mirrors/pikasTech-unidesk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: allow host-networked egress proxy

Browse Source
This commit is contained in:
Codex
2026-06-26 17:28:34 +00:00
parent 678dc427d6
commit 1a11d3654a
6 changed files with 35 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/src/platform-infra/policy.ts
+16 -2
View File
@@ -75,8 +75,10 @@ export function policyChecks(sub2api: Sub2ApiConfig, yaml: string, target: Sub2A
},
{
name: "no-host-network",
ok: !/^\s*hostNetwork:\s*true\s*$/mu.test(yaml),
detail: "Pods must not join the host network.",
ok: hostNetworkPolicyOk(yaml, target),
detail: target.egressProxy?.hostNetwork === true
? "Only the YAML-declared egress proxy Deployment may join the host network."
: "Pods must not join the host network unless explicitly allowed by YAML for the egress proxy.",
},
{
name: "no-host-port",
@@ -154,3 +156,15 @@ export function policyChecks(sub2api: Sub2ApiConfig, yaml: string, target: Sub2A
return checks;
}
function hostNetworkPolicyOk(yaml: string, target: Sub2ApiTargetConfig): boolean {
const matches = [...yaml.matchAll(/^\s*hostNetwork:\s*true\s*$/gmu)];
if (matches.length === 0) return true;
const proxy = target.egressProxy;
if (proxy === null || !proxy.enabled || !proxy.hostNetwork || matches.length !== 1) return false;
const egressProxyDeployment = new RegExp(
`kind:\\s*Deployment[\\s\\S]*?name:\\s*${escapeRegExp(proxy.deploymentName)}[\\s\\S]*?hostNetwork:\\s*true`,
"u",
);
return egressProxyDeployment.test(yaml);
}