Gitea #143. Five charts offer no networkPolicy.probeSources - their probes are
exec probes and put no packet on the network - so for them 169.254.7.127/32
would be an ipBlock that matches nothing, which is exactly the strict-looking
empty rule this script exists to catch. Assertion 7 now exempts them on the
absence of that value, the same conditionality assertion 4 and the overlay
guard already use, and records the exemption as a held assertion rather than
as silence.
Also names two limits of assertion 7 in its header: assertions 1, 3, 4 and 5
are not re-run on the switched-on render, and assertion 3's omission is the
interesting one - with probeSources empty, 15008 sits in a rule with no
"from" that neither of assertion 3's two justifications covers. Teaching it a
third would mean writing a rule against a guess, because where ztunnel dials
from cannot be settled until a namespace joins the mesh.
jklein
19a2c5e4a5