Skip to content

Scoped CiliumNetworkPolicy as sole Phase-1 access control for fovea audit

Date: 2026-06-28 Status: Accepted Decision: hl-jecc Deciders: Sean Brandt

qdrant-fovea runs keyless because the fovea chart (0.5.2) cannot plumb audit.qdrant.api_key (no auditQdrantKey secret-ref field, no extraEnv; blocked on seanb4t/fovea#69). Enabling Qdrant auth without the key would 401 every audit write. The fovea namespace has no default-deny egress and no Qdrant NetworkPolicy today (octopus + engram qdrants are also unprotected), so a keyless qdrant-fovea.fovea.svc:6334 is reachable by any pod in the cluster via cluster-DNS.

Ship Phase 1 keyless with a scoped CiliumNetworkPolicy as the sole access control: ingress to qdrant-fovea on :6334 (gRPC, the audit data path) from app.kubernetes.io/name: fovea pods only, and on :6333 (HTTP, readiness probe) from fromEntities: host (the local node’s kubelet). Defer Qdrant API-key auth to Phase 2 (hl-uh07.13), which leaves this NetworkPolicy unchanged.

  • The netpol closes the cross-namespace lateral-movement hole — the primary threat model for a cluster-DNS-reachable keyless store.
  • Blocking on the chart change would defer forensics/observability value indefinitely for a defense-in-depth layer, not a primary control.
  • The kubelet-probe gotcha (ingress must allow fromEntities: host or the readiness probe is dropped and the Deployment never becomes Ready) is a non-obvious, load-bearing detail future contributors must not rediscover.
  • Scoped CiliumNetworkPolicy, keyless (chosen): ships now without a fovea-chart change; closes lateral movement; no new secret/Vault path; matches the cluster’s CiliumNetworkPolicy convention.
  • Block Phase 1 on the chart change, API key day-one (rejected): defense-in-depth from day one, but couples audit enablement + forensics value to fovea’s release cadence and delays the lateral-movement fix.
  • Positive: audit enablement is decoupled from the fovea chart release cadence; establishes the first Qdrant NetworkPolicy in the cluster (a reusable pattern for octopus/engram qdrants).
  • Negative: a compromised fovea pod can read/forge audit records until Phase 2 lands; kubectl port-forward to :6333 is Cilium-version-dependent and must be verified against the cluster build.
  • Neutral: Phase 2 keeps this NetworkPolicy unchanged; the API key is additive.