NetworkEnforcer v0.2.0

What's Changed

• chore: helm chart 0.1.1 release by @github-actions[bot] in #187
• docs: add a quickstart section by @andreaterzolo in #181
• docs: fix quickstart command by @andreaterzolo in #189
• chore: use tilt with e2e cluster setup by @andreaterzolo in #182
• refactor: align with k8s.io/api/networking/v1 PolicyType by @kyledong-suse in #183
• docs: fix quickstart example by @andreaterzolo in #192
• test: fix proposal assertion in e2e tests by @andreaterzolo in #191
• test: check our violation inside eventually by @andreaterzolo in #195
• test(e2e): allow e2e test to run in existing clusters by @holyspectral in #199
• deps(otel): update otel-collector-contrib to 0.158.0 by @github-actions[bot] in #203
• feat: allow users to directly promote a policy into protect mode by @kyledong-suse in #202
• chore(deps): bump github.com/cilium/cilium from 1.19.6 to 1.20.0 by @dependabot[bot] in #206
• chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 by @dependabot[bot] in #207
• feat: add validating admission webhook for WorkloadNetworkPolicyProposal by @kyledong-suse in #205
• docs: istio investigation by @andreaterzolo in #204
• chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 by @dependabot[bot] in #211
• chore(deps): bump rancher-sandbox/runtime-enforcer/.github/actions/attestation from 9fe610d3c44031aae52ccf1e9f34205432a84c3d to 57cc5aeb8c5d00c59ed40b4532c5c645b0311101 by @dependabot[bot] in #212
• chore(deps): bump rancher-sandbox/runtime-enforcer/.github/actions/merge-multiarch from 9fe610d3c44031aae52ccf1e9f34205432a84c3d to 57cc5aeb8c5d00c59ed40b4532c5c645b0311101 by @dependabot[bot] in #209
• chore(deps): bump rancher-sandbox/runtime-enforcer/.github/actions/container-build from 9fe610d3c44031aae52ccf1e9f34205432a84c3d to 57cc5aeb8c5d00c59ed40b4532c5c645b0311101 by @dependabot[bot] in #210
• feat: first Istio scaffolding by @andreaterzolo in #213
• feat: remove components that are no more used by @andreaterzolo in #251
• fix: skip not learning events by @andreaterzolo in #258
• feat: rework CRDs supporting Istio by @andreaterzolo in #257
• feat: istio extract monitor logs by @andreaterzolo in #259
• fix(istio): key learning proposals by workload instead of pod name by @kyledong-suse in #261
• feat(api): normalize ViolationRecord for backend-dispatched attribution by @dottorblaster in #267
• feat: implement monitor and protect istio reconciliation flow by @andreaterzolo in #270
• feat: exclude traffic outside the mesh by @andreaterzolo in #271
• feat: return nil when policies are not owned by our CRDs by @andreaterzolo in #272
• fix: use CreateOrPatch to avoid issues with unexported fields by @andreaterzolo in #274
• feat(istio): populate WorkloadNetworkPolicyProposal from learning events by @kyledong-suse in #269
• chore(deps): bump updatecli/updatecli-action from 3.4.0 to 3.5.0 by @dependabot[bot] in #280
• feat(istio): promote to WorkloadNetworkPolicies for istio by @kyledong-suse in #278
• feat: receive/emit violation evts from ztunnel by @holyspectral in #273
• test(e2e): add e2e test for the Istio ambient path by @dottorblaster in #277
• feat: keep violation in wnp by @holyspectral in #282
• refactor: adapt some legacy code and removed some unused components by @andreaterzolo in #285
• test(e2e): extend suite with a protect case for Istio by @dottorblaster in #290
• feat: support multiple providers and not just istio by @andreaterzolo in #302
• refactor: replace WNPP validating webhook with VAP for security.rancher.io/promote by @kyledong-suse in #296
• test(e2e): consolidate Istio flow test and unify packet helpers by @dottorblaster in #303
• refactor: use slog.Logger in WorkloadNetworkPolicyStatusSync by @dottorblaster in #311
• feat: enrich violation via src podIP and dest pod name. by @holyspectral in #298
• feat: istio implementation by @dottorblaster in #313
• deps(otel): update otel-collector-contrib to 0.159.0 by @github-actions[bot] in #314
• fix: silent failure in resolving owner policy by @holyspectral in #315
• deps(go): update Go to 1.26.6 version by @github-actions[bot] in #317
• chore(deps): bump github.com/yuin/gopher-lua from 1.1.1 to 1.1.2 by @dependabot[bot] in #321
• chore(deps): bump rancher-sandbox/runtime-enforcer/.github/actions/attestation from 57cc5aeb8c5d00c59ed40b4532c5c645b0311101 to ee1d7a3b1f785fadf8d9c914680e5596ebbd38e1 by @dependabot[bot] in #320
• chore(deps): bump rancher-sandbox/runtime-enforcer/.github/actions/merge-multiarch from 57cc5aeb8c5d00c59ed40b4532c5c645b0311101 to ee1d7a3b1f785fadf8d9c914680e5596ebbd38e1 by @dependabot[bot] in #322
• chore(deps): bump istio.io/api from 1.30.3-0.20260710004328-2e43f07b30b6 to 1.31.0-beta.0 by @dependabot[bot] in #318
• chore(deps): bump rancher-sandbox/runtime-enforcer/.github/actions/container-build from 57cc5aeb8c5d00c59ed40b4532c5c645b0311101 to ee1d7a3b1f785fadf8d9c914680e5596ebbd38e1 by @dependabot[bot] in #319
• refactor: rework learning event by @andreaterzolo in #316
• feat: support k8s learning flow and extend again the learning event definition by @andreaterzolo in #323
• chore(deps): bump rancher-sandbox/runtime-enforcer/.github/actions/attestation from ee1d7a3b1f785fadf8d9c914680e5596ebbd38e1 to d00c26279237d1015fa5d38a86a7e168ec9419cd by @dependabot[bot] in #327
• chore(deps): bump rancher-sandbox/runtime-enforcer/.github/actions/container-build from ee1d7a3b1f785fadf8d9c914680e5596ebbd38e1 to d00c26279237d1015fa5d38a86a7e168ec9419cd by @dependabot[bot] in #326
• chore(deps): bump rancher-sandbox/runtime-enforcer/.github/actions/merge-multiarch from ee1d7a3b1f785fadf8d9c914680e5596ebbd38e1 to d00c26279237d1015fa5d38a86a7e168ec9419cd by @dependabot[bot] in #325
• feat: support learning with Cilium provider and add e2e tests by @andreaterzolo in #328
• chore(deps): bump rancher-sandbox/runtime-enforcer/.github/actions/container-build from d00c26279237d1015fa5d38a86a7e168ec9419cd to 0e2ae7d89f753dbe53a15832e59536fb28432897 by @dependabot[bot] in #330
• feat: support pod resolution from hubble flow by @andreaterzolo in #329
• chore(deps): bump rancher-sandbox/runtime-enforcer/.github/actions/merge-multiarch from d00c26279237d1015fa5d38a86a7e168ec9419cd to 0e2ae7d89f753dbe53a15832e59536fb28432897 by @dependabot[bot] in #331
• chore(deps): bump rancher-sandbox/runtime-enforcer/.github/actions/attestation from d00c26279237d1015fa5d38a86a7e168ec9419cd to 0e2ae7d89f753dbe53a15832e59536fb28432897 by @dependabot[bot] in #332
• chore(deps): bump updatecli/updatecli-action from 3.5.0 to 3.6.0 by @dependabot[bot] in #333
• feat: support monitor mode for the k8s flow by @andreaterzolo in #334
• feat(calico): stream allowed flo...

network-enforcer-chart-0.1.2

SUSE Security Network Enforcer helm chart

NetworkEnforcer v0.1.0

What's Changed

• docs: initial network-enforcer RFC by @dottorblaster in #9
• docs: add initial dev docs by @andreagit97 in #11
• fix: emit real ports in NetworkPolicyProposal generation by @dottorblaster in #12
• cleanup: remove no more used backends by @andreagit97 in #14
• chore: add zizmor action by @dottorblaster in #16
• chore: add GitHub issue templates by @dottorblaster in #17
• fix: dedicated directory for controller cmd by @dottorblaster in #15
• feat: rework of the current POC by @andreagit97 in #18
• refactor: apply linters to all files by @andreagit97 in #23
• chore: setup dependabot by @dottorblaster in #24
• chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.34.0 to 1.44.0 by @dependabot[bot] in #26
• chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #25
• chore(deps): bump github.com/sirupsen/logrus from 1.9.3 to 1.9.4 by @dependabot[bot] in #31
• chore(deps): bump github.com/onsi/ginkgo/v2 from 2.27.2 to 2.31.0 by @dependabot[bot] in #29
• ci: don't trigger jobs twice on PR pushes by @andreagit97 in #36
• chore(deps): bump sigs.k8s.io/controller-runtime from 0.23.3 to 0.24.1 by @dependabot[bot] in #34
• chore(deps): bump k8s.io/apimachinery from 0.36.0 to 0.36.2 by @dependabot[bot] in #33
• chore(deps): bump k8s.io/api from 0.36.0 to 0.36.2 by @dependabot[bot] in #39
• chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #37
• chore(deps): bump github.com/cilium/cilium from 1.19.4 to 1.19.5 by @dependabot[bot] in #38
• chore(deps): bump k8s.io/client-go from 0.36.0 to 0.36.2 by @dependabot[bot] in #35
• docs: add cniWatcher RFC by @kyledong-suse in #22
• chore(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by @dependabot[bot] in #41
• chore(deps): bump go.mongodb.org/mongo-driver from 1.17.6 to 1.17.7 by @dependabot[bot] in #42
• chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot[bot] in #45
• chore(deps): bump actions/cache from 5.0.5 to 6.1.0 by @dependabot[bot] in #43
• refactor: remove no more used test/utils folder + some makefile targets by @andreagit97 in #46
• refactor: rename networkpolicyproposals api group by @andreagit97 in #47
• refactor: remove all kubebuilder generated stuff by @andreagit97 in #55
• docs: add a new RFC for monitor mode by @andreagit97 in #40
• refactor: rename network policy proposal by @andreagit97 in #56
• chore: fix Calico setup with tilt by @andreagit97 in #54
• feat(api): add WorkloadNetworkPolicy CRD by @dottorblaster in #59
• chore: automate cniwatcher RBAC generation via Go markers by @dottorblaster in #60
• feat: implement WNPP reconciler to handle proposal promotion by @andreagit97 in #61
• chore: rename go module into github.com/rancher-sandbox/network-enforcer by @andreagit97 in #62
• chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by @dependabot[bot] in #63
• feat: implement WorkloadNetworkPolicyReconciler with protect/monitor mode enforcement by @dottorblaster in #64
• feat(cniwatcher): add per-node violation buffer and ScrapeViolations GRPC server by @dottorblaster in #85
• chore(cniwatcher): refine Dockerfile.cniwatcher COPY stage by @kyledong-suse in #92
• feat(workflow): provide main branch builds by @holyspectral in #93
• chore: add a PR template by @dottorblaster in #94
• feat(api): add violation lifecycle by @dottorblaster in #88
• chore: replace custom NamespaceLabelKey with corev1.LabelMetadataName by @dottorblaster in #96
• feat(workflows): release pipeline by @holyspectral in #95
• chore(deps): bump rancher-sandbox/runtime-enforcer/.github/actions/attestation from 3ef087afd4c8131a1eacdd84873b7ddcaa13beaf to 89394bdcf7d1e8728a3c57aefdfbc3fcabd1140c by @dependabot[bot] in #102
• chore(deps): bump rancher-sandbox/runtime-enforcer/.github/actions/container-build from 3ef087afd4c8131a1eacdd84873b7ddcaa13beaf to 89394bdcf7d1e8728a3c57aefdfbc3fcabd1140c by @dependabot[bot] in #104
• chore(deps): bump rancher-sandbox/runtime-enforcer/.github/actions/merge-multiarch from 3ef087afd4c8131a1eacdd84873b7ddcaa13beaf to 89394bdcf7d1e8728a3c57aefdfbc3fcabd1140c by @dependabot[bot] in #103
• chore: provide sample crd yaml files by @holyspectral in #101
• chore(deps): update go version using updatecli by @holyspectral in #98
• deps(go): update Go to 1.26.5 version by @github-actions[bot] in #107
• chore(ci): provide values.schema.json by @holyspectral in #100
• chore(deps): add updatecli policy for opentelemetry-ebpf-instrumentation by @dottorblaster in #108
• fix: updatecli OBI job now also updates the subchart by @dottorblaster in #110
• chore: claude settings.json by @holyspectral in #112
• feat: scrape cniwatcher deny events and sync WorkloadNetworkPolicy by @dottorblaster in #106
• fix(helm): allow Helm v4 dependency key in values schema by @dottorblaster in #113
• refactor: rename cmd/netenforcer to cmd/controller by @dottorblaster in #114
• chore(deps): bump updatecli/updatecli-action from 3.3.0 to 3.4.0 by @dependabot[bot] in #115
• fix(updatecli): add HOME env and dependson ordering to OBI pipeline by @dottorblaster in #116
• fix(updatecli): switch to single shell step for helm and OBI by @dottorblaster in #118
• fix(updatecli): manually call git add -A to avoid updatecli internal errors by @dottorblaster in #119
• chore: stop vendoring opentelemetry-ebpf-instrumentation chart tarball by @dottorblaster in #121
• chore(deps): bump rancher-sandbox/runtime-enforcer/.github/actions/attestation from 89394bdcf7d1e8728a3c57aefdfbc3fcabd1140c to d3dbdc129a21016d114bc3bdae6eb47491c0db25 by @dependabot[bot] in #130
• chore(deps): bump rancher-sandbox/runtime-enforcer/.github/actions/container-build from 89394bdcf7d1e8728a3c57aefdfbc3fcabd1140c to d3dbdc129a21016d114bc3bdae6eb47491c0db25 by @dependabot[bot] in #129
• chore(deps): bump rancher-sandbox/runtime-enforcer/.github/actions/merge-multiarch from 89394bdcf7d1e8728a3c57aefdfbc3fcabd1140c to d3dbdc129a21016d114bc3bdae6eb47491c0db25 by @dependabot[bot] in #128
• chore: improve controller dockerfile and remove an unused make target by @andreagit97 in #131
• refactor: refine cniwatcher unit tests by @kyl...

network-enforcer-chart-0.1.1

SUSE Security Network Enforcer helm chart