From 31d37c97671f919cb825be374ba6405340576d54 Mon Sep 17 00:00:00 2001 From: Justin Klein Date: Wed, 14 Oct 2026 13:59:51 +0000 Subject: [PATCH] feat(cyberchef)!: NetworkPolicy, on by default Major, as every chart in this rollout is: networkPolicy.enabled defaults to true, so the object reaches running releases on the next upgrade. The simplest policy of the sweep, and the one to read first. CyberChef is a static web app - nginx serves files, the recipes run in the visitor's browser, the pod holds no state and calls nothing - so what the policy buys is the two CEILINGS rather than any source restriction: inbound is capped at 8080, the single port the pod declares, and outbound at DNS, which is as tight as the object goes without breaking name resolution. The 8080 rule carries no source selector by default, and that is deliberate rather than an oversight: 8080 is the port all three probes address, and the kubelet probes from the IP of the worker node running the pod, which no chart can know. Guessing it wrong leaves the pod permanently un-Ready, a symptom that reads as a broken application. Narrowing it is networkPolicy.probeSources, and the restricted branch then also carries the ingress controller - measured as the rke2-traefik DaemonSet in kube-system, which serves this chart's HTTPRoute as well, since the same Traefik backs the Gateway API here. Part of #5 --- cyberchef/Chart.yaml | 2 +- cyberchef/templates/NOTES.txt | 46 +++++ .../templates/cyberchef.networkpolicy.yaml | 167 ++++++++++++++++++ cyberchef/values.schema.json | 51 ++++++ cyberchef/values.yaml | 78 ++++++++ 5 files changed, 343 insertions(+), 1 deletion(-) create mode 100644 cyberchef/templates/cyberchef.networkpolicy.yaml diff --git a/cyberchef/Chart.yaml b/cyberchef/Chart.yaml index 05c1740..7b6dec9 100644 --- a/cyberchef/Chart.yaml +++ b/cyberchef/Chart.yaml @@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/gchq/CyberChef/master/src/web/static/ima type: application -version: 9.1.0+up11.4.0 +version: 10.0.0+up11.4.0 appVersion: "11.4.0" maintainers: diff --git a/cyberchef/templates/NOTES.txt b/cyberchef/templates/NOTES.txt index 21d0f91..1e4dd6d 100644 --- a/cyberchef/templates/NOTES.txt +++ b/cyberchef/templates/NOTES.txt @@ -108,3 +108,49 @@ cyberchef.env HAS NO EFFECT ON THE APP files, but the served CyberChef bundle is static and reads none of them — configuration has to happen in the browser. {{- end }} +{{- if .Values.networkPolicy.enabled }} + +NETWORKPOLICY IS ACTIVE — WHAT IT CAPS, AND WHAT IT DOES NOT + {{ .Release.Name }}-{{ .Chart.Name }}-networkpolicy selects this workload's pods. + Inbound: TCP 8080 only, the single port this pod declares. Outbound: DNS{{ with .Values.networkPolicy.egress }}{{ with .extraPorts }} + plus TCP {{ join ", " . }}{{ end }}{{ end }} — a static file server needs nothing more. + + Three limits belong in the same breath, because none of them is visible in + the object itself: + + - EGRESS IS BY PORT, NEVER BY DESTINATION. A NetworkPolicy matches CIDRs and + selectors and cannot express a hostname, so every egress rule permits its + port to ANY address. That is a limit of the object, not a shortcut — this + cluster's CNI (Canal: Flannel plus Calico) has no FQDN rule either. An + outbound port the chart does not know about is BLOCKED: add it to + networkPolicy.egress.extraPorts, and expect to find out through an + application-level connection error rather than through this object. +{{- if .Values.networkPolicy.probeSources }} + - THE PROBE PATH IS RESTRICTED in this release, because + networkPolicy.probeSources is set to + {{ join ", " .Values.networkPolicy.probeSources }} + Probes come from the IP of the WORKER NODE running the pod. If none of those + CIDRs covers the node this pod lands on, the kubelet's probes are dropped + and THE POD NEVER BECOMES READY — the rollout then times out and the symptom + looks like a broken application. Compare + + kubectl -n {{ .Release.Namespace }} describe pod -l app={{ .Release.Name }}-{{ .Chart.Name }}-deployment + + against `kubectl get node -o wide`. +{{- else }} + - THE PROBED PORT IS OPEN INSIDE THE CLUSTER. networkPolicy.probeSources is + empty, so that rule carries no source selector at all and any pod the CNI + routes to can reach it. Not from the internet — but this is NOT pod-level + isolation. Narrowing it means listing the worker node IPs in + networkPolicy.probeSources, because the kubelet probes from the node's own + address and the chart cannot know it; a wrong guess there leaves the pod + permanently un-Ready. +{{- end }} + - IT IS ONLY A BOUNDARY WHERE THE CNI ENFORCES POLICIES. Where it does not, + this object is accepted and filters nothing, so everything reads as + configured while nothing is filtered. `kubectl -n {{ .Release.Namespace }} get networkpolicy` + shows the object exists; only a connection attempt from an unrelated + namespace shows that it bites. + + Switch it off with networkPolicy.enabled: false. +{{- end }} diff --git a/cyberchef/templates/cyberchef.networkpolicy.yaml b/cyberchef/templates/cyberchef.networkpolicy.yaml new file mode 100644 index 0000000..5f95b85 --- /dev/null +++ b/cyberchef/templates/cyberchef.networkpolicy.yaml @@ -0,0 +1,167 @@ +{{- /* +NetworkPolicy for cyberchef (Gitea #5). + +CyberChef is a static web app: nginx serves files, the recipes run in the +visitor's browser, and the pod holds no state and talks to nothing. That makes +this the simplest policy in the repository and a good one to read first. + +What it is worth here is almost entirely the two CEILINGS rather than any +source restriction: only 8080 is reachable, and outbound traffic is capped at +DNS. The pod has no reason to open a single outbound connection - it serves +static files - so the egress cap is as tight as the object allows. Were this +image ever to gain a second listener, or were the container ever compromised, +neither could be reached or could reach out. + +The ingress direction is NOT restricted by source in the default, and that is +not an oversight: 8080 is the port all three probes address. See the probe note +on the rule below. + +WHAT THIS OBJECT IS: a ceiling on reachability, not an authentication layer. +Only the ports declared below are reachable at all - whatever else the process +binds, now or after the next app update, is blocked without anyone having to +notice it exists. + +WHAT IT IS NOT: + - EGRESS IS COARSE. A NetworkPolicy matches CIDRs and selectors and NEVER + hostnames, so "only to the database host" cannot be expressed at all. This + cluster's CNI is Canal (Flannel plus Calico for policy) and has no FQDN + rule; Calico's GlobalNetworkSet could express one but would bind this chart + to Calico, the same argument that kept implementation-specific objects out + of the Gateway-API sweep (#114). Each egress rule therefore permits its + PORT to any destination. + - NOT A BOUNDARY WHERE THE CNI DOES NOT ENFORCE ONE. An unenforced policy is + accepted by the API server and filters nothing, so everything reads as + configured while nothing is filtered. + - THE REASONING IS IN TEMPLATE COMMENTS, not in "#" comments: those are part + of the rendered object, travel into the cluster and appear in every release + diff. ci/run-networkpolicy-test.sh fails on a rendered "#". + +THE PORT NUMBERS BELOW ARE POD PORTS, NEVER NODEPORTS. A NetworkPolicy is +evaluated at the pod's network interface, after kube-proxy has already +translated a NodePort to the targetPort, so a NodePort number here would match +nothing while looking strict - and, being the only rule for that port, would +block every inbound connection instead. ci/run-networkpolicy-test.sh asserts +every port here against the containerPorts of the pod spec this policy +selects. +*/ -}} +{{- if .Values.networkPolicy.enabled }} +{{- $np := .Values.networkPolicy }} +{{- $ns := .Release.Namespace }} +{{- $probeSources := $np.probeSources | default list }} +{{- $allowedNs := $np.allowedNamespaces | default list }} +{{- $ic := $np.ingressController | default dict }} +{{- $routed := or .Values.ingress.enabled .Values.httpRoute.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ .Release.Name }}-{{ .Chart.Name }}-networkpolicy + labels: + app: {{ .Release.Name }}-{{ .Chart.Name }}-networkpolicy +spec: + {{- /* + Selects the Deployment's pods. ci/run-networkpolicy-test.sh fails if + this matches no pod spec of the same render - which is the mistake that + would otherwise leave a policy in the namespace filtering nothing, and + its usual cause is a label renamed in the workload template. + */}} + podSelector: + matchLabels: + app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment + policyTypes: + - Ingress + {{- /* + Egress is listed because there IS something to restrict, and here the + restriction is close to total: a static file server needs name resolution and + nothing else, so DNS is the only rule. That is as tight as this object can be + made without breaking the pod. + */}} + - Egress + ingress: + {{- /* + 8080 - the only port this pod declares, the one the Service targets, and the + one all three probes address. It is therefore the probe path, and the shape + below is the whole reason networkPolicy.probeSources exists. + */}} + - ports: + - protocol: TCP + port: 8080 + {{- if $probeSources }} + {{- /* + RESTRICTED, because the operator supplied probeSources. The kubelet's probes + come from the IP of the WORKER NODE running the pod, so that address has to be + in the list or the pod never becomes Ready - and a pod that is never Ready + reads as a broken application rather than as a policy. + + The ingress controller is added to the same rule, or the Ingress (and the + HTTPRoute - the same Traefik serves both here) goes dark the moment this list + is filled. + */}} + from: + - namespaceSelector: + matchLabels: + {{- /* + Set by Kubernetes itself on every namespace (>= 1.21), so this needs no + labelling work on a namespace this chart does not own. + */}} + kubernetes.io/metadata.name: {{ $ns }} + {{- if and $routed $ic.namespace }} + {{- /* + ONE from-entry with TWO selectors, which is an AND: pods carrying these labels + IN that namespace. Written as two list entries it would be an OR, and would + open the port to every pod in kube-system. + */}} + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: {{ $ic.namespace | quote }} + {{- with $ic.podLabels }} + podSelector: + matchLabels: + {{- toYaml . | nindent 14 }} + {{- end }} + {{- end }} + {{- range $allowedNs }} + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: {{ . | quote }} + {{- end }} + {{- range $probeSources }} + - ipBlock: + cidr: {{ . | quote }} + {{- end }} + {{- else }} + {{- /* + NO "from" SELECTOR, WHICH MEANS OPEN - deliberately, and only inside the + cluster, because this port carries no NodePort. The alternative was to guess + the worker node CIDRs, and a wrong guess blocks every kubelet probe: the pod + stays un-Ready, the rollout times out, and the cause looks like the + application. An empty "from: []" would be worse than either - it allows + everything too, but while reading as a restriction. Narrow it with + networkPolicy.probeSources. + */}} + {{- end }} + egress: + {{- /* + DNS, unconditionally. There is no value to switch this off, and that is + deliberate: a knob whose only other setting breaks every name lookup in + the pod is a trap and not a feature. + */}} + - ports: + - protocol: UDP + port: 53 + - protocol: TCP + port: 53 + {{- with $np.egress }} + {{- with .extraPorts }} + {{- /* + Ports only, to any destination - see the header. This is the operator's + escape hatch from the egress cap, and the only alternative to switching + the whole policy off. + */}} + - ports: + {{- range . }} + - protocol: TCP + port: {{ int . }} + {{- end }} + {{- end }} + {{- end }} +{{- end }} diff --git a/cyberchef/values.schema.json b/cyberchef/values.schema.json index 934bab5..6aace01 100644 --- a/cyberchef/values.schema.json +++ b/cyberchef/values.schema.json @@ -9,6 +9,57 @@ "description": "Helm's conventional cross-chart values. Unused by this chart, kept open so an umbrella install cannot break on it.", "type": "object" }, + "networkPolicy": { + "description": "The chart's NetworkPolicy (Gitea #5), on by default. A ceiling on reachability and not an authentication layer: only the declared container ports are reachable at all, egress is capped by PORT (a NetworkPolicy matches CIDRs and selectors, never hostnames, so a destination host cannot be expressed), and ingress is capped by source for every port no network probe touches. Only a boundary where the cluster's CNI enforces policies - an unenforced policy is accepted by the API server and filters nothing. The template's header carries the full list of what it does not do.", + "type": "object", + "additionalProperties": false, + "properties": { + "enabled": { + "type": "boolean" + }, + "allowedNamespaces": { + "description": "Namespaces whose pods may reach this workload, in addition to the release's own namespace, which is always allowed. Matched on the kubernetes.io/metadata.name label Kubernetes sets on every namespace itself, so no labelling work is needed - and no typo protection either: a name that does not exist matches nothing and is silently ineffective. An entry opens the port to EVERY pod in that namespace; for the ingress controller use ingressController instead.", + "type": ["array", "null"], + "items": { + "type": "string" + } + }, + "probeSources": { + "description": "Source CIDRs allowed to reach the port the network probes address. EMPTY MEANS OPEN, not blocked: with no entry that rule is rendered without a \"from\" selector. The kubelet's probes come from the IP of the worker node running the pod, an address the chart cannot know and must not guess - a guessed CIDR that excludes the real node blocks every probe and the pod never becomes Ready, which reads as a broken application rather than as a policy. Setting this restricts the rule, which is why the chart adds the own namespace, ingressController and allowedNamespaces to the same rule.", + "type": ["array", "null"], + "items": { + "type": "string" + } + }, + "ingressController": { + "description": "The ingress controller allowed to reach the routed port once probeSources restricts it; rendered only while ingress.enabled or httpRoute.enabled is true. The two keys become ONE \"from\" entry and are therefore an AND - pods carrying podLabels IN namespace - which is the whole point: the controller's namespace in allowedNamespaces would open the port to every pod in kube-system. The default is measured on this cluster (DaemonSet rke2-traefik in kube-system, which also serves the Gateway API here), not assumed; a policy written against the wrong controller is accepted, looks strict and silently blocks all web traffic.", + "type": ["object", "null"], + "additionalProperties": false, + "properties": { + "namespace": { + "type": ["string", "null"] + }, + "podLabels": { + "description": "Label set the controller's pods carry, rendered verbatim as a podSelector's matchLabels. Kept open because the chart does not interpret the keys.", + "type": ["object", "null"] + } + } + }, + "egress": { + "type": ["object", "null"], + "additionalProperties": false, + "properties": { + "extraPorts": { + "description": "Additional outbound TCP ports, to ANY destination - ports and not destinations, because a NetworkPolicy cannot express a hostname. DNS is always allowed and has no switch. Without an entry here an outbound port the chart does not already derive is blocked, which is the cap's whole purpose and also its upgrade risk.", + "type": ["array", "null"], + "items": { + "type": "integer" + } + } + } + } + } + }, "scaleDown": { "type": "boolean" }, diff --git a/cyberchef/values.yaml b/cyberchef/values.yaml index 1469dcc..b2113d0 100644 --- a/cyberchef/values.yaml +++ b/cyberchef/values.yaml @@ -125,3 +125,81 @@ httpRoute: # is how a migration from the Ingress runs: the HTTPRoute takes a second # hostname while the Ingress keeps ingress.domain. hostnames: [] + +# --------------------------------------------------------------------------- +# NetworkPolicy (Gitea #5). On by default. The reference implementation with +# the full reasoning is template-chart; the convention is in README, "Chart +# style guidelines", and the operator's view on this chart's wiki page. +# --------------------------------------------------------------------------- +networkPolicy: + # WHAT THIS POLICY ALLOWS: inbound 8080 only - the single port this pod + # declares - and outbound nothing but DNS. CyberChef is a static web app + # whose recipes run in the browser, so the pod has no reason to open an + # outbound connection at all, which makes the egress cap unusually tight. + # + # WHAT IT DOES NOT DO: the 8080 rule is NOT restricted by source in the + # default, because 8080 is the port all three probes address - see + # probeSources below. So this policy is a port and egress ceiling, not + # pod-level isolation. And it is only a boundary where the CNI enforces + # policies; unenforced, it is accepted and filters nothing. + enabled: true + # Namespaces whose pods may reach this workload, in addition to the release's + # own namespace, which is always allowed. Empty means: own namespace only. + # + # Matched on the "kubernetes.io/metadata.name" label Kubernetes sets on every + # namespace itself, so no labelling work is needed on a namespace this chart + # does not own - and no typo protection either: a name that does not exist + # matches nothing and is silently ineffective. Note the granularity: an entry + # opens the port to EVERY pod in that namespace. + allowedNamespaces: [] + # Source CIDRs allowed to reach port 8080, which is the port all three probes address. + # + # EMPTY MEANS OPEN, NOT BLOCKED. With no entry that rule is rendered WITHOUT a + # "from" selector, so the port is reachable from anywhere the CNI routes to - + # inside the cluster, since it carries no NodePort. + # + # That is the deliberate choice between two bad defaults. The kubelet's probes + # originate from the IP of the WORKER NODE running the pod, an address this + # chart cannot know and must not guess: a CIDR that excludes the real node + # blocks every probe, the pod never becomes Ready, the rollout times out, and + # the symptom reads as a broken application rather than as a policy. + # + # Narrow it by listing the worker node IPs (e.g. ["10.0.1.11/32"]) - and mind + # the companion trap: once this list is non-empty the rule IS restricted, so + # everything else that needs the port has to be in it. The chart adds the own + # namespace, the ingressController below and allowedNamespaces to the same rule for exactly that reason. + probeSources: [] + # The ingress controller allowed to reach the routed port once probeSources + # restricts it. Rendered only while ingress.enabled or httpRoute.enabled is true, and only in + # the restricted branch - with the default (open) rule the controller reaches + # the port anyway. The two keys become ONE "from" entry and are therefore an + # AND: pods carrying podLabels IN namespace. That is the point of having them + # at all - the controller's namespace in allowedNamespaces would open the port + # to every pod in kube-system. + # + # MEASURED ON THIS CLUSTER, NOT ASSUMED (2026-10-14): ingress-nginx is gone, + # the only IngressClass is "traefik" and it is the default, and the controller + # is the DaemonSet rke2-traefik in kube-system. The same Traefik serves the + # Gateway API here, so this one source covers the Ingress and the HTTPRoute + # path alike. A policy written against the wrong controller is accepted, looks + # strict, and silently blocks all web traffic - and ingress.className says + # nothing about it, because a class names an implementation, not the pods the + # traffic comes from. + ingressController: + namespace: kube-system + podLabels: + app.kubernetes.io/name: rke2-traefik + egress: + # Additional outbound TCP ports. DNS (UDP and TCP 53) is always allowed and + # has no switch - a knob whose only other setting breaks every name lookup + # in the pod is a trap, not a feature. + # + # PORTS, NOT DESTINATIONS, and that is a limit of the object rather than + # laziness: a NetworkPolicy matches CIDRs and selectors and never hostnames, + # so "only to the database host" cannot be written at all. Each entry + # permits its port to ANY destination. What the cap still buys is real: a + # compromised pod cannot open arbitrary outbound connections. + # + # Nothing is needed here for CyberChef itself. Add 443 only if something + # is put in front of the pod that has to call out. + extraPorts: []