feat: narrow Traefik trusted range and restrict echo ingress to Traefik

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-03 16:15:28 +09:00
parent 98874b0c6c
commit 3af52bb66a
2 changed files with 69 additions and 6 deletions
@@ -28,15 +28,16 @@ spec:
          # traffic and Traefik sees a pod-network address rather than the
          # host nginx address.
          #
-          # Trusting the whole pod CIDR means any pod in the cluster could
-          # forge these headers. That is acceptable in this lab and is the
-          # reason a production setup would narrow it — see the trade-off
-          # section in docs/two-hop-proxy-header-contract.md.
+          # The node/host range is deliberately absent. Because svclb SNATs,
+          # the host nginx address never reaches Traefik — measured, not assumed.
+          # Trusting a range that cannot appear only widens the surface.
+          #
+          # Trusting the whole pod CIDR still means any pod in the cluster could
+          # forge these headers, which is why echo-network-policy.yaml restricts
+          # who may reach the application at all.
          trustedIPs:
            - 10.42.0.0/16
-            - 192.168.122.0/24
      websecure:
        forwardedHeaders:
          trustedIPs:
            - 10.42.0.0/16
-            - 192.168.122.0/24