It is possible to bypass the queue-proxy #6520
Description
/area networking
What version of Knative?
v0.11.0-125-gb8f7090cc
Expected Behavior
From within the cluster, it shouldn't be possible to connect directly to the user container and bypass the queue proxy for a revision.
I would expect that this would be prohibited, possibly via network policy.
Actual Behavior
Port 8080 of the user container is exposed and available
Note: this only works if the revision is scaled to 1 or more instances already
Steps to Reproduce the Problem
Deploy a knative service ("webapp" in my example)
get the PodIP
% kubectl get pods/webapp-mrpn8-deployment-6559dcff9b-c2pxx -oyaml | grep "podIP:"
podIP: 10.36.0.28
Able to (from on cluster) connect directly to port 8080 on that pod
# curl http://10.36.0.28:8080
<html>
<head>
<title>Hello there...</title>
</head>