docs: add SECURITY-HARDENING.md (HTTP/2 bomb mitigation, NetworkPolicy, resource limits)#228
Open
motsc wants to merge 1 commit into
Open
docs: add SECURITY-HARDENING.md (HTTP/2 bomb mitigation, NetworkPolicy, resource limits)#228motsc wants to merge 1 commit into
motsc wants to merge 1 commit into
Conversation
Documents production hardening for ClickStack deployments: - HTTP/2 bomb mitigation (Codex disclosure, June 2026): patched ingress controller versions for nginx, Apache, Envoy/Istio - NetworkPolicy starter example for HyperDX UI/API - Recommended HyperDX deployment resource limits (cgroup OOM bounds DoS) - Caveats on exposing OTLP gRPC (port 4317, HTTP/2-only) publicly No behavior changes — pure docs addition + two cross-references.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a production hardening guide. No behavior changes — pure docs addition.
What
docs/SECURITY-HARDENING.mdcovering:README.md(new "Production Hardening" section)NOTES.txtfooterWhy
Chart defaults are safe for development (Service
ClusterIP, Ingress disabled), but production operators frequently flip Ingress on without considering the HTTP/2 termination layer. The June 2026 HTTP/2 bomb disclosure makes the pinning question urgent: nginx-ingress < 4.13.0 / Apache mod_http2 < 2.0.41 are exposed.Out of scope
Customers who want stronger built-in defaults can follow the example values shown in the doc; not enforcing them here keeps the chart backward-compatible.