NetworkPolicy: restrict :8443 ingress to the controller SA
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 45/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- go, kubernetes
- Domain
- infrastructure, security
Research direction
Start by tracing SeiNode resource generation around internal/noderesource/noderesource.go, including buildRBACProxyContainer, and review the bearer-token flow in internal/sidecartransport/sidecartransport.go. Add focused test coverage for the generated NetworkPolicy. Done means each SeiNode selects its owned pods and permits :8443 only from the controller, with an owner reference and the specified ingress policy type.
Written by the indexing model from the issue text.
Description
Problem
Surfaced by security cross-review on the TLS-removal refactor. With kube-rbac-proxy running in --insecure-listen-address (HTTP) and SAR-based authz as the trust boundary, the controller→sidecar bearer token traverses the cluster network in clear text. Authz still works, but the threat model now leans entirely on "no packet-capture-capable workload in the cluster" and "no untrusted workload can reach :8443 on a SeiNode pod."
A per-SeiNode NetworkPolicy restricting ingress on :8443 to the controller's pod labels closes the second leg of that assumption.
Proposed scope
- Generate a NetworkPolicy per SeiNode (or a shared one keyed on the SeiNode-owned pod labels) selecting pods with
sei.io/nodelabel policyTypes: [Ingress], single rule allowingfrom.podSelectormatching the controller manager pod (orfrom.namespaceSelectorfor the controller namespace)- Owner-ref'd to the SeiNode so it GCs cleanly
Why deferred from refactor/seinode-drop-sidecar-tls
The refactor establishes the new trust model; NetworkPolicy hardens it. Decoupling lets the refactor land cleanly with the threat model documented, while the hardening lands in a focused PR with its own test coverage.
References
refactor/seinode-drop-sidecar-tls(commits 2076a80..c51075b)internal/noderesource/noderesource.gobuildRBACProxyContainer—--insecure-listen-addressinternal/sidecartransport/sidecartransport.go— bearer-token injection
- Dominant language
- Go
- Stars
- 1
- Forks
- 2
- Avg merge
- 2h 29m
- Merged PRs (30d)
- 56
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from sei-protocol/sei-k8s-controller
-
Difficulty 5/5 Over a week Newbie friendliness 32/100
-
Difficulty 5/5 Over a week Newbie friendliness 32/100
sei-protocol/sei-k8s-controller#457 · 2 comments ·
-
Difficulty 3/5 1-2 days Newbie friendliness 68/100
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
-
Difficulty 3/5 1-2 days Newbie friendliness 65/100
All issues in sei-protocol/sei-k8s-controller
Similar issues
-
optimization optimization:agents-md-curator
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
githubnext/gh-aw-cao#13143 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
blinklabs-io/bursa#904 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
yanet-platform/ipfw-go#129 ·
-
bug confmap/provider/googlesecretmanagerprovider needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
open-telemetry/opentelemetry-collector-contrib#51273 · 2 comments ·
-
bug: AI Gateway client filter lists "Unknown" twice when NULL and literal Unknown clients coexist Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 90/100