homeprod/kubernetes/personal/openclaw/kustomization.yaml at e354a56e159605da6b57a2403aeb6ba16ebbe7bb - homeprod - Gitea

vhaudiquet/homeprod

mirror of https://github.com/vhaudiquet/homeprod.git synced 2026-09-25 18:28:25 +00:00

Files

T

kosmosandvhaudiquet e242b2ddce openclaw: allow LAN egress on all ports

The operator's managed policy is default-deny with egress limited to DNS
and TCP 443, so reaching a LAN service on any other port is dropped.
Measured against 10.4.1.222 from inside the pod: 443 returns RST while
7020 times out, so routing is fine and the port is what gets refused.

Add a supplementary egress policy admitting 10.0.0.0/8, excluding the
service (10.96.0.0/12) and pod (10.244.0.0/16) CIDRs so this does not
grant every pod a path out. No port list: the point is arbitrary LAN
services. Registered in the directory kustomization alongside the
existing mail and radicale egress policies.

2026-09-20 17:33:35 +02:00

11 lines

279 B

YAML

Raw Blame History

 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: openclaw
 resources:
   - openclaw-instance.yaml
   - openclaw-secrets.yaml
   - networkpolicy.yaml
   - networkpolicy-lan-egress.yaml
   - networkpolicy-mail-egress.yaml
   - networkpolicy-radicale-egress.yaml