44 lines
1.4 KiB
YAML
44 lines
1.4 KiB
YAML
|
# Default-deny ingress for the serving pods.
|
||
|
|
#
|
||
|
|
# This is a real compensating control, not hygiene: vLLM is pinned to v0.11.0
|
||
|
|
# (forced — last release with Volta kernels), which sits below the patch line on
|
||
|
|
# several advisories that will never be backported to that branch, incl.
|
||
|
|
# CVE-2026-54234 (remote DoS) and GHSA-7m6h-x95x-82q5 (cross-user data leak).
|
||
|
|
# Those are all remote/unauthenticated attack surface, so keeping the engines
|
||
|
|
# reachable only from opted-in in-cluster clients is what keeps exposure low.
|
||
|
|
#
|
||
|
|
# Consumers opt in with label `llm-client: "true"`. Do NOT expose these via
|
||
|
|
# Ingress.
|
||
|
|
apiVersion: networking.k8s.io/v1
|
||
|
|
kind: NetworkPolicy
|
||
|
|
metadata:
|
||
|
|
name: llm-serving-default-deny
|
||
|
|
spec:
|
||
|
|
podSelector:
|
||
|
|
matchLabels:
|
||
|
|
app.kubernetes.io/part-of: llm-serving
|
||
|
|
policyTypes:
|
||
|
|
- Ingress
|
||
|
|
ingress:
|
||
|
|
- from:
|
||
|
|
# Any pod, any namespace, that explicitly opts in as an LLM client.
|
||
|
|
- namespaceSelector: {}
|
||
|
|
podSelector:
|
||
|
|
matchLabels:
|
||
|
|
llm-client: "true"
|
||
|
|
# Sibling engines (harness may chain calls between them).
|
||
|
|
- podSelector:
|
||
|
|
matchLabels:
|
||
|
|
app.kubernetes.io/part-of: llm-serving
|
||
|
|
ports:
|
||
|
|
- protocol: TCP
|
||
|
|
port: 8080
|
||
|
|
- from:
|
||
|
|
# Prometheus scraping /metrics.
|
||
|
|
- namespaceSelector:
|
||
|
|
matchLabels:
|
||
|
|
kubernetes.io/metadata.name: monitoring
|
||
|
|
ports:
|
||
|
|
- protocol: TCP
|
||
|
|
port: 8080
|