Security is top tier: close the cluster's open doors, then attack the forge from inside. The owner wants top-tier security. A security-engineer friend asked whether he could run a privileged: true pod.
Checked 11-09:
No pod is privileged or uses the host PID namespace. The forge pod mounts no Kubernetes token (automountServiceAccountToken: false), runs with hostUsers: false, drops ALL capabilities and has allowPrivilegeEscalation: false. Its namespace enforces baseline.
cells-test was labelled enforce=privileged. It's empty, and it's now restricted; a server dry-run of a privileged pod there is refused.
Nine namespaces had no pod-security label: backup, cnpg-system, default, flux-system, forgejo, mcp, plat-storage, plat-system and standby. They now carry warn and audit at baseline (not enforced).
Done when:
Enforce everywhere. Each of those nine namespaces enforces baseline or restricted, or has a written reason in docs/ops/ for what it needs (a hostPath, hostNetwork). Exceptions are narrowed to the one workload, and no namespace is left unlabelled. The label lives in the GitOps source so it can't drift.
A red-team run from inside the forge pod, recorded as findings. Each one gets a test that fails if the door reopens:
- app to forge: can an app process read the forge's data, its env (FORGE_EDGE_TOKEN), or another app's files or ports?
- agent sandbox escape: bwrap with procMount: Unmasked. Can a crew run reach outside its worktree, or the network beyond its allowlist?
- note or issue text as instructions: prompt injection into crew briefs (#10365 adds one test; widen it).
- forged identity headers: can anyone outside reach an app with x-forge-user headers that the proxy didn't strip?
A security page under ops: one line per control and its last check, following the P9 Calm rules.
Security is top tier: close the cluster's open doors, then attack the forge from inside. The owner wants top-tier security. A security-engineer friend asked whether he could run a
privileged: truepod.Checked 11-09:
automountServiceAccountToken: false), runs withhostUsers: false, drops ALL capabilities and hasallowPrivilegeEscalation: false. Its namespace enforcesbaseline.cells-testwas labelledenforce=privileged. It's empty, and it's nowrestricted; a server dry-run of a privileged pod there is refused.warnandauditatbaseline(not enforced).Done when:
baselineorrestricted, or has a written reason indocs/ops/for what it needs (a hostPath, hostNetwork). Exceptions are narrowed to the one workload, and no namespace is left unlabelled. The label lives in the GitOps source so it can't drift.- app to forge: can an app process read the forge's data, its env (
FORGE_EDGE_TOKEN), or another app's files or ports? - agent sandbox escape: bwrap withprocMount: Unmasked. Can a crew run reach outside its worktree, or the network beyond its allowlist? - note or issue text as instructions: prompt injection into crew briefs (#10365 adds one test; widen it). - forged identity headers: can anyone outside reach an app withx-forge-userheaders that the proxy didn't strip?