Red Hat Bugzilla – Bug 1467802
[RFE] Deny egress connections to nodes from pods (except DNS traffic)
Last modified: 2017-08-09 15:42:15 EDT
Proposed title of this feature request
- Deny egress connections to nodes from pods (except DNS traffic)
Who is the customer behind the request?
- Account: name (acct #): La Poste - 5366280
- TAM customer: yes
What is the nature and description of the request?
- the customer likes to protect nodes from potential malicious attacks from pods
- today, connections from pod to nodes are mandatory due to DNS traffic (DNS feature is implemented by DNSMASQ on each node),
- today, EgressNetworkPolicy rules are limited to ip only, which requires customer to allow all traffic to the nodes (and not only DNS traffic)
Why does the customer need this? (List the business requirements here)
- to meet security requirements
How would the customer like to achieve this? (List the functional requirements here)
- by an enhancement of the EgressNetworkPolicy to allow implicit DNS traffic (port 53) to nodes.
For each functional requirement listed, specify how Red Hat and the customer can test to confirm the requirement is successfully implemented.
- configure an EgressNetworkPolicy without allowing traffic to nodes (just Deny on cidrSelector: 0.0.0.0/0) and try DNS resolution in pods.
Is there already an existing RFE upstream or in Red Hat Bugzilla?
- Non found so far
Does the customer have any specific time-line dependencies and which release would they like to target (i.e. RHEL5, RHEL6)?
Is the sales team involved in this request and do they have any additional input?
- Sales is looped in, so no further input.
List any affected packages or components.
Would the customer be able to assist in testing this functionality if implemented?