security: scope notify-bridge ingress #1

Merged

waylon merged 1 commit from security/174-notify-bridge-ingress into main

2026-10-23 08:21:05 -05:00

waylon commented

2026-10-23 08:20:25 -05:00

Owner

Restrict Family Dashboard ingress from the notify-bridge namespace to pods labeled app=notify-bridge-app on TCP 8080. The dashboard manifest configures SENSOR_BACKEND_URL to the notify-bridge-app Service, and the live Service selects that same app label. The cleanup CronJob pods in that namespace do not need this access.

Validation: server-side dry-run accepted the NetworkPolicy; confirmed the live app pod selector and Service endpoint; both public family hosts returned HTTP 200; git diff --check passed.

Restrict Family Dashboard ingress from the notify-bridge namespace to pods labeled `app=notify-bridge-app` on TCP 8080. The dashboard manifest configures `SENSOR_BACKEND_URL` to the `notify-bridge-app` Service, and the live Service selects that same app label. The cleanup CronJob pods in that namespace do not need this access. Validation: server-side dry-run accepted the NetworkPolicy; confirmed the live app pod selector and Service endpoint; both public family hosts returned HTTP 200; `git diff --check` passed.

waylon added 1 commit

2026-10-23 08:20:25 -05:00

security: scope notify bridge ingress

CI / checks (pull_request) Has been cancelled

Details

95b3ca5317