sec(data): persist postgres-customers admin lockdown into Deployment manifest + drill log#63
Merged
mastermanas805 merged 1 commit intoJun 6, 2026
Conversation
…+ drill log Follow-up to the 2026-06-06 apply of PR #61. The lockdown was applied to prod via `kubectl patch` (imperative). This makes the durable repo manifest match the live state so a future apply of postgres-customers.yaml does NOT silently revert the lockdown back to the vulnerable catch-all pg_hba: - mount the postgres-customers-hba ConfigMap at /etc/postgresql/pg_hba.conf (subPath) - start postgres with `-c hba_file=... -c password_encryption=scram-sha-256` - strategy RollingUpdate → Recreate (the RWO PVC deadlocks a rolling update on a Multi-Attach error; Recreate terminates the old pod first — brief downtime, acceptable for single-replica stateful) Runbook §9 Drill Log records the apply result: external admin (instanode_admin + instant_cust) now REJECTED at pg_hba (verified live; baseline reached scram), all in-cluster admin + customer usr_* paths preserved (verified), no rollback. Lists the operator follow-ups (durable pg-proxy role-gate; proxy-IP churn refresh; networkpolicy.yaml apply-exclude). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
mastermanas805
force-pushed
the
sec/postgres-customers-lockdown-durable-manifest
branch
from
5894e73 to
2110e01
Compare
mastermanas805
deleted the
sec/postgres-customers-lockdown-durable-manifest
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to PR #61 (merged
78cb6677), which closed the truehomie public-admin DROP vector and was applied to prod 2026-06-06.PR #61 was applied imperatively (
kubectl patch). This PR makes the durable repo manifest (k8s/data/postgres-customers.yaml) match the live state so a futurekubectl applyof that file does not silently revert the lockdown.Changes
postgres-customers.yaml: mount thepostgres-customers-hbaConfigMap at/etc/postgresql/pg_hba.conf(subPath); start postgres with-c hba_file=... -c password_encryption=scram-sha-256; strategyRollingUpdate → Recreate(the RWO PVC deadlocks a rolling update on a Multi-Attach error — hit + fixed during apply).Apply verification (live, do-nyc3-instant-prod)
instanode_admin(the confirmed vector) +instant_cust. Baseline beforehand reached scram (password authentication failed) — i.e. the vector was OPEN; nowpg_hba.conf rejects connection ...before any password.instant_custCREATE/DROP smoke OK; api/workerinstanode_adminconnect +pg_database_sizeOK.usr_*path preserved: still reaches scram.Operator follow-ups (also in runbook §9)
PG_PROXY_DENIED_ROLES, staged inInstaNode-dev/instant-pg-proxy) so closure no longer depends on the churning proxy-pod-IP reject lines.instant-pg-proxyreschedule, refresh the<proxy-ip>/32 rejectlines inpostgres-customers-lockdown.yaml+ reload.apply.ymlincludesnetworkpolicy.yaml, which is not enforced today and would default-deny the proxy path if applied — add to the apply EXCLUDE list or add the pg-proxy ingress rule first.🤖 Generated with Claude Code