zyratlo commented on code in PR #8073: URL: https://github.com/apache/texera/pull/8073#discussion_r3962069993
########## bin/k8s/templates/base/jupyter-pool/jupyter-network-policy.yaml: ########## @@ -0,0 +1,48 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +{{- if and .Values.notebookMigrationService.enabled .Values.jupyterPool.networkPolicy.enabled }} +# Stops one user's JupyterLab from reaching another's. Users run arbitrary code in these +# pods, so a neighbour in the pool is the one genuinely hostile caller. Allowing every +# namespace but the pool's own denies pod-to-pod traffic inside it while leaving the real +# callers working: the notebook migration service, and the Envoy proxy wherever the gateway +# installation runs it. +# +# Defence in depth, not the authorisation boundary: the per-user Jupyter token is what stops +# one user reading another's notebooks. Egress is left alone, since notebooks legitimately +# install packages and call out. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ .Values.jupyterPool.name }}-deny-cross-user + namespace: {{ .Values.jupyterPool.namespace }} +spec: + podSelector: + matchLabels: + type: jupyter + policyTypes: + - Ingress + ingress: + - from: + # kubernetes.io/metadata.name is set automatically on every namespace, so this + # selects "any namespace but the pool's own" without labelling anything by hand. + - namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: NotIn + values: + - {{ .Values.jupyterPool.namespace }} Review Comment: Fixed in 59f095dcd, which adds workflowComputingUnitPool.namespace to the NotIn list. Both premises checked out: the namespace is known to the chart, and grepping the CU service and the engine for jupyter returns nothing, so neither side has a reason to call the other. One refinement to the reasoning: the read-only embedding only covers the iframe path, and a user holds their own token and can drive the pod directly, so both pools run user code and that is the cleaner reason to deny both. Verified with a probe pod in the CU namespace, blocked by IP and DNS while still reaching texera-dev, and an ablation removing the namespace restores the connection. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
