Skip to content

ops(runbook): drain + sequencing procedure for flipping/rolling back the §8.2 egress lockdown #258

Description

@saadqbal

Operational runbook follow-up split out from the §8.2 egress lockdown work (client-runtime#102/#103/#104, chart 1.7.0/1.7.1). Gates the per-fleet lockdown flip.

Why

Enabling the lockdown per fleet flips egressProxy.routeWorkloads=true + networkPolicy.training.allowExternalHttps=false. From the 2026-06-12 dev-EKS incident:

  • Flipping routeWorkloads=true injects HTTPS_PROXY=egress-proxy-service:3128 into every training pod spawned during the window.
  • A later rollback/downgrade that removes the egress-proxy leaves those in-flight pods CrashLooping on a dead proxy (ProxyError: Failed to resolve 'egress-proxy-service').
  • jobs-manager consumes experiments from the queue once and does not re-spawn failed/deleted jobs — so disruption = lost runs, and kubectl delete job on a stuck job orphans the experiment.

Ask

Author a runbook (client/docs/runbooks/egress-lockdown-flip.md) covering:

  1. Pre-flip: drain in-flight training (quiet window / wait for active jobs) before enabling routeWorkloads on a shared cluster.
  2. Flip ordering: routeWorkloads=true → verify a training run routes via the gateway (squid TCP_TUNNEL) → allowExternalHttps=false → verify G2 (helm test).
  3. Rollback ordering: revert allowExternalHttps first, drain, then remove the gateway — never pull the egress-proxy out from under dependent pods. Recovery for already-CrashLooping pods: temporarily re-apply egress-proxy (configmap+service+deployment) so they resolve it and finish, then remove.
  4. Hard rule: never kubectl delete job a stuck training job (jobs-manager won't recreate it → orphaned experiment).

Acceptance

  • Runbook merged under client/docs/.
  • Referenced from SECURITY.md §8.2 and the v1.7.0 release "enabling the lockdown" steps.

Related

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Fields

No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions