38 lines
2.7 KiB
Markdown
38 lines
2.7 KiB
Markdown
# Cilium Network Policy Audit Results
|
|
|
|
| Test | From | To | Expected | Actual | Result |
|
|
|------|------|----|----------|--------|--------|
|
|
| Cross-tenant: alpha→testfirma:18789 | tenant-alpha | openclaw.tenant-testfirma:18789 | block | blocked | ✅ PASS |
|
|
| Cross-tenant: testfirma→alpha:18789 | tenant-testfirma | openclaw.tenant-alpha:18789 | block | blocked | ✅ PASS |
|
|
| Cross-tenant: alpha→testfirma:18793 | tenant-alpha | openclaw.tenant-testfirma:18793 | block | blocked | ✅ PASS |
|
|
| Cross-tenant: alpha→testfirma:9090 | tenant-alpha | openclaw.tenant-testfirma:9090 | block | blocked | ✅ PASS |
|
|
| Tenant→OpenBao | tenant-alpha | openbao:8200 | block | blocked | ✅ PASS |
|
|
| Tenant→ZITADEL (svc) | tenant-alpha | zitadel:8080 | block | blocked | ✅ PASS |
|
|
| Tenant→Portal | tenant-alpha | pieced-portal:3000 | block | blocked | ✅ PASS |
|
|
| Tenant→Portal DB | tenant-alpha | portal-db-rw:5432 | block | blocked | ✅ PASS |
|
|
| Tenant→ArgoCD | tenant-alpha | argocd-server:443 | block | blocked | ✅ PASS |
|
|
| Tenant→K8s API | tenant-alpha | kubernetes.default:443 | block | blocked | ✅ PASS |
|
|
| Tenant→K8s API | tenant-testfirma | kubernetes.default:443 | block | blocked | ✅ PASS |
|
|
| Tenant→DNS | tenant-alpha | kube-dns | allow | allowed | ✅ PASS |
|
|
| Tenant→LiteLLM | tenant-alpha | litellm.inference:4000 | allow | allowed | ✅ PASS |
|
|
| Tenant→world:443 | tenant-alpha | httpbin.org:443 | allow | allowed | ✅ PASS |
|
|
| Platform→OpenBao | pieced-system | openbao:8200 | allow | allowed | ✅ PASS |
|
|
| Platform→ZITADEL | pieced-system | zitadel:8080 | allow | allowed | ✅ PASS |
|
|
| Platform→K8s API | pieced-system | kubernetes.default:443 | allow | allowed | ✅ PASS |
|
|
| Platform→LiteLLM | pieced-system | litellm.inference:4000 | allow | allowed | ✅ PASS |
|
|
| Platform→Portal DB | pieced-system | portal-db-rw:5432 | allow | **BLOCKED** | ❌ FAIL |
|
|
| Tenant→Operator | tenant-alpha | pieced-operator:8080 | block | blocked | ✅ PASS |
|
|
| Tenant→metadata endpoint | tenant-alpha | 169.254.169.254 | block | blocked | ✅ PASS |
|
|
|
|
## Summary
|
|
|
|
- **Passed**: 20
|
|
- **Failed**: 1
|
|
- **Date**: 2026-04-12 15:16:10 UTC
|
|
|
|
## Notes
|
|
|
|
- DNS exfiltration: DNS is allowed for tenants (required for egress). DNS tunneling is a theoretical risk — acceptable for pilot. Consider Cilium DNS-aware policies post-pilot.
|
|
- LiteLLM namespace: Tests assume `litellm.inference.svc:4000`. Adjust if your LiteLLM is in a different namespace.
|
|
- K8s API blocking: If this test fails, you need an explicit CiliumClusterwideNetworkPolicy denying egress to the API server CIDR from tenant namespaces. The API server is typically at the host IP or 10.96.0.1, not in a pod namespace, so namespace-based deny may not cover it.
|