Network egress access control with untrusted intermediary

A method comprising:

• receiving, via an untrusted execution node, a network egress request from a container service within a cloud data platform;
• receiving a cryptographically signed egress policy associated with the network egress request;
• validating the network egress request against the cryptographically signed egress policy, the validating comprising forwarding Domain Name System (DNS) requests from the container service to an off-node DNS resolver including policy enforcement capabilities;
• establishing a determination of whether the network egress request complies with the cryptographically signed egress policy based on the validating;
• and
• granting or denying the network egress request based on the determination, the granting comprising proxying network traffic associated with the network egress request through an egress proxy that performs network address translation to route outbound and corresponding return traffic for the container service.

A machine-storage medium embodying instructions that, when executed by a machine, cause the machine to perform operations comprising:

• receiving a network egress request from a container service within a cloud data platform;
• receiving, via an untrusted execution node by a trusted service controller of the cloud data platform, a cryptographically signed egress policy associated with the network egress request;
• validating, by one or more hardware processors, the network egress request against the cryptographically signed egress policy, the validating comprising forwarding Domain Name System (DNS) requests from the container service to an off-node DNS resolver including policy enforcement capabilities;
• establishing a determination of whether the network egress request complies with the cryptographically signed egress policy based on the validating;
• and
• granting or denying the network egress request based on the determination, the granting comprising proxying network traffic associated with the network egress request through an egress proxy that performs network address translation to route outbound and corresponding return traffic for the container service.