fix - #59
Open
entlein wants to merge 2 commits into
Open
Conversation
Signed-off-by: entlein <einentlein@gmail.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
… RCA why this regressed in the first place Signed-off-by: entlein <einentlein@gmail.com>
|
Buildable image for the /proc full-path fix is ready for pickup.
Built from branch What it changes: Live acceptance to verify: deploy this node-agent with |
entlein
added a commit
to k8sstormcenter/bob
that referenced
this pull request
Aug 1, 2026
… form Addresses the review comments on #176. NO YAML ALIASES. The pushed cp-argocd-repo-server.yaml contained &id001/*id001 because anchor_wildcards() handed all three anchored entries the SAME flags list object and PyYAML back-references anything it sees twice by identity. Kubescape does not resolve aliases, and a reviewer cannot see what a rule allows through a pointer. Fixed at both levels: each entry gets its own list, and both generators now dump through a NoAliasDumper that refuses to emit anchors at all. PLURAL FORM + CIDR. IPAddress and DNS are DEPRECATED singulars; the v0.0.2 fields are the lists IPAddresses and DNSNames, and an IPAddresses entry may be a literal, a CIDR, or "*" (pkg/registry/file/networkmatch, spec 5.7/5.8). Every egress moves onto them: 10.43.0.1 -> [10.43.0.0/16, 10.96.0.0/12] apiserver, k3s AND kubeadm 10.42.0.1 -> [10.42.0.0/16, 10.244.0.0/16] pod CIDR, k3s AND flannel 140.82.121.3/4, 185.199.108-111.153 -> dropped, keyed on dnsNames github.com / charts.helm.sh instead The external addresses rotate, so pinning them guarantees the SBoB stops matching. The learn captured the DNS names, so nothing is lost by keying on them — and the representativeness gate is now STRONGER for it: repo-server must show egress to both github.com and charts.helm.sh by name. PLACEHOLDERS for volatile Host headers: 10.42.0.250:8082 and 127.0.0.1:6443 become *:8082 and *:6443. A pod IP differs on every restart. TRUNCATED PATHS repaired. /4_46_21.2502219693/{ca.crt,token,namespace} is the projected SA-token directory with its leading characters eaten by the node-agent bug; the correct form is known because every uncorrupted profile carries it, so it is restored rather than shipped as garbage. COMPACT FORMAT. One entry per line via default_flow_style=None. An SBoB is read as a policy document and block style buried the paths among their flags: application-controller 978 -> 412 lines, repo-server 430 -> 228, dex 129 -> 64. The gate had to learn all of this too, and it silently broke first: reading only the singular ipAddress it failed 6 of 7 correct profiles. It now reads both forms, satisfies an expectation by literal OR containing CIDR, and counts a public DNS name as leaving the cluster. Verified on the RUNNING storage:sbob-rc4 — applied and read back, the plural ipAddresses with CIDRs persist and every profile's opens are preserved exactly. Also pins storage to sbob-rc5s from the helm-chart PR. node-agent is HELD at rc4 with a comment saying why: rc5s predates the fix on k8sstormcenter/node-agent#59 for the truncation above, and its build is currently red, so there is no fixed tag to move to yet. Refs #170 #176 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jd9m962b1JAHdAy3rGe7nm
entlein
added a commit
to k8sstormcenter/bob
that referenced
this pull request
Aug 1, 2026
node-agent sbob-rc5s-fpo carries the /proc full-path fix from k8sstormcenter/node-agent#59: NormalizePath re-roots headless /proc/<pid>/<file> opens via an explicit allowlist (task|fd|setgroups|gid_map|uid_map|status|stat| cgroup|mountinfo|maps|environ|comm|cmdline|ns) rather than only task|fd, so "/17/setgroups" resolves to "/proc/17/setgroups". Built from fix/fullpathopens-sbob (migrate/sbob HEAD eab532e4 + the PR's pkg/utils/path.go), so it compiles against the migrated storage and must be paired with storage:sbob-rc5s. The original fix/fullpathopens branch is 32 commits behind and fails the AP/NN mock compile — not a valid build source. Digest: sha256:4e512e03724e34c8788f35151d5cd4e0fa2a5a4dced5a92df4c14402e329ca30 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jd9m962b1JAHdAy3rGe7nm
entlein
added a commit
to k8sstormcenter/bob
that referenced
this pull request
Aug 2, 2026
… form Addresses the review comments on #176. NO YAML ALIASES. The pushed cp-argocd-repo-server.yaml contained &id001/*id001 because anchor_wildcards() handed all three anchored entries the SAME flags list object and PyYAML back-references anything it sees twice by identity. Kubescape does not resolve aliases, and a reviewer cannot see what a rule allows through a pointer. Fixed at both levels: each entry gets its own list, and both generators now dump through a NoAliasDumper that refuses to emit anchors at all. PLURAL FORM + CIDR. IPAddress and DNS are DEPRECATED singulars; the v0.0.2 fields are the lists IPAddresses and DNSNames, and an IPAddresses entry may be a literal, a CIDR, or "*" (pkg/registry/file/networkmatch, spec 5.7/5.8). Every egress moves onto them: 10.43.0.1 -> [10.43.0.0/16, 10.96.0.0/12] apiserver, k3s AND kubeadm 10.42.0.1 -> [10.42.0.0/16, 10.244.0.0/16] pod CIDR, k3s AND flannel 140.82.121.3/4, 185.199.108-111.153 -> dropped, keyed on dnsNames github.com / charts.helm.sh instead The external addresses rotate, so pinning them guarantees the SBoB stops matching. The learn captured the DNS names, so nothing is lost by keying on them — and the representativeness gate is now STRONGER for it: repo-server must show egress to both github.com and charts.helm.sh by name. PLACEHOLDERS for volatile Host headers: 10.42.0.250:8082 and 127.0.0.1:6443 become *:8082 and *:6443. A pod IP differs on every restart. TRUNCATED PATHS repaired. /4_46_21.2502219693/{ca.crt,token,namespace} is the projected SA-token directory with its leading characters eaten by the node-agent bug; the correct form is known because every uncorrupted profile carries it, so it is restored rather than shipped as garbage. COMPACT FORMAT. One entry per line via default_flow_style=None. An SBoB is read as a policy document and block style buried the paths among their flags: application-controller 978 -> 412 lines, repo-server 430 -> 228, dex 129 -> 64. The gate had to learn all of this too, and it silently broke first: reading only the singular ipAddress it failed 6 of 7 correct profiles. It now reads both forms, satisfies an expectation by literal OR containing CIDR, and counts a public DNS name as leaving the cluster. Verified on the RUNNING storage:sbob-rc4 — applied and read back, the plural ipAddresses with CIDRs persist and every profile's opens are preserved exactly. Also pins storage to sbob-rc5s from the helm-chart PR. node-agent is HELD at rc4 with a comment saying why: rc5s predates the fix on k8sstormcenter/node-agent#59 for the truncation above, and its build is currently red, so there is no fixed tag to move to yet. Refs #170 #176 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jd9m962b1JAHdAy3rGe7nm
entlein
added a commit
to k8sstormcenter/bob
that referenced
this pull request
Aug 2, 2026
node-agent sbob-rc5s-fpo carries the /proc full-path fix from k8sstormcenter/node-agent#59: NormalizePath re-roots headless /proc/<pid>/<file> opens via an explicit allowlist (task|fd|setgroups|gid_map|uid_map|status|stat| cgroup|mountinfo|maps|environ|comm|cmdline|ns) rather than only task|fd, so "/17/setgroups" resolves to "/proc/17/setgroups". Built from fix/fullpathopens-sbob (migrate/sbob HEAD eab532e4 + the PR's pkg/utils/path.go), so it compiles against the migrated storage and must be paired with storage:sbob-rc5s. The original fix/fullpathopens branch is 32 commits behind and fails the AP/NN mock compile — not a valid build source. Digest: sha256:4e512e03724e34c8788f35151d5cd4e0fa2a5a4dced5a92df4c14402e329ca30 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jd9m962b1JAHdAy3rGe7nm
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Signed-off-by: entlein einentlein@gmail.com
Overview