Aleksei Sviridkin d3322a8010 docs(api): document the SecurityGroup attachment model ...

Rewrite the SecurityGroup design doc for the targetRef projection:
selector derivation from lineage labels, the structural (not
selector-validated) RBAC boundary, and the additive-policy reality —
a SecurityGroup can only widen a managed application's allowed traffic,
never sever its platform-managed management plane, and equally cannot
tighten below the platform baseline. Records the deliberate caveats:
raw non-application pods are not targetable, and a targetRef to a
non-existent application matches zero pods rather than erroring.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-06-22 19:32:11 +03:00

..

apis

docs(api): document the SecurityGroup attachment model

2026-06-22 19:32:11 +03:00

apiserver

feat(sdn): wire SecurityGroup into the aggregated apiserver

2026-06-22 16:35:10 +03:00

cmd/server

feat(sdn): wire SecurityGroup into the aggregated apiserver

2026-06-22 16:35:10 +03:00

config

feat(api): add helm-upgrade-timeout annotation for asymmetric budgets

2026-06-22 09:48:26 +05:00

generated

feat(api): attach SecurityGroup to an application via targetRef

2026-06-22 19:32:10 +03:00

lineage

feat: Gateway API support via Cilium

2026-05-25 17:07:02 +03:00

ovnstatus

[kubeovn] Implement the KubeOVN plunger

2025-09-11 02:11:58 +03:00

registry

test(api): cover SecurityGroup targetRef projection

2026-06-22 19:32:10 +03:00

version

refactor(telemetry): split telemetry between operator and controller

2026-01-19 13:52:15 +01:00