feat(network): symmetric R0011/R0012 with NetworkPolicy-style internal allowlisting and port-aware alerting - #923

Closed

entlein wants to merge 41 commits into

kubescape:mainfrom

k8sstormcenter:feat/network-v2

Commits on Sep 9, 2026

allow networkpolicy to be a cel selector for internal/external traffic allowlisting
entlein
committed
152b6a1
Allow alert from unexpected Ports, allow Port=0 as intentional wildcard
entlein
committed
d8012be
Allow alert from unexpected Ports, allow Port=0 as intentional wildcard
entlein
committed
15964c0
remove explicit wildcard, declare port as non-mandatory, keep the alert if delcared and violated
entlein
committed
ea8718b
feat(cel/network): serviceRef/serviceSelector/host neighbor resolution
entlein
committed
f2958d3
feat(cel/network): real-Flux component test, RBAC + perf fixes for serviceRef
entlein
committed
a0c6dd9
test(component): scope the internal-egress rule to the serviceRef suite
entlein
committed
fa8a6d6
test(chart): make network service resolution a value
entlein
committed
2aa0fea
fix(cel): invalidate cached results when a profile is re-resolved
entlein
committed
641c523
feat(rules): R0012 unexpected internal egress
entlein
committed
daf4658
feat(rules): R0011/R0012 symmetric egress/ingress, no IP-class gate
entlein
committed
62280f9
dedup selector engine after portalerts merge
entlein
committed
398dba2
pin storage to k8sstormcenter/storage@3844202a (dnsNames + deflate fixes)
entlein
committed
b930e20
test(component): Test_50 asserts shipped R0011; Test_51 ingress R0012 twin
entlein
committed
34ba4c4
chart(kubescape-rules): standalone chart shipping the R0011/R0012 ruleset
entlein
committed
1e129cd
rules: consume the peer-selector engine in R0011/R0012
entlein
committed
00f4dd2
review: address maintainer blockers on network-v2

entlein
and
claude
committed
703d142
fix(cel/network): label-only peer matching, empty selector fails closed
entlein
committed
c14926c
test(networkpeer): characterize excludeNamespaces × selector resolution

entlein
and
claude
committed
9974b0f
test(cel/network): eval-level selector truth tables, matchAddrPort grid, fail-closed edges
entlein
committed
6a08861
test: pin default-posture R0011/R0012 behavior on learned profiles (Test_53)

entlein
and
claude
committed
1519962
fix(learn): record service ClusterIP so learned profiles don't false-positive R0011/R0012

entlein
and
claude
committed
a01f15a
feat(network): silence node/host peers by default; expose loopback to R0011/R0012

entlein
and
claude
committed
319d868
Revert the standalone kubescape-rules chart

entlein
and
claude
committed
f1ed309
fix(network): address review — port-aware selector matching + CR nits

entlein
and
claude
committed
b9cf961
test(testutils): use a YAML document reader for multi-doc apply (CodeRabbit)

entlein
and
claude
committed
6978e02
perf(projection): don't mark every profile resolution-dependent for the host peer

entlein
and
claude
committed
bb3a5e6
test(component): make Test_20/30/36 deterministic — kill the flakes

entlein
and
claude
committed
55001dc
fix(projection): keep host-injected profiles resolution-dependent (matthyx)

entlein
and
claude
committed
48fc584
test(component): Test_54 — peer allowlisting is namespace-invariant (entlein)

entlein
and
claude
committed
b6d5bd1
Revert "test(component): Test_54 — peer allowlisting is namespace-invariant (entlein)"
entlein
committed
0d6358b
feat(network): commit to namespace-agnostic peer matching, drop dead profileNs

entlein
and
claude
committed
3b8d18c
test(network): name the namespace-disambiguation collision case explicitly

entlein
and
claude
committed
a08e735
feat(network): NetworkPolicy namespaceSelector semantics — omitted=same-ns, {}=cluster-wide

entlein
and
claude
committed
790a618
feat(network): unify serviceSelector namespace semantics with the podSelector path

entlein
and
claude
committed
189a8b2
pinning sotrage to kubescape
entlein
committed
763f734
pinning sotrage to kubescape part 2
entlein
committed
ee19189
switching off by default and 3-way overlay
entlein
committed
ddac9c8
hostaddr listing
entlein
committed
462151d
fix(network): resolve rebase fallout — restore the egress selector clause, keep the prepared resolution values, adopt upstream's test helpers
entlein
committed
bb61ec4

Commits on Sep 10, 2026

unmessing the rebase mess - try1
entlein
committed
b74353e