open-platform/mitosis

Fork 0

identity-defined CiliumNetworkPolicy (closes #13) #37

New issue

Closed

opened 2026-07-01 02:03:48 +00:00 by plat · 1 comment

plat commented

2026-07-01 02:03:48 +00:00

Owner

Track/Wave: DOM-2 · Wave G5 · Size XL
Repos: mitosis, gitops, mcp, _app-template
Depends on: DOM-1a, HYB-1, RBAC-4

Why

Realizes 'the network is domain-defined': per-app FQDN egress instead of the interim blanket 443/80 allow. User chose to build now. Closes #13.

Scope

(a) CNI swap at bring-up — bin/up's k3d create installs Cilium (flannel-backend=none + Cilium Helm); VERIFY every existing networking.k8s.io/v1 NetworkPolicy still enforces natively before adding Cilium rules. (b) A per-app allowedHosts spec (charts/app values) that the overlay renderer turns into a CiliumNetworkPolicy toFQDNs rule, REPLACING the blanket allow as the default, keeping RFC1918-exclusion + intra-ns/Traefik/CoreDNS rules.

Acceptance

A fresh bin/up cluster runs Cilium (cilium status Ready); all existing platform NetworkPolicies still enforce; an app declaring allowedHosts:[api.example.com] blocks a non-allowlisted host and allows the allowlisted one; a no-allowedHosts app is rejected/defaulted per policy.

Notes

Seam A (bin/up) AFTER HYB-1 + Seam B (overlay) AFTER RBAC-4 — last on both. MIGRATION RISK: adopting Cilium on the already-live client platform is a CNI migration; validate on staging, then plan deliberate migration or re-germinate. HAZARD: must preserve cert-manager ACME DNS-01 egress (shared with POL-4).

Part of the First Client Deploy → Governance roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.

**Track/Wave:** `DOM-2` · Wave **G5** · Size **XL** **Repos:** `mitosis`, `gitops`, `mcp`, `_app-template` **Depends on:** DOM-1a, HYB-1, RBAC-4 ## Why Realizes 'the network is domain-defined': per-app FQDN egress instead of the interim blanket 443/80 allow. User chose to build now. Closes #13. ## Scope (a) CNI swap at bring-up — bin/up's k3d create installs Cilium (flannel-backend=none + Cilium Helm); VERIFY every existing networking.k8s.io/v1 NetworkPolicy still enforces natively before adding Cilium rules. (b) A per-app allowedHosts spec (charts/app values) that the overlay renderer turns into a CiliumNetworkPolicy toFQDNs rule, REPLACING the blanket allow as the default, keeping RFC1918-exclusion + intra-ns/Traefik/CoreDNS rules. ## Acceptance A fresh bin/up cluster runs Cilium (cilium status Ready); all existing platform NetworkPolicies still enforce; an app declaring allowedHosts:[api.example.com] blocks a non-allowlisted host and allows the allowlisted one; a no-allowedHosts app is rejected/defaulted per policy. ## Notes **Seam A (bin/up) AFTER HYB-1 + Seam B (overlay) AFTER RBAC-4 — last on both.** MIGRATION RISK: adopting Cilium on the already-live client platform is a CNI migration; validate on staging, then plan deliberate migration or re-germinate. HAZARD: must preserve cert-manager ACME DNS-01 egress (shared with POL-4). --- *Part of the **First Client Deploy → Governance** roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.*

plat added this to the Client Deploy → Governance Roadmap milestone

2026-07-01 02:03:48 +00:00

plat added the

goal

roadmap

horizon:governance

labels

2026-07-01 02:03:48 +00:00

plat added a new dependency

2026-07-01 02:04:47 +00:00

#24 /goal /ultracode-workflows [DOM-1a] public ACME TLS for the platform domain (letsencrypt-dns01 ClusterIssuer + public wildcard cert)

plat added a new dependency

2026-07-01 02:04:47 +00:00

#25 /goal /ultracode-workflows [HYB-1] harden the bare-k3s VPS germination path (two-step registries + tunnel cutover + public-edge-aware germinate)

plat added a new dependency

2026-07-01 02:04:47 +00:00

#31 /goal /ultracode-workflows [RBAC-4] retire the god-PAT — per-user delegated agent identity + per-app scoped read-only kube token

plat added a new dependency

2026-07-01 02:04:51 +00:00

#42 /goal /ultracode-workflows [POL-4] policy-govern the secrets + domains + network invariants

plat added a new dependency

2026-07-01 02:04:54 +00:00

#46 /goal /ultracode-workflows [GATE] validated grandchild acceptance gate — secrets+domains+rbac+policy on a VPS depth-2/3 platform

plat referenced this issue

2026-07-01 02:05:20 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47

plat referenced this issue from open-platform/app-template

2026-07-01 21:19:24 +00:00

DOM-2: allowedHosts egress allowlist in chart values #5

plat referenced this issue

2026-07-01 21:19:25 +00:00

DOM-2 [NO-GO / DO NOT MERGE]: germinate on Cilium CNI — evidence it breaks first-try germination #59

plat commented

2026-07-01 21:22:34 +00:00

Author

Owner

DOM-2 delivered as a SPLIT: the per-app FQDN-egress renderer is MERGED (mcp#10 + _app-template#5, default-off PLAT_FQDN_EGRESS, proven live on Cilium — allow/block correct, std netpols still enforce). The Cilium CNI SWAP is a documented NO-GO on current k3s/k3d (registry hostPort + kpr apiserver-cert blockers) — kept kube-router, prerequisite tracked in a new issue. The domain-defined-network capability is ready and lights up the moment the platform runs on Cilium.

plat closed this issue

2026-07-01 21:22:34 +00:00

plat referenced this issue

2026-07-02 02:21:34 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47