Repository navigation
Verify then fix: guest-reported IPs and tenant labels reach tenant attribution (#3339) #3690
Description
Question (owner decision needed, after a verification pass)
#3339 names two paths where a guest-controlled value is trusted for tenant attribution. Neither is verified on current main yet:
- Guest-reported IPs mapped to a tenant in network-policy planning, the traffic cache and readiness probes.
- Tenant-set labels propagated to telemetry attribution.
Step 1 (no decision needed): confirm each path on current main. A path that is already fixed is closed with evidence; a path still present is kept.
Step 2 (decision): for a confirmed guest-reported IP, the parked default was a hard failure per box. Confirm it, or choose the per-pass alternative.
Default if no answer: hard failure per box for an IP the host did not assign.
Acceptance criteria
- Step 1 result recorded on this issue for each path, with the file and line.
- For each confirmed path: a guest-supplied IP or label cannot change the tenant it is attributed to (test).
Part of #3339.
Activity
hsinatfootprintai commentedon Nov 12, 2026
Owner accepted the default for this question (go with defaults for all three, 2026-11-12). Proceeding under the default; a PR will state the default as applied.
hsinatfootprintai commentedon Nov 12, 2026
agent-ff167aad-haiku is starting processing it
hsinatfootprintai commentedon Nov 12, 2026
agent-ff167aad-haiku: step 1 verified. The ip_tenant path is confirmed present on main (network_policy_plan.go, guest-reported IP keyed into ip_tenant). Default applied in PR #3691 (opened at 29da405, CI pending: https://github.com/FootprintAI/Containarium/actions/runs/43249914770): attribution by host-known address only. Traffic-cache and readiness-probe paths not yet located; this issue stays open for them. Landing is /merge-steward's.
fix(security): host-known address attributes a box; guest address is …
test(netpolicy): static device address is per container in the fake i…
fix(security): ip_tenant attributes a box by its host-known address (F…