pieced/pieced-portal
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
1c61111da3e7045561bb62e678f733703186d69b
pieced-portal/scripts/cilium-audit-results-20260412-171801.md
admin 6f9f46b2d0 Ratelimit
2026-04-12 18:13:26 +02:00

2.7 KiB
Raw Blame History

Cilium Network Policy Audit Results

Test From To Expected Actual Result
Cross-tenant: alpha→testfirma:18789 tenant-alpha openclaw.tenant-testfirma:18789 block blocked ✅ PASS
Cross-tenant: testfirma→alpha:18789 tenant-testfirma openclaw.tenant-alpha:18789 block blocked ✅ PASS
Cross-tenant: alpha→testfirma:18793 tenant-alpha openclaw.tenant-testfirma:18793 block blocked ✅ PASS
Cross-tenant: alpha→testfirma:9090 tenant-alpha openclaw.tenant-testfirma:9090 block blocked ✅ PASS
Tenant→OpenBao tenant-alpha openbao:8200 block blocked ✅ PASS
Tenant→ZITADEL (svc) tenant-alpha zitadel:8080 block blocked ✅ PASS
Tenant→Portal tenant-alpha pieced-portal:3000 block blocked ✅ PASS
Tenant→Portal DB tenant-alpha portal-db-rw:5432 block blocked ✅ PASS
Tenant→ArgoCD tenant-alpha argocd-server:443 block blocked ✅ PASS
Tenant→K8s API tenant-alpha kubernetes.default:443 block blocked ✅ PASS
Tenant→K8s API tenant-testfirma kubernetes.default:443 block blocked ✅ PASS
Tenant→DNS tenant-alpha kube-dns allow allowed ✅ PASS
Tenant→LiteLLM tenant-alpha litellm.inference:4000 allow allowed ✅ PASS
Tenant→world:443 tenant-alpha httpbin.org:443 allow allowed ✅ PASS
Platform→OpenBao pieced-system openbao:8200 allow allowed ✅ PASS
Platform→ZITADEL pieced-system zitadel:8080 allow allowed ✅ PASS
Platform→K8s API pieced-system kubernetes.default:443 allow allowed ✅ PASS
Platform→LiteLLM pieced-system litellm.inference:4000 allow allowed ✅ PASS
Platform→Portal DB pieced-system portal-db-rw:5432 allow BLOCKED ❌ FAIL
Tenant→Operator tenant-alpha pieced-operator:8080 block blocked ✅ PASS
Tenant→metadata endpoint tenant-alpha 169.254.169.254 block blocked ✅ PASS

Summary

  • Passed: 20
  • Failed: 1
  • Date: 2026-04-12 15:19:15 UTC

Notes

  • DNS exfiltration: DNS is allowed for tenants (required for egress). DNS tunneling is a theoretical risk — acceptable for pilot. Consider Cilium DNS-aware policies post-pilot.
  • LiteLLM namespace: Tests assume litellm.inference.svc:4000. Adjust if your LiteLLM is in a different namespace.
  • K8s API blocking: If this test fails, you need an explicit CiliumClusterwideNetworkPolicy denying egress to the API server CIDR from tenant namespaces. The API server is typically at the host IP or 10.96.0.1, not in a pod namespace, so namespace-based deny may not cover it.