coulomb/reef-railiance
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record Qonto egress enforcement failure

Browse source
This commit is contained in:
codex 2026-07-27 03:27:58 +02:00
parent 9ac0468cdf
commit 70f72e4a92
2 changed files with 13 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
WORK-RECORDS.md
View file

@ -21,7 +21,7 @@
| task | REEF-RAILIANCE-WP-0002-T04 | cancel | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md |
| task | REEF-RAILIANCE-WP-0002-T05 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md |
| task | REEF-RAILIANCE-WP-0002-T06 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md |
| task | REEF-RAILIANCE-WP-0003-T01 | progress | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
| task | REEF-RAILIANCE-WP-0003-T02 | todo | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
| task | REEF-RAILIANCE-WP-0003-T01 | done | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
| task | REEF-RAILIANCE-WP-0003-T02 | progress | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
| task | REEF-RAILIANCE-WP-0003-T03 | wait | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
| task | REEF-RAILIANCE-WP-0003-T04 | wait | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |

11
workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md
View file

@ -50,6 +50,17 @@ state_hub_task_id: "2a6742f1-6fcf-4164-b885-a7a9ea39521d"
Implement and verify FQDN-aware policy or a controlled egress proxy. Do not
substitute unrestricted HTTPS.
2026-07-27: Implemented a pinned Canonical Squid controlled-proxy candidate
that permits `CONNECT` only to exact host `thirdparty.qonto.com:443`, with
private-address exclusions and namespace/pod isolation policies. Repository
tests and Kubernetes server-side validation passed. Live probes did not:
allowlisted proxy access returned `000`, non-allowlisted access returned
`000`, and direct Qonto HTTPS unexpectedly succeeded despite namespace
default-deny. The candidate was removed from the live cluster and is not
included by the runtime Kustomization. T02 remains `progress` until
railiance01 NetworkPolicy enforcement is repaired and the three-way probe
proves allowlisted success, other-host denial, and direct-bypass denial.
## T03 - Deploy and verify rapp-qonto
```task