- Shipped
- August 3, 2026 at 2:47 AM UTC
- Author
- Kamo
- Commit
- 8f6c672
Reverts the policy added in 06db7db and patched in 24f76ae. It took SecurityService down for roughly six minutes in production (pod 0/1, Hikari connections dying, one liveness restart) and was removed to restore service. The mistake was assuming in-cluster dependencies resolve to pods. Most of them do not here: cockroachdb-public, nats and minio-public are all Services with manual Endpoints pointing at the node address 192.168.4.22, and only redis is actually pod-backed. A namespaceSelector rule cannot match a node address, and every node address sits inside the private ranges the internet rule excepts — so those three had no matching rule and Cilium failed them closed. The patch in 24f76ae caught MinIO and missed the other two, which is precisely how it broke. A correct version is writable (allow the node subnet on 26257/4222/9000 plus the pod CIDR), but shipping a second attempt at something that just caused an outage, with no staging environment to prove it against, is a bad trade for what this buys. It was only ever defence-in-depth: the real control against a sender-supplied URL is PublicHostGuard plus the DNS-pinning fetcher in SecurityService, which is the only layer that understands DNS rebinding, is unit tested against **************** bypasses, and is unaffected by this revert. Worth doing properly later, together with converting those node-backed Services to real in-cluster endpoints — the topology is what makes network policy hazardous here, and that is the thing to fix first.