Files

T

History

zeekayandHanzo Dev f2e139087e Nothing here writes to a cluster

Four workflows reached a cluster directly and none of them could deploy this
repo's fleet:

auto-deploy.yml ran kubectl set image against ns hanzo for iam, console, chat
and twenty other hanzoai services that are not declared here, on a workflow_run
trigger naming "Hanzo Monorepo CI" — a workflow this repo does not have.

auto-deploy-gated.yml ran kubectl apply / kubectl kustomize over k8s/, which the
ApplicationSet does not read, so a successful run changed the cluster to
something git did not describe.

reusable-deploy-service.yml was a workflow_call whose every step was kubectl;
nothing in this repo calls it.

pr-preview.yml built node/ evm/ dex/ pricing/ — four directories that do not
exist, so the loop skipped all of them — then ran kubectl set image ... || true
against lux-dev-k8s, a cluster no ApplicationSet targets, swallowing the
failure. e2e.yml already runs the whole suite on every pull request.

k8s/security/restrict-loadbalancers.sh patched live luxd Services by port INDEX.
Those Services are ClusterIP now and their ports are declared in
deploy/lux-mainnet/luxd.yaml; a patch by index also removes a different port the
moment the list is reordered.

The path is deploy/pin.sh -> deploy/ -> the ApplicationSet. There is no second
one to keep in step.

Co-authored-by: Hanzo Dev <[email protected]>

2026-09-01 12:44:37 -07:00

cilium-allow-cluster-ingress.yaml

fix(security): CiliumNetworkPolicy allowing cluster/host/remote-node ingress

2026-04-21 09:07:02 -07:00

network-policy-bridge.yaml

k8s(financial): bump lux-financial to v1.2.0

2026-04-20 22:33:19 -07:00

network-policy-validators.yaml

k8s(financial): bump lux-financial to v1.2.0

2026-04-20 22:33:19 -07:00

README.md

Nothing here writes to a cluster

2026-09-01 12:44:37 -07:00

README.md

k8s/security — Network Policies and Hardening

Security manifests for the Lux validator infrastructure. These are applied separately from the main kustomize overlays to allow staged rollout and review.

Manifests

network-policy-validators.yaml

NetworkPolicy for the lux-mainnet namespace. Isolates luxd validator pods:

Port 9631 (staking P2P): open to all sources — required for consensus protocol participation.
Port 9650 (HTTP API) and Port 9630 (gRPC): restricted to pods with label app: api-gateway or app: luxd within the same namespace. Blocks direct external API access.

network-policy-bridge.yaml

NetworkPolicy for the lux-bridge namespace. Isolates the Valkey (kv) pods:

Port 6379: restricted to pods with label app: bridge-server or app: mpc-node. Prevents unauthorized access to bridge state and MPC signing session data.

The validator LoadBalancer ports

There was a restrict-loadbalancers.sh here that removed /spec/ports/0 from the luxd-0…luxd-4 Services by index. Both halves of what it did are gone: those Services are ClusterIP now, not LoadBalancers, and the ports they do publish are declared in deploy/lux-mainnet/luxd.yaml. A patch by port index is also not a description of anything — reorder the list and it removes a different port than it did yesterday.

Which ports luxd publishes is a values question. Ask it in the values file.

Applying

kubectl apply -f k8s/security/network-policy-validators.yaml
kubectl apply -f k8s/security/network-policy-bridge.yaml

Coordinate with the on-call engineer first.