Bug 1467802 - [RFE] Deny egress connections to nodes from pods (except DNS traffic)
[RFE] Deny egress connections to nodes from pods (except DNS traffic)
Status: NEW
Product: OpenShift Container Platform
Classification: Red Hat
Component: RFE (Show other bugs)
Unspecified Unspecified
unspecified Severity low
: ---
: ---
Assigned To: Eric Paris
Xiaoli Tian
Depends On:
  Show dependency treegraph
Reported: 2017-07-05 04:09 EDT by Carsten Lichy-Bittendorf
Modified: 2018-01-25 16:20 EST (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Carsten Lichy-Bittendorf 2017-07-05 04:09:45 EDT
Proposed title of this feature request
 - Deny egress connections to nodes from pods (except DNS traffic)

Who is the customer behind the request?
 -    Account: name (acct #): La Poste - 5366280
 -    TAM customer: yes

What is the nature and description of the request?
 - the customer likes to protect nodes from potential malicious attacks from pods
 - today, connections from pod to nodes are mandatory due to DNS traffic (DNS feature is implemented by DNSMASQ on each node),
 - today, EgressNetworkPolicy rules are limited to ip only, which requires customer to allow all traffic to the nodes (and not only DNS traffic)

Why does the customer need this? (List the business requirements here)
 - to meet security requirements

How would the customer like to achieve this? (List the functional requirements here)
 - by an enhancement of the EgressNetworkPolicy to allow implicit DNS traffic (port 53) to nodes.

For each functional requirement listed, specify how Red Hat and the customer can test to confirm the requirement is successfully implemented.
 - configure an EgressNetworkPolicy without allowing traffic to nodes (just Deny on cidrSelector: and try DNS resolution in pods.

Is there already an existing RFE upstream or in Red Hat Bugzilla?
 - Non found so far

Does the customer have any specific time-line dependencies and which release would they like to target (i.e. RHEL5, RHEL6)?

Is the sales team involved in this request and do they have any additional input?
 - Sales is looped in, so no further input.

List any affected packages or components.
 - EgressNetworkPolicy

Would the customer be able to assist in testing this functionality if implemented?
 - yes

Note You need to log in before you can comment on or make changes to this bug.