Skip to content

fix: prevent access to internal apl service#2933

Merged
CasLubbers merged 7 commits intomainfrom
APL-1579
Feb 11, 2026
Merged

fix: prevent access to internal apl service#2933
CasLubbers merged 7 commits intomainfrom
APL-1579

Conversation

@j-zimnowoda
Copy link
Contributor

@j-zimnowoda j-zimnowoda commented Feb 10, 2026 •
edited
Loading

📌 Summary

Prevents access to the tools container on port 17771.
Runs internal service on localhost only, thus removal of the readiness probe for that container.

🔍 Reviewer Notes

Deploy netshoot to test connectivity

# NS=otomi
# kubectl -n $NS run tmp-shell --rm -i --tty --image nicolaka/netshoot -- /bin/bash

Before connection to api on 17771 was not denied

tmp-shell:~# curl 10.2.2.56:8080/v1/teams
{"error":"'Authorization' header required"}
tmp-shell:~# curl 10.2.2.56:17771
{"status":"ok"}tmp-shell:~# curl 10.2.2.56:17771

After connection to api on 17771 is denied

tmp-shell:~# curl 10.2.1.41:8080/v1/teams
{"error":"'Authorization' header required"}tmp-shell:~#
tmp-shell:~# curl 10.2.1.41:17771
curl: (56) Recv failure: Connection reset by peer

🧹 Checklist

  • Code is readable, maintainable, and robust.
  • Unit tests added/updated

@svcAPLBot

This comment was marked as outdated.

Sign in to view
CasLubbers
CasLubbers approved these changes Feb 11, 2026
View reviewed changes
Copy link
Contributor

@CasLubbers CasLubbers left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

With the side note that migrating to this will take some time to remove the healthcheck

@CasLubbers CasLubbers merged commit b4fa8f6 into main Feb 11, 2026
15 checks passed
@CasLubbers CasLubbers deleted the APL-1579 branch February 11, 2026 09:27
Ani1357 pushed a commit that referenced this pull request Feb 16, 2026
@j-zimnowoda @Ani1357
fix: prevent access to internal apl service (#2933)
6d2c15d 
(cherry picked from commit b4fa8f6)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@merll merll merll approved these changes

@CasLubbers CasLubbers CasLubbers approved these changes

@ferruhcihan ferruhcihan Awaiting requested review from ferruhcihan ferruhcihan is a code owner

@Ani1357 Ani1357 Awaiting requested review from Ani1357 Ani1357 is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@j-zimnowoda @svcAPLBot @merll @CasLubbers