nordisk/holger

deploy/k8s/service-nodeport.yaml

# Overlay for clusters without a LoadBalancer (bare-metal Talos without
# MetalLB): exposes holger on every node's IP at fixed high ports.
#
# SECURITY: this is the widest exposure holger has, and it is NOT covered by
# deploy/k8s/networkpolicy.yaml — NodePort traffic arrives via the node's own
# kube-proxy path, so a NetworkPolicy on the pod does not bound who reaches
# 30051/30443 from outside the cluster. Both reviews (2026-06-14 M-6,
# 2026-09-11) flagged it and it is kept deliberately, because the alternative
# for a LoadBalancer-less cluster is no ingress at all.
#
# Do not apply this file unless BOTH hold:
#   * a firewall in front of the nodes admits 30051/30443 only from the networks
#     that should hold clients, and
#   * the RON config sets `auth` with `require_auth_for_reads: true` — with the
#     default open-read posture this overlay publishes the artifact store to
#     everyone who can route to a node.
# Prefer MetalLB (or the cluster's LoadBalancer) and deploy/k8s/service.yaml.
apiVersion: v1
kind: Service
metadata:
  name: holger-nodeport
  namespace: holger
  labels:
    app: holger
spec:
  type: NodePort
  selector:
    app: holger
  ports:
    - name: grpc
      port: 50051
      targetPort: grpc
      nodePort: 30051
    - name: https
      port: 8443
      targetPort: https
      nodePort: 30443