Networking and egress

RestoreTrust does not require an inbound connection to your cluster. The agent establishes an outbound, TLS-protected session, and each restore Job receives narrowly scoped egress to its configured backup source.

Required network paths

Restore Jobs do not need access to the RestoreTrust worker endpoint.

Backup source ports

For FTP, restrict the destination address even though the passive data port varies.

Egress policy model

The generated RBAC manifest creates restoretrust-job-egress-floor in the job namespace. It selects every Pod, denies ingress, and permits only DNS egress.

For each restore:

1. the worker resolves the configured source hostname inside your cluster;
2. it rejects addresses covered by built-in or customer-defined deny rules;
3. it pins the chosen address into the restore Pod;
4. it creates a NetworkPolicy that permits only that address and source port.

The per-execution policy is removed with its Job.

Protect internal ranges

The worker always denies loopback, link-local, unspecified, and the Kubernetes API address as source targets. Add your Pod, Service, management, and other protected ranges to the Deployment:

env:  - name: RT_JOB_EGRESS_CLUSTER_CIDRS    value: "10.96.0.0/12,10.244.0.0/16"  - name: RT_JOB_EGRESS_DENY_CIDRS    value: "10.0.0.0/24,192.0.2.0/24"

To permit sources only in approved ranges, add:

env:  - name: RT_JOB_EGRESS_ALLOW_CIDRS    value: "10.20.0.0/16,203.0.113.0/24"

When an allowlist is present, resolution outside it fails before a Job is created. See Configure a worker for update guidance.

Cluster DNS

The generated floor permits Pods labeled k8s-app: kube-dns in the kube-system namespace. This works for standard CoreDNS deployments.

If Pod /etc/resolv.conf points to NodeLocal DNSCache or another resolver address, add that address to the floor's to list before starting the agent:

egress:  - to:      - namespaceSelector:          matchLabels:            kubernetes.io/metadata.name: kube-system        podSelector:          matchLabels:            k8s-app: kube-dns      - ipBlock:          cidr: "<DNS_IPV4>/32"      - ipBlock:          cidr: "<DNS_IPV6>/128"    ports:      - protocol: UDP        port: 53      - protocol: TCP        port: 53

Remove the IPv4 or IPv6 entry if it does not apply. Keep the existing CoreDNS selector when your cluster uses both paths.

Optional egress admission

On Kubernetes 1.30 or newer, the console generates an optional admission policy. It denies additional or widened NetworkPolicies in the selected job namespace.

NetworkPolicy allowances are additive, so another policy could otherwise widen egress. Apply the admission manifest only after reviewing existing cluster-scoped policy with the same name.

Verify policy state

kubectl -n <JOB_NAMESPACE> get networkpolicykubectl -n <JOB_NAMESPACE> get networkpolicy restoretrust-job-egress-floor -o yamlkubectl -n <AGENT_NAMESPACE> logs deployment/restoretrust-k8s-agent --tail=100

During a check, you should also see one restoretrust-egress-... policy for its restore Pod. If DNS or source access fails, compare the resolved address in the agent or check logs with your allow and deny ranges, firewall rules, and CNI behavior.

DNS remains available to restore Pods. If your threat model requires DNS filtering or node-level egress controls, enforce those at the cluster or network layer.