k.rennerandClaude Opus 4.7
2ac909693f
With pod CIDR (10.244.0.0/16) BGP-advertised to the UDM and the
v30iot → pod-CIDR firewall rule in place for return-path traffic,
every pod in every namespace without a CNP is reachable from any
device VLAN that can route. Defense-in-depth: lock down the
namespaces that don't already have one.
Five new CNPs, all the same minimal shape (intra-namespace + monitoring
scrape + host/remote-node + any specific cross-namespace consumer):
database : webhook ingress from kube-apiserver (host) only.
No app pods land here — the actual postgres Clusters
live in each consumer's namespace.
influxdb : home-assistant (HACS writes) + grafana queries
immich : traefik (web UI) + velero (PVC backup mount)
velero : no cross-namespace ingress, just probes
crowdsec : traefik bouncer middleware (LAPI :8080)
Not in this commit, addressed separately:
monitoring, rook-ceph -- extensive cross-ns flows, deserves audit
music-assistant -- hostNetwork, CNP doesn't apply
security, storage -- empty namespaces
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>