- Shipped
- August 3, 2026 at 10:26 AM UTC
- Author
- Kamo
- Commit
- 93de3e7
This policy took the whole platform's login offline for hours. Cilium enforces egress against the RESOLVED BACKEND, after service DNAT, so the port it matches is the pod's targetPort and never the ClusterIP's port. The in-cluster allowlist of {6379, 80, 8080} therefore permitted kamowsmedia-service (80 -> 80) and silently dropped kamocapcha-service (80 -> 3000). Capcha verification became unreachable, and because CapchaVerificationService builds a RestTemplate with no timeouts, every login thread blocked there indefinitely rather than failing fast. The canary noted in the header validated "sibling services:80" using the SERVICE port, so it passed while never exercising a backend listening on anything else. That is why this was not caught before it shipped. The port list is now removed for in-cluster endpoints. The kamo namespace exposes ~35 distinct targetPorts and SecurityService legitimately calls many of them, so enumerating them is a list that will be wrong again the next time someone adds a service. It also bought little: the SSRF containment this policy exists for comes from the `world` rule and from no rule matching node identities. A reachable sibling pod on 3000 was never the threat model. The node-resident and world rules are untouched, so the actual containment — no node access beyond CRDB/NATS/MinIO, no internet beyond 80/443 — is unchanged. Applied live before this commit; the platform is serving logins again.