You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When combining remoteNamespace and remoteSelector in a single network.allow policy the generated netpol results in two separate peers. This effectively allows anything in the namespace ingress or egress rather than locking down to the specific pod.
mjnagel
changed the title
Network policies generated by operator separate namespace and pod selectors
Network policies generated by operator separate remote namespace and pod selectors
Jul 1, 2024
Environment
N/A
Steps to reproduce
When combining
remoteNamespace
andremoteSelector
in a singlenetwork.allow
policy the generated netpol results in two separate peers. This effectively allows anything in the namespace ingress or egress rather than locking down to the specific pod.Visual Proof (screenshots, videos, text, etc)
uds-core/src/pepr/operator/controllers/network/generate.ts
Lines 42 to 63 in de60e25
Severity/Priority
High - this results in incorrect policies, that tend to work for the end user so they may not notice the reduced security posture.
Additional Context
Fixing this will likely be a breaking change, although it is meant to be a bugfix (behavior should've been this already).
The text was updated successfully, but these errors were encountered: