From 813c9230709988d1b2ec361b320893cfe5f90f9c Mon Sep 17 00:00:00 2001 From: Justin Klein Date: Wed, 14 Oct 2026 14:07:26 +0000 Subject: [PATCH] test(outline): does the install-test enforce policies at all? [EXPERIMENT, reverted next] The first experiment did not settle it. Restricting cyberchef's probe port 8080 to 192.0.2.11/32 - an address that cannot be the k3d node's - left the install-test GREEN, which has two very different causes: either k3s' policy controller exempts the kubelet's probe traffic (good news for this convention, whose default leaves the probe port open anyway), or it enforces nothing at all (no net under this rollout). This separates them without touching a probe. Outline's egress rule for DNS is removed, so the pod cannot resolve "postgres" or "redis" - and all three of its probes hit /_health, which checks both stores. Expected: RED, which proves egress is enforced. Green means nothing is enforced in CI and the scope has to be renegotiated. Reverted in the next commit either way. Part of #5 --- outline/templates/outline.networkpolicy.yaml | 28 ++++++++++++++------ 1 file changed, 20 insertions(+), 8 deletions(-) diff --git a/outline/templates/outline.networkpolicy.yaml b/outline/templates/outline.networkpolicy.yaml index 3be11b3..f37697c 100644 --- a/outline/templates/outline.networkpolicy.yaml +++ b/outline/templates/outline.networkpolicy.yaml @@ -140,15 +140,27 @@ spec: {{- end }} egress: {{- /* - DNS, unconditionally. There is no value to switch this off, and that is - deliberate: a knob whose only other setting breaks every name lookup in - the pod is a trap and not a feature. + TEMPORARY - THIS COMMIT IS AN EXPERIMENT AND IS REVERTED IN THE NEXT ONE. + + The DNS rule is REMOVED here on purpose. Everything about the scope of + Gitea #5 rests on the install-test enforcing NetworkPolicies, and the first + experiment did not settle it: restricting cyberchef's probe port to an + address that cannot be the node's left the install-test GREEN. That has two + possible causes and they are very different - either k3s' policy controller + exempts the kubelet's probe traffic, which would be good news for this + convention, or it enforces nothing at all, which would mean there is no net + under this rollout. + + This separates them, unambiguously and without touching a probe. Outline + resolves "postgres" and "redis" by name, and all three of its probes hit + /_health, which checks BOTH stores. With no DNS rule and policyTypes + Egress, every lookup fails. + + EXPECTED: the pod never becomes Ready, rollout status times out, the + outline install-test goes RED - which proves egress is enforced. + If it goes GREEN, nothing is enforced in CI and the scope of this issue has + to be renegotiated rather than pushed through. */}} - - ports: - - protocol: UDP - port: 53 - - protocol: TCP - port: 53 {{- /* Postgres. The port, not the host - outline.secrets.dbSecretRef carries a connection URL the chart never parses, so this is the STANDARD port and not