fix(config): Harden production DaemonSet manifests - #416
Merged
Conversation
A production-readiness pass over config/ against the CIS Benchmark and Pod Security Standards flagged several gaps across galactic-cni, galactic-router, galactic-gateway, fabric-router, and vmtap-cni. This closes the mechanical ones. - dnsPolicy: ClusterFirstWithHostNet on every hostNetwork: true pod (cni, gateway, router, vmtap; fabric already had it) — without it a hostNetwork pod silently falls back to the host's own /etc/resolv.conf instead of cluster DNS, with no admission error, just a kubelet-log warning. - priorityClassName: system-node-critical on cni, gateway, router, and vmtap, matching fabric-router. galactic-cni in particular is more fundamental than any other node component: if evicted under node pressure, no pod (including the CNI's own peers) can schedule on that node at all. - capabilities.drop: ["ALL"] paired with every capabilities.add across cni, gateway, and router. Without an explicit drop, containers retain the runtime default capability set on top of whatever they actually add. - seccompProfile: RuntimeDefault at pod level on all five DaemonSets. - readOnlyRootFilesystem: true on every container across cni, gateway, router, and vmtap, verified none of the four binaries write anywhere outside their already-mounted hostPath volumes. - startupProbe on cni, router, and both gateway containers, reusing the existing gRPC health checks with a longer failureThreshold, since BPF map creation and GoBGP's cold start can outrun the short initialDelaySeconds on readinessProbe/livenessProbe and trigger a restart loop before the process finishes initializing. - Explicit updateStrategy: RollingUpdate maxUnavailable: 1 on cni, gateway, router, and vmtap, matching fabric. - pod-security.kubernetes.io/audit and /warn: baseline alongside the existing enforce: privileged on the galactic-system namespace, so drift now surfaces in events/audit logs instead of nowhere. - automountServiceAccountToken: false on vmtap-cni, which has no RBAC at all — internal/vmtap has no Kubernetes client, so mounting a ServiceAccount token there granted zero capability for no reason. - Every DaemonSet's actual listening ports are now declared explicitly via containerPort, even though hostNetwork: true makes this documentation rather than something Kubernetes enforces. Every BGP-speaking container previously had zero containerPort entries for its real BGP port, and galactic-cni's metrics port had no trace anywhere in the manifest at all. Making those ports explicit meant actually looking at the numbers, which surfaced two collision-prone defaults. galactic-router's metrics port moved from 8080 to 9179, next to its own grpc-health port (5179) instead of the generic controller-runtime default. galactic-router's grpc-health code default moved from 5000 to 5179: 5000 collides with Talos's /sbin/dashboard, macOS AirPlay Receiver, Flask's dev server, and Docker Registry, and every deployed manifest already had to override it for exactly that reason. galactic-cni's metrics port moved from 9091 (Prometheus Pushgateway's own reserved default) to 9180, next to galactic-router's 9179. Verified via kubectl kustomize on every affected kustomization, and task lint, task build, task test:unit. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
ecv
approved these changes
Aug 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A production-readiness review of the DaemonSet manifests against the CIS Benchmark and Pod Security Standards found gaps in privilege scoping, health/lifecycle probes, and namespace policy visibility across every node component. This closes the mechanical gaps and makes every container's actual listening port explicit, which surfaced two collision-prone port defaults, now fixed. A cluster-wide secrets-access finding is intentionally left open pending a separate design conversation.
Note
Split out from #413 (closed) to isolate this from the unrelated router graceful-shutdown fix, which shipped separately as #414.
Test plan
Related to #413