mengw15 commented on code in PR #8073: URL: https://github.com/apache/texera/pull/8073#discussion_r3959504979
########## bin/k8s/templates/base/jupyter-pool/jupyter-network-policy.yaml: ########## @@ -0,0 +1,48 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +{{- if and .Values.notebookMigrationService.enabled .Values.jupyterPool.networkPolicy.enabled }} +# Stops one user's JupyterLab from reaching another's. Users run arbitrary code in these +# pods, so a neighbour in the pool is the one genuinely hostile caller. Allowing every +# namespace but the pool's own denies pod-to-pod traffic inside it while leaving the real +# callers working: the notebook migration service, and the Envoy proxy wherever the gateway +# installation runs it. +# +# Defence in depth, not the authorisation boundary: the per-user Jupyter token is what stops +# one user reading another's notebooks. Egress is left alone, since notebooks legitimately +# install packages and call out. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ .Values.jupyterPool.name }}-deny-cross-user + namespace: {{ .Values.jupyterPool.namespace }} +spec: + podSelector: + matchLabels: + type: jupyter + policyTypes: + - Ingress + ingress: + - from: + # kubernetes.io/metadata.name is set automatically on every namespace, so this + # selects "any namespace but the pool's own" without labelling anything by hand. + - namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: NotIn + values: + - {{ .Values.jupyterPool.namespace }} Review Comment: The pool is not where arbitrary code most easily runs: the embedded notebook is read-only — the toolbar is hidden, the cells are frozen and the keyboard manager is disabled — while a Python UDF in a computing-unit pod is code execution by design, and `workflowComputingUnitPool.namespace` sits on the allowed side of this selector. The weaker neighbour is blocked and the stronger one is not. Unlike Envoy's namespace, the CU pool's is known to the chart, and nothing on the CU side talks to Jupyter — there is no reference to it anywhere in the computing-unit or engine code. Not blocking: adding `.Values.workflowComputingUnitPool.namespace` to the NotIn list would close that gap without having to know where the gateway runs. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
