From d04546382d406a47d7ca6b35011153b15be1cb4a Mon Sep 17 00:00:00 2001 From: atlas-bot Date: Sun, 4 Oct 2026 15:19:06 +0000 Subject: [PATCH] network-policies: let paperclip agents reach edge-1 SSH on 10.2.30.108:22 (REN-627) Scoped access for the zwave-js restart (REN-628): forced-command user atlas-zwave on edge-1. One /32, TCP 22 only. Co-Authored-By: Claude Opus 5.5 --- kubernetes/apps/paperclip/network-policy.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kubernetes/apps/paperclip/network-policy.yaml b/kubernetes/apps/paperclip/network-policy.yaml index 47dd0a5d..889ec05c 100644 --- a/kubernetes/apps/paperclip/network-policy.yaml +++ b/kubernetes/apps/paperclip/network-policy.yaml @@ -92,6 +92,14 @@ spec: - ports: - port: "4245" protocol: TCP + # edge-1 SSH as the forced-command user atlas-zwave (zwave-js restart and + # logs only; REN-627, access REN-628). Not a node IP, so toCIDRSet matches. + - toCIDRSet: + - cidr: 10.2.30.108/32 + toPorts: + - ports: + - port: "22" + protocol: TCP - toEntities: - kube-apiserver toPorts: -- 2.54.0