[INFRA][SECURITY] Community Test: Zero-Trust NetworkPolicy Enforcement on Calico / Cilium Clusters

[forgespectrayan]

🎯 Kubernetes Zero-Trust Network Security Validation

Per ADR-0034 §10, Spector enforces strict network plane separation:

• Public Plane (Ports 7700 / 7070): Accessible from Ingress/LoadBalancer.
• Internal Replication Plane (Port 9090): Private data plane for off-heap SIMD WAL transfers, strictly restricted to inter-node cluster communication.

Our Helm chart includes a NetworkPolicy template (deploy/helm/spector/templates/networkpolicy.yaml). We need community verification on network-policy-enforcing Kubernetes clusters (Calico, Cilium, Weave Net, or cloud-managed EKS/GKE).

---

📋 What to Test

1. Enable NetworkPolicy:
   • Set networkPolicy.enabled: true in deploy/helm/spector/values.yaml and deploy to a cluster with an active NetworkPolicy CNI.
2. Port Isolation Probes:
   • Verify external clients can hit port 7700 (Cortex UI) and port 7070 (API).
   • From an external or untrusted pod in the cluster, attempt to connect to port 9090 on spector-cell-owner-0 — it must be dropped/timed out.
   • Verify that owner and replica pods can communicate over port 9090 without interruption.

---

✅ Acceptance Criteria & Deliverable

• Document your CNI provider (Calico, Cilium, etc.) and verification results (e.g. nc -zv probes).
• Submit a PR with any needed rule refinements in deploy/helm/spector/templates/networkpolicy.yaml!