Mattia Eleuteri dde255b7af fix(securitygroups): project a membership-only group to a policy Cilium accepts ...

A SecurityGroup with attachments and no rules still needs its backing
CiliumNetworkPolicy, which carries the attachments the controller
reconciles. Its spec held only an empty ingress list: the CRD anyOf
accepts that, but the agent's api.Rule.Sanitize counts entries, so
Cilium 1.19 marks the policy Valid=False.

Write one empty ingress rule, which allows nothing, and disable default
deny in both directions so the rule does not isolate the member pods.
The policy is then valid and still changes nothing in the datapath. The
reverse projection recognises that exact spec, enableDefaultDeny
included, so the group still reads back with no rules while a
tenant-authored empty ingress rule keeps its default deny and stays
visible.

Fixes #5129

Assisted-by: LLM
Signed-off-by: Mattia Eleuteri <mattia@hidora.io>

2026-10-27 08:44:43 +01:00

..

apps

chore(deps): roll up pending Renovate updates and move to Go 1.27.1 (#4447)

2026-09-26 10:17:29 +04:00

core

refactor: apply the Go 1.27 modernizers

2026-09-24 17:23:18 +03:00

sdn

fix(securitygroups): project a membership-only group to a policy Cilium accepts

2026-10-27 08:44:43 +01:00