jklein
813c923070
Validate Helm Charts / Detect changed charts (pull_request) Successful in 3s
Validate Helm Charts / Selector match (pull_request) Successful in 9s
Validate Helm Charts / HTTPRoute match (pull_request) Successful in 9s
Validate Helm Charts / Bump level (pull_request) Successful in 3s
Validate Helm Charts / YAML scalars (pull_request) Successful in 9s
Validate Helm Charts / Build cyberchef (pull_request) Successful in 5s
Validate Helm Charts / Resource quantities (pull_request) Successful in 10s
Validate Helm Charts / NetworkPolicy (pull_request) Failing after 10s
Validate Helm Charts / Trivy config cyberchef (pull_request) Successful in 14s
Validate Helm Charts / Build outline (pull_request) Successful in 5s
Validate Helm Charts / Build template-chart (pull_request) Successful in 5s
Validate Helm Charts / Trivy config outline (pull_request) Successful in 17s
Validate Helm Charts / Trivy config template-chart (pull_request) Successful in 15s
Install-test / Install-test cyberchef (pull_request) Successful in 1m9s
Install-test / Install-test outline (pull_request) Failing after 5m59s
Validate Helm Charts / Install-test (pull_request) Failing after 7m7s
The first experiment did not settle it. Restricting cyberchef's probe port 8080 to 192.0.2.11/32 - an address that cannot be the k3d node's - left the install-test GREEN, which has two very different causes: either k3s' policy controller exempts the kubelet's probe traffic (good news for this convention, whose default leaves the probe port open anyway), or it enforces nothing at all (no net under this rollout). This separates them without touching a probe. Outline's egress rule for DNS is removed, so the pod cannot resolve "postgres" or "redis" - and all three of its probes hit /_health, which checks both stores. Expected: RED, which proves egress is enforced. Green means nothing is enforced in CI and the scope has to be renegotiated. Reverted in the next commit either way. Part of #5