From d3ef3729f87afd20ff2bf83afd6ba88c1eafff62 Mon Sep 17 00:00:00 2001 From: Justin Klein Date: Wed, 14 Oct 2026 14:00:11 +0000 Subject: [PATCH] test(ci): prove the install-test enforces NetworkPolicies [EXPERIMENT, reverted next] The scope of Gitea #5 - 29 charts at once, default on - rests on the claim that the install-test enforces policies, so a policy that blocks the probe path goes red in CI rather than silently in production. k3d is created without --disable-network-policy, but a flag read off a workflow file is not evidence. This commit restricts cyberchef's probe port 8080 to 192.0.2.11/32, an RFC 5737 documentation address that cannot be the k3d node's IP. The kubelet probes from the node's own address, so they are dropped and the pod must never become Ready. Expected: the cyberchef install-test goes RED on rollout status. If it goes green, policies are not enforced in CI and the scope has to be renegotiated. Reverted in the next commit either way. Part of #5 --- ci/cyberchef/test-values.yaml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/ci/cyberchef/test-values.yaml b/ci/cyberchef/test-values.yaml index 923c48d..e17f22b 100644 --- a/ci/cyberchef/test-values.yaml +++ b/ci/cyberchef/test-values.yaml @@ -28,6 +28,30 @@ ingress: # Ingress switch. domain: cyberchef.ci.local enabled: false + +# TEMPORARY - THIS COMMIT IS AN EXPERIMENT AND IS REVERTED IN THE NEXT ONE. +# +# The whole scope of Gitea #5 rests on one claim: that the install-test +# ENFORCES NetworkPolicies, so a policy which blocks the probe path goes red in +# CI instead of silently in production. k3d is created without +# --disable-network-policy, so k3s should bring its policy controller - but +# "should" read off a flag is not evidence, and 29 charts are about to be +# switched over on the strength of it. +# +# So: 192.0.2.11/32 is a documentation address (RFC 5737 TEST-NET-1). It is +# NOT the k3d node's IP and cannot be. Setting it restricts cyberchef's probe +# port 8080 to that one source, which means the kubelet's probes - which come +# from the node's own address - are dropped. +# +# EXPECTED: the pod never becomes Ready and `kubectl rollout status` times out, +# i.e. the install-test for cyberchef goes RED. +# +# If it goes GREEN instead, policies are not enforced in CI, the net under this +# rollout does not exist, and the scope has to be renegotiated rather than +# pushed through. +networkPolicy: + probeSources: + - 192.0.2.11/32 httpRoute: enabled: true # The Gateway does not exist in the CI cluster, and it does not need to: a