Security

routess ships with production-ready Kubernetes security defaults.

Network PoliciesCopy Anchor Link

A default-deny policy blocks all ingress and egress in the routess namespace. Allows are explicit:

• Web: ingress from Cloudflare tunnel namespace only
• API: ingress from Cloudflare tunnel + intra-namespace; egress to Postgres + DNS + external (for Google OAuth)
• Docs / Landing: ingress from Cloudflare tunnel only

DNS egress is allowed namespace-wide on UDP/TCP 53.

Pod Security StandardsCopy Anchor Link

Every pod runs:

• Non-root: web as UID 101 (nginx), api as 1000, docs and landing as 1001
• No privilege escalation: allowPrivilegeEscalation: false
• Dropped capabilities: capabilities.drop: [ALL]
• Seccomp: RuntimeDefault profile
• Read-only root filesystem: api only (web needs nginx temp dirs)

ServiceAccountsCopy Anchor Link

Each service has a dedicated ServiceAccount with automountServiceAccountToken: false. None of the workloads need to call the Kubernetes API.

SecretsCopy Anchor Link

API secrets (JWT secret, analytics salt, PAT pepper, Google OAuth credentials, DB credentials, Resend key) are stored in Kubernetes Secret objects and injected as env vars via secretKeyRef. CI pulls values from 1Password and injects them via helm install --set.

Plan rotations: rotating the JWT secret logs every user out, rotating the PAT pepper invalidates every personal access token, and rotating the analytics salt resets analytics pseudonyms.

Resource limitsCopy Anchor Link

CPU, memory, and ephemeral storage limits are set on every container to prevent resource exhaustion.