Großteil dieser Datei ist Begründung pro Regel, und das ist genau die Kategorie, die bleibt: wer die
:8124-Regel löscht, muss wissen, dass sie der Vertrauensanker fürX-Forwarded-Forist. Wer eine Gate-Regel löscht, muss wissen, dass sie das Einzige ist, was zwischen einem--auth=none-Editor und dem LAN steht. Solche Kommentare sind hier kein Beiwerk, sie sind Teil der Sicherheitsbegründung.Gekürzt wurde Wiederholung. Vier fast wortgleiche Absätze erklärten das Authentik-Gate-Muster einmal pro App, drei davon leiteten erneut her, dass
endpointSelector: {}eine:8080-Freigabe namespace-weit macht. Diese Warnung steht jetzt einmal, an der ersten:8080-Regel — und ist dort stärker als vorher, weil sie sagt, dass sich drei Apps den Port teilen und eine Änderung alle drei trifft.Der World-Ingress- und der ICMP-Block behalten ihre Regel und verlieren ihren Vorfallsbericht: kein pauschales
fromEntities: worldauf eineendpointSelector: {}-Policy; ICMP braucht eine explizite Freigabe, sobald irgendeine L4-Regel existiert, und Cilium nimmt einen Typ pro Eintrag.Zwei veraltete Verweise sind mit rausgefallen. Der Egress-nach-world war dokumentiert als „garage S3" und „legacy InfluxDB on VM 108" — Garage ist nach nas-1 abgelöst, und es gibt kein Proxmox mehr, das VM 108 beherbergen könnte. Ersetzt durch das, was die Regel tatsächlich gewährt, statt durch eine Zielliste, die sich schon geändert hat.
Nur Kommentare; der nach Nicht-Kommentarzeilen gefilterte Diff ist leer, und die Datei besteht weiter
--dry-run=server.152 comment lines to 125 — a much lighter cut than the previous batches, on purpose. Most of this file is per-rule security rationale, and that is exactly the category worth keeping: someone deleting the :8124 rule needs to know it is the trust anchor for X-Forwarded-For, and someone deleting a gate rule needs to know it is what stands between an --auth=none editor and the LAN. What was cut is repetition. Four near-identical paragraphs explained the Authentik gate pattern once per app, three of them re-deriving that endpointSelector {} makes a :8080 grant namespace-wide. That warning is now stated once, at the first :8080 rule, and it is stronger for being in one place: three apps share that port, so changing any of those rules affects all three. The world-ingress and ICMP blocks keep their rules and lose their incident reports — do not add a blanket fromEntities: world to an endpointSelector {} policy; ICMP needs an explicit allow once any L4 rule exists and Cilium takes one type per entry. Two stale references went with it. Egress-to-world was documented as reaching "garage S3" and "legacy InfluxDB on VM 108": Garage was retired to nas-1 and there is no Proxmox left to host VM 108. Both replaced by what the rule actually grants rather than a list of destinations that has already changed. Comments only; the diff filtered for non-comment lines is empty, and the file still passes a server-side dry run.🤖 Automated review — model
CLI default(complexity: complex), commitc3bad3bece42f3ed1834c3943e74875ed7161488.Summary
Comment-only cleanup of
kubernetes/infrastructure/network-policies/home-assistant-ns.yaml: deduplicates four near-identical "Authentik gate + shared:8080" explanations into a single caution note, trims the world-ingress/ICMP block down to the rule rationale, and drops two stale destination references (Garage S3, legacy InfluxDB VM) from the egress-to-world comment. I diffed the file and confirmed every changed line is a#comment — nospec:, selector, port, or rule content was touched, and the YAML nesting/indentation around each edited block is intact. No blocking issues.🟡 Suggestions
kubernetes/infrastructure/network-policies/home-assistant-ns.yaml:44-51— the consolidatedCAUTION for every :8080 rule hereblock sits above the shelly-manager rule, which is the second:8080rule in the file (vscode, lines 36-43, comes first and keeps its own unrelated comment about the Authentik step-up). The PR description says the warning "is now stated once, at the first:8080rule," which isn't quite accurate — a reader scanning top-down hits vscode's:8080rule before seeing the shared-port caution. This placement is unchanged from before the PR (the old per-rule comment was in the same spot), so it's not a regression, just a minor mismatch between the PR body's claim and the actual diff.Tests
Not applicable — comment-only change to a policy manifest, no rule semantics changed. The PR body's claim that the diff filtered to non-comment lines is empty checks out: I verified every added/removed line in the diff starts with
#. I could not independently run--dry-run=serverin this environment (no cluster access), so I did not verify that claim directly, but the file parses as structurally valid YAML on inspection (consistent indentation, unchanged rule bodies) and all file paths newly referenced or retained in comments (kubernetes/apps/influxdb/ha-token-job.yaml,vscode-gate-egress.yaml,shelly-manager-gate-egress.yaml,zigbee2mqtt-gate-egress.yaml) exist in the repo.Recommendation
Looks reasonable — no blocking issues; comment above is optional.