docs: add SECURITY-HARDENING.md (HTTP/2 bomb mitigation, NetworkPolicy, resource limits)

[motsc]

Adds a production hardening guide. No behavior changes — pure docs addition.

What

• New docs/SECURITY-HARDENING.md covering:
  • HTTP/2 bomb mitigation (Codex June 2026 disclosure): patched ingress controller versions for nginx 1.29.8+, Apache mod_http2 2.0.41+ (CVE-2026-49975), Envoy/Istio guidance
  • NetworkPolicy starter spec for HyperDX UI/API
  • Recommended HyperDX deployment resource limits (cgroup OOM as DoS backstop)
  • Caveat on exposing OTLP gRPC port 4317 (HTTP/2-only) publicly
  • Upgrade cadence / advisories to subscribe to
• Link from README.md (new "Production Hardening" section)
• Link from rendered NOTES.txt footer

Why

Chart defaults are safe for development (Service ClusterIP, Ingress disabled), but production operators frequently flip Ingress on without considering the HTTP/2 termination layer. The June 2026 HTTP/2 bomb disclosure makes the pinning question urgent: nginx-ingress < 4.13.0 / Apache mod_http2 < 2.0.41 are exposed.

Out of scope

• No changes to chart templates or default values
• No new toggles or APIs

Customers who want stronger built-in defaults can follow the example values shown in the doc; not enforcing them here keeps the chart backward-compatible.

[changeset-bot]

⚠️ No Changeset found

Latest commit: f7cb4f9

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

Deep Review

Scope: Docs-only PR — new docs/SECURITY-HARDENING.md, a README.md "Production Hardening" section, and a NOTES.txt footer link. Reviewed against base ca8c0dc.
Intent: Add a production hardening guide. Since operators copy-paste the doc's examples, the review centered on whether its concrete claims about the chart (template paths, values keys, ports, labels) match the actual chart.

Most structural claims verified correct: the templates/hyperdx/networkpolicy.yaml path, the hyperdx.networkPolicy.enabled/spec keys, the empty hyperdx.deployment.resources: {} default, and OTLP ports 4317/4318. One example, however, is inert.

🔴 P0/P1 — must fix

• docs/SECURITY-HARDENING.md:39 — The example NetworkPolicy podSelector selects app.kubernetes.io/component: hyperdx, a label no HyperDX pod carries (pods only get app.kubernetes.io/name, app.kubernetes.io/instance, and app: <fullname> from clickstack.selectorLabels; the sole component label in the chart is task on the cronjob), so the "deny-by-default" policy matches zero pods and silently protects nothing.
  • Fix: Change the example podSelector.matchLabels to labels the Deployment actually emits — e.g. app.kubernetes.io/name plus the release-specific app.kubernetes.io/instance — and note the instance value must be substituted per release.
  • _{ce-correctness-reviewer, ce-learnings-researcher, ce-maintainability-reviewer}

🟡 P2 — recommended

• charts/clickstack/templates/NOTES.txt:41 — The added footer renders on every helm install/helm upgrade, making it a user-facing change, but no changeset accompanies it, contrary to AGENTS.md which requires npx changeset for user-facing changes.
  • Fix: Add a patch-level changeset under .changeset/ describing the NOTES footer addition.

🔵 P3 nitpicks (4)

• docs/SECURITY-HARDENING.md:15 — Hardcoded upstream versions (ingress-nginx 4.13.0+, nginx 1.29.8+, mod_http2 2.0.41+) and CVE-2026-49975 will go stale with no "verify current" pointer next to them.
  • Fix: Append a link to each upstream releases/advisory page beside the version strings so readers can confirm currency.
• docs/SECURITY-HARDENING.md:46 — The example hardcodes ports 3000/8000, duplicating hyperdx.ports.app/hyperdx.ports.api in values.yaml, which will drift if the defaults change.
  • Fix: Add inline comments referencing hyperdx.ports.app/hyperdx.ports.api as the authoritative source.
• docs/SECURITY-HARDENING.md:30 — The doc does not mention that networkPolicy.enabled: true with an empty spec hard-fails template rendering (the template fails).
  • Fix: Add a sentence warning not to enable the NetworkPolicy without providing a complete spec.
• (branch name) — The working branch docs-security-hardening omits the warren/ prefix required by AGENTS.md Branch Naming.
  • Fix: Use the warren/ prefix on future branches.

---

Reviewers (4): ce-correctness-reviewer, ce-project-standards-reviewer, ce-maintainability-reviewer, ce-learnings-researcher.

Testing gaps: No assertion that NOTES.txt still renders after the footer/whitespace edit, though the change is literal text and low-risk; charts/clickstack/tests/networkpolicy_test.yaml cannot catch a doc example whose podSelector matches no pods.