Router /statusz exposes cross-tenant request log and worker pod IPs on ClusterIP Service #2275

This issue was generated as part of an AI review of pre-GA debug and diagnostic surfaces.

Problem Description

atenet-router serves an unauthenticated /statusz endpoint (HTML and ?format=json) on 0.0.0.0:4040 (cmd/atenet/internal/router/router.go:303-310, status.go:40-53, 101-153). Port 4040 is also published cluster-wide via the atenet-router Kubernetes Service (manifests/ate-install/atenet-router.yaml:354-357).

Impact

Any pod in the cluster can query http://atenet-router.ate-system.svc:4040/statusz without authentication and obtain:

1. Recent Query Ring (queries): The last 100 requests processed across all tenants (extproc.QueryRecorder):
   • Client: :authority header (actor name and atespace).
   • Host: Target host.
   • Path: Request URI path (query string stripped via redactPath, but path and API routes exposed).
   • Method: HTTP method.
   • Target: Upstream destination IP and port (e.g. workerIP:443), exposing private Kubernetes pod IPs of actor workloads.
2. Process Flags & Environment (flags, args): Full os.Args and every CLI flag value, disclosing internal certificate file paths, gRPC dial targets, and timing thresholds.
3. Cluster Topology: Router ClusterIP, namespace, Kubernetes API server version string, dependency health report, and actor parking statistics.

Architectural Interaction with GKE Gateway Health Checks

GKE Regional Internal L7 Gateway (gke-l7-rilb) requires a HealthCheckPolicy (networking.gke.io/v1) pointing to port: 4040, requestPath: /statusz because standard HTTP probes to port 80/8080 fail with 404 due to strict host header filtering in atenet-router.

Proposed Remediation

1. Add a --status-address flag to atenet-router defaulting to 127.0.0.1, keeping the rich dashboard off the flat pod network.
2. Remove port 4040 from the public Kubernetes atenet-router Service.
3. Provide a dedicated, lightweight /healthz endpoint on port 4040 (or the status port) that returns 200 OK without exposing the dashboard, flags, or query ring, and update the GKE HealthCheckPolicy to target /healthz.