docs(security): enforcementProbeHost must accept TCP :443 when egress is open (exit-7 false-pass caveat)

[saadqbal]

Docs-only follow-up from the v1.7.1 egress-enforcement check review (chart 1.7.1; client-runtime#104, shipped via #253 / #255 / #256).

Context

The helm test enforcement check (templates/egress-enforcement-check.yaml) decides "egress blocked" from curl's exit code: 7 (connection refused) and 28 (timeout) ⇒ TCP never established ⇒ "blocked → enforced → test passes".

The caveat

exit 7 also occurs when the probe host's :443 is closed/refusing. With the default enforcementProbeHost: 1.1.1.1 (443 always open) this is safe — only a real network block yields 7/28. But if an operator overrides enforcementProbeHost to a host whose :443 is not reachable when egress is allowed, the test would false-pass: report the lockdown enforced while training pods can still reach the internet — the exact false-sense-of-security #104 exists to prevent.

Ask (docs only, no code change)

• client/docs/SECURITY.md (§8.2) and the values.yaml comment for enforcementProbeHost: document that a custom probe host MUST accept TCP on :443 from outside the cluster (reachable whenever egress is allowed). Recommend keeping the default 1.1.1.1 unless there's a specific reason.
• Optionally note that only curl exit 28/7 count as "blocked".

Acceptance

• SECURITY.md §8.2 documents the probe-host :443-reachability requirement.
• values.yaml enforcementProbeHost comment notes the same.

Related

• client-runtime#104 (enforcement check), chart 1.7.1 (feat(egress-proxy): deploy-time egress-enforcement pre-flight (non-blocking) [client-runtime#104] #253/fix(egress-proxy): enforcement check probes TCP reachability, not HTTP code [#104] #255/fix(egress-proxy): probe reports DNS failure distinctly, not as a TCP connect [#104] #256)
• docs(security): EKS VPC-CNI NetworkPolicy is a §8.2 lockdown prerequisite + per-fleet egress pre-flight #248 (SECURITY-docs / CNI prerequisite — can be done in the same docs PR)