Merge pull request #21141 from vespa-engine/mpolden/update-acl

Stop trusting port 4080 on proxy nodes

1 files changed, 1 insertions, 2 deletions

diff --git a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/node/NodeAcl.java b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/node/NodeAcl.java
index 88a62c94f43..ac24c83e129 100644
--- a/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/node/NodeAcl.java
+++ b/node-repository/src/main/java/com/yahoo/vespa/hosted/provision/node/NodeAcl.java
@@ -109,10 +109,9 @@ public class NodeAcl {
             case proxy:
                 // Proxy nodes trust:
                 // - config servers
-                // - all connections from the world on 4080 (insecure tb removed), and 4443
+                // - all connections from the world on 443 (production traffic) and 4443 (health checks)
                 trustedNodes.addAll(allNodes.nodeType(NodeType.config).asList());
                 trustedPorts.add(443);
-                trustedPorts.add(4080);
                 trustedPorts.add(4443);
                 break;