From cd888c86c916891b9cde9def1bcd811a402bcc23 Mon Sep 17 00:00:00 2001 From: knyaz Date: Sat, 1 Aug 2026 12:23:45 +0000 Subject: [PATCH] Restrict agent-phase DNS egress to cluster DNS The ridges-agent-egress NetworkPolicy allowed UDP/TCP 53 to 0.0.0.0/0 (no `to:` selector). Agent pods could therefore query arbitrary authoritative DNS servers, opening a DNS-tunneling channel out of the sandbox: low-bandwidth, but enough to exfiltrate data or relay traffic to non-whitelisted endpoints, bypassing the SNI allowlist that gates port 443. Scope DNS egress to kube-system (kube-dns / CoreDNS, and node-local-dns DaemonSets where present), which is where every cluster's resolver lives. Legitimate resolution is unaffected; the HTTPS path via the iptables REDIRECT + SNI router is unchanged. --- k8s/local/network-policies.yaml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/k8s/local/network-policies.yaml b/k8s/local/network-policies.yaml index b0aeac0d..fec12e28 100644 --- a/k8s/local/network-policies.yaml +++ b/k8s/local/network-policies.yaml @@ -1,5 +1,5 @@ --- -# Agent phase: allow only DNS + outbound port 443. +# Agent phase: allow only cluster DNS + outbound port 443. # All HTTPS traffic from the main container is transparently intercepted by the # iptables REDIRECT rule and forwarded to the proxy SNI router on port 15443. # The proxy sidecar (UID 1337, exempt from REDIRECT) reaches the internet directly. @@ -16,8 +16,15 @@ spec: policyTypes: - Egress egress: - # DNS resolution - - ports: + # DNS resolution — cluster DNS only (kube-dns / CoreDNS in kube-system). + # Without a `to:` selector port 53 is open to the entire internet, which + # would let agent code exfiltrate data or tunnel arbitrary traffic (e.g. + # LLM calls to non-whitelisted providers) over DNS queries. + - to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + ports: - port: 53 protocol: UDP - port: 53