riotpiao-poimen/homelab
2
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects 1 Releases Wiki Activity

P3.8: Audit NetworkPolicy — downstream must only accept gateway traffic #13

New Issue
Closed
opened 2026-09-08 04:43:00 +00:00 by rock · 1 comment
rock commented 2026-09-08 04:43:00 +00:00
Owner
Copy Link
Copy Source

Summary

Identity headers are trustworthy only if downstream cannot receive spoofed traffic directly. Audit + fix NetworkPolicies.

Config repo: rock/homelab — k8s/apps/llm-serving/, k8s/apps/sqs/

Services to audit

  • llm-serving (NO NetworkPolicy — any pod can call inference directly)
  • poimen-memory
  • sqs management-service
  • minio (has own auth, verify no bypass)

Per service

  1. NetworkPolicy with policyTypes: [Ingress]
  2. Ingress from only allows api namespace + monitoring
  3. No wildcard ingress
  4. Use kubernetes.io/metadata.name (not plain name: label)

Acceptance Criteria

  • llm-serving pods only accept from api namespace
  • Verified with kubectl exec from non-api namespace (timeout/refuse)

Depends on

  • P3.4 (headers exist before downstream trusts them)
## Summary Identity headers are trustworthy only if downstream cannot receive spoofed traffic directly. Audit + fix NetworkPolicies. **Config repo:** `rock/homelab` — `k8s/apps/llm-serving/`, `k8s/apps/sqs/` ## Services to audit - [ ] llm-serving (NO NetworkPolicy — any pod can call inference directly) - [ ] poimen-memory - [ ] sqs management-service - [ ] minio (has own auth, verify no bypass) ## Per service 1. NetworkPolicy with `policyTypes: [Ingress]` 2. Ingress `from` only allows `api` namespace + monitoring 3. No wildcard ingress 4. Use `kubernetes.io/metadata.name` (not plain `name:` label) ## Acceptance Criteria - [ ] llm-serving pods only accept from api namespace - [ ] Verified with kubectl exec from non-api namespace (timeout/refuse) ## Depends on - P3.4 (headers exist before downstream trusts them)
rock added this to the Phase 3: OAuth2 Token Exchange & Identity Propagation milestone 2026-09-08 04:43:00 +00:00
rock added the priority/mediumstatus/todotype/infraarea/downstream labels 2026-09-08 04:43:01 +00:00
rock self-assigned this 2026-09-08 04:43:01 +00:00
rock added this to the API-GW OAuth project 2026-09-08 04:44:04 +00:00
rock added the status/review label 2026-09-08 16:18:52 +00:00
rock moved this to In Review in API-GW OAuth on 2026-09-08 16:19:15 +00:00
rock closed this issue 2026-09-08 22:50:38 +00:00
rock commented 2026-09-09 00:56:16 +00:00
Author
Owner
Copy Link
Copy Source

Closed by homelab PR #15: #15

Closed by homelab PR #15: https://forgejo.riotpiao.com/riotpiao-poimen/homelab/pulls/15
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/auth
Authentication & authorization
 area/authentik
Authentik OIDC provider config
 area/downstream
Downstream service changes
 area/gateway
API gateway code (homelab-frontend)
 priority/high
Must have
 priority/medium
Should have
 status/blocked
Blocked by dependency
 status/done
Completed
 status/in-progress
Currently being worked on
 status/review
Ready for review
 status/todo
Not started
 type/docs
Documentation
 type/feature
New feature
 type/infra
Infrastructure change
No labels area/downstream priority/medium status/review status/todo type/infra
Milestone
No items
No Milestone Phase 3: OAuth2 Token Exchange & Identity Propagation
Projects
Clear projects
No projects
API-GW OAuth
In Review
Assignees
Clear assignees
poimen rock (Rock)
No Assignees rock
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab#13