Aleksei Sviridkin fb740db0b0 docs(security): separate the fail-open Gateway-listener policy from the fail-closed route policies ...

The self-assessment summarised the whole hostname policy set as
fail-closed, while its own table row states that the Gateway-listener
policy passes a Gateway whose namespace carries no host label. Say
which policies are which. The port-443 kinds comment in the reconciler
test also tied the GRPCRoute admission rule to the port-80 listener;
the rule matches the kind wherever it attaches, and the port-443
exclusion is a least-privilege choice, not the reason the rule exists.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-09-04 01:18:07 +03:00

..

reports

docs(security): publish vulnerability reporting and a backlog reconciliation

2026-08-11 00:40:31 +05:00

incident-response.md

docs(security): fix the supported set at three lines and record that no backport rule exists

2026-08-10 21:55:37 +05:00

self-assessment.md

docs(security): separate the fail-open Gateway-listener policy from the fail-closed route policies

2026-09-04 01:18:07 +03:00

threat-model.md

docs(security): record GRPCRoute in the route hostname policy set

2026-09-03 22:17:29 +03:00