From 5208379310107843d51ba2feaa11a7616964b191 Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Sat, 24 Oct 2026 00:02:32 +0200
Subject: [PATCH] longhorn: enable the internal NetworkPolicies

With them only Longhorn's own components can reach the longhorn-manager API, which any pod could otherwise call without authentication to manage volumes. 1.12 was kept off because its instance-manager policy left the host-side iSCSI initiator out; 1.13 opens port 3260 to any source while v1DataEngineInitiatorSourceCIDRs is empty.
---
 apps/templates/longhorn-helm.yaml | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/apps/templates/longhorn-helm.yaml b/apps/templates/longhorn-helm.yaml
index 578e12e..84cf283 100644
--- a/apps/templates/longhorn-helm.yaml
+++ b/apps/templates/longhorn-helm.yaml
@@ -29,12 +29,10 @@ spec:
             defaultClassReplicaCount: 1
           preUpgradeChecker:
             jobEnabled: false
-          # From 1.12 Longhorn adds NetworkPolicies between its components,
-          # and Calico enforces them. The instance-manager one only admits
-          # Longhorn pods, while the iSCSI initiator connects from the host,
-          # so keep them off until that is tested on its own.
-          networkPolicies:
-            restrictInternalTraffic: false
+          # restrictInternalTraffic is on by default since 1.12: only Longhorn
+          # components may reach the longhorn-manager API (otherwise any pod
+          # could manage volumes unauthenticated). Since 1.13 iSCSI (3260)
+          # stays open to the host-side initiator.
           # From 1.13 the CSI controller may read every Secret in the cluster,
           # for provisioner-secret StorageClass parameters. Neither
           # StorageClass here uses those.