From 08f89ef729bc1ef65e620f09869febfd906470ce Mon Sep 17 00:00:00 2001 From: Lukas Wuttke Date: Thu, 30 Jul 2026 17:07:41 +0200 Subject: [PATCH] docs: finish the MySQL/egress overclaim fix on main (backend#1186) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PR #68 corrected the "air-gapped" FAQ and the security.mdx MySQL claim, but only touched security.mdx + faqs.mdx. Three pages still carried the same factual error on main: - overview.mdx: "a NetworkPolicy that blocks data egress from training pods" — false by default (networkPolicy.training.allowExternalHttps defaults true), and it contradicted the already-merged security.mdx ("Direct outbound HTTPS is still allowed by default today"). - configuration.mdx + eks-client-deployment-guide.mdx: NetworkPolicy "blocking pod-to-pod, MySQL, and Kubernetes API access" — the chart's network-policy-training.yaml (rule 3) explicitly PERMITS TCP/3306 to the in-cluster mysql-client pod; training reads its dataset from it and CrashLoopBackOffs without it. Reworded to mirror the accurate security.mdx description: MySQL and the results proxy stay reachable, arbitrary pod-to-pod + K8s API are blocked, direct outbound HTTPS is on by default with an optional stricter lockdown. Verified against client/client/templates/network-policy-training.yaml and values.yaml (allowExternalHttps: true). Refs tracebloc/backend#1186. Co-Authored-By: Claude Opus 4.8 --- environment-setup/configuration.mdx | 2 +- environment-setup/eks-client-deployment-guide.mdx | 2 +- environment-setup/overview.mdx | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/environment-setup/configuration.mdx b/environment-setup/configuration.mdx index fc8e14a..5c465f5 100644 --- a/environment-setup/configuration.mdx +++ b/environment-setup/configuration.mdx @@ -288,7 +288,7 @@ The CronJob's ServiceAccount is bound to the built-in `cluster-admin` ClusterRol #### NetworkPolicy hardening for training pods -Training pods run untrusted ML code. The chart can apply a NetworkPolicy that denies ingress and restricts egress to DNS + external HTTPS only — blocking pod-to-pod, MySQL, and Kubernetes API access from the training pod. +Training pods run untrusted ML code. The chart can apply a NetworkPolicy that denies all ingress and restricts egress — arbitrary pod-to-pod traffic and the Kubernetes API are blocked, while the in-cluster MySQL that serves the training data and the proxy that reports results stay reachable. Direct outbound HTTPS is allowed by default; a stricter lockdown that instead routes it through an in-cluster egress gateway can be enabled per cluster. ```yaml networkPolicy: diff --git a/environment-setup/eks-client-deployment-guide.mdx b/environment-setup/eks-client-deployment-guide.mdx index dd4c07d..87d2517 100644 --- a/environment-setup/eks-client-deployment-guide.mdx +++ b/environment-setup/eks-client-deployment-guide.mdx @@ -743,7 +743,7 @@ env: #### NetworkPolicy for Training Pods -The chart can apply a NetworkPolicy that denies ingress and restricts egress to DNS + external HTTPS only — blocking pod-to-pod, MySQL, and Kubernetes API access from training pods. +The chart can apply a NetworkPolicy that denies all ingress and restricts egress — arbitrary pod-to-pod traffic and the Kubernetes API are blocked, while the in-cluster MySQL that serves the training data and the proxy that reports results stay reachable. Direct outbound HTTPS is allowed by default; a stricter lockdown that instead routes it through an in-cluster egress gateway can be enabled per cluster. ```yaml networkPolicy: diff --git a/environment-setup/overview.mdx b/environment-setup/overview.mdx index 674c82a..484191b 100644 --- a/environment-setup/overview.mdx +++ b/environment-setup/overview.mdx @@ -45,7 +45,7 @@ Raw data stays inside your infrastructure. Your workspace opens an **outbound-on | Training & evaluation results | Yes — the metrics models are judged on | | Trained model weights | **Only if you allow it** — your choice per collaboration, set in the admin panel | -Enforced by per-job container isolation, a NetworkPolicy that blocks data egress from training pods, a vulnerability scan before any model runs, and TLS on all traffic. +Enforced by per-job container isolation, a NetworkPolicy that restricts training-pod egress, a vulnerability scan before any model runs, and TLS on all traffic. **The mental model:** `1 machine = 1 workspace = n datasets`. One deployment per machine; as many datasets inside it as you like.