Limiting external network access for apps

[TheTechArch]

Description

It will be supported to create client code in and app that could trigger calls against external APIs. We need to figure out how this call can go out of the cloud infrastructure and how credentials (secrets) can be assigned to that request.

Technical considerations

• How to handle credentials safe (handled in #1127)
• How can organizations managing outgoing firewall rules from their own Kubernetes Cluster

Acceptance criterea

• Firewalls opening is controlled

Tasks

• [ ] Analyze how the network setup can be set up to prevent general access to external API
• [ ] Analyze how the firewall can be controlled safely

[lvbachmann]

Reducing estimate as this works now - we just need to make sure it still works after restricting app's access to the Internet.

[TheTechArch]

Close this. No plan to add outgoing firewall

[ivarne]

So no protection for Log4j type issues?

[altinnadmin]

No plan to add outgoing firewall

@TheTechArch Has this been discussed with @alt-how? And is there a reason for why we're closing this now? This still sounds like a valuable capability to me.

[TheTechArch]

Keep it open for now to land on a possible implementation in the future for apps.

[nkylstad]

@altinnadmin @TheTechArch any thoughts on where this issue should live? I don't think altinn-studio repo is the right place 🤔

[altinnadmin]

I don't think altinn-studio repo is the right place

I agree.

Hmmm, I guess we currently do not have a dedicated backlog for our application infrastructure product... 🤔

@bengtfredh @SandGrainOne @Herskis Should we create a new repo/backlog?