bluejay/bluejay-infra
1
0
Fork 0
Code Issues Pull Requests 14 Actions Packages Projects Releases Wiki Activity

WIP: Tighten RemoteDesktop network policy isolation #15

Draft
bluejay wants to merge 1 commits from sprint39/cx-5-netpol-isolation into main
pull from: sprint39/cx-5-netpol-isolation
merge into: bluejay:main
Conversation 0 Commits 1 Files Changed 4 +190 -41
bluejay commented 2026-05-19 17:05:16 +00:00
Owner
Copy Link

Summary

  • tighten fc-desktop desktop-isolation egress to CoreDNS, intranet-web:5300, and noc1 step-ca 9000/9443 only
  • add guacd-desktop-egress so Guacamole display egress is limited to desktop pods on 5901/TCP
  • add infra lint coverage for desktop and guacd isolation contracts

Verification

  • targeted RemoteDesktopNetworkPolicyTests: 6/6
  • full bluejay-infra lint: 63/66; unrelated existing failures in fc-updater public method allowlist and github-runner init-container assumptions
  • live browser-only session 8a33d412-9bb0-4f32-9b5c-6ee6d0625eb8: 1.1.1.1 blocked, intranet-web:5300 OK, step-ca 9443 OK, guacd -> desktop 5901 OK
## Summary - tighten fc-desktop desktop-isolation egress to CoreDNS, intranet-web:5300, and noc1 step-ca 9000/9443 only - add guacd-desktop-egress so Guacamole display egress is limited to desktop pods on 5901/TCP - add infra lint coverage for desktop and guacd isolation contracts ## Verification - targeted RemoteDesktopNetworkPolicyTests: 6/6 - full bluejay-infra lint: 63/66; unrelated existing failures in fc-updater public method allowlist and github-runner init-container assumptions - live browser-only session 8a33d412-9bb0-4f32-9b5c-6ee6d0625eb8: 1.1.1.1 blocked, intranet-web:5300 OK, step-ca 9443 OK, guacd -> desktop 5901 OK
bluejay added 1 commit 2026-05-19 17:05:17 +00:00
Tighten RemoteDesktop network policies 2896b60d3c
bluejay changed title from Tighten RemoteDesktop network policy isolation to WIP: Tighten RemoteDesktop network policy isolation 2026-05-19 17:05:29 +00:00
This pull request is marked as a work in progress.
This branch is out-of-date with the base branch
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin sprint39/cx-5-netpol-isolation:sprint39/cx-5-netpol-isolation
git checkout sprint39/cx-5-netpol-isolation
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
bluejay
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: bluejay/bluejay-infra#15
Delete Branch "sprint39/cx-5-netpol-isolation"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?