refactor(proxy-init): remove obsolete enforce-drop mode

enforce-drop existed only because, before the transparent listener, a
REDIRECT had no receiver so DROP was the only fail-closed option. Now that
every proxy-sidecar/lite image ships the transparent listener,
enforce-redirect captures bypass egress instead of dropping it, and the
operator only emits enforce-redirect. enforce-drop is dead.

Remove the enforce-drop MODE (setup_enforce_drop + AB_EGRESS chain + the
dispatch + the mode-table/env-var/injection docs) and test-enforce-drop.sh.
The init script now accepts only redirect | enforce-redirect.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Hai Huang <huang195@gmail.com>

Author: huang195

authbridge/proxy-init/README.md

@@ -2,14 +2,13 @@
 
 The `proxy-init` container programs iptables rules for an
 AuthBridge-injected pod. It runs once at pod startup as a Kubernetes
-init container, then exits. It has three modes, selected by the `MODE`
+init container, then exits. It has two modes, selected by the `MODE`
 env var:
 
 | `MODE` | Used by | What it does |
 |---|---|---|
 | `redirect` (default) | `envoy-sidecar` | Transparently **REDIRECT**s pod traffic to the Envoy listeners. |
 | `enforce-redirect` | `proxy-sidecar`, `lite` | Fail-closed egress guard that **captures**: REDIRECTs external TCP that bypasses the forward proxy to AuthBridge's transparent listener; DROPs non-TCP external egress. |
-| `enforce-drop` | `proxy-sidecar`, `lite` | Fail-closed egress guard that **DROP**s any egress that bypasses the forward proxy. Predates `enforce-redirect`; retained as a no-transparent-listener fallback. |
 
 ## `redirect` mode (envoy-sidecar)
 
@@ -66,58 +65,22 @@ the Envoy path. IPv6 mirrors apply the same rules. See
 [`test-enforce-redirect.sh`](./test-enforce-redirect.sh), which proves
 the capture, the preemption, and the non-TCP drop via packet counters.
 
-`CLUSTER_CIDRS` has the same Kind-shaped default and OCP/EKS override
-requirement as documented under `enforce-drop` below.
-
-## `enforce-drop` mode (proxy-sidecar)
-
-In `proxy-sidecar` mode the workload is configured with `HTTP_PROXY`
-pointing at AuthBridge's forward proxy. On its own that is purely
-cooperative — an app that ignores `HTTP_PROXY` (or sets `NO_PROXY`)
-egresses directly and bypasses AuthBridge. `enforce-drop` closes that
-gap **without** transparently redirecting (you cannot REDIRECT raw
-traffic into a CONNECT forward proxy): it installs a fail-closed guard
-that DROPs any direct egress, forcing all external traffic through the
-proxy regardless of whether the app honors `HTTP_PROXY`.
-
-`init-iptables.sh` builds a dedicated `AB_EGRESS` chain hooked from
-**`mangle` OUTPUT at position 1**, with this order:
-
-1. `RETURN` ztunnel's own sockets (fwmark `0x539`) — keeps the mesh path working; a no-op when ambient is absent.
-2. `RETURN` the proxy's own re-originated egress (`--uid-owner $PROXY_UID`, default 1337).
-3. `RETURN` loopback (the app → proxy hop) and in-cluster CIDRs (`CLUSTER_CIDRS`, mesh/DNS).
-4. `DROP` everything else — direct external egress, including UDP (QUIC/HTTP-3).
-
-An IPv6 mirror drops external v6 egress (allowing loopback, link-local,
-the proxy UID, and `CLUSTER_CIDRS6`).
-
 > **`CLUSTER_CIDRS` is Kind-shaped by default.** The `10.0.0.0/8` default
 > covers Kind (pods `10.244.0.0/16` + services `10.96.0.0/16`). Other
 > distros differ — **OpenShift** uses services `172.30.0.0/16` and pods
 > `10.128.0.0/14`, and `172.30.0.0/16` is **outside** `10/8`, so the
 > default would drop in-cluster service traffic. On OCP/EKS/etc. you
 > **must** override `CLUSTER_CIDRS` with the cluster's real pod+service
 > ranges. The script logs the resolved value at startup, and the
-> operator wiring (follow-up PR) sets it from the cluster's CIDRs.
+> operator sets it from the cluster's CIDRs.
 
-> **`enforce-drop` intentionally ignores `OUTBOUND_PORTS_EXCLUDE`** (a
+> **`enforce-redirect` intentionally ignores `OUTBOUND_PORTS_EXCLUDE`** (a
 > `redirect`-mode knob). Any destination previously bypassed that way —
 > e.g. a direct LLM endpoint at `host.docker.internal:11434` — is now
-> dropped unless it goes through the forward proxy or falls within
-> `CLUSTER_CIDRS`. That is the point: `enforce-drop` closes direct-egress
-> holes. Operators relying on a bypass must route it through the proxy
-> (or, for in-cluster targets, include it in `CLUSTER_CIDRS`).
-
-**Why `mangle` OUTPUT, not `filter`:** when Istio ambient is active it
-installs an in-pod `nat OUTPUT` REDIRECT (`ISTIO_OUTPUT` → ztunnel
-`:15001`). The netfilter OUTPUT hook order is `raw → mangle → nat →
-filter`, so a DROP in `mangle` evaluates the original destination and
-fires **before** ambient's nat redirect can rewrite it; a DROP in
-`filter` would run after nat and be defeated. `-I 1` also places the
-chain ahead of Istio's appended (`-A`) mangle chain. This makes the
-guard robust with no ambient, in-pod ambient, or node-level ambient.
-See [`test-enforce-drop.sh`](./test-enforce-drop.sh), which proves the
-preemption via packet counters.
+> captured (external TCP) or dropped (external non-TCP) unless it falls
+> within `CLUSTER_CIDRS`. That is the point: `enforce-redirect` closes
+> direct-egress holes. Operators relying on a bypass for an in-cluster
+> target must include it in `CLUSTER_CIDRS`.
 
 ## iptables backend
 
@@ -129,18 +92,18 @@ whichever the host kernel exposes. Override with `IPTABLES_CMD` (and
 
 | Variable | Default | Mode | Purpose |
 |---|---|---|---|
-| `MODE` | `redirect` | all | `redirect` (envoy-sidecar), `enforce-redirect` or `enforce-drop` (proxy-sidecar) |
-| `PROXY_UID` | `1337` | all | UID of the AuthBridge sidecar process; exempted from redirect / drop |
+| `MODE` | `redirect` | all | `redirect` (envoy-sidecar) or `enforce-redirect` (proxy-sidecar / lite) |
+| `PROXY_UID` | `1337` | all | UID of the AuthBridge sidecar process; exempted from redirect |
 | `PROXY_PORT` | `15123` | redirect | AuthBridge outbound listener port |
 | `INBOUND_PROXY_PORT` | `15124` | redirect | AuthBridge inbound listener port |
 | `TRANSPARENT_PORT` | `8082` | enforce-redirect | AuthBridge transparent listener port; REDIRECT target for captured external TCP egress |
 | `OUTBOUND_PORTS_EXCLUDE` | (empty) | redirect | Comma-separated outbound port list to skip (e.g. `8080`) |
 | `INBOUND_PORTS_EXCLUDE` | (empty) | redirect | Comma-separated inbound port list to skip |
-| `POD_IP` | (required in `redirect`) | redirect | Set via Downward API; DNAT target for ambient-mesh inbound. Not used by `enforce-*`. |
-| `CLUSTER_CIDRS` | `10.0.0.0/8` | enforce-redirect, enforce-drop | Comma-separated in-cluster CIDRs allowed direct (pods/services/DNS) |
-| `CLUSTER_CIDRS6` | (empty) | enforce-redirect, enforce-drop | IPv6 in-cluster CIDRs (dual-stack); empty drops all external v6 egress |
+| `POD_IP` | (required in `redirect`) | redirect | Set via Downward API; DNAT target for ambient-mesh inbound. Not used by `enforce-redirect`. |
+| `CLUSTER_CIDRS` | `10.0.0.0/8` | enforce-redirect | Comma-separated in-cluster CIDRs allowed direct (pods/services/DNS) |
+| `CLUSTER_CIDRS6` | (empty) | enforce-redirect | IPv6 in-cluster CIDRs (dual-stack); empty drops all external v6 egress |
 | `IPTABLES_CMD` | auto-detected | all | Override iptables binary (`iptables-legacy` / `iptables-nft`) |
-| `IP6TABLES_CMD` | derived from `IPTABLES_CMD` | enforce-redirect, enforce-drop | Override ip6tables binary |
+| `IP6TABLES_CMD` | derived from `IPTABLES_CMD` | enforce-redirect | Override ip6tables binary |
 
 ## Required Kubernetes capabilities
 
@@ -164,17 +127,14 @@ in [`.github/workflows/build.yaml`](../../.github/workflows/build.yaml)).
 
 [`test-enforce-redirect.sh`](./test-enforce-redirect.sh) validates
 `enforce-redirect` mode in a private network namespace (`unshare --net`):
-it asserts the `AB_REDIRECT` rule structure, proves external TCP is
-captured to `TRANSPARENT_PORT` while preempting a simulated Istio ambient
-`nat OUTPUT` REDIRECT, and proves external UDP is dropped — all via packet
-counters. [`test-enforce-drop.sh`](./test-enforce-drop.sh) does the same
-for `enforce-drop` (asserts `AB_EGRESS` structure and the `mangle` DROP
-preemption). Both require root + iptables-nft on Linux (run on CI; not
+it asserts the `AB_REDIRECT` / `AB_NOTCP` rule structure, proves external
+TCP is captured to `TRANSPARENT_PORT` while preempting a simulated Istio
+ambient `nat OUTPUT` REDIRECT, and proves external UDP is dropped — all via
+packet counters. Requires root + iptables-nft on Linux (runs on CI; not
 macOS):
 
 ```sh
 sudo ./test-enforce-redirect.sh
-sudo ./test-enforce-drop.sh
 ```
 
 ## Where it gets injected
@@ -186,11 +146,8 @@ container automatically:
   `envoy-sidecar`.
 - `enforce-redirect` mode (`MODE=enforce-redirect`) when the resolved
   AuthBridge mode is `proxy-sidecar` / `lite` — the transparent listener
-  in those images receives the captured egress. _The operator wiring that
-  sets this lands in the companion kagenti-operator PR; this PR adds the
-  mode to the image and the transparent listener to the proxy._
-- `enforce-drop` mode (`MODE=enforce-drop`) — the drop-based fallback,
-  retained for environments without the transparent listener.
+  in those images receives the captured egress. This is always-on for
+  those modes (the operator injects it unconditionally).
 
 See
 [`authbridge/demos/weather-agent/demo-ui-advanced.md`](../demos/weather-agent/demo-ui-advanced.md)

authbridge/proxy-init/init-iptables.sh

@@ -141,16 +141,10 @@ set -e
 #                     In-cluster + loopback + proxy-UID traffic is left direct.
 #                     Nothing breaks for agents that ignore HTTP_PROXY — their
 #                     traffic is captured, not dropped. See setup_enforce_redirect().
-#   enforce-drop      — proxy-sidecar: a fail-closed egress guard that DROPs any
-#                     egress bypassing the proxy. Predates enforce-redirect;
-#                     retained for the no-transparent-listener fallback. The app
-#                     is configured with HTTP_PROXY pointing at AuthBridge's
-#                     forward proxy. Installs no REDIRECT and no inbound rules.
-#                     See setup_enforce_drop() below.
 MODE="${MODE:-redirect}"
 case "${MODE}" in
-  redirect|enforce-redirect|enforce-drop) ;;
-  *) echo "ERROR: unknown MODE='${MODE}' (expected: redirect | enforce-redirect | enforce-drop)" >&2; exit 1 ;;
+  redirect|enforce-redirect) ;;
+  *) echo "ERROR: unknown MODE='${MODE}' (expected: redirect | enforce-redirect)" >&2; exit 1 ;;
 esac
 
 # --- Auto-detect iptables backend ---
@@ -184,10 +178,11 @@ SSH_PORT="${SSH_PORT:-22}"
 OUTBOUND_PORTS_EXCLUDE="${OUTBOUND_PORTS_EXCLUDE:-}"
 INBOUND_PORTS_EXCLUDE="${INBOUND_PORTS_EXCLUDE:-}"
 
-# enforce-drop mode: in-cluster destinations the agent may reach directly
-# (pods / services / DNS) — everything else egressing the pod is dropped.
-# Defaults to the RFC1918 10/8 block which covers typical Kind pod (10.244/16)
-# and service (10.96/16) CIDRs; override with the cluster's actual ranges.
+# enforce-redirect mode: in-cluster destinations the agent may reach directly
+# (pods / services / DNS) — external TCP is REDIRECTed to the transparent
+# listener and external non-TCP is dropped. Defaults to the RFC1918 10/8 block
+# which covers typical Kind pod (10.244/16) and service (10.96/16) CIDRs;
+# override with the cluster's actual ranges.
 CLUSTER_CIDRS="${CLUSTER_CIDRS:-10.0.0.0/8}"
 CLUSTER_CIDRS6="${CLUSTER_CIDRS6:-}"   # IPv6 in-cluster CIDRs (dual-stack); empty = none
 
@@ -205,118 +200,23 @@ ISTIO_HEALTH_PROBE_SRC="${ISTIO_HEALTH_PROBE_SRC:-169.254.7.127}"
 # We use DNAT to the pod IP instead of REDIRECT to avoid needing route_localnet=1,
 # which would require a privileged init container (to write to read-only /proc/sys).
 # POD_IP is only needed by redirect mode (DNAT target for the ambient inbound
-# rule). enforce-drop does no DNAT, so it does not require it.
+# rule). enforce-redirect does no DNAT, so it does not require it.
 if [ "${MODE}" = "redirect" ] && [ -z "${POD_IP}" ]; then
   echo "ERROR: POD_IP environment variable is not set (required for redirect mode)." >&2
   echo "Set it via the Kubernetes Downward API (status.podIP) or manually." >&2
   exit 1
 fi
 
-# =============================================================================
-# enforce-drop mode (proxy-sidecar fail-closed egress guard)
-# =============================================================================
-#
-# proxy-sidecar configures the app with HTTP_PROXY=127.0.0.1:<forward-proxy>.
-# Unlike redirect mode we do NOT transparently REDIRECT — you cannot redirect
-# raw traffic into a CONNECT forward proxy. Instead we DROP any egress that
-# leaves the pod without going through the proxy, forcing all external traffic
-# through AuthBridge regardless of whether the app honors HTTP_PROXY.
-#
-# Placement — a dedicated chain hooked from *mangle* OUTPUT at position 1:
-#   * Istio ambient, when active, installs an in-pod `nat OUTPUT` REDIRECT
-#     (ISTIO_OUTPUT -> ztunnel :15001). The netfilter OUTPUT hook order is
-#     raw -> mangle -> nat -> filter, so a DROP in mangle evaluates the
-#     ORIGINAL destination and fires BEFORE ambient's nat redirect can rewrite
-#     it. A DROP in `filter` would run after nat and be defeated (dst already
-#     rewritten to 127.0.0.1). -I 1 also places us ahead of Istio's appended
-#     (-A) mangle ISTIO_OUTPUT chain.
-#   * Works identically with no ambient, in-pod ambient, or node-level ambient
-#     (in the node-level case our pod-netns rule runs before the packet ever
-#     reaches the host netns).
-#
-# Rule order in the chain: RETURN ztunnel's own sockets (fwmark 0x539, a no-op
-# when ambient is absent) -> RETURN the proxy's own egress (PROXY_UID) ->
-# RETURN loopback (app -> proxy) -> RETURN in-cluster CIDRs (mesh/DNS) ->
-# DROP everything else (direct external egress, incl. UDP/QUIC).
-setup_enforce_drop() {
-  CHAIN="AB_EGRESS"
-
-  echo "enforce-drop: installing fail-closed egress guard (mangle OUTPUT, chain ${CHAIN})"
-  echo "enforce-drop: exempt proxy UID=${PROXY_UID}; allowed in-cluster CIDRs=${CLUSTER_CIDRS}"
-
-  # --- IPv4 ---
-  ${IPT} -t mangle -N "${CHAIN}" 2>/dev/null || true
-  ${IPT} -t mangle -F "${CHAIN}"
-  # Replies to inbound connections (and related flows) are locally generated and
-  # also traverse OUTPUT — a reply is never a "bypass". Let established/related
-  # traffic through FIRST, so e.g. kubelet health-probe responses to an
-  # off-cluster node IP (in Kind the node is 172.18.0.0/16, outside CLUSTER_CIDRS)
-  # are not caught by the terminal DROP. Only NEW app-initiated flows are gated.
-  ${IPT} -t mangle -A "${CHAIN}" -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
-  # ztunnel's own sockets (ambient) carry fwmark 0x539 — let them through so the
-  # mesh/HBONE path keeps working. No-op when ambient is not installed.
-  ${IPT} -t mangle -A "${CHAIN}" -m mark --mark "${ZTUNNEL_MARK}" -j RETURN
-  # the AuthBridge proxy's own re-originated egress (must run as PROXY_UID).
-  ${IPT} -t mangle -A "${CHAIN}" -m owner --uid-owner "${PROXY_UID}" -j RETURN
-  # app -> proxy over loopback (HTTP_PROXY target), and any loopback traffic.
-  ${IPT} -t mangle -A "${CHAIN}" -o lo -j RETURN
-  ${IPT} -t mangle -A "${CHAIN}" -d 127.0.0.0/8 -j RETURN
-  # in-cluster traffic (pods / services / DNS) — carried by the mesh, not the proxy.
-  for cidr in $(echo "${CLUSTER_CIDRS}" | tr ',' ' '); do
-    [ -n "${cidr}" ] && ${IPT} -t mangle -A "${CHAIN}" -d "${cidr}" -j RETURN
-  done
-  # everything else == direct external egress that bypassed the proxy. Drop it.
-  # No -p filter, so UDP (QUIC/HTTP-3) is dropped as well as TCP.
-  ${IPT} -t mangle -A "${CHAIN}" -j DROP
-  # Hook at position 1 so we run before any appended Istio mangle chain and
-  # before nat OUTPUT.
-  if ! ${IPT} -t mangle -C OUTPUT -j "${CHAIN}" 2>/dev/null; then
-    ${IPT} -t mangle -I OUTPUT 1 -j "${CHAIN}"
-  fi
-  echo "enforce-drop: IPv4 egress guard configured"
-
-  # --- IPv6 ---
-  # Cluster is IPv4-only by default; until v6 cluster CIDRs are wired
-  # (CLUSTER_CIDRS6), drop external v6 egress while allowing: established/related
-  # replies, loopback, link-local unicast (fe80::/10) and link-local multicast
-  # (ff02::/16, which carries NDP neighbor/router solicitations and MLD), the
-  # proxy UID, and ztunnel's mark.
-  if command -v "${IP6T%% *}" >/dev/null 2>&1 && ${IP6T} -t mangle -L >/dev/null 2>&1; then
-    ${IP6T} -t mangle -N "${CHAIN}" 2>/dev/null || true
-    ${IP6T} -t mangle -F "${CHAIN}"
-    ${IP6T} -t mangle -A "${CHAIN}" -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
-    ${IP6T} -t mangle -A "${CHAIN}" -m mark --mark "${ZTUNNEL_MARK}" -j RETURN
-    ${IP6T} -t mangle -A "${CHAIN}" -m owner --uid-owner "${PROXY_UID}" -j RETURN
-    ${IP6T} -t mangle -A "${CHAIN}" -o lo -j RETURN
-    ${IP6T} -t mangle -A "${CHAIN}" -d ::1/128 -j RETURN
-    ${IP6T} -t mangle -A "${CHAIN}" -d fe80::/10 -j RETURN
-    ${IP6T} -t mangle -A "${CHAIN}" -d ff02::/16 -j RETURN
-    for cidr in $(echo "${CLUSTER_CIDRS6}" | tr ',' ' '); do
-      [ -n "${cidr}" ] && ${IP6T} -t mangle -A "${CHAIN}" -d "${cidr}" -j RETURN
-    done
-    ${IP6T} -t mangle -A "${CHAIN}" -j DROP
-    if ! ${IP6T} -t mangle -C OUTPUT -j "${CHAIN}" 2>/dev/null; then
-      ${IP6T} -t mangle -I OUTPUT 1 -j "${CHAIN}"
-    fi
-    echo "enforce-drop: IPv6 egress guard configured"
-  else
-    echo "enforce-drop: ip6tables unavailable — skipping IPv6 egress guard"
-  fi
-
-  echo "enforce-drop: fail-closed egress guard active"
-}
-
 # =============================================================================
 # enforce-redirect mode (proxy-sidecar fail-closed egress guard, capture variant)
 # =============================================================================
 #
-# Same intent as enforce-drop — force all external egress through AuthBridge
-# regardless of whether the app honors HTTP_PROXY — but instead of DROPping
-# bypass traffic, it CAPTURES it: external TCP is transparently REDIRECTed to
-# the forward proxy's transparent listener (TRANSPARENT_PORT), which recovers
-# the original destination via SO_ORIGINAL_DST and tunnels it through the same
-# outbound pipeline. Because nothing is dropped, agents that ignore HTTP_PROXY
-# keep working — this is what lets enforcement be always-on.
+# Forces all external egress through AuthBridge regardless of whether the app
+# honors HTTP_PROXY, by CAPTURING bypass traffic: external TCP is transparently
+# REDIRECTed to the forward proxy's transparent listener (TRANSPARENT_PORT),
+# which recovers the original destination via SO_ORIGINAL_DST and tunnels it
+# through the same outbound pipeline. Because nothing is dropped, agents that
+# ignore HTTP_PROXY keep working — this is what lets enforcement be always-on.
 #
 # Placement — a dedicated chain hooked from *nat* OUTPUT at position 1 (REDIRECT
 # is a nat-table target). Inserted before Istio's appended ISTIO_OUTPUT so we
@@ -330,7 +230,7 @@ setup_enforce_drop() {
 # TRANSPARENT_PORT -> DROP all other external egress (UDP/QUIC, so HTTP/3 can't
 # bypass; well-behaved clients fall back to TCP and get captured).
 #
-# Unlike enforce-drop there is no conntrack ESTABLISHED rule: nat only evaluates
+# The nat REDIRECT chain has no conntrack ESTABLISHED rule: nat only evaluates
 # the first packet of a flow, so replies and established connections are not
 # re-translated.
 # Two chains are needed because REDIRECT is a nat-table target but the nat table
@@ -438,16 +338,12 @@ setup_enforce_redirect() {
   echo "enforce-redirect: fail-closed egress capture active"
 }
 
-# Dispatch enforce-* modes here and exit; redirect mode falls through to the
+# Dispatch enforce-redirect here and exit; redirect mode falls through to the
 # transparent-interception logic below.
 if [ "${MODE}" = "enforce-redirect" ]; then
   setup_enforce_redirect
   exit 0
 fi
-if [ "${MODE}" = "enforce-drop" ]; then
-  setup_enforce_drop
-  exit 0
-fi
 
 # =============================================================================
 # OUTBOUND traffic interception (nat OUTPUT)