vhaudiquet/homeprod
1
0
Fork 1
mirror of https://github.com/vhaudiquet/homeprod.git synced 2026-09-25 10:23:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

openclaw: allow LAN egress on all ports

Browse Source 
The operator's managed policy is default-deny with egress limited to DNS
and TCP 443, so reaching a LAN service on any other port is dropped.
Measured against 10.4.1.222 from inside the pod: 443 returns RST while
7020 times out, so routing is fine and the port is what gets refused.

Add a supplementary egress policy admitting 10.0.0.0/8, excluding the
service (10.96.0.0/12) and pod (10.244.0.0/16) CIDRs so this does not
grant every pod a path out. No port list: the point is arbitrary LAN
services. Registered in the directory kustomization alongside the
existing mail and radicale egress policies.
This commit is contained in:
kosmos
2026-09-20 17:33:35 +02:00
committed by vhaudiquet
parent 0d81f4a5d2
commit e242b2ddce
2 changed files with 40 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kubernetes/personal/openclaw/kustomization.yaml
+1
View File
@@ -5,5 +5,6 @@ resources:
- openclaw-instance.yaml
- openclaw-secrets.yaml
- networkpolicy.yaml
- networkpolicy-lan-egress.yaml
- networkpolicy-mail-egress.yaml
- networkpolicy-radicale-egress.yaml