From 9aecaacbb206370d25fd797abf4bc71aa45a1fa4 Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Sat, 7 Nov 2026 11:16:37 +0100 Subject: [PATCH] feat(shelly-manager): restrict firmware LB ingress to the IoT network shelly-manager-firmware (:8082, /fw/ only) accepted any world source. Shelly devices live on IoT; the LB is ETP=Local, so the client address reaches the pod. Refs S28-19 Co-Authored-By: Claude Opus 5.5 --- .../infrastructure/network-policies/home-assistant-ns.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml b/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml index b48edb83..b548276f 100644 --- a/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml +++ b/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml @@ -225,8 +225,8 @@ spec: matchLabels: app.kubernetes.io/name: shelly-manager ingress: - - fromEntities: - - world + - fromCIDRSet: + - cidrGroupRef: net-iot toPorts: - ports: - port: "8082" -- 2.54.0