Protect the flow Endpoints: NetworkPolicy + mTLS/TLS on the listeners #56

New issue

Open

opened 2026-09-19 01:23:15 +00:00 by ginjiruu · 0 comments

ginjiruu commented

2026-09-19 01:23:15 +00:00

Owner

Context

Security architecture review, 18 Sep 2026 (candidate 2, "Strong"). The three flow Endpoints (OIDC Check :8083, Exchange Check :8084, callback/logout :8082) are served as plaintext — gRPC without TLS, HTTP without TLS — and are exposed as cluster-wide Services; the only shipped NetworkPolicy covers the metrics port. The ext_authz protocol has no client authentication: trust is by network proximity, and here "proximity" is the whole cluster. Any pod can replay a captured Session (the Check response returns the full verified identity-claim set), replay a captured code+state pair against the callback, or drive unbounded token-endpoint grants from the bridge's egress.

What to build

Make listener security part of the serve module's interface instead of an absence:

Ship a NetworkPolicy restricting 8082–8084 ingress to the gateway's namespace (plus health probes).
Serve the two gRPC listeners with mTLS (client CA) and the callback listener with TLS. The listener seam takes a factory — a plain adapter for tests, an mTLS/TLS adapter for production (two adapters make the seam real).
Document the gateway-side ExternalAuth backend TLS configuration in the deploy runbook and samples.

Acceptance criteria

A NetworkPolicy in the shipped manifests restricts 8082–8084 ingress to the gateway's namespace (plus probes); traffic from other namespaces is denied
The gRPC listeners serve mTLS with a client CA; a dial without a valid client cert is rejected (tested through the interface)
The callback listener serves TLS
The listener seam takes a factory: plain adapter for tests, mTLS/TLS adapter for production; existing serving tests run through the plain adapter
The deploy runbook documents the gateway-side ExternalAuth backend TLS configuration
The live flow still works end-to-end on the portable cluster (httpbin-auth) after the change

Blocked by

None — can start immediately

## Context Security architecture review, 18 Sep 2026 (candidate 2, "Strong"). The three flow Endpoints (OIDC Check :8083, Exchange Check :8084, callback/logout :8082) are served as plaintext — gRPC without TLS, HTTP without TLS — and are exposed as cluster-wide Services; the only shipped NetworkPolicy covers the metrics port. The ext_authz protocol has no client authentication: trust is by network proximity, and here "proximity" is the whole cluster. Any pod can replay a captured Session (the Check response returns the full verified identity-claim set), replay a captured code+state pair against the callback, or drive unbounded token-endpoint grants from the bridge's egress. ## What to build Make listener security part of the serve module's interface instead of an absence: 1. Ship a NetworkPolicy restricting 8082–8084 ingress to the gateway's namespace (plus health probes). 2. Serve the two gRPC listeners with mTLS (client CA) and the callback listener with TLS. The listener seam takes a factory — a plain adapter for tests, an mTLS/TLS adapter for production (two adapters make the seam real). 3. Document the gateway-side ExternalAuth backend TLS configuration in the deploy runbook and samples. ## Acceptance criteria - [ ] A NetworkPolicy in the shipped manifests restricts 8082–8084 ingress to the gateway's namespace (plus probes); traffic from other namespaces is denied - [ ] The gRPC listeners serve mTLS with a client CA; a dial without a valid client cert is rejected (tested through the interface) - [ ] The callback listener serves TLS - [ ] The listener seam takes a factory: plain adapter for tests, mTLS/TLS adapter for production; existing serving tests run through the plain adapter - [ ] The deploy runbook documents the gateway-side ExternalAuth backend TLS configuration - [ ] The live flow still works end-to-end on the portable cluster (httpbin-auth) after the change ## Blocked by - None — can start immediately

ginjiruu added the

ready-for-agent

label

2026-09-19 01:25:25 +00:00