Mattia Eleuteri dde255b7af fix(securitygroups): project a membership-only group to a policy Cilium accepts ...

A SecurityGroup with attachments and no rules still needs its backing
CiliumNetworkPolicy, which carries the attachments the controller
reconciles. Its spec held only an empty ingress list: the CRD anyOf
accepts that, but the agent's api.Rule.Sanitize counts entries, so
Cilium 1.19 marks the policy Valid=False.

Write one empty ingress rule, which allows nothing, and disable default
deny in both directions so the rule does not isolate the member pods.
The policy is then valid and still changes nothing in the datapath. The
reverse projection recognises that exact spec, enableDefaultDeny
included, so the group still reads back with no rules while a
tenant-authored empty ingress rule keeps its default deny and stays
visible.

Fixes #5129

Assisted-by: LLM
Signed-off-by: Mattia Eleuteri <mattia@hidora.io>

2026-10-27 08:44:43 +01:00

..

apis

fix(securitygroups): project a membership-only group to a policy Cilium accepts

2026-10-27 08:44:43 +01:00

apiserver

refactor(api): keep each app's kind without the apimachinery fork

2026-09-26 16:08:24 +03:00

cmd/server

docs(api): clarify kind-wide Helm timeout overrides

2026-10-10 22:36:54 +03:00

config

docs(api): clarify kind-wide Helm timeout overrides

2026-10-10 22:36:54 +03:00

generated

chore(deps): move the Kubernetes libraries to v0.37.1

2026-09-26 16:08:25 +03:00

lineage

perf(lineage): cache owner GETs and short-circuit re-admission

2026-09-29 17:32:13 +02:00

ovnstatus

refactor: apply the Go 1.27 modernizers

2026-09-24 17:23:18 +03:00

registry

fix(securitygroups): project a membership-only group to a policy Cilium accepts

2026-10-27 08:44:43 +01:00

version

test(version): clear ambient COZYSTACK_VERSION in the unset case

2026-07-06 10:03:56 +05:00