jklein
36bcfd3b11
The part that carries the rollout of Gitea #5. 29 charts get a policy that is on by default, and every way one of them can be wrong is SILENT: the API server accepts a policy that filters nothing just as readily as one that filters everything, and neither is a render error, so neither the build nor a rollout sees it. ci/run-networkpolicy-test.sh holds every rendered NetworkPolicy against the pod specs, probes and Services of the SAME render: 1. the podSelector really matches a pod of that render - otherwise the object sits in the namespace, is listed by kubectl, reads as a boundary and filters nothing, usually because a label was renamed in another file; 2. every INGRESS port is a containerPort of the selected pods, which catches the NodePort mistake mechanically. Egress ports are deliberately excluded: an egress port belongs to the DESTINATION, and comparing it would fail every chart that reaches a database; 3. no ingress rule allows every source by accident. "from: []" always fails - it allows everything while reading as a restriction. A MISSING "from" is the documented open form and is accepted only where the render justifies it: every port of the rule is addressed by a network probe, or published by a NodePort Service. That is stricter than the plan's wording, which banned both forms, and it had to be, because the precedents use the second one on purpose; 4. the probe path. For every port a NETWORK probe addresses, the policy either leaves it unrestricted or the chart offers networkPolicy.probeSources AND says in NOTES.txt that a list missing the node's IP leaves the pod permanently un-Ready. exec probes are excluded by design - they run inside the container and put no packet on the network, which is exactly why valkey and minecraft-server can restrict their port by source with no probeSources at all. Two guards beyond the four: a chart that renders NO policy fails, because that is how this issue decayed in the first place - garage and keycloak were both created after #5 and both arrived without one. And a "#" comment inside a rendered policy fails, because it is part of the object and is shipped to the cluster. Helm is the parser through ci/yaml2json, as in the other render tests: the runners have neither pyyaml nor yq, and a hand-written parser could read nothing, find nothing and leave this green over a chart it never looked at. Every failure path was run, not just the green ones, and one of them earned its keep immediately: the probeSources check was a substring test, so a chart whose key had been deleted while the comment above it still discussed the value passed. It now looks for the key. Part of #5
31 lines
1.4 KiB
YAML
31 lines
1.4 KiB
YAML
# Overlay for the NetworkPolicy render test (Gitea #5), applied last.
|
|
#
|
|
# Its only job is to render a code path the chart's own defaults never reach:
|
|
# the SOURCE-RESTRICTED ingress rule. With probeSources empty - the default, and
|
|
# deliberately so - the probe port's rule carries no "from" at all, so the whole
|
|
# restricted branch of the template, the one containing the ingress-controller
|
|
# AND, the namespace list and the ipBlock peers, is never rendered and never
|
|
# checked. That branch is also the one with the expensive mistake in it: a
|
|
# namespaceSelector and a podSelector written as two list entries instead of one
|
|
# would be an OR, and would open the port to every pod in kube-system.
|
|
#
|
|
# ci/run-networkpolicy-test.sh FAILS a chart that has an overlay here and still
|
|
# renders no restricted rule. That guard is the point: without it the overlay
|
|
# could silently stop reaching the branch, and the test would stay green over a
|
|
# code path nobody entered.
|
|
#
|
|
# template-chart carries it rather than a real chart because it is installed
|
|
# nowhere (ci/excluded-charts.txt) - so the restricted form is exercised on
|
|
# every pull request with no release depending on these values.
|
|
networkPolicy:
|
|
# Not the real node addresses of any cluster; a documentation CIDR
|
|
# (RFC 5737 TEST-NET-1) so nobody can mistake these for something to copy.
|
|
probeSources:
|
|
- 192.0.2.11/32
|
|
- 192.0.2.12/32
|
|
allowedNamespaces:
|
|
- monitoring
|
|
egress:
|
|
extraPorts:
|
|
- 5432
|