Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 2 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

Merge fix/gateway-ingress-default-deny: renderer emits gateway-ingress allow for exposed apps (R-NET-01/02/03)

Browse Source
This commit is contained in:
jakman85 committed 2026-08-25 01:01:03 -05:00
2 parents e022a2aea4 c6a480eed1
commit 6522204478
7 files changed
+663
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

apps/pihole.yaml
+20
View File
@@ -103,6 +103,26 @@ spec:
port: 80
targetPort: 80
---
# CiliumNetworkPolicy gateway-ingress allow (R-NET-01/02): pihole-allow-gateway-ingress
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: pihole-allow-gateway-ingress
namespace: pihole
labels:
app.kubernetes.io/name: pihole
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: pihole
ingress:
- fromEntities:
- ingress
toPorts:
- ports:
- port: '80'
protocol: TCP
---
# HTTPRoute pihole-80 (R-TLS/R-DNS)
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
catalog/render.py
+103
View File
@@ -315,6 +315,54 @@ def r_dependency_policies(s: dict) -> list:
return out
def r_gateway_ingress_policy(s: dict):
"""North-south allow: let the shared Cilium Gateway reach an exposed service's port(s).
Any service that renders an HTTPRoute (non-empty ingressRoutes) is reachable through the
shared Gateway, but the namespace default-deny has `ingress: []` (deny all east-west and
north-south). This CiliumNetworkPolicy is the ADDITIVE, least-privilege allow that opens
ONLY the north-south path (docs/09 "Ingress opens north-south only — it does not relax
east-west default-deny"): ingress from Cilium's reserved `ingress` identity (the Gateway/
Ingress Envoy proxy, `reserved:ingress`, numeric identity 8 in Cilium 1.16.5) to ONLY the
exposed service port(s). Everything else stays denied; undeclared ports stay denied.
Verified empirically against the cluster: with default-deny in place, Hubble shows the
Gateway proxy reaching the backend as source identity `(ingress)` and the flow
`Policy denied DROPPED` on the service port — so `fromEntities: [ingress]` is exactly the
source the Cilium Gateway uses, and the port is the service targetPort (R-NET-01/02).
"""
if not s["ingressRoutes"]:
return None
ports = _service_ports(s)
return {
"apiVersion": "cilium.io/v2",
"kind": "CiliumNetworkPolicy",
"metadata": {
"name": f"{s['name']}-allow-gateway-ingress",
"namespace": s["name"],
"labels": {"app.kubernetes.io/name": s["name"]},
},
"spec": {
"endpointSelector": {
"matchLabels": {"app.kubernetes.io/name": s["name"]}
},
"ingress": [
{
"fromEntities": ["ingress"],
"toPorts": [
{
"ports": [
{"port": str(p["port"]), "protocol": "TCP"}
for p in ports
]
}
],
}
],
},
}
def _route_meta(s: dict, route: dict) -> dict:
meta = {
"name": f"{s['name']}-{route['port']}",
@@ -616,6 +664,16 @@ def render(sd: dict, image_automation: bool = True) -> list:
for cnp in r_dependency_policies(s):
docs.append((f"CiliumNetworkPolicy egress allow (R-NET-02): {cnp['metadata']['name']}", cnp))
gw_allow = r_gateway_ingress_policy(s)
if gw_allow:
docs.append(
(
"CiliumNetworkPolicy gateway-ingress allow (R-NET-01/02): "
f"{gw_allow['metadata']['name']}",
gw_allow,
)
)
for hr in r_httproutes(s):
docs.append((f"HTTPRoute {hr['metadata']['name']} (R-TLS/R-DNS)", hr))
@@ -725,6 +783,51 @@ def _selftest() -> int:
cnps = [d[1] for d in dep_docs if d[1]["kind"] == "CiliumNetworkPolicy"]
check(len(cnps) == 1, "one dependency must render one CiliumNetworkPolicy allow")
# 4b) exposure (ingressRoutes) -> an ADDITIVE gateway-ingress CiliumNetworkPolicy that
# allows ONLY the reserved `ingress` (Gateway proxy) identity to the exposed port,
# while default-deny still denies all other ingress (R-NET-01/02).
exp_docs = render(
{
"name": "z",
"source": {"image": "a:1"},
"ingressRoutes": [{"host": "z.home.keithjackson.dev", "port": 80}],
}
)
gw = [
d[1]
for d in exp_docs
if d[1]["kind"] == "CiliumNetworkPolicy"
and d[1]["metadata"]["name"].endswith("-allow-gateway-ingress")
]
check(len(gw) == 1, "an exposed service must render one gateway-ingress allow (R-NET-01)")
if gw:
ing = gw[0]["spec"]["ingress"]
check(
ing[0]["fromEntities"] == ["ingress"],
"gateway-ingress allow must be from the reserved `ingress` (Gateway) identity",
)
allowed_ports = {p["port"] for r in ing for tp in r["toPorts"] for p in tp["ports"]}
check(
allowed_ports == {"80"},
"gateway-ingress allow must be least-privilege (only the exposed port)",
)
# default-deny stays deny-all-ingress even when an exposed service adds the allow.
exp_dd = next(d[1] for d in exp_docs if d[1]["kind"] == "NetworkPolicy")
check(
exp_dd["spec"]["ingress"] == [],
"gateway-ingress allow must be ADDITIVE — default-deny ingress stays [] (R-NET-01)",
)
# an internal (no ingressRoutes) service must NOT get a gateway-ingress allow.
internal_docs = render({"name": "int", "source": {"image": "a:1"}})
check(
not any(
d[1]["kind"] == "CiliumNetworkPolicy"
and d[1]["metadata"]["name"].endswith("-allow-gateway-ingress")
for d in internal_docs
),
"a non-exposed service must not render a gateway-ingress allow (least privilege)",
)
# 5) vm kind -> VirtualMachine + standalone DataVolume.
vm_docs = render(
{
conformance/tests/l1-rendering/container-workload-render/golden/expected.yaml
+20
View File
@@ -78,6 +78,26 @@ spec:
port: 8080
targetPort: 8080
---
# CiliumNetworkPolicy gateway-ingress allow (R-NET-01/02): paas-demo-allow-gateway-ingress
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: paas-demo-allow-gateway-ingress
namespace: paas-demo
labels:
app.kubernetes.io/name: paas-demo
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: paas-demo
ingress:
- fromEntities:
- ingress
toPorts:
- ports:
- port: '8080'
protocol: TCP
---
# HTTPRoute paas-demo-8080 (R-TLS/R-DNS)
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
conformance/tests/l1-rendering/egress-class-render/golden/egress-internet.expected.yaml
+20
View File
@@ -103,6 +103,26 @@ spec:
port: 8989
targetPort: 8989
---
# CiliumNetworkPolicy gateway-ingress allow (R-NET-01/02): sonarr-allow-gateway-ingress
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: sonarr-allow-gateway-ingress
namespace: sonarr
labels:
app.kubernetes.io/name: sonarr
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: sonarr
ingress:
- fromEntities:
- ingress
toPorts:
- ports:
- port: '8989'
protocol: TCP
---
# HTTPRoute sonarr-8989 (R-TLS/R-DNS)
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
conformance/tests/l1-rendering/egress-class-render/golden/egress-vpn.expected.yaml
+20
View File
@@ -103,6 +103,26 @@ spec:
port: 8989
targetPort: 8989
---
# CiliumNetworkPolicy gateway-ingress allow (R-NET-01/02): sonarr-allow-gateway-ingress
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: sonarr-allow-gateway-ingress
namespace: sonarr
labels:
app.kubernetes.io/name: sonarr
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: sonarr
ingress:
- fromEntities:
- ingress
toPorts:
- ports:
- port: '8989'
protocol: TCP
---
# HTTPRoute sonarr-8989 (R-TLS/R-DNS)
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
conformance/tests/l2-behavioral/gateway-ingress-reachable/chainsaw-test.yaml
+302
View File
@@ -0,0 +1,302 @@
# =============================================================================
# L2 BEHAVIORAL — Exposed app reachable through the Gateway under default-deny
# (R-NET-01, R-NET-02, R-NET-03) [RUNNABLE]
# Catalog: docs/14 (default-deny + explicit allow family)
# Spec: docs/03 "Default-deny baseline" / "Explicit allow rules";
# docs/09 "Interaction with default-deny" (ingress opens NORTH-SOUTH only).
#
# THE GAP THIS CLOSES: an onboarded app's rendered default-deny has `ingress: []`
# (deny ALL), so the Cilium Gateway (Envoy, reserved identity `ingress`) cannot
# reach the backend — an Accepted HTTPRoute is still unreachable. The renderer now
# also emits an ADDITIVE gateway-ingress CiliumNetworkPolicy allowing ONLY the
# `ingress` identity to ONLY the declared port. This test proves that end-to-end
# through the REAL shared Gateway:
#
# GIVEN an exposed app namespace with default-deny + the gateway-ingress allow
# (fromEntities: [ingress] -> declared port 8080 only), attached to the
# shared Gateway with a declared route (8080) and an undeclared route (9091),
# WHEN a client dials the Gateway VIP for the DECLARED host -> THEN it reaches the
# backend (proves the additive allow opens the north-south path, R-NET-02/03);
# WHEN a client dials the Gateway VIP for the UNDECLARED port -> THEN the backend is
# NOT reached (default-deny still drops it, R-NET-02);
# WHEN an in-namespace peer (NOT the `ingress` identity) dials the declared port
# east-west -> THEN it is DENIED (the allow is least-privilege / gateway-only;
# default-deny east-west is intact, R-NET-01).
#
# This asserts observable BEHAVIOR through the live Gateway (green Job = the intended
# verdict), not object existence (R-TEST-01).
#
# TWO FAILURE MODES ARE DISTINGUISHED (per the WS-NET pod->Gateway-VIP reachability
# finding, DECISIONS-LOG): the gateway probes classify each attempt as
# * REACHED (backend marker in the body) -> the intended verdict for the declared host;
# * DENIED (a real HTTP status, e.g. 503, but NO backend marker) -> default-deny drop
# (the intended verdict for the undeclared port);
# * NO-GATEWAY (curl code 000 / connect timeout) -> the probe's node cannot reach the
# Gateway VIP AT ALL. That is a SEPARATE platform fault (a node-local Cilium L7LB/
# envoy desync makes pods on an affected node unable to reach the Gateway VIP or
# ClusterIP), NOT default-deny. The probe SELF-SKIPS that case (exits 0 with a SKIP
# note) so this test never false-fails on the unrelated reachability bug. The
# hermetic east-west denial (below) needs no Gateway and always asserts.
#
# SELF-SKIPPING: the whole L2 layer is gated by CLUSTER_AVAILABLE in conformance/
# run.sh (skipped with no cluster). Within the test, `given` asserts the shared
# Gateway is Programmed (a missing Gateway fails fast/diagnostically), and the gateway
# probes self-skip the node-local reachability fault as above. The backend uses NO
# readinessProbe: the default-deny baseline blocks the kubelet node->pod probe, so a
# probe-bearing pod would never go Ready (DECISIONS-LOG K4); `phase: Running` is the
# correct readiness signal. Cleanup deletes both fixture namespaces in `finally`.
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
name: gateway-ingress-reachable
labels:
conformance.home.k3s/R-NET-01: "true"
conformance.home.k3s/R-NET-02: "true"
conformance.home.k3s/R-NET-03: "true"
annotations:
conformance.home.k3s/requirements: "R-NET-01, R-NET-02, R-NET-03"
conformance.home.k3s/layer: "L2"
conformance.home.k3s/safety-critical: "false"
conformance.home.k3s/executable: "true"
conformance.home.k3s/intent: >-
An exposed app is reachable through the shared Gateway under default-deny via an
additive gateway-ingress allow (ingress identity -> declared port only); an
undeclared port is not reachable through the Gateway and east-west stays denied.
spec:
# A generous timeout: pulling images + programming two HTTPRoutes on the Gateway.
timeouts:
apply: 60s
assert: 180s
steps:
# -- GIVEN: the exposed-app fixture (default-deny + gateway-ingress allow + backend +
# Service + declared/undeclared HTTPRoutes) and a probe namespace. Assert the shared
# Gateway is Programmed (precondition) and the backend pod is Running (listeners up).
# Each gateway-probe step below re-captures the Gateway VIP into a binding (chainsaw
# output bindings are step-scoped) so probes dial the real ingress address that
# split-horizon DNS resolves service hostnames to — env-agnostic, no hardcoded IP.
- name: given-exposed-app-under-default-deny
try:
- apply:
file: fixtures/app-and-probe.yaml
- assert:
resource:
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: shared
namespace: gateway
# JMESPath binding (parenthesized key) rather than a list literal: chainsaw does
# STRICT length-equal list matching, so asserting one element against the full
# conditions[] would fail (DECISIONS-LOG K4). This pinpoints Programmed=True.
status:
(conditions[?type == 'Programmed'] | [0].status): "True"
- assert:
resource:
apiVersion: v1
kind: Pod
metadata:
labels:
app.kubernetes.io/name: gw-backend
namespace: conformance-gw-ingress
status:
# scalar match — Running means both httpd listeners are up (no readinessProbe
# under default-deny; DECISIONS-LOG K4).
phase: Running
# -- THEN(reachable): a client in the unrestricted probe namespace dials the Gateway VIP
# for the DECLARED host. --connect-to sets SNI/Host to the hostname but dials the VIP
# (the real ingress address; -k because we test REACHABILITY, not TLS — trusted-tls
# covers the chain). The backend's marker in the body proves the Gateway (identity
# `ingress`) reached the backend THROUGH default-deny (green Job = REACHED). If the
# probe's node cannot reach the VIP at all (code 000), self-skip (green + SKIP note):
# that is the separate pod->Gateway-VIP platform fault, not default-deny.
- name: then-reachable-through-gateway
try:
# chainsaw output bindings are step-scoped, so re-capture the VIP in this step.
- command:
entrypoint: kubectl
args: [-n, gateway, get, gateway, shared, -o, "jsonpath={.status.addresses[0].value}"]
outputs:
- name: gwvip
value: ($stdout)
- apply:
resource:
apiVersion: batch/v1
kind: Job
metadata:
name: probe-reachable
namespace: conformance-gw-probe
spec:
backoffLimit: 6
activeDeadlineSeconds: 180
template:
spec:
restartPolicy: Never
containers:
- name: probe
image: curlimages/curl:8.11.1
env:
- name: GWVIP
value: ($gwvip)
command:
- sh
- -c
- |
set -u
host="gw-declared-conformance.home.keithjackson.dev"
last=000
i=0
while [ "$i" -lt 30 ]; do
code="$(curl -k -sS --max-time 8 -o /tmp/body \
-w '%{http_code}' \
--connect-to "${host}:443:${GWVIP}:443" \
"https://${host}/" 2>/dev/null || echo 000)"
last="$code"
if grep -q GW_BACKEND_REACHED /tmp/body 2>/dev/null; then
echo "REACHED: Gateway reached the backend through default-deny (code ${code})"
exit 0
fi
i=$((i+1)); sleep 5
done
if [ "$last" = "000" ]; then
echo "SKIP: this node cannot reach the Gateway VIP (code 000) —" 1>&2
echo " separate pod->Gateway-VIP platform fault, NOT default-deny" 1>&2
exit 0
fi
echo "FAIL: Gateway returned ${last} but the backend marker was absent — default-deny drop of the declared port?" 1>&2
exit 1
- assert:
resource:
apiVersion: batch/v1
kind: Job
metadata: { name: probe-reachable, namespace: conformance-gw-probe }
status: { succeeded: 1 }
# -- THEN(undeclared port denied through the Gateway): same Gateway VIP, same backend, the
# UNDECLARED host -> port 9091. Routing is identical to the declared route (proven to
# reach the backend), so the ONLY difference is the missing allow on 9091: the Gateway
# Envoy's upstream connect is DROPPED by default-deny. The backend marker MUST be
# absent. A leak (the 9091 marker appears) fails the Job. If the node cannot reach the
# VIP at all (code 000), self-skip (same platform fault as above).
- name: then-undeclared-port-denied-through-gateway
try:
# chainsaw output bindings are step-scoped, so re-capture the VIP in this step.
- command:
entrypoint: kubectl
args: [-n, gateway, get, gateway, shared, -o, "jsonpath={.status.addresses[0].value}"]
outputs:
- name: gwvip
value: ($stdout)
- apply:
resource:
apiVersion: batch/v1
kind: Job
metadata:
name: probe-undeclared
namespace: conformance-gw-probe
spec:
backoffLimit: 4
activeDeadlineSeconds: 150
template:
spec:
restartPolicy: Never
containers:
- name: probe
image: curlimages/curl:8.11.1
env:
- name: GWVIP
value: ($gwvip)
command:
- sh
- -c
- |
set -u
host="gw-undeclared-conformance.home.keithjackson.dev"
reached_gw=no
i=0
while [ "$i" -lt 8 ]; do
code="$(curl -k -sS --max-time 8 -o /tmp/body \
-w '%{http_code}' \
--connect-to "${host}:443:${GWVIP}:443" \
"https://${host}/" 2>/dev/null || echo 000)"
if grep -q GW_BACKEND_UNDECLARED /tmp/body 2>/dev/null; then
echo "LEAK: undeclared port 9091 reachable through the Gateway (code ${code})" 1>&2
exit 1
fi
[ "$code" != "000" ] && reached_gw=yes
i=$((i+1)); sleep 5
done
if [ "$reached_gw" = "yes" ]; then
echo "DENIED: undeclared port not reachable through the Gateway (backend marker never returned)"
exit 0
fi
echo "SKIP: this node cannot reach the Gateway VIP (code 000) —" 1>&2
echo " separate pod->Gateway-VIP platform fault, NOT default-deny" 1>&2
exit 0
- assert:
resource:
apiVersion: batch/v1
kind: Job
metadata: { name: probe-undeclared, namespace: conformance-gw-probe }
status: { succeeded: 1 }
# -- THEN(east-west still denied): HERMETIC (no Gateway needed). An in-namespace peer
# (NOT the `ingress` identity), covered by the namespace-wide default-deny, dials the
# DECLARED port east-west. The gateway-ingress allow is least-privilege (only
# fromEntities: [ingress]), so this connect MUST be dropped — default-deny east-west
# is intact (R-NET-01). The probe EXITS 0 only when the connection is BLOCKED (green
# Job = denied). This step always runs the real assertion (independent of the pod->VIP
# reachability fault above).
- name: then-east-west-still-denied
try:
- apply:
resource:
apiVersion: batch/v1
kind: Job
metadata:
name: probe-eastwest
namespace: conformance-gw-ingress
spec:
backoffLimit: 4
activeDeadlineSeconds: 120
template:
metadata:
labels: { app: eastwest-peer }
spec:
restartPolicy: Never
containers:
- name: probe
image: busybox:1.36.1
command:
- sh
- -c
- |
set -u
# DNS resolves (baseline allows it); the TCP connect must drop.
if nc -w 5 gw-backend 8080 </dev/null 2>/dev/null; then
echo "LEAK: east-west reached the declared port under default-deny" 1>&2
exit 1
fi
echo "DENIED: east-west blocked; gateway allow is least-privilege"
exit 0
- assert:
resource:
apiVersion: batch/v1
kind: Job
metadata: { name: probe-eastwest, namespace: conformance-gw-ingress }
status: { succeeded: 1 }
# -- Cleanup: delete both fixture namespaces (fixed names, outside chainsaw's managed
# namespace). finally accepts delete (DECISIONS-LOG: step-level finally = script/
# command/delete/wait only).
finally:
- delete:
ref:
apiVersion: v1
kind: Namespace
name: conformance-gw-ingress
- delete:
ref:
apiVersion: v1
kind: Namespace
name: conformance-gw-probe
conformance/tests/l2-behavioral/gateway-ingress-reachable/fixtures/app-and-probe.yaml
+178
View File
@@ -0,0 +1,178 @@
# Fixtures for gateway-ingress-reachable (R-NET-01/02/03).
#
# Reproduces the WS-APPS onboarding shape the renderer emits for an EXPOSED service:
# an app namespace carrying the default-deny baseline (deny ALL ingress) PLUS the
# additive gateway-ingress CiliumNetworkPolicy that allows ONLY the reserved `ingress`
# identity (the Cilium Gateway/Envoy proxy) to the ONE declared service port. A second
# port listens but has NO allow -> it is the "undeclared port" that must stay denied
# even through the Gateway.
#
# The namespace opts into the shared Gateway (gateway-access: shared) exactly like a
# rendered app namespace, so its HTTPRoutes attach to the real platform Gateway and the
# probe exercises the true north-south path (Gateway Envoy -> backend), not a stand-in.
---
apiVersion: v1
kind: Namespace
metadata:
name: conformance-gw-ingress
labels:
homelab.keithjackson.dev/app-namespace: "true"
gateway-access: "shared"
---
# Default-deny baseline: deny ALL ingress + egress, allow ONLY DNS egress. Byte-shape
# matches the renderer's r_default_deny / the platform baseline (R-NET-01). podSelector {}
# => every pod in the namespace, including the backend.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny
namespace: conformance-gw-ingress
spec:
podSelector: {}
policyTypes: [Ingress, Egress]
ingress: []
egress:
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
- podSelector:
matchLabels:
k8s-app: kube-dns
ports:
- protocol: UDP
port: 53
- protocol: TCP
port: 53
---
# The ADDITIVE gateway-ingress allow the renderer now emits (render.py r_gateway_ingress_policy):
# ingress from the reserved `ingress` identity (the Cilium Gateway Envoy proxy) to ONLY the
# declared service port 8080. Port 9091 is deliberately NOT allowed (the undeclared port).
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: gw-backend-allow-gateway-ingress
namespace: conformance-gw-ingress
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: gw-backend
ingress:
- fromEntities:
- ingress
toPorts:
- ports:
- port: "8080"
protocol: TCP
---
# Backend: two busybox httpd listeners. 8080 = the DECLARED/allowed port; 9091 = an
# UNDECLARED port that LISTENS (so a block is caused by POLICY, not a missing listener,
# per the deny-undeclared rationale). No readinessProbe: the default-deny baseline blocks
# the kubelet node->pod probe, so probe-bearing pods would never go Ready (DECISIONS-LOG K4).
apiVersion: apps/v1
kind: Deployment
metadata:
name: gw-backend
namespace: conformance-gw-ingress
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/name: gw-backend
template:
metadata:
labels:
app.kubernetes.io/name: gw-backend
spec:
containers:
- name: declared
image: busybox:1.36.1
command:
- sh
- -c
- |
mkdir -p /www
echo GW_BACKEND_REACHED > /www/index.html
exec httpd -f -p 8080 -h /www
- name: undeclared
image: busybox:1.36.1
command:
- sh
- -c
- |
mkdir -p /www
echo GW_BACKEND_UNDECLARED > /www/index.html
exec httpd -f -p 9091 -h /www
---
# Service addresses both listeners (addressability); POLICY, not the Service, decides what
# the Gateway may reach. 8080 declared+allowed; 9091 undeclared (no allow).
apiVersion: v1
kind: Service
metadata:
name: gw-backend
namespace: conformance-gw-ingress
spec:
selector:
app.kubernetes.io/name: gw-backend
ports:
- name: declared
port: 8080
targetPort: 8080
- name: undeclared
port: 9091
targetPort: 9091
---
# DECLARED HTTPRoute -> allowed port 8080. Attaches to the real shared Gateway.
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: gw-declared
namespace: conformance-gw-ingress
spec:
parentRefs:
- name: shared
namespace: gateway
sectionName: https
hostnames:
- gw-declared-conformance.home.keithjackson.dev
rules:
- matches:
- path:
type: PathPrefix
value: /
backendRefs:
- name: gw-backend
port: 8080
---
# UNDECLARED HTTPRoute -> undeclared port 9091. The route is Accepted (routing works), but
# the Gateway Envoy's connection to backend:9091 is DROPPED by default-deny (no allow) — so
# the Gateway cannot reach it. Proves an undeclared port stays denied even through ingress.
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: gw-undeclared
namespace: conformance-gw-ingress
spec:
parentRefs:
- name: shared
namespace: gateway
sectionName: https
hostnames:
- gw-undeclared-conformance.home.keithjackson.dev
rules:
- matches:
- path:
type: PathPrefix
value: /
backendRefs:
- name: gw-backend
port: 9091
---
# Probe namespace: NO default-deny, so probes can reach the Gateway Service (simulating a
# LAN/edge client). The Gateway then proxies to the backend as identity `ingress` — the
# path under test. Kept separate from the app namespace so the app's default-deny stays
# namespace-wide (podSelector {}) exactly like production.
apiVersion: v1
kind: Namespace
metadata:
name: conformance-gw-probe