Scoped CiliumNetworkPolicy as sole Phase-1 access control for fovea audit
Date: 2026-06-28 Status: Accepted Decision: hl-jecc Deciders: Sean Brandt
Context
Section titled “Context”qdrant-fovea runs keyless because the fovea chart (0.5.2) cannot plumb audit.qdrant.api_key (no auditQdrantKey secret-ref field, no extraEnv; blocked on seanb4t/fovea#69). Enabling Qdrant auth without the key would 401 every audit write. The fovea namespace has no default-deny egress and no Qdrant NetworkPolicy today (octopus + engram qdrants are also unprotected), so a keyless qdrant-fovea.fovea.svc:6334 is reachable by any pod in the cluster via cluster-DNS.
Decision
Section titled “Decision”Ship Phase 1 keyless with a scoped CiliumNetworkPolicy as the sole access control: ingress to qdrant-fovea on :6334 (gRPC, the audit data path) from app.kubernetes.io/name: fovea pods only, and on :6333 (HTTP, readiness probe) from fromEntities: host (the local node’s kubelet). Defer Qdrant API-key auth to Phase 2 (hl-uh07.13), which leaves this NetworkPolicy unchanged.
Rationale
Section titled “Rationale”- The netpol closes the cross-namespace lateral-movement hole — the primary threat model for a cluster-DNS-reachable keyless store.
- Blocking on the chart change would defer forensics/observability value indefinitely for a defense-in-depth layer, not a primary control.
- The kubelet-probe gotcha (ingress must allow
fromEntities: hostor the readiness probe is dropped and the Deployment never becomes Ready) is a non-obvious, load-bearing detail future contributors must not rediscover.
Alternatives Considered
Section titled “Alternatives Considered”- Scoped CiliumNetworkPolicy, keyless (chosen): ships now without a fovea-chart change; closes lateral movement; no new secret/Vault path; matches the cluster’s CiliumNetworkPolicy convention.
- Block Phase 1 on the chart change, API key day-one (rejected): defense-in-depth from day one, but couples audit enablement + forensics value to fovea’s release cadence and delays the lateral-movement fix.
Consequences
Section titled “Consequences”- Positive: audit enablement is decoupled from the fovea chart release cadence; establishes the first Qdrant NetworkPolicy in the cluster (a reusable pattern for octopus/engram qdrants).
- Negative: a compromised fovea pod can read/forge audit records until Phase 2 lands;
kubectl port-forwardto:6333is Cilium-version-dependent and must be verified against the cluster build. - Neutral: Phase 2 keeps this NetworkPolicy unchanged; the API key is additive.