Skip to content

feat(network): add opt-in sentinel isolation and strict policy profile - #837

Open
Baylem wants to merge 19 commits into
masterfrom
stack/pr-763
Open

feat(network): add opt-in sentinel isolation and strict policy profile#837
Baylem wants to merge 19 commits into
masterfrom
stack/pr-763

Conversation

@Baylem

@Baylem Baylem commented Nov 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Supersedes #763 using the same reviewed commits on an upstream branch, enabling GitHub's native stacking. Prior review discussion remains on that PR. Current-head CI passed.

Native stack, bottom to top: #837 → #838.

A sentinel currently receives namespace-wide access to game pods, while default probe/API-server allowances use broad private ranges. NetworkPolicies add their grants together, so per-server player rules do not narrow those exceptions.

Add module-controlled GameTemplate.spec.sentinelIsolation. Opted-in pods use owned policies for the same server's advertised protocol/port tuples; legacy chart grants exclude those sources and destinations. Templates that omit the field keep existing behavior. Add an opt-in strict chart profile requiring explicit kubelet CIDRs, probe ports and API-server CIDRs, with validation and migration guidance.

Closes #713.

Validation:

  • Operator production, controller test sources and E2E test sources compile for Linux amd64.
  • Added policy/ownership regressions, exact rendered policy-tuple checks, and a dedicated Cilium CI bucket exercising allowed/denied traffic, legacy-template opt-in, probes, heartbeats and API-to-agent access.
  • CRDs regenerated and canonical chart bundles synchronized. Actionlint and offline zizmor passed. Independent review completed; its Cilium node-CIDR finding is fixed.
  • Tests and cluster checks were not run locally, per repository policy.

Module defaults are adopted separately in GameplanePanel/module. Cilium installations with node-hosted API servers need the documented node-CIDR configuration. CI/profile changes overlap #840 and the resource-placement PR and should be retained together. Web/Compose image builds on this base need #759.

CI installs Trivy v0.74.0 directly from its official GitHub release with bounded retries and a pinned SHA-256 checksum. The existing vulnerability scans and failure gates remain enabled.

November 6 follow-up: All six affected standalone Go modules now select github.com/klauspost/compress v1.20.2 to fix GO-2026-6865. Module and workspace checksums are included. The patch was independently reviewed; standalone Linux builds, affected feature builds and controller regression-source compilation passed. Runtime tests and security scans run in CI under repository policy.

Current validation: all 104 main CI jobs passed on 1bfcce00 (CI run). All other applicable workflows passed.

Baylem added 15 commits October 21, 2026 11:25
@Baylem
feat(network): add template sentinel isolation and strict policy profile
4ae4173 
Signed-off-by: Baylem <zelathis@gmail.com>
@Baylem
merge: include shared web build prerequisite
72c77db 
Signed-off-by: Baylem <zelathis@gmail.com>
@Baylem
ci: require and report every audit E2E bucket
c936277 
Signed-off-by: Baylem <zelathis@gmail.com>
@Baylem
fix(e2e): distinguish policy verdicts from probe diagnostics
7afeb80 
Signed-off-by: Baylem <zelathis@gmail.com>
@Baylem
fix(ci): preserve audit coverage with upstream selection
afa3b52 
Signed-off-by: Baylem <zelathis@gmail.com>
@Baylem
test(ci): cover audit buckets in full selection fixtures
45c448f 
Signed-off-by: Baylem <zelathis@gmail.com>
@Baylem
test: synchronize closed RCON response fixtures
240126f 
Signed-off-by: Baylem <zelathis@gmail.com>
@Baylem
fix: preserve sentinel access through isolation opt-out
2a00660 
Signed-off-by: Baylem <zelathis@gmail.com>
@Baylem
chore: merge upstream namespace controls into isolation
bbbd632 
Signed-off-by: Baylem <zelathis@gmail.com>
@Baylem
test: distinguish wipe inventory from sentinel safety queries
911020b 
Signed-off-by: Baylem <zelathis@gmail.com>
@Baylem
chore: reconcile isolation CRDs with upstream Tailscale schemas
f4c8223 
Signed-off-by: Baylem <zelathis@gmail.com>
@Baylem
Merge upstream FRP dependency security fix
89b3bff 
Signed-off-by: Baylem <zelathis@gmail.com>
@Baylem
merge: synchronize network isolation with upstream master
d17729d 
Signed-off-by: Baylem <zelathis@gmail.com>
@Baylem
fix(ci): install pinned Trivy from GitHub releases
f209797 
Signed-off-by: Baylem <zelathis@gmail.com>
@Baylem
merge: share pinned Trivy installer with network isolation
0190a11 
Signed-off-by: Baylem <zelathis@gmail.com>
@coderabbitai

coderabbitai Bot commented Nov 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 37 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

Commits

Reviewing files that changed from the base of the PR and between 973aa12 and 1bfcce0.

Files ignored due to path filters: 7

  • agent/go.sum is excluded by !**/*.sum
  • api/go.sum is excluded by !**/*.sum
  • go.work.sum is excluded by !**/*.sum
  • mcp-server/go.sum is excluded by !**/*.sum
  • operator/go.sum is excluded by !**/*.sum
  • telemetry-receiver/go.sum is excluded by !**/*.sum
  • tunnel/go.sum is excluded by !**/*.sum
Files selected for processing: 50

  • .github/actions/install-trivy/action.yaml
  • .github/workflows/ci.yaml
  • .github/workflows/publish-edge.yaml
  • .github/workflows/release.yaml
  • agent/go.mod
  • api/go.mod
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_backups.yaml
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_backupschedules.yaml
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_clusters.yaml
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_gameservers.yaml
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_gametemplates.yaml
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_modules.yaml
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_modulesources.yaml
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_networkcaptures.yaml
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_restores.yaml
  • charts/gameplane/crd-manifests/gameplane.local_backups.yaml
  • charts/gameplane/crd-manifests/gameplane.local_backupschedules.yaml
  • charts/gameplane/crd-manifests/gameplane.local_clusters.yaml
  • charts/gameplane/crd-manifests/gameplane.local_gameservers.yaml
  • charts/gameplane/crd-manifests/gameplane.local_gametemplates.yaml
  • charts/gameplane/crd-manifests/gameplane.local_modules.yaml
  • charts/gameplane/crd-manifests/gameplane.local_modulesources.yaml
  • charts/gameplane/crd-manifests/gameplane.local_networkcaptures.yaml
  • charts/gameplane/crd-manifests/gameplane.local_restores.yaml
  • charts/gameplane/templates/networkpolicies.yaml
  • charts/gameplane/templates/validate.yaml
  • charts/gameplane/values.yaml
  • charts/tests/check_network_isolation.py
  • deploy/kind/e2e.sh
  • docs/module-authoring.md
  • docs/networking.md
  • hack/ci_scope.py
  • hack/test_ci_scope.py
  • mcp-server/go.mod
  • operator/api/v1alpha1/gametemplate_types.go
  • operator/config/crd/gameplane.local_gametemplates.yaml
  • operator/go.mod
  • operator/internal/controller/gameserver_controller.go
  • operator/internal/controller/gameserver_sentinel.go
  • operator/internal/controller/gameserver_wipe_inventory_test.go
  • operator/internal/controller/sentinel_isolation.go
  • operator/internal/controller/sentinel_isolation_test.go
  • operator/specs.md
  • telemetry-receiver/go.mod
  • test/e2e/buckets.sh
  • test/e2e/ci_selection_e2e_test.go
  • test/e2e/network_isolation_e2e_test.go
  • test/e2e/specs.md
  • test/e2e/suite-components.json
  • tunnel/go.mod
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@Baylem Baylem added area: chart Helm chart and deployment area: e2e kind-based end-to-end suite area: modules game template OCI bundles area: operator controller-runtime operator and CRDs area: shared netguard, gameaction, gameproto, svcutil and other shared packages area: web React dashboard type: feature New capability or user-facing addition labels Nov 5, 2026 — with ChatGPT Codex Connector
@Baylem
Baylem added this pull request to stack #842 November 5, 2026 03:57
This was referenced Nov 5, 2026
Closed
Open
@github-actions

github-actions Bot commented Nov 5, 2026 •
edited
Loading

Copy link
Copy Markdown

CI Report - 1bfcce0

run 42180083901 - attempt 1

0 failed - 33 passed - 0 skipped - 159m14s elapsed

Test selection: full (selection-rule change) - per-suite table

Coverage

Module Measured Gate Margin
web L95.93 S94.44 B89.33 F91.9 L92 S92 B82 F76 +2.44

Changed

Area Files +/-
operator/ 10 +402/-5
test/ 5 +248/-5
charts/ 22 +123/-25
docs/ 2 +69/-0
.github/ 4 +41/-12
deploy/ 1 +37/-2
hack/ 2 +13/-2
api/ 2 +3/-3
mcp-server/ 2 +3/-3
tunnel/ 2 +3/-3
agent/ 2 +3/-2
telemetry-receiver/ 2 +3/-2
(root) 1 +1/-0

Slowest jobs

Job Duration
e2e telemetry / arm64 (kind) 23m24s
e2e telemetry / amd64 (kind) 22m49s
build e2e images 16m59s
e2e capture overhead (kind) 12m21s
e2e web live / amd64 (kind) 12m0s

e2e buckets run

api-agent, api-auth, api-mods, api-rbac, api-roles, bot-fast, management-placement, multicluster, operator, optional-components, postgres-availability, ratelimit, telemetry, upgrade

@Baylem
Baylem marked this pull request as ready for review November 6, 2026 06:56
@Baylem
Baylem requested a review from ValgulNecron as a code owner November 6, 2026 06:56
@Baylem
fix(deps): update compress for GO-2026-6865
6045280 
Select github.com/klauspost/compress v1.20.2 in all six affected standalone module graphs, including transitive consumers, and refresh their checksums.

Signed-off-by: Baylem <zelathis@gmail.com>
Baylem added 3 commits November 6, 2026 02:14
@Baylem
Merge shared compress advisory fix into network isolation
93293a3 
Signed-off-by: Baylem <zelathis@gmail.com>
@Baylem
fix(deps): retain workspace graph checksum
9391601 
Keep the historical compress go.mod checksum required when loading transitive workspace module metadata. The selected compress source remains v1.20.2.

Signed-off-by: Baylem <zelathis@gmail.com>
@Baylem
Merge shared workspace checksum into network isolation
1bfcce0 
Signed-off-by: Baylem <zelathis@gmail.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ValgulNecron ValgulNecron Awaiting requested review from ValgulNecron ValgulNecron is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

area: chart Helm chart and deployment area: e2e kind-based end-to-end suite area: modules game template OCI bundles area: operator controller-runtime operator and CRDs area: shared netguard, gameaction, gameproto, svcutil and other shared packages area: web React dashboard type: feature New capability or user-facing addition

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Narrow probe and apiserver exceptions and isolate sentinel-to-game traffic per server

1 participant

@Baylem