Clawdlinux Operator Security

Treat agent objectives and tool outputs as untrusted input. Review controls against your cluster configuration, not policy-object presence alone.

Egress Enforcement

networkPolicy.enabled defaults to true. The chart selects pods labeled app.kubernetes.io/part-of: agentic-operator in the release namespace. It allows configured internal dependencies, including DNS and LiteLLM, while denying other egress. Additional destinations require explicit configuration.

The cluster CNI must enforce Kubernetes NetworkPolicy. Optional Cilium FQDN policy requires Cilium and networkPolicy.cilium.enabled=true. Check namespace and label selection before testing allowed and denied traffic. Managed workload namespaces require separate policy application and matching labels. The Tenant reconciler does not consume spec.networkPolicy; apply tenant policies separately.

gVisor Isolation

Pods opt in with agentic.clawdlinux.org/runtime-sandbox: gvisor. The webhook sets runtimeClassName: gvisor unless the pod already selected another runtime. Nodes must have runsc; creating a RuntimeClass does not install it.

Strict enforcement requires the RuntimeClass and a Ready node capable of running it. Without a scheduling selector, mark confirmed nodes with agentic.clawdlinux.org/gvisor-ready: "true". best-effort explicitly permits an unsandboxed fallback.

Authorization And Secrets

Review tenant Roles and bindings before production use, including access to namespace Secrets. Use Kubernetes Secrets for credentials, restrict access with RBAC, and configure etcd encryption and API auditing. Kubernetes Events are not a Secret-access audit log.

The legacy direct-action path uses an in-process Go evaluator, not a Rego engine. Tool-profile enforcement exists in selected runtime paths, not universally.

The agentctl MCP surface is intended for external orchestration and uses configured bearer authentication. An empty token disables authentication. Individual actor identity propagation and full RBAC integration remain unconnected. Supplying LICENSE_JWT does not replace the open-source no-op license validator.

Evidence Limits

HMAC hash-chain and JSONL verification primitives exist. Automatic complete per-run signed evidence is not connected. These controls do not establish compliance certification.

See evidence boundaries and troubleshooting.