Does Ganeti live in the production cluster and therefore sit behind the
firewalling that prohibits loading data into our analytics pipelines from
Labs?
Yes, but it seems possible to me that the firewalls could be modified to
support specific data flows.