Skip to content

feat: Embed NetworkPolicy to extensions #105

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat: Embed NetworkPolicy to extensions #105

wants to merge 1 commit into from

Conversation

@vicentefb
Copy link
Contributor

@vicentefb vicentefb commented Oct 20, 2025 •
edited
Loading

Related to #32

This PR introduces an opinionated security for sandboxes by integrating the automated creation of K8s NetworkPolicy resources. The change is introduced in the extensions folder.

This is achieved by extending the SandboxTemplate API and implementing the corresponding lifecycle management logic within the sandboxclaim-controller. These changes ensure that all sandboxes are secure by default with a "deny-all" network posture.

Key Changes

NetworkPolicy Integration:

  • The SandboxTemplate CRD has been extended with a spec.networkPolicy section, allowing administrators to define a secure "blueprint" for sandbox networking.

  • The sandboxclaim-controller now reconciles these settings, creating a unique, "default-deny" NetworkPolicy for each SandboxClaim.

This implementation directly fulfills key security requirements:

  • Restricts pod-to-pod communication: Each sandbox gets an individual policy, ensuring it is isolated from other sandboxes.

  • Controls ingress: The policy only allows traffic from trusted sources defined in the template (e.g., an L7XLB).

  • Restricts egress: All outgoing traffic is blocked by default, except for essential DNS lookups.

  • Blocks API server access: This is a direct result of the default-deny egress posture.

Controller RBAC Updates:

  • The ClusterRole for the sandboxclaim-controller has been updated to include the necessary permissions to manage networkpolicies across the cluster.

Unit Tests:

  • Added unit tests for the NetworkPolicy translation logic, covering various ingress and egress rule configurations.

@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Oct 20, 2025
@k8s-ci-robot k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Oct 20, 2025
@k8s-ci-robot
Copy link
Contributor

k8s-ci-robot commented Oct 20, 2025

Hi @vicentefb. Thanks for your PR.

I'm waiting for a github.com member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot added the size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. label Oct 20, 2025
@netlify
Copy link

netlify bot commented Oct 20, 2025 •
edited
Loading

✅ Deploy Preview for agent-sandbox canceled.

Name Link
🔨 Latest commit fbd0596
🔍 Latest deploy log https://app.netlify.com/projects/agent-sandbox/deploys/690e72288f63cd0008879e32

@barney-s
Copy link
Contributor

barney-s commented Oct 20, 2025

Thanks for this. Looks like a good approach.

@k8s-ci-robot k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 1, 2025
@k8s-ci-robot k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 3, 2025
gongmax
gongmax reviewed Nov 3, 2025
View reviewed changes
extensions/controllers/sandboxclaim_controller.go

// NameHash generates an FNV-1a hash from a string and returns
// it as a fixed-length hexadecimal string.
func NameHash(objectName string) string {
Copy link

@gongmax gongmax Nov 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it possible to reuse the same method in the SandboxController? https://github.com/kubernetes-sigs/agent-sandbox/blob/main/controllers/sandbox_controller.go#L236

gongmax
gongmax approved these changes Nov 3, 2025
View reviewed changes
Copy link

@gongmax gongmax left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@k8s-ci-robot
Copy link
Contributor

k8s-ci-robot commented Nov 3, 2025

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: gongmax, vicentefb
Once this PR has been reviewed and has the lgtm label, please assign soltysh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 4, 2025
@janetkuo janetkuo added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Nov 7, 2025
@k8s-ci-robot k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 7, 2025
@vicentefb
feat: Embed NetworkPolicy to extensions
fbd0596 
updated logging to avoid error

rebase

'rebase
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@justinsb justinsb Awaiting requested review from justinsb

@soltysh soltysh Awaiting requested review from soltysh

1 more reviewer

@gongmax gongmax gongmax approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@vicentefb @k8s-ci-robot @barney-s @gongmax @janetkuo