This is an automated email from the ASF dual-hosted git repository.
Aias00 pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/shenyu-website.git
The following commit(s) were added to refs/heads/main by this push:
new f7f96e41f19 docs deployment : add admin network isolation checklist.
(#1125)
f7f96e41f19 is described below
commit f7f96e41f199cfbbaf32e11b7218b036ebee2f03
Author: BobSong <[email protected]>
AuthorDate: Mon Jul 13 20:14:27 2026 +0800
docs deployment : add admin network isolation checklist. (#1125)
---
docs/deployment/deployment-before.md | 8 ++++++++
.../current/deployment/deployment-before.md | 8 ++++++++
.../version-2.7.0.3/deployment/deployment-before.md | 8 ++++++++
versioned_docs/version-2.7.0.3/deployment/deployment-before.md | 8 ++++++++
4 files changed, 32 insertions(+)
diff --git a/docs/deployment/deployment-before.md
b/docs/deployment/deployment-before.md
index 40adfa0c161..0a6242b6840 100644
--- a/docs/deployment/deployment-before.md
+++ b/docs/deployment/deployment-before.md
@@ -54,3 +54,11 @@ In [the openGuass initialization scripts
directory](https://github.com/apache/sh
* maven repository:
https://mvnrepository.com/artifact/org.opengauss/opengauss-jdbc/5.0.0-og
* homepage: https://gitee.com/opengauss/openGauss-connector-jdbc
+
+## Deployment Security Checklist
+
+Before deploying Apache ShenYu in production, verify the following Admin-plane
network controls:
+
+- [ ] Restrict the ShenYu Admin listening port to trusted internal networks
and authorized operators or Gateway nodes by using firewall rules, security
groups, Kubernetes `NetworkPolicy`, or equivalent controls.
+- [ ] Do not expose the Admin `/websocket` endpoint to public or otherwise
untrusted networks. The endpoint is unauthenticated by design because it is
used for data synchronization between ShenYu Admin and Gateway nodes, so it
must be protected by network-level access controls.
+- [ ] Expose the Gateway data plane separately, and do not publish the Admin
plane through a public load balancer or Ingress.
diff --git
a/i18n/zh/docusaurus-plugin-content-docs/current/deployment/deployment-before.md
b/i18n/zh/docusaurus-plugin-content-docs/current/deployment/deployment-before.md
index ab5c399dbe5..53df1e5d4c9 100644
---
a/i18n/zh/docusaurus-plugin-content-docs/current/deployment/deployment-before.md
+++
b/i18n/zh/docusaurus-plugin-content-docs/current/deployment/deployment-before.md
@@ -54,3 +54,11 @@ description: 部署先决条件
* maven repository:
https://mvnrepository.com/artifact/org.opengauss/opengauss-jdbc/5.0.0-og
* homepage: https://gitee.com/opengauss/openGauss-connector-jdbc
+
+## 部署安全检查清单
+
+在生产环境部署 Apache ShenYu 前，请确认管理平面已采取以下网络安全措施：
+
+- [ ] 通过防火墙规则、安全组、Kubernetes `NetworkPolicy` 或同等措施，将 ShenYu Admin
监听端口限制在可信内部网络，并仅允许授权运维人员或 Gateway 节点访问。
+- [ ] 不要将 Admin 的 `/websocket` 端点暴露到公网或其他不可信网络。该端点用于 ShenYu Admin 与 Gateway
节点之间的数据同步，因此按设计不进行身份认证，必须依靠网络层访问控制进行保护。
+- [ ] 将 Gateway 数据平面与 Admin 管理平面分开暴露，不要通过公网负载均衡器或 Ingress 发布 Admin 管理平面。
diff --git
a/i18n/zh/docusaurus-plugin-content-docs/version-2.7.0.3/deployment/deployment-before.md
b/i18n/zh/docusaurus-plugin-content-docs/version-2.7.0.3/deployment/deployment-before.md
index c69d013ded5..d03ced5d3aa 100644
---
a/i18n/zh/docusaurus-plugin-content-docs/version-2.7.0.3/deployment/deployment-before.md
+++
b/i18n/zh/docusaurus-plugin-content-docs/version-2.7.0.3/deployment/deployment-before.md
@@ -54,3 +54,11 @@ description: 部署先决条件
* maven repository:
https://mvnrepository.com/artifact/org.opengauss/opengauss-jdbc/5.0.0-og
* homepage: https://gitee.com/opengauss/openGauss-connector-jdbc
+
+## 部署安全检查清单
+
+在生产环境部署 Apache ShenYu 前，请确认管理平面已采取以下网络安全措施：
+
+- [ ] 通过防火墙规则、安全组、Kubernetes `NetworkPolicy` 或同等措施，将 ShenYu Admin
监听端口限制在可信内部网络，并仅允许授权运维人员或 Gateway 节点访问。
+- [ ] 不要将 Admin 的 `/websocket` 端点暴露到公网或其他不可信网络。该端点用于 ShenYu Admin 与 Gateway
节点之间的数据同步，因此按设计不进行身份认证，必须依靠网络层访问控制进行保护。
+- [ ] 将 Gateway 数据平面与 Admin 管理平面分开暴露，不要通过公网负载均衡器或 Ingress 发布 Admin 管理平面。
diff --git a/versioned_docs/version-2.7.0.3/deployment/deployment-before.md
b/versioned_docs/version-2.7.0.3/deployment/deployment-before.md
index 298283ebf36..176730556f9 100644
--- a/versioned_docs/version-2.7.0.3/deployment/deployment-before.md
+++ b/versioned_docs/version-2.7.0.3/deployment/deployment-before.md
@@ -54,3 +54,11 @@ In [the openGuass initialization scripts
directory](https://github.com/apache/sh
* maven repository:
https://mvnrepository.com/artifact/org.opengauss/opengauss-jdbc/5.0.0-og
* homepage: https://gitee.com/opengauss/openGauss-connector-jdbc
+
+## Deployment Security Checklist
+
+Before deploying Apache ShenYu in production, verify the following Admin-plane
network controls:
+
+- [ ] Restrict the ShenYu Admin listening port to trusted internal networks
and authorized operators or Gateway nodes by using firewall rules, security
groups, Kubernetes `NetworkPolicy`, or equivalent controls.
+- [ ] Do not expose the Admin `/websocket` endpoint to public or otherwise
untrusted networks. The endpoint is unauthenticated by design because it is
used for data synchronization between ShenYu Admin and Gateway nodes, so it
must be protected by network-level access controls.
+- [ ] Expose the Gateway data plane separately, and do not publish the Admin
plane through a public load balancer or Ingress.
