feat: firewall de egress — lista blanca + lista negra (prep iteración 2)#84
Open
az-adhoc wants to merge 1 commit into
Open
feat: firewall de egress — lista blanca + lista negra (prep iteración 2)#84az-adhoc wants to merge 1 commit into
az-adhoc wants to merge 1 commit into
Conversation
…+to) Prepara blockOutboundTraffic.yaml (iteración 2) para soportar lista blanca (allowedHosts, ya existía) + lista negra (bannedHosts, nuevo) vía AuthorizationPolicy DENY por SNI en el egressgateway (DENY > ALLOW; sirve para carve-outs dentro de un wildcard permitido). Corrige la regla ALLOW: from y to iban como reglas separadas (OR) → el firewall quedaba abierto; ahora una sola regla (from AND to). Aditivo, default off (blockOutboundTraffic: false), sin bump.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Qué
Prepara
blockOutboundTraffic.yaml(firewall de egress, iteración 2) para soportar dos listas, manteniéndolo default off (blockOutboundTraffic: false):allowedHosts, ya existía): default-deny víaREGISTRY_ONLY+ ServiceEntry + VirtualService + AuthorizationPolicyALLOWpor SNI.bannedHosts, nuevo): AuthorizationPolicyaction: DENYpor SNI en el egressgateway.DENYtiene precedencia sobreALLOW→ sirve para carve-outs dentro de un wildcard permitido (ej.allowedHosts: ["*.foo.com"]+bannedHosts: ["bad.foo.com"]).Fix incluido
La
AuthorizationPolicyALLOW teníafromytocomo reglas separadas → Istio las OR-ea, dejando el firewall abierto (este ns a cualquier host, o cualquier origen a los hosts permitidos). Ahora van en una sola regla (fromANDto).Modelo
Whitelist estricta (
REGISTRY_ONLY): soloallowedHostses alcanzable; un host fuera de la blanca ya queda bloqueado por el sidecar, así que la negra solo aplica como excepción dentro de wildcards. La lista blanca se va a poblar desde el inventario de egress (iteración 1, specingadhoc/devops-project0007).Compatibilidad
Aditivo, opt-in, sin bump de versión.
blockOutboundTraffic: falseen todos los tenants hoy (0 ServiceEntries en los clusters) → cambio dormido, sin impacto en vivo. Capacidad lista para activar por tenant en la iteración 2.Pendiente (no en este PR)
adhoc.dnsBannedHost(/etc/hosts sinkhole, no-prod) en favor de este DENY Istio-native.Archivos:
blockOutboundTraffic.yaml,values.yaml(ingress.istio.bannedHosts: []),questions.yml.