NetworkPolicy locking down training-pod egress

[LukasWodka]

Summary

Adds a Helm-templated NetworkPolicy that denies ingress and restricts egress on training pods. Selects on the tracebloc.io/workload=training label injected by the jobs-manager in the companion PR: tracebloc/client-runtime#1.

Training pods run untrusted Python code uploaded by external data scientists. This is the first kernel-level control on what that code can reach from inside the pod.

What the policy does

Ingress: denied entirely — nothing should connect TO a training pod.

Egress, allowed:

• DNS to the cluster DNS service (kube-system / openshift-dns depending on platform)
• TCP/443 to addresses outside the cluster's pod/service CIDRs — this is what lets the training container still reach Azure Service Bus, App Insights, and the tracebloc backend

Egress, blocked (the whole point):

• Pod-to-pod in-cluster traffic
• ClusterIP services — mysql-client, jobs-manager, Kubernetes API server
• Any port other than 53 (DNS) and 443

Per-platform defaults

Platform	enabled	Reason
AKS	true	Requires Azure NPM (--network-policy azure) or Calico at cluster create. Documented in ci/aks-values.yaml.
EKS	false	Default AWS VPC CNI does NOT enforce NetworkPolicy. A policy that silently isn't enforced gives a false sense of security. Customers running Calico / Cilium add-ons should override to true.
BM	true	Requires Calico / Cilium / kube-router. Flannel alone does NOT enforce.
OC	true	OVN-Kubernetes enforces by default. Custom DNS selector + OpenShift pod/service CIDRs (10.128.0.0/14 + 172.30.0.0/16).

Design note: the map-merge footgun

Helm merges map values rather than replacing them. If I'd defaulted dnsSelector: {k8s-app: kube-dns} in values.yaml, the OpenShift override would add its label to that map rather than replacing it — producing a broken selector.

So dnsSelector defaults to {} in values.yaml, and the template falls back to {k8s-app: kube-dns} if empty. Each platform's ci/*-values.yaml sets the full intended selector. Documented in-line.

Known limitations (intentional for this PR)

1. Exfiltration to external attacker.com on port 443 is still possible — this only closes in-cluster paths and non-443 egress. Closing external entirely requires routing all training-pod traffic through jobs-manager (architectural endgame, separate effort).
2. No L7 filtering — NetworkPolicy is L3/L4.
3. CIDR-exclusion requires the cluster's pod/service CIDRs to be in the defaults (10.0.0.0/8 / 172.16.0.0/12 / 192.168.0.0/16). Customers with custom CIDRs must override clusterCidrs.
4. Enforcement depends on CNI — see the platform table above.

Test plan

• helm lint --strict passes on all 4 platforms
• helm unittest — 8 new cases covering rendering toggle, podSelector, ingress denial, DNS allow, external HTTPS allow, cluster CIDR blocking, OpenShift selector override. 47/47 total across 6 suites
• Manual helm template inspection on AKS/EKS/BM/OC — EKS correctly produces no output (disabled), OC uses openshift-dns namespace and the correct DNS daemon-set label
• Dev-edge rollout: spin a netshoot pod with the training label, verify:
  • DNS resolution ✓
  • curl https://api.tracebloc.io/ ✓
  • curl mysql-client:3306 blocked
  • curl kubernetes.default.svc blocked
  • curl jobs-manager pod IP blocked
• Real experiment runs end-to-end on dev edge with policy active
• Stg 72h soak across AKS + OC + bare-metal
• Prod canary on one customer edge

Dependency

Must land after tracebloc/client-runtime#1 has built a new jobs-manager image tag (:dev first). Otherwise the label doesn't exist and the policy selects nothing — not broken, just ineffective.

CI note (not a blocker)

Existing helm-ci.yaml paths: filter triggers on main and openshift branches but not develop. I validated locally (helm lint --strict, helm unittest, per-platform helm template). Worth a follow-up to add develop to the trigger list.

🤖 Generated with Claude Code