Router dynamic xDS gRPC control plane runs plaintext on 0.0.0.0:18000 #2276

This issue was generated as part of an AI review of pre-GA debug and diagnostic surfaces.

Problem Description

In cmd/atenet/internal/router/router.go:91-98 and dataplane.go:91, the dynamic xDS Aggregated Discovery Service (ADS, CDS, LDS, RDS, SDS) is initialized on all interfaces:

lis, err := net.Listen("tcp", fmt.Sprintf(":%d", s.cfg.XdsPort))

Port 18000 (--port-xds=18000) is served over plaintext gRPC with no TLS and no authentication interceptors.

Impact

While Envoy in the same pod dials 127.0.0.1:18000, the server listens on 0.0.0.0. Any pod on the cluster network capable of reaching the atenet-router pod IP can connect to port 18000 and stream all dynamic xDS resources via ADS (discoverygrpc) or SDS (secretgrpc).

This exposes listener configurations, route tables, internal cluster endpoints, and secret metadata (including filesystem paths of certificates and trust bundles).

Proposed Remediation

In cmd/atenet/internal/router/dataplane.go:91, bind strictly to loopback:

lis, err := net.Listen("tcp", net.JoinHostPort("127.0.0.1", strconv.Itoa(s.cfg.XdsPort)))