Does Ganeti live in the production cluster and therefore sit behind the firewalling that prohibits loading data into our analytics pipelines from Labs?

Yes, but it seems possible to me that the firewalls could be modified to support specific data flows.