chore: initialize main branch#11
Merged
Merged
Conversation
feiskyer
approved these changes
May 9, 2022
mainred
pushed a commit
that referenced
this pull request
Jun 14, 2022
chore: initialize main branch
rchincha
added a commit
to rchincha/fleet-networking
that referenced
this pull request
Jul 21, 2026
…curityPolicy attach Extends the FrontDoorProfile reconciler with the WAF enforcement path described in docs/first-party/002-afd-implementation-plan.md Azure#11: - spec.wafPolicy nil + ComplianceMode=None -> no WAF; any prior fleet-managed SecurityPolicy is drift-deleted so a user who clears the field does not leave stale WAF attachment behind. Programmed=True. - spec.wafPolicy set -> resolve the referenced Microsoft.Network/ frontdoorwebapplicationfirewallpolicies resource via armfrontdoor PoliciesClient, then upsert a Microsoft.Cdn/profiles/{}/securityPolicies/ fleet-waf-{uid} of type WebApplicationFirewall binding the policy to the default AFD endpoint (path "/*"). Programmed=True. - ComplianceMode=SFI-NS253 -> additionally require PolicySettings.Mode == Prevention; Detection or nil-Mode is rejected with Reason=WAFPolicyNotInPreventionMode so an SFI-audited tenant cannot ship a WAF policy that only observes traffic. Terminal client rejections (WAFPolicyNotFound, WAFPolicyNotInPreventionMode, malformed ID, cross-subscription ref) short-circuit before Programmed=True is set, so a single Programmed condition remains authoritative for readiness. Cross-subscription refs are intentionally rejected in POC scope because the Clients bundle does not build a per-sub armfrontdoor client yet; the message tells the operator exactly why. Reconciler gains WAFPoliciesClient, SecurityPoliciesClient, and SubscriptionID fields (last cached because neither SDK client exposes it and the resolver needs it for cross-sub detection). Test scaffolding: - WAFPolicyFake exposes SetPolicy/DeletePolicy for pre-seeding a policy at a specific PolicyMode; the reconciler only reads so the store is test-owned. - SecurityPolicyFake exposes GetStored so specs can assert on the exact ARM ID, WafPolicy.ID, and Association domains the reconciler wrote. - Endpoint fake now populates .ID on create; a nil ID would silently produce an empty Association and mask bugs. No new envtest specs land in this commit -- suite_test.go only wires the fakes so the existing happy-path spec keeps passing. Specs exercising the three WAF paths (happy / NotFound / NotInPrevention) land next. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a8fabc68-e113-49ef-b82d-d99a8502da11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
We moved the legacy code to legacy branch, and this main branch starts from 31d6360