In the IaC, the SSH port on the load balancer is open to any IP address.
It can (and should) be restricted to only allow connections from approved CIDRs.
This has been done manually for the dev FRIDGE, but should be implemented directly in the IaC and always done by default at the time of initial deployment.
Port 443 being open is fine with the current model, as we currently allow connection to Harbor from anywhere.
But there's no reason for port 80 to be also open to the world. If some internal traffic needs to hit port 80, restrict the CIDR to internal IP addresses.
In the IaC, the SSH port on the load balancer is open to any IP address.
It can (and should) be restricted to only allow connections from approved CIDRs.
This has been done manually for the dev FRIDGE, but should be implemented directly in the IaC and always done by default at the time of initial deployment.
Port 443 being open is fine with the current model, as we currently allow connection to Harbor from anywhere.
But there's no reason for port 80 to be also open to the world. If some internal traffic needs to hit port 80, restrict the CIDR to internal IP addresses.