graphprotocol / graphprotocol/indexer
Kubernetes deployment model alignment with documented security concerns
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 262
- Forks
- 148
- PR merge metrics
- No merged PRs in 30d
Description
In the Indexing docs, it says:
Firewall - Only the Indexer service needs to be exposed publicly and particular attention should be paid to locking down admin ports and database access: the Graph Node JSON-RPC endpoint (default port: 8030), the Indexer management API endpoint (default port: 18000), and the Postgres database endpoint (default port: 5432) should not be exposed.
The service for the query-node uses a NodePort service across all the endpoints: https://github.com/graphprotocol/indexer/blob/0d106091dd51a3f38c0e5b162befbc3157444d08/k8s/base/query-node/service.yaml#L17-L18
This was done in #493 but not explicitly called out in the PR docs why the ports needed to be added to the externally facing service (changed from LoadBalancer to NodePort).
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read the Indexing security guidance and inspect k8s/base/query-node/service.yaml at the linked service definition, then compare the change introduced in #493. Determine whether exposing these endpoints through NodePort is intentional and document or adjust the deployment so its behavior and the stated security concerns agree.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes
- Domain
- infrastructure, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100