docs: finish the MySQL/egress overclaim fix on main (backend#1186)

[LukasWodka]

What this fixes

Completes the factual-correction half of tracebloc/backend#1186 (RFC-0003 §9 messaging alignment). PR #68 corrected the "air-gapped" FAQ and the security.mdx MySQL claim, but it only edited security.mdx + faqs.mdx. Three other pages on main still carried the same overclaim — this PR finishes the sweep so the live docs are internally consistent.

Ground truth verified against the chart itself — tracebloc/client/client/templates/network-policy-training.yaml and values.yaml:

• MySQL (TCP/3306) is explicitly permitted to training pods (rule 3). Training reads its dataset from the in-cluster mysql-client pod and CrashLoopBackOffs without it — so any claim that the NetworkPolicy blocks MySQL access is false.
• The results/FLOPs requests-proxy (8888) is also always permitted (rule 4).
• Direct outbound HTTPS is allowed by default (networkPolicy.training.allowExternalHttps: true, values.yaml:188) — so "blocks data egress" is false by default. The stricter gateway-routed lockdown ships with the chart but is off until an operator enables it.

Reworded to mirror the accurate description already merged in security.mdx:21.

Changes (file:line → before / after)

1. environment-setup/overview.mdx:48

• Before:"Enforced by per-job container isolation, a NetworkPolicy that blocks data egress from training pods, a vulnerability scan…"
• After:"…a NetworkPolicy that restricts training-pod egress, a vulnerability scan…"
• Why: egress is not blocked by default; the previous wording directly contradicted security.mdx ("Direct outbound HTTPS is still allowed by default today"). Kept tight — this is the high-level Overview page.

2. environment-setup/configuration.mdx:291

• Before:"The chart can apply a NetworkPolicy that denies ingress and restricts egress to DNS + external HTTPS only — blocking pod-to-pod, MySQL, and Kubernetes API access from the training pod."
• After:"The chart can apply a NetworkPolicy that denies all ingress and restricts egress — arbitrary pod-to-pod traffic and the Kubernetes API are blocked, while the in-cluster MySQL that serves the training data and the proxy that reports results stay reachable. Direct outbound HTTPS is allowed by default; a stricter lockdown that instead routes it through an in-cluster egress gateway can be enabled per cluster."

3. environment-setup/eks-client-deployment-guide.mdx:746

• Before:(identical sentence to Fix GSC crawl budget: add 41 redirects for old docs URLs #2, "…from training pods.")
• After:(same accurate rewrite as Fix GSC crawl budget: add 41 redirects for old docs URLs #2.)

No headings/anchors changed; no link targets touched; MDX unchanged structurally.

⚠️ Flagged for Lukas — develop is stale and will regress main on the next promotion

develop never received PR #68 (it's behind main by 4 commits) and never had these three lines fixed. So develop currently carries all five overclaims:

Branch line	Claim
develop:environment-setup/security.mdx:21	OLD — "Training pods are denied data egress — they can't reach MySQL…" (the exact claim #68 fixed on main)
develop:tools-help/faqs.mdx:31	OLD — "### Do you support air-gapped clusters?" heading (also #68 territory)
develop:environment-setup/configuration.mdx:291	MySQL-blocked (this PR's #2, unfixed on develop)
develop:environment-setup/eks-client-deployment-guide.mdx:746	MySQL-blocked (this PR's #3, unfixed on develop)
develop:environment-setup/overview.mdx:48	"blocks data egress" (this PR's #1, unfixed on develop)

Recommendation: after this merges, do a main → develop backmerge to reconcile. Otherwise a future develop → main release PR (like #60 / #57) can re-introduce the corrected overclaims onto the live site. This is a pre-existing drift from #68 targeting main directly — not created here, but worth closing out.

Deferred (intentionally NOT in this PR — positioning/voice, per #68)

Same items #68 reserved for you, still open:

• Adding the pinned "three ingress, one egress, nothing sideways / raw data is never an egress channel" definition of secure environment to TERMINOLOGY.md as the quotable source of truth.
• The workspace → secure environment rename across overview.mdx / security.mdx (terminology drift, not a factual error).
• All tracebloc-website marketing copy (different repo).

Refs tracebloc/backend#1186.

🤖 Generated with Claude Code

---

Note

Low Risk
Documentation-only factual corrections with no runtime or configuration behavior changes.

Overview
Finishes the RFC-0003 / backend#1186 factual sweep on main: three environment-setup pages still claimed training NetworkPolicy blocks MySQL and implied all data egress is blocked. They now match the chart and the wording already fixed in security.mdx.

overview.mdx — Replaces "blocks data egress from training pods" with "restricts training-pod egress" so the overview no longer implies default egress is fully blocked.

configuration.mdx and eks-client-deployment-guide.mdx — Replaces the old "DNS + external HTTPS only … blocking pod-to-pod, MySQL, and Kubernetes API" line with an accurate description: ingress denied; arbitrary pod-to-pod and API egress blocked; in-cluster MySQL (training data) and the results proxy stay allowed; direct outbound HTTPS is on by default, with optional stricter routing via an in-cluster egress gateway.

No code, anchors, or structural MDX changes—copy only.

^{Reviewed by Cursor Bugbot for commit 08f89ef. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[LukasWodka]

👋 Heads-up — Code review queue is at 31 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• backend#1146 — docs(rfc): platform cost & autoscaling architecture · author: @saadqbal · reviewer: @LukasWodka, @saqlainsyed007, @aptracebloc
• backend#1201 — docs(rfc): Data spaces & federated dataset composition (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1217 — docs(rfc): Dataset integrity & score reproducibility (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1261 — RFC-BACKEND-0008: board & process reset (decision RFC — for markup) · author: @LukasWodka · reviewer: @saadqbal
• backend#1284 — docs(deploy): backend deploy runbook skeleton (#1263) · author: @LukasWodka · no reviewer assigned
• backend#1332 — feat(check-model): allow KNN/GaussianProcess on a single-edge owned dataset (#923 follow-up) · author: @divyasinghds · no reviewer assigned
• backend#1353 — chore(ci): baseline historical gitleaks findings + wire caller · author: @LukasWodka · no reviewer assigned
• backend#1361 — feat(tasks): bound ExperimentQueue growth for PAUSED experiments (backend#1351) · author: @saqlainsyed007 · no reviewer assigned
• backend#1368 — feat(blob_store): migrate CheckModelClassesView link/model_reform to blob_store (#1162) · author: @saadqbal · no reviewer assigned
• backend#1372 — feat(api): unauthenticated GET /version/ reporting the running build (#1342) · author: @LukasWodka · reviewer: @saqlainsyed007

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 08f89ef. Configure here.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
tracebloc	🟢 Ready	View Preview	Jul 30, 2026, 3:09 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[LukasWodka]

Sweep result: no findings — content re-verified against the chart, not just re-read

Bugbot: 0 issues. All checks green (Mintlify Deployment, link-rot, pii-gate ×4, check); vale-spellcheck is NEUTRAL, i.e. not configured — not a failure.

Because a docs claim is only as good as the code it describes, I re-derived every factual assertion in this PR from the current tracebloc/client chart on develop rather than trusting the PR body. All three hold:

Claim	Verified against
in-cluster MySQL stays reachable	network-policy-training.yamlrule 3 — podSelector: app=mysql-client, port 3306. Header comment confirms training CrashLoopBackOffs without it.
results proxy stays reachable	rule 4 — podSelector: app=requests-proxy, port 8888 (client#196).
arbitrary pod-to-pod + K8s API blocked	rule 2 — ipBlock: 0.0.0.0/0 with except: the cluster pod/service CIDRs.
direct outbound HTTPS allowed by default	values.yaml:188 → allowExternalHttps: true. Template gates rule 2 on dig "allowExternalHttps" true, so an absent key also keeps it.
stricter lockdown ships but is off	egressProxy.enabled: true but routeWorkloadsdefault false (values.schema.json:389): "enable per-fleet, verify a run, then drop the direct egress rule."

So "blocks data egress" / "blocking … MySQL" were genuinely false, and the replacement wording is accurate. No overclaim introduced.

Terminology check — clean. Swept the whole branch, not just the diff:

• The only air-gap mention left is the corrected tools-help/faqs.mdx:32, which states the environment "is not fully air-gapped" and reframes as "defined, auditable ingress and egress". Correct per the pinned framing.
• Zero hits repo-wide for cryptographic / tamper-proof / sealed / impossible to / cannot (leave|exfiltrate|escape|reach). Nothing claims a cryptographic seal.
• Zero hits for the old wording (DNS + external HTTPS only, MySQL, and Kubernetes API, denies ingress and restricts) — the sweep really is finished on main.
• never leaves your infrastructure survives in 4 places; that's the sanctioned "raw data is never an egress channel" framing, not an overclaim.

CNI dependency is caveated on both rewritten pages — worth confirming, since "restricts egress" is only true if the CNI enforces: configuration.mdx has the per-platform table + a <Warning> immediately below the edit, and eks-client-deployment-guide.mdx has the "EKS caveat" paragraph (with enabled: false in its own example). The untouched deploy-aks / deploy-openshift / deploy-bare-metal pages each carry the same caveat. overview.mdx:48 is left bare, which I think is right for a high-level overview page — it links onward at line 80.

Base branch is main, which is correct: docs is content-only and exempt from the develop-only rule and the FR gate.

Confirmed: the develop drift you flagged is real

Re-checked line by line — main is 4 ahead of develop, and all five overclaims are still live there:

develop line	Current text
environment-setup/security.mdx:21	"Training pods are denied data egress — they can't reach MySQL, other pods, or the Kubernetes API." — false on all three counts
tools-help/faqs.mdx:31	"### Do you support air-gapped clusters?" answered "Yes" — the pinned-terminology violation
configuration.mdx:291 · eks-client-deployment-guide.mdx:746 · overview.mdx:48	the three this PR fixes, unfixed there

So the backmerge recommendation stands: without a main → develop reconcile, the next develop → main release PR silently reverts all five. That's a decision for @LukasWodka, not something to fix in this PR. I did not touch develop.

[aptracebloc]

Approving — accurate correction of the NetworkPolicy egress overclaim (in-cluster MySQL and the results proxy stay reachable; outbound HTTPS allowed by default with an optional egress-gateway lockdown). Consistent wording across all three files; CI green.