From 744ea79933de11cd1067aece67f7872d3f34f6a6 Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Sat, 7 Nov 2026 11:16:07 +0100 Subject: [PATCH] feat(mosquitto): restrict LB ingress to the IoT network mosquitto-iot accepted MQTT from any world source. Over the last 7 days the mosquitto log shows client connections from 10.2.30.0/24 only. The LB is ETP=Local, so the client address reaches the pod. Refs S28-19 Co-Authored-By: Claude Opus 5.5 --- .../infrastructure/network-policies/home-assistant-ns.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml b/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml index b48edb83..b1ba2c4e 100644 --- a/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml +++ b/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml @@ -186,8 +186,8 @@ spec: matchLabels: app.kubernetes.io/name: mosquitto ingress: - - fromEntities: - - world + - fromCIDRSet: + - cidrGroupRef: net-iot toPorts: - ports: - port: "1883" -- 2.54.0