diff --git a/environment-setup/configuration.mdx b/environment-setup/configuration.mdx index fc8e14a..5c465f5 100644 --- a/environment-setup/configuration.mdx +++ b/environment-setup/configuration.mdx @@ -288,7 +288,7 @@ The CronJob's ServiceAccount is bound to the built-in `cluster-admin` ClusterRol #### NetworkPolicy hardening for training pods -Training pods run untrusted ML code. The chart can apply a NetworkPolicy that denies ingress and restricts egress to DNS + external HTTPS only — blocking pod-to-pod, MySQL, and Kubernetes API access from the training pod. +Training pods run untrusted ML code. The chart can apply a NetworkPolicy that denies all ingress and restricts egress — arbitrary pod-to-pod traffic and the Kubernetes API are blocked, while the in-cluster MySQL that serves the training data and the proxy that reports results stay reachable. Direct outbound HTTPS is allowed by default; a stricter lockdown that instead routes it through an in-cluster egress gateway can be enabled per cluster. ```yaml networkPolicy: diff --git a/environment-setup/eks-client-deployment-guide.mdx b/environment-setup/eks-client-deployment-guide.mdx index dd4c07d..87d2517 100644 --- a/environment-setup/eks-client-deployment-guide.mdx +++ b/environment-setup/eks-client-deployment-guide.mdx @@ -743,7 +743,7 @@ env: #### NetworkPolicy for Training Pods -The chart can apply a NetworkPolicy that denies ingress and restricts egress to DNS + external HTTPS only — blocking pod-to-pod, MySQL, and Kubernetes API access from training pods. +The chart can apply a NetworkPolicy that denies all ingress and restricts egress — arbitrary pod-to-pod traffic and the Kubernetes API are blocked, while the in-cluster MySQL that serves the training data and the proxy that reports results stay reachable. Direct outbound HTTPS is allowed by default; a stricter lockdown that instead routes it through an in-cluster egress gateway can be enabled per cluster. ```yaml networkPolicy: diff --git a/environment-setup/overview.mdx b/environment-setup/overview.mdx index 674c82a..484191b 100644 --- a/environment-setup/overview.mdx +++ b/environment-setup/overview.mdx @@ -45,7 +45,7 @@ Raw data stays inside your infrastructure. Your workspace opens an **outbound-on | Training & evaluation results | Yes — the metrics models are judged on | | Trained model weights | **Only if you allow it** — your choice per collaboration, set in the admin panel | -Enforced by per-job container isolation, a NetworkPolicy that blocks data egress from training pods, a vulnerability scan before any model runs, and TLS on all traffic. +Enforced by per-job container isolation, a NetworkPolicy that restricts training-pod egress, a vulnerability scan before any model runs, and TLS on all traffic. **The mental model:** `1 machine = 1 workspace = n datasets`. One deployment per machine; as many datasets inside it as you like.