Context
Second killswitch layer, and the one that matters most: it is enforced in the CNI datapath outside the pod, so it survives the failure that actually causes leaks — the sidecar crashing or wg0 being torn down, which takes the in-pod rules from #33 with it.
Cilium semantics to build on: an endpoint with any egress rule is default-deny for egress, so the allow list is the killswitch — there is no explicit deny to write. The corollary is that adding toEntities: world anywhere for convenience silently destroys it.
Traffic shape works out conveniently. Healthy traffic looks like UDP/51820 to the server identity; the inner payload is encrypted and invisible to policy. Leaked traffic looks like plaintext to an internet IP and matches nothing. Inbound connections arriving through the tunnel on a forwarded port are decapsulated inside the pod netns and never cross the veth as plaintext, so policy neither sees nor blocks them — the killswitch does not interfere with port forwarding.
Scope
Generate policy per injected workload. Suggested shape: one CiliumClusterwideNetworkPolicy matching the opt-in label as the baseline (server plus DNS only), with per-workload policies adding narrow allows.
Acceptance criteria
Depends on #25 and #32. See docs/ROADMAP.md § Phase 5.10.
Context
Second killswitch layer, and the one that matters most: it is enforced in the CNI datapath outside the pod, so it survives the failure that actually causes leaks — the sidecar crashing or
wg0being torn down, which takes the in-pod rules from #33 with it.Cilium semantics to build on: an endpoint with any egress rule is default-deny for egress, so the allow list is the killswitch — there is no explicit deny to write. The corollary is that adding
toEntities: worldanywhere for convenience silently destroys it.Traffic shape works out conveniently. Healthy traffic looks like UDP/51820 to the server identity; the inner payload is encrypted and invisible to policy. Leaked traffic looks like plaintext to an internet IP and matches nothing. Inbound connections arriving through the tunnel on a forwarded port are decapsulated inside the pod netns and never cross the veth as plaintext, so policy neither sees nor blocks them — the killswitch does not interfere with port forwarding.
Scope
Generate policy per injected workload. Suggested shape: one
CiliumClusterwideNetworkPolicymatching the opt-in label as the baseline (server plus DNS only), with per-workload policies adding narrow allows.Acceptance criteria
NetworkPolicywhen not running CiliumDepends on #25 and #32. See
docs/ROADMAP.md§ Phase 5.10.