docs: add SECURITY-HARDENING.md (HTTP/2 bomb mitigation, NetworkPolicy, resource limits)

[motsc]

Adds a production hardening guide. No behavior changes — pure docs addition.

What

• New docs/SECURITY-HARDENING.md covering:
  • HTTP/2 bomb mitigation (Codex June 2026 disclosure): patched ingress controller versions for nginx 1.29.8+, Apache mod_http2 2.0.41+ (CVE-2026-49975), Envoy/Istio guidance
  • NetworkPolicy starter spec for HyperDX UI/API
  • Recommended HyperDX deployment resource limits (cgroup OOM as DoS backstop)
  • Caveat on exposing OTLP gRPC port 4317 (HTTP/2-only) publicly
  • Upgrade cadence / advisories to subscribe to
• Link from README.md (new "Production Hardening" section)
• Link from rendered NOTES.txt footer

Why

Chart defaults are safe for development (Service ClusterIP, Ingress disabled), but production operators frequently flip Ingress on without considering the HTTP/2 termination layer. The June 2026 HTTP/2 bomb disclosure makes the pinning question urgent: nginx-ingress < 4.13.0 / Apache mod_http2 < 2.0.41 are exposed.

Out of scope

• No changes to chart templates or default values
• No new toggles or APIs

Customers who want stronger built-in defaults can follow the example values shown in the doc; not enforcing them here keeps the chart backward-compatible.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 4e46eb4

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

Deep Review

This is a docs-only PR: it adds docs/SECURITY-HARDENING.md, a "Production Hardening" section in README.md, and a footer link in the rendered charts/clickstack/templates/NOTES.txt. No chart templates or default values change, so there is no template-rendering or values-default risk. The review focused on whether the doc's copy-paste examples actually match the chart they describe, since operators will apply them verbatim.

Environment note: the shell was unavailable this run (bwrap sandbox setup failed on every command, including with the sandbox disabled), so git, grep, and glob could not run. The diff and all claims were verified by reading files directly (_helpers.tpl, hyperdx/deployment.yaml, hyperdx/networkpolicy.yaml, values.yaml, NOTES.txt).

✅ No critical issues found. No P0/P1 breakage — nothing in this diff renders a broken manifest or changes a values default.

🟡 P2 -- recommended

• docs/SECURITY-HARDENING.md:39 -- the deny-by-default NetworkPolicy example selects pods via podSelector.matchLabels: {app.kubernetes.io/component: hyperdx}, but the chart never applies an app.kubernetes.io/component label, so an operator who copies this "deny-by-default" spec gets a policy that matches zero pods and silently provides no protection.
  • Fix: Select the pods using labels the chart actually sets on HyperDX pods (app.kubernetes.io/name and app.kubernetes.io/instance from clickstack.selectorLabels, or the app: <fullname> label), and note that the instance value is release-dependent.

🔵 P3 nitpicks (2)

• docs/SECURITY-HARDENING.md:46 -- the example ingress rule permits only ports 3000 (app) and 8000 (api) from in-cluster pods and omits the OpAMP port 4320, which the HyperDX container exposes for the in-cluster OTel collector; applied literally as deny-by-default this could block the collector's OpAMP channel.
  • Fix: Add port 4320 to the allowed in-namespace ports, or call out that OpAMP traffic must be permitted separately.
• charts/clickstack/templates/NOTES.txt:40 -- this PR modifies a rendered chart template (the install notes users see) but adds no changeset, and AGENTS.md requires a changeset for user-facing changes.
  • Fix: Add a changeset for the NOTES.txt change, or confirm a docs-only notes edit is intentionally exempt from the version-bump convention.

---

Reviewers (5): correctness, security, project-standards, maintainability, testing.

Testing gaps: None attributable to this PR — the hyperdx.networkPolicy values keys and templates/hyperdx/networkpolicy.yaml template referenced by the doc pre-date this diff, so their unit-test coverage is out of scope here.