Aleksei Sviridkin 70a675fd6b feat(cozystack-basics): gate GRPCRoute hostnames in tenant namespaces ...

The route hostname policy covered HTTPRoute and TLSRoute. GRPCRoute
carries spec.hostnames too, and it can reach a tenant Gateway: the
port-443 listeners pin allowedRoutes.kinds to HTTPRoute and TLSRoute,
but the port-80 listener leaves kinds unset, and an unset list resolves
to the kinds the listener protocol supports, which for HTTP includes
GRPCRoute. A GRPCRoute in a tenant namespace could therefore claim any
hostname on the plaintext listener with nothing checking it.

Tenants hold no gateway.networking.k8s.io RBAC, so this is the same
defence-in-depth against a chart bug that the other two rules are, not a
tenant-user control. The new rule is the HTTPRoute rule with grpcroutes
in place of httproutes and the single served version the bundle
provides; the coverage guard pins that list to the bundle like the
others.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-09-03 22:17:28 +03:00

..

e2e-apps

test(valkey): port e2e to chainsaw suite

2026-09-01 11:44:07 +04:00

e2e-chainsaw

feat(valkey): add managed Valkey service (#3380)

2026-09-02 18:18:42 +04:00

lib

docs(release): name all four sourcers of the image-ref enumeration

2026-08-14 18:37:59 +05:00

testdata

fix(migrations): make the unadopted-pools record publish best-effort

2026-08-25 12:38:28 +03:00

admin-kubeconfig-invariant.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

app-cleanup-hooks_test.bats

fix(apps): make the post-delete cleanup hooks report failure

2026-08-12 18:43:02 +03:00

bats-no-exit-trap.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

boilerplate.go.txt

Introduce cozystack-controller (#560)

2025-01-09 12:24:51 +01:00

build-matrix_test.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

build-matrix.sh

fix(build): force full image rebuild on root Go source changes

2026-06-25 10:21:05 +05:00

buildkitd.toml

ci(build): route PR base-image pulls through mirror.gcr.io

2026-06-24 23:17:25 +03:00

capture-dataplane.bats

test(e2e): capture host-netns address attribution and a healthy-pod reference

2026-08-09 14:42:19 +03:00

capture-previous-logs.bats

fix(e2e): preserve previous-log cap slots

2026-08-28 15:29:29 +05:00

cdi_golden_image_create.sh

[vm-default-images] Added new optional package

2026-04-14 19:59:19 +05:00

changelog-preserve.sh

ci(release): execute the release-changelog logic in tests, not just grep it

2026-07-24 11:34:17 +05:00

check-applicationdefinition-crd-ordering.bats

fix(platform): make *-rd sources depend on cozystack-engine

2026-06-24 22:43:56 +03:00

check-gpu-operator-variants.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

check-gpu-recording-rules.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

check-host-runtime.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

check-host-runtime.sh

fix(hack): wrap du in 'timeout 5s' to prevent preflight stall

2026-04-11 17:07:35 +03:00

check-kafka-rd-schema.bats

test(kafka): assert scalar boolean tls.enabled type in rd-schema check

2026-05-27 16:21:46 +03:00

check-kafka-rd-secrets.bats

test(kafka): add cluster-ca-cert checks to kafka-rd secrets bats test

2026-05-27 11:16:41 +03:00

check-migrations-target.sh

refactor(hack): replace ls|grep with pure-bash glob (shellcheck SC2010)

2026-07-14 13:08:54 +03:00

check-mongodb-rd-secrets.bats

fix(mongodb): declare the trust anchor with a TenantProjection

2026-09-01 11:20:32 +03:00

check-nats-rd-secrets.bats

test(nats): compare both tenant grant surfaces against their whole form

2026-08-15 22:40:58 +03:00

check-optional-repos.sh

Rename cozypkg to cozyhr

2025-12-25 16:54:22 +01:00

check-qdrant-rd-secrets.bats

test(qdrant): pin the tenant-visible Secret surface on both layers

2026-08-09 21:44:07 +03:00

check-rd-presets.sh

fix(hack): tighten resourcesPreset enum check

2026-05-12 03:04:48 +03:00

cilium-leak-healer_test.bats

fix(e2e): skip cilium-agent restart for the reserved:ingress IP variant

2026-06-30 19:40:47 +03:00

clickhouse-update-versions_test.bats

fix(clickhouse): fetch tags via skopeo and fail closed on a missing pin

2026-08-26 00:15:22 +03:00

cni-plugins-staging-contract.bats

feat(multus)!: stage reference CNI plugins from the multus image

2026-08-05 14:19:47 +03:00

codeowners-invariant.bats

test(codeowners): guard the coverage invariant with a unit check

2026-08-10 10:30:30 +02:00

collect-images.sh

[dx] Refactor collect-images functionality

2025-07-03 14:26:56 +03:00

common-envs_test.bats

test(hack): cover the default (non-export) build path (#3262)

2026-07-29 17:47:28 +05:00

common-envs.mk

fix(ci): gate release tags/pushes off under OCI_EXPORT_DIR (defense-in-depth)

2026-07-29 17:47:28 +05:00

cozyreport-summary.sh

fix(e2e): collect logs for unready pods and record truncated captures

2026-08-05 17:37:04 +03:00

cozyreport-talos.bats

fix(e2e): bound every remaining read in the report collector

2026-08-07 14:38:29 +03:00

cozyreport.bats

test(e2e): capture CertificateSigningRequests in cozyreport

2026-08-20 17:39:36 +03:00

cozyreport.sh

test(e2e): stop blocking merges on the tenant node-join deadline

2026-08-21 12:52:42 +03:00

cozystack-controller-secret-rbac.bats

test(cozystack-controller): guard the Secret grant by effective permission

2026-08-12 18:37:09 +03:00

cozystack-version-stamp.bats

test(platform): enforce go-forward version stamps route through the helper

2026-06-24 15:32:52 +03:00

cozytest-capture-gate.bats

fix(tests): report a data-plane capture cut short by its backstop

2026-08-08 17:08:54 +03:00

cozytest-trace-switch.bats

test(tests): keep trace switch suite ASCII-only

2026-08-28 15:31:22 +05:00

cozytest.sh

test(tests): keep trace switch suite ASCII-only

2026-08-28 15:31:22 +05:00

dcgm-default-counters.csv

fix(gpu-operator): pin upstream behavior changes; correct DLS licensing example

2026-04-30 14:52:56 +03:00

download-dashboards.sh

Add monitoring for NATs

2026-02-17 22:54:12 +01:00

downstream-trigger-map.bats

docs(agents): add downstream repository checklist to the PR template

2026-07-14 17:07:47 +03:00

e2e-capture-dataplane.sh

test(e2e): capture host-netns address attribution and a healthy-pod reference

2026-08-09 14:42:19 +03:00

e2e-capture-previous-logs.sh

fix(e2e): preserve previous-log cap slots

2026-08-28 15:29:29 +05:00

e2e-cilium-endpoint-leak-healer.sh

fix(e2e): stop the sandbox cluster CIDR overlapping the pod range

2026-08-11 02:31:27 +03:00

e2e-cilium-leak-healer.yaml

fix(e2e): skip cilium-agent restart for the reserved:ingress IP variant

2026-06-30 19:40:47 +03:00

e2e-ghcr-mirror.yaml

test(e2e): warm the ghcr.io mirror before the tenant suites need it

2026-08-14 11:08:49 +03:00

e2e-install-cozystack.bats

test(e2e): stop blocking merges on the tenant node-join deadline

2026-08-21 12:52:42 +03:00

e2e-node-join-soft-red.sh

test(e2e): stop blocking merges on the tenant node-join deadline

2026-08-21 12:52:42 +03:00

e2e-post-install-prep.sh

fix(e2e): budget each linstor wait separately in post-install-prep

2026-08-10 00:10:53 +03:00

e2e-prepare-cluster.bats

Merge branch 'main' into feat/kubernetes-nodes-phase2b

2026-08-19 13:14:11 +03:00

e2e-prepull-images.sh

test(e2e): pre-pull platform images via staged-busybox DaemonSet

2026-05-25 11:56:30 +05:00

e2e-runner-identity.sh

test(e2e): record the runner's SVM feature flags in the identity capture

2026-08-23 19:38:49 +05:00

e2e-talos-image-cache.yaml

test(e2e): make the talos image cache reachable by tenant workers (#3254)

2026-07-09 18:21:07 +05:00

e2e-test-openapi.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

etcd-probe_test.bats

test(etcd): stop losing the metrics probe's output to the attach race

2026-07-19 20:16:01 +03:00

gate-concurrency-contract.bats

fix(ci): put every label guard in lockstep, forks included

2026-08-14 18:37:57 +05:00

ghcr-mirror_test.bats

test(e2e): stop blocking merges on the tenant node-join deadline

2026-08-21 12:52:42 +03:00

helm-unit-tests.bats

fix(hack): fail when a chart runs no Helm unit test suites

2026-08-12 18:45:22 +03:00

helm-unit-tests.sh

fix(hack): fail when a chart runs no Helm unit test suites

2026-08-12 18:45:22 +03:00

image-pin-consistency.bats

fix(backupstrategy-controller): give chBackupClientImage a producer

2026-07-21 23:15:46 +05:00

issue-triage-contract.bats

feat(ci): auto-apply triage labels to issues

2026-08-12 16:35:36 +03:00

kubectl-wait-retry_test.bats

test(kubernetes): make kubectl_wait_retry set -e safe

2026-07-31 16:11:08 +03:00

kubernetes-md0-migration.bats

test(platform): cover migration 47 fail-closed contract

2026-06-30 12:08:18 +05:00

kubernetes-nodes-unpin-hook.bats

fix(kubernetes-nodes): unpin absence via --ignore-not-found

2026-07-25 02:07:43 +03:00

kubernetes-pre-delete-hook.bats

fix(apps/kubernetes): report the pre-delete cleanup outcome honestly

2026-08-07 06:49:56 +03:00

md-no-hardwrap.bats

feat(agents): add md-no-hardwrap hook enforcing the prose rule

2026-07-14 14:37:52 +03:00

migrate-to-version-1.0.sh

Fixed packages name conversion in migration script

2026-03-03 19:10:39 +05:00

migration-50-etcd-adopt.bats

feat(platform): make the etcd-adoption skip-backup hatch reachable

2026-07-20 11:29:09 +05:00

migration-54-redis-adopt.bats

test(migrations): cover migration 54 redis adopt (label+pin, CRD probe fail-closed)

2026-08-19 10:15:59 +02:00

migration-55-fluxcd-orphan.bats

feat(platform): orphan tenant FluxCD HelmReleases on upgrade

2026-08-20 13:37:09 +03:00

migration-56-adopt-path.bats

fix(migrations): record foreign-owner skips, harden record_skip, scope restamp to kubernetes- names

2026-08-25 13:28:58 +03:00

migration-56-adopt-values.bats

fix(migrations): discover pre-chartRef parents via inline spec.chart in the restamp

2026-08-25 13:50:14 +03:00

migration-seaweedfs-db-adopt.bats

test(seaweedfs): run the db-adopt migrations in the shell they ship with

2026-07-20 15:40:49 +05:00

monitoring-pvc-backfill-migration.bats

test(monitoring): reproduce the real vmselect cache PVC name in the backfill test

2026-07-08 22:27:42 +03:00

multus-install-cni-plugins.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

nightly-mirror_test.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

nightly-mirror.sh

fix(nightly): rewrite an image host that is the whole scalar value

2026-07-28 18:07:34 +02:00

node-join-soft-red_test.bats

test(e2e): stop blocking merges on the tenant node-join deadline

2026-08-21 12:52:42 +03:00

overlay-main-images_test.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

overlay-main-images.sh

fix(ci): preserve a PR's own edits to non-rebuilt package image refs

2026-06-30 16:56:33 +03:00

package-mk-phony.bats

test(hack): cover the .PHONY declarations this tree relies on

2026-08-14 01:25:34 +03:00

package.mk

fix(hack): declare the shared package targets phony

2026-08-12 18:42:58 +03:00

parse-rc-tag.sh

ci(release): dispatch changelog generation at rc time

2026-07-24 18:16:16 +05:00

pod-label-census_test.bats

fix(e2e): select catch pod logs by the nested release instance label

2026-08-05 16:46:50 +03:00

post-install-prep.bats

fix(e2e): budget each linstor wait separately in post-install-prep

2026-08-10 00:10:53 +03:00

pre-checks.sh

Fix osx grep have no -P flag (#438)

2024-10-21 11:59:56 +02:00

promote-gate-contract.bats

docs(hack): fix a wrong claim about grep-error propagation in two contract tests

2026-08-10 12:08:02 +03:00

promote-packages-artifact_test.bats

fix(release): preflight the rc tree's own pin before publishing

2026-08-14 18:37:58 +05:00

promote-packages-artifact.sh

fix(release): preflight the rc tree's own pin before publishing

2026-08-14 18:37:58 +05:00

promote-packages-contract.bats

test(release): pin every requiredBaseFiles entry, not just the list

2026-08-14 18:37:59 +05:00

promote-retag_test.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

promote-retag.sh

fix(ingress-nginx): pull the protobuf-exporter from the project namespace

2026-08-12 18:16:18 +02:00

promote-rewrite-tags_test.bats

feat(multus)!: stage reference CNI plugins from the multus image

2026-08-05 14:19:47 +03:00

promote-rewrite-tags.sh

test(ci): make the image-ref guards see split-host and unparseable files

2026-07-21 21:08:15 +05:00

promotion-retention-contract.bats

fix(release): stop a failed org package listing from exiting green

2026-08-14 18:37:59 +05:00

release-changelog-behaviour.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

release-changelog-contract.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

release-freeze-contract.bats

test(ci): extend the backport label contract to both spellings

2026-08-27 13:08:16 +05:00

remediation-guard.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

route-hostname-policy-version-coverage.bats

feat(cozystack-basics): gate GRPCRoute hostnames in tenant namespaces

2026-09-03 22:17:28 +03:00

run-kubernetes-block-io_test.bats

test(e2e): capture worker block IO and volume state on node-join failure

2026-08-17 14:22:09 +03:00

run-kubernetes-cpu-throttle_test.bats

test(e2e): anchor the phase-warning guard on its own unique phrase

2026-08-18 15:44:13 +03:00

run-kubernetes-drain_test.bats

test(e2e): fix post-merge seams the conflict markers missed

2026-07-08 18:06:22 +05:00

run-kubernetes-kvm-exits_test.bats

test(e2e): measure the sandbox kernel KVM exit counters across the node-join wait

2026-08-17 14:18:21 +03:00

run-kubernetes-network-counters_test.bats

test(e2e): measure tenant worker CPU as a rate, and the sandbox nodes under it

2026-08-15 10:19:19 +03:00

run-kubernetes-node-join_test.bats

test(e2e): stop blocking merges on the tenant node-join deadline

2026-08-21 12:52:42 +03:00

run-kubernetes-runner-canary_test.bats

test(e2e): stop blocking merges on the tenant node-join deadline

2026-08-21 12:52:42 +03:00

run-kubernetes-runner-cpu_test.bats

test(e2e): stop blocking merges on the tenant node-join deadline

2026-08-21 12:52:42 +03:00

run-kubernetes-sandbox-cpu-time_test.bats

test(e2e): measure tenant worker CPU as a rate, and the sandbox nodes under it

2026-08-15 10:19:19 +03:00

run-kubernetes-schedulable_test.bats

fix(e2e): bound the tenant failure diagnostics per read and as a phase

2026-08-09 02:51:06 +03:00

run-kubernetes-serial-console_test.bats

feat(kubernetes)!: manage worker pools as KubernetesNodes, adopt on upgrade (Phase 2, breaking) (#3315)

2026-08-26 12:06:18 +04:00

run-kubernetes-talos-diagnostics_test.bats

test(e2e): stop blocking merges on the tenant node-join deadline

2026-08-21 12:52:42 +03:00

run-kubernetes-talos-spec_test.bats

fix(e2e): wire the ghcr.io mirror into the tenant install and node-join flow

2026-08-09 16:17:44 +03:00

run-kubernetes-thread-cpu_test.bats

test(e2e): split the tenant worker CPU time across QEMU threads

2026-08-16 05:17:16 +03:00

runner-identity.bats

test(e2e): record the runner's SVM feature flags in the identity capture

2026-08-23 19:38:49 +05:00

sandbox-cidr-disjoint.bats

fix(e2e): stop the sandbox cluster CIDR overlapping the pod range

2026-08-11 02:31:27 +03:00

sandbox-runner-headroom.bats

fix(ci): give the nightly e2e runner headroom over its guest vCPUs

2026-08-15 02:41:19 +03:00

seaweedfs-guard-parity.bats

fix(seaweedfs): stop the naming guard guessing which volume generation holds the data

2026-07-20 15:40:48 +05:00

seaweedfs-naming-audit.bats

fix(seaweedfs): read the chart name first-match, fail the fake on unmodelled calls

2026-07-27 13:52:59 +05:00

seaweedfs-naming-audit.sh

fix(seaweedfs): read the chart name first-match, fail the fake on unmodelled calls

2026-07-27 13:52:59 +05:00

select-changelog-source.sh

ci(release): dispatch changelog generation at rc time

2026-07-24 18:16:16 +05:00

select-e2e_test.bats

fix(ci): correct two reachability defects in the selection graph

2026-08-16 10:44:44 +05:00

select-e2e.sh

fix(ci): correct two reachability defects in the selection graph

2026-08-16 10:44:44 +05:00

select-install_test.bats

fix(platform): make etcd-application depend on etcd-operator

2026-08-15 17:58:07 +05:00

select-install.sh

test(e2e): fold the clickhouse backup Tests into the app's own suite

2026-07-30 16:04:03 +04:00

talos-image-cache_test.bats

test(e2e): pin that an unanswered mirror lookup is not a mirror absence

2026-08-09 13:31:54 +03:00

talos-reconcile-heredoc_test.bats

test(e2e): drop the parent-chart heredoc cases removed by the Phase 2 split

2026-08-10 23:24:11 +03:00

tenant-pre-delete-hook.bats

fix(tenant): bound the pre-delete cleanup waits and the hook Job

2026-08-07 14:38:06 +03:00

update-codegen.sh

feat(cozystack-controller): extract application CA into a key-free tenant Secret

2026-07-21 23:59:48 +03:00

update-crd.sh

refactor(labels): remove cozystack.io/ui label

2026-01-19 13:59:29 +01:00

upload-assets.sh

[docs] Added openapi generation tool

2026-03-25 15:57:25 +05:00

upload-releasenotes.sh

Add AI-agent for changelogs generation

2025-11-26 20:18:43 +01:00

validate-changelog.sh

ci(release): fix second-round review findings

2026-07-24 11:34:17 +05:00

verify-promoted-packages_test.bats

test(release): cover the verifier's rc-reference scan guard

2026-08-14 18:37:59 +05:00

verify-promoted-packages.sh

docs(release): say what the gates actually guarantee

2026-08-14 18:37:58 +05:00