Redis on a public load balancer
An external scan found port 6379 open on a cluster IP. Match it to a Service, check which namespaces have a default-deny network policy, and name the gap.
Briefing
Last night’s external attack-surface scan lists 198.51.100.47:6379 as open with no authentication. That range belongs to the cluster’s cloud load balancers.
A Service of type LoadBalancer gets a public address from the cloud provider. NetworkPolicies decide which pods may talk to which, but only in namespaces that have them.
ops-bastion · Kubernetes review
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.