{{- /* NetworkPolicy for minecraft-router (Gitea #5). The router is the one chart here whose whole job is to forward traffic to OTHER releases, so its egress rule is the interesting one and it is DERIVED from the routing table rather than guessed: server.backendPort, plus the per-mapping "port" override for every entry of mappings that has one. Add a backend on a non-standard port and the policy follows it, because both come from the same value. What it does NOT express is the destination. The mappings name hosts (internalUrl), and a NetworkPolicy matches CIDRs and selectors and never hostnames - so the rule permits those PORTS to any address, not those services. A backend in another namespace is reachable through this rule; so is anything else listening on 25565. Inbound splits in two: the proxy port is a NodePort and faces the internet, the API port is the probe path. WHAT THIS OBJECT IS: a ceiling on reachability, not an authentication layer. Only the ports declared below are reachable at all - whatever else the process binds, now or after the next app update, is blocked without anyone having to notice it exists. WHAT IT IS NOT: - EGRESS IS COARSE. A NetworkPolicy matches CIDRs and selectors and NEVER hostnames, so "only to the database host" cannot be expressed at all. This cluster's CNI is Canal (Flannel plus Calico for policy) and has no FQDN rule; Calico's GlobalNetworkSet could express one but would bind this chart to Calico, the same argument that kept implementation-specific objects out of the Gateway-API sweep (#114). Each egress rule therefore permits its PORT to any destination. - NOT A BOUNDARY WHERE THE CNI DOES NOT ENFORCE ONE. An unenforced policy is accepted by the API server and filters nothing, so everything reads as configured while nothing is filtered. - THE REASONING IS IN TEMPLATE COMMENTS, not in "#" comments: those are part of the rendered object, travel into the cluster and appear in every release diff. ci/run-networkpolicy-test.sh fails on a rendered "#". THE PORT NUMBERS BELOW ARE POD PORTS, NEVER NODEPORTS. A NetworkPolicy is evaluated at the pod's network interface, after kube-proxy has already translated a NodePort to the targetPort, so a NodePort number here would match nothing while looking strict - and, being the only rule for that port, would block every inbound connection instead. ci/run-networkpolicy-test.sh asserts every port here against the containerPorts of the pod spec this policy selects. */ -}} {{- if .Values.networkPolicy.enabled }} {{- $backendPorts := list (int .Values.server.backendPort) }} {{- range .Values.mappings }} {{- if .port }}{{- $backendPorts = append $backendPorts (int .port) }}{{- end }} {{- end }} {{- $np := .Values.networkPolicy }} {{- $ns := .Release.Namespace }} {{- $probeSources := $np.probeSources | default list }} {{- $allowedNs := $np.allowedNamespaces | default list }} {{- /* networkPolicy.ingress - the policy's INBOUND side, and not the same thing as networkPolicy.ingressController (the SOURCE SELECTOR for the ingress controller's pods, a SIBLING of it and no part of it) nor as the top-level .Values.ingress (the Ingress object). All three match a search for "ingress"; one round of this work already mistook the second for an inbound escape hatch on the strength of the substring. */}} {{- $npIngress := $np.ingress | default dict }} {{- /* NULL-SAFE ON PURPOSE (#99): ambientMesh is an OBJECT, so every read goes through a fallback reproducing THIS chart's declared defaults. An operator who deletes the object, or writes only "enabled: true", must land on the defaults and not in a nil dereference - #136 shipped exactly that defect one value away, where the NOTES.txt branch dereferenced .networkPolicy.egress directly. Clearing the probe-source list restores the constant rather than removing the ipBlock, deliberately: the two halves are not separable, and enabled: false is how you open nothing. */}} {{- $ambient := $npIngress.ambientMesh | default dict }} {{- $ambientEnabled := $ambient.enabled }} {{- $ambientPort := $ambient.port | default 15008 }} {{- $ambientProbeSources := $ambient.redirectedProbeSources | default (list "169.254.7.127/32") }} apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: {{ .Release.Name }}-{{ .Chart.Name }}-networkpolicy labels: app: {{ .Release.Name }}-{{ .Chart.Name }}-networkpolicy spec: {{- /* Selects the Deployment's pods. ci/run-networkpolicy-test.sh fails if this matches no pod spec of the same render - which is the mistake that would otherwise leave a policy in the namespace filtering nothing, and its usual cause is a label renamed in the workload template. */}} podSelector: matchLabels: app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment policyTypes: - Ingress {{- /* Egress is listed because the router's outbound traffic is exactly known for once - DNS, and the backend ports from its own routing table. That makes this one of the few egress caps in the sweep that is derived rather than guessed. */}} - Egress ingress: {{- /* THE PROXY PORT, and deliberately open with no "from" at all: it is published as a NodePort (server.outwardPort) and the senders are Minecraft clients on the internet. After NodePort masquerading the source address is a cluster node anyway, so a source selector here could only ever be a list of node IPs - which would be a restriction in appearance and a maintenance trap in fact. NOTE THE NUMBER: this is the POD port (server.port), not server.outwardPort. The NodePort is translated by kube-proxy before the packet reaches the pod, so writing 30565 here would match nothing while looking strict - and being the only rule for this port, it would block every player instead. ci/run-networkpolicy-test.sh asserts exactly this. */}} - ports: - protocol: TCP port: {{ .Values.server.port | int64 }} {{- /* THE API PORT - the router's own HTTP interface, and the port all three probes address. So it is the probe path and stays open inside the cluster by default. No ingress-controller entry: this chart renders no Ingress, and nothing should route to the router's API from outside. */}} - ports: - protocol: TCP port: {{ .Values.server.apiPort | int64 }} {{- if $ambientEnabled }} {{- /* FIRST HALF OF networkPolicy.ingress.ambientMesh (Gitea #143). 15008/TCP is ztunnel's HBONE tunnel, the port every inbound connection arrives on once the namespace carries istio.io/dataplane-mode - ambient "does not and will never bypass Kubernetes NetworkPolicy enforcement", so without it a pod in the mesh is simply unreachable. It is the one port here that is NOT a containerPort of the selected pod spec: ztunnel terminates it, not the application. ci/run-networkpolicy- test.sh therefore holds a NAMED exception for exactly this number, gated on exactly this value - and assertion 7 of that script proves, on a second render, that 15008 stays the ONLY such port and that it is absent while the value is false. AN ISTIO CONSTANT, NOT A STANDARD: 15008 is not registered with IANA for this, no protocol prescribes it, and Kubernetes knows nothing about it - Istio picked it for HBONE and Istio can change it. Hence a VALUE with a documented default rather than a literal here, so an operator can correct it without a chart release. Read for ztunnel 1.30.6. The exception ci/run-networkpolicy-test.sh grants is pinned to the number THAT TEST names, plus a check that this chart declares the same default - never to whatever the value says, because that would let a mistyped port ride in through a configurable field (design A of #143). NOT MEASURED: that 15008 alone suffices comes from Istio's documentation. Measured on this cluster is only which listeners ztunnel opens. Provable at the first namespace to join the mesh; none has. */}} - protocol: TCP port: {{ int $ambientPort }} {{- end }} {{- if $probeSources }} {{- /* RESTRICTED, because the operator supplied probeSources. The kubelet's probes come from the IP of the WORKER NODE running the pod, so that address has to be in the list or the pod never becomes Ready - and a pod that is never Ready reads as a broken application rather than as a policy. */}} from: - namespaceSelector: matchLabels: {{- /* Set by Kubernetes itself on every namespace (>= 1.21), so this needs no labelling work on a namespace this chart does not own. */}} kubernetes.io/metadata.name: {{ $ns }} {{- range $allowedNs }} - namespaceSelector: matchLabels: kubernetes.io/metadata.name: {{ . | quote }} {{- end }} {{- range $probeSources }} - ipBlock: cidr: {{ . | quote }} {{- end }} {{- if $ambientEnabled }} {{- /* SECOND HALF OF networkPolicy.ingress.ambientMesh, and the reason it is one value and not two. Inside the mesh the kubelet's probes are redirected and no longer arrive from the worker node's address: they arrive from 169.254.7.127. An operator who only opens 15008 by hand writes a policy that passes review - and the moment probeSources is non-empty every probe is dropped, the pod never becomes Ready, and the symptom reads as a broken application rather than as a policy. That is assertion 4 of ci/run-networkpolicy-test.sh one value further along. A switch whose halves can only be had together cannot be set halfway. Only in this branch, because this is the only branch with a "from" list: with no sources restricted the rule is open and needs no peer. The IPv6 counterpart is deliberately absent - this cluster is SingleStack IPv4, and an ipBlock of the wrong family is accepted and matches nothing. WHERE 169.254.7.127 COMES FROM - vendor magic, not protocol: it is LINK-LOCAL (169.254.0.0/16, RFC 3927), a range reserved for node-local use and never routed; Istio's IPv6 counterpart fd16:9254:7127:1337:ffff:ffff:ffff:ffff carries the SAME DIGITS plus 1337; and KUBERNETES DOES NOT KNOW THE ADDRESS - neither the NetworkPolicy API nor the kubelet - only Istio's data plane rewrites the probe source onto it. Read for ztunnel 1.30.6, and if Istio changes it THE FAILURE IS SILENT: probes dropped, and only where probeSources is non-empty, which is nowhere today. A LIST, not a string, and the one case where that does not contradict "a constant, not a configuration": a DUAL-STACK cluster needs BOTH entries at once. This cluster is SingleStack IPv4, so the IPv6 counterpart is left out - an ipBlock of the wrong family is accepted and matches nothing. Add it ALONGSIDE, never instead. UNPROVEN IN OPERATION: probeSources is empty in every chart here, so no release reaches this branch. CI proves its render, through the overlays in ci/networkpolicy. */}} {{- range $ambientProbeSources }} - ipBlock: cidr: {{ . | quote }} {{- end }} {{- end }} {{- else }} {{- /* NO "from" SELECTOR, WHICH MEANS OPEN - deliberately, and only inside the cluster, because this port carries no NodePort. The alternative was to guess the worker node CIDRs, and a wrong guess blocks every kubelet probe: the pod stays un-Ready, the rollout times out, and the cause looks like the application. An empty "from: []" would be worse than either - it allows everything too, but while reading as a restriction. Narrow it with networkPolicy.probeSources. */}} {{- end }} egress: {{- /* DNS, unconditionally. There is no value to switch this off, and that is deliberate: a knob whose only other setting breaks every name lookup in the pod is a trap and not a feature. */}} - ports: - protocol: UDP port: 53 - protocol: TCP port: 53 {{- /* THE BACKENDS, by port, derived from the routing table: server.backendPort plus the "port" override of every mapping that sets one. So a backend on a non-standard port is covered automatically, and there is no second list to keep in step with mappings. Ports and not destinations: the mappings name hosts (internalUrl) and this object cannot match a hostname, so this rule permits those ports to ANY address. That is wider than the routing table and is the honest description of what the object can do. */}} - ports: {{- range $backendPorts | uniq }} - protocol: TCP port: {{ . }} {{- end }} {{- with $np.egress }} {{- with .extraPorts }} {{- /* Ports only, to any destination - see the header. This is the operator's escape hatch from the egress cap, and the only alternative to switching the whole policy off. */}} - ports: {{- range . }} - protocol: TCP port: {{ int . }} {{- end }} {{- end }} {{- end }} {{- end }}