From b5f3c9af88843a02f37c6e1901a25f4450a8d4dc Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Sat, 18 Jul 2026 22:40:42 +0200 Subject: [PATCH] fix(security): block Hetzner metadata from pods --- docs/node-autoscaling.md | 9 ++++++++- .../cilium/cilium-clusterwide-network-policy.yaml | 9 +++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/docs/node-autoscaling.md b/docs/node-autoscaling.md index 6c20db701..1aff613b7 100644 --- a/docs/node-autoscaling.md +++ b/docs/node-autoscaling.md @@ -40,6 +40,11 @@ Cluster Autoscaler (dynamic workers, managed by KSail) generates the worker config secret (`cluster-autoscaler-config`), and manages the Talos snapshot lifecycle. Node pool configuration lives in `ksail.prod.yaml`, not in Flux manifests. +- **Metadata isolation** — the Hetzner overlay denies pod egress to the + instance metadata service (`169.254.169.254`) with + `require-mutual-auth`. This preserves Talos/host boot-time user-data access + while preventing workloads on autoscaled nodes from reading the reusable + worker machine config from IMDS. - **Storage architecture** — autoscaler nodes are **compute-only** (no Hetzner volume, no Longhorn storage). Static KSail workers have dedicated Hetzner volumes and serve as Longhorn storage nodes. Pods on @@ -54,7 +59,9 @@ Cluster Autoscaler (dynamic workers, managed by KSail) - `HCLOUD_CLOUD_INIT` — base64-encoded Talos worker machine config generated by KSail. 3. The server boots Talos, applies the machine config, and joins the cluster. -4. Once the node is Ready, pending pods are scheduled. +4. Once the node is Ready, pending pods are scheduled. A prod-only Cilium + cluster-wide deny policy blocks pod egress to Hetzner IMDS + (`169.254.169.254`) so workloads cannot read the user-data after boot. --- diff --git a/k8s/providers/hetzner/infrastructure/controllers/cilium/cilium-clusterwide-network-policy.yaml b/k8s/providers/hetzner/infrastructure/controllers/cilium/cilium-clusterwide-network-policy.yaml index 9581f16e1..940be031f 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/cilium/cilium-clusterwide-network-policy.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/cilium/cilium-clusterwide-network-policy.yaml @@ -78,3 +78,12 @@ spec: - {} authentication: mode: required + + # Deny pod egress to Hetzner IMDS. Autoscaler-created workers receive their + # Talos worker machine config through Hetzner user-data, and that config + # contains reusable cluster join material. Keep host/Talos boot-time metadata + # access intact, but prevent workloads from reading user-data after a node + # joins the cluster. + egressDeny: + - toCIDRSet: + - cidr: 169.254.169.254/32