fix(ec2): honest enforcement status + subnet IP + nft sanitize + serialize reconcile

[vieiralucas]

Summary

Bug-hunt 2026-06-18 findings 1.5, 1.6, 1.7, 2.2, 4.3 (the audit's remaining tail).

• 1.5 (MED) — nftables enforcement now requires a native-Linux host whose daemon shares this netns (resolve_enforcement_mode gains host_local). On Docker Desktop / podman-machine the bridges live in the daemon's VM, so host nft filters nothing — yet enforced falsely read true. Now degrades with an accurate warning.
• 1.6 (LOW) — CNI detection scans calico-system / tigera-operator / cilium besides kube-system, so a Tigera-operator / dedicated-namespace Calico/Cilium isn't mis-reported as non-enforcing.
• 1.7 (LOW) — instance metadata private IP derived from the subnet CIDR (was hard-coded 10.0.0.x outside the subnet); real container IPs still override.
• 2.2 (LOW) — CIDR/protocol tokens are charset-sanitized before interpolation into the nft -f - script, closing a ruleset-injection surface.
• 4.3 (LOW) — firewall reconciles serialized behind a per-runtime async mutex so a concurrent k8s apply+prune can't delete a just-applied NetworkPolicy.

Test plan

• cargo test -p fakecloud-ec2 -p fakecloud-k8s (incl. host-local gate + out-of-range port tests), control-plane e2e green, clippy + fmt clean.

---

Summary by cubic

Fix false-positive nftables enforcement on non-host-local setups, sanitize nft input, derive instance private IPs from the subnet, broaden CNI detection, and serialize policy reconciles to avoid races. Adds unit tests for sanitization, subnet-derived IPs, and the host-local enforcement gate.

• Bug Fixes
  • Require a native Linux host whose daemon shares the netns for nftables; if opted-in via FAKECLOUD_EC2_SG_ENFORCEMENT but not host-local or nft/CAP_NET_ADMIN capable, degrade to disabled with a clear warning.
  • Sanitize CIDR [0-9a-fA-F.:/] and protocol tokens [a-z0-9-] before embedding into nft -f -; drop invalid matches only.
  • Derive metadata private IPs from the instance’s subnet CIDR instead of a fixed 10.0.0.x; real container IPs still override when available.
  • Detect CNI by scanning kube-system, calico-system, tigera-operator, and cilium; exposed as cni_component_names() in fakecloud-k8s.
  • Serialize firewall and NetworkPolicy reconciles with a per-runtime async mutex to prevent apply/prune races.

^{Written for commit 0488455. Summary will update on new commits.}

[codecov]

Codecov Report

❌ Patch coverage is 65.06024% with 29 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/fakecloud-k8s/src/client.rs	0.00%	9 Missing ⚠️
crates/fakecloud-ec2/src/service/instance.rs	68.00%	8 Missing ⚠️
crates/fakecloud-ec2/src/runtime/mod.rs	0.00%	7 Missing ⚠️
crates/fakecloud-ec2/src/runtime/firewall.rs	90.24%	4 Missing ⚠️
crates/fakecloud-ec2/src/runtime/k8s.rs	0.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!