From 71ab916ff729b086135b631278e03074c20dd8f8 Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Sat, 7 Nov 2026 11:17:06 +0100 Subject: [PATCH] feat(home-assistant): restrict LB ingress to the client networks home-assistant-bgp (:8123) accepted any world source. Allowed now: Privat, VPN, IoT and Server, per the approved source matrix. Browser and app access from outside goes through Traefik and is unaffected. The LB is ETP=Local, so the client address reaches the pod. Refs S28-19 Co-Authored-By: Claude Opus 5.5 --- .../infrastructure/network-policies/home-assistant-ns.yaml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml b/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml index b48edb83..82e7075f 100644 --- a/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml +++ b/kubernetes/infrastructure/network-policies/home-assistant-ns.yaml @@ -205,8 +205,11 @@ spec: matchLabels: app.kubernetes.io/name: home-assistant ingress: - - fromEntities: - - world + - fromCIDRSet: + - cidrGroupRef: net-privat + - cidrGroupRef: net-vpn + - cidrGroupRef: net-iot + - cidrGroupRef: net-server toPorts: - ports: - port: "8123" -- 2.54.0