Kjell Tore Guttormsen
8dc3090080
Found by simulert v4.1 smoke — doc/code-drift in v4.1 ship: docs/observability.md claims "Cloud metadata endpoints (169.254.169.254) are permanently blocked" but the validator allowed them when VOYAGE_OTEL_ALLOW_PRIVATE=1. Cloud metadata services expose IAM credentials and instance secrets — operator-trust extended to RFC-1918 home-lab access does NOT extend here, because the blast-radius (cloud-account compromise) is qualitatively different. New HARD_BLOCKED_HOSTS set checked BEFORE the link-local opt-in path: - 169.254.169.254 (AWS / GCP / Azure metadata) - 100.100.100.200 (AliCloud metadata) - metadata.google.internal - metadata.azure.com New error code ENDPOINT_HARD_BLOCKED. Existing test for ENDPOINT_LINK_LOCAL_REJECTED on 169.254.169.254 updated to assert the new code; 3 new tests verify the hard-block holds even with VOYAGE_OTEL_ALLOW_PRIVATE=1, plus AliCloud + GCP-hostname coverage. Tests: 487 → 490 pass + 2 skipped. |
||
|---|---|---|
| .. | ||
| commands | ||
| fixtures | ||
| helpers | ||
| hooks | ||
| integration | ||
| lib | ||
| parsers | ||
| synthetic | ||
| validators | ||