Add basic network policy for Ingress to Workers by haiyanmeng · Pull Request #488 · agent-substrate/substrate

haiyanmeng · 2026-07-22T02:14:58Z

This PR includes #340 and several tiny enhancements:

- Add ate.dev/worker-pool label to NetworkPolicy metadata and remove Egress management to allow default egress behavior
- Define ateSystemNamespace and atenetRouterAppName constants for Ingress peer selectors
- Centralize deterministic NetworkPolicy naming logic (resources.NetworkPolicyName) and prevent trailing hyphens
- Add comprehensive E2E test suite for networkpolicy covering control plane reconciliation, positive data plane verification (authorized ingress via atenet-router), and negative data plane verification (unauthorized ingress blocking)

Here is the e2e test result:

$ ./hack/run-e2e.sh ./internal/e2e/suites/networkpolicy/...
=== RUN   TestNetworkPolicyLifecycleAndReconciliation
    networkpolicy_test.go:45: Creating namespace: pown-891
    networkpolicy_test.go:61: Creating WorkerPool pown-891/test-wp-netpol...
    networkpolicy_test.go:67: Waiting for NetworkPolicy substrate-test-wp-netpol-4d332 to be created...
    networkpolicy_test.go:83: Successfully retrieved NetworkPolicy substrate-test-wp-netpol-4d332
    networkpolicy_test.go:120: Deleting WorkerPool pown-891/test-wp-netpol and verifying NetworkPolicy GC...
    networkpolicy_test.go:139: NetworkPolicy substrate-test-wp-netpol-4d332 was successfully garbage collected
--- PASS: TestNetworkPolicyLifecycleAndReconciliation (2.48s)
=== RUN   TestNetworkPolicyDataPlaneEnforcement
    networkpolicy_test.go:143: Creating namespace: rulb-250
    networkpolicy_test.go:148: Waiting for ActorTemplate rulb-250/counter to be Ready...
    networkpolicy_test.go:148: ActorTemplate rulb-250/counter is Ready with golden snapshot "gs://snapshot-substrate-test-haiyanmeng-gke-dev/ate-demo-counter/7f7a56f7-a3c9-44ba-9486-c98e763282e7/2026-07-22T18:37:38Z-WVWHPIIGHK5MMVFYITI7ACPTG3"
    networkpolicy_test.go:159: Creating Actor "netpol-dataplane-rulb-250" in Atespace "rulb-250"...
    networkpolicy_test.go:176: Resuming Actor "netpol-dataplane-rulb-250"...
    networkpolicy_test.go:182: Actor "netpol-dataplane-rulb-250" reached RUNNING status
    networkpolicy_test.go:185: === Verifying authorized ingress via atenet-router ===
    networkpolicy_test.go:214: Positive Data Plane Verification PASSED: Successfully accessed actor "netpol-dataplane-rulb-250" via authorized atenet-router (HTTP 200): hello from: 169.254.17.2 | preserved memory count: 1 | preserved file counter: 1
    networkpolicy_test.go:217: === Verifying unauthorized ingress blocking ===
    networkpolicy_test.go:218: Creating namespace: jwnm-278
    networkpolicy_test.go:231: Target worker pod rulb-250/counter-856d7c896c-j9zcp has IP 10.24.0.31
    networkpolicy_test.go:256: Creating unauthorized probe pod jwnm-278/unauthorized-probe...
    networkpolicy_test.go:260: Pod jwnm-278/unauthorized-probe is RUNNING
    networkpolicy_test.go:272: Executing unauthorized connection attempt from jwnm-278/unauthorized-probe to 10.24.0.31:8080...
    networkpolicy_test.go:278: Negative Data Plane Verification PASSED: Unauthorized connection attempt from jwnm-278/unauthorized-probe to 10.24.0.31:8080 was blocked as expected (err: exit status 1)
--- PASS: TestNetworkPolicyDataPlaneEnforcement (13.01s)
PASS
Cleaning up 3 namespaces...
Deleting namespace pown-891...
Deleting namespace rulb-250...
Deleting namespace jwnm-278...
ok  	github.com/agent-substrate/substrate/internal/e2e/suites/networkpolicy	16.954s

Eitan Yarmush (EItanya) · 2026-07-22T19:54:19Z

This PR includes #340 and several tiny enhancements:

Should we close #340 then?

Eitan Yarmush (EItanya) · 2026-07-22T19:55:23Z

 		os.Exit(1)
 	}

+	if err = (&controllers.NetworkPolicyReconciler{


Should this be optional? seems like a net positive, but not sure if specific networking needs might want this togglable

Bowei Du (@bowei) , what do you think?

haiyanmeng · 2026-07-22T19:57:33Z

This PR includes #340 and several tiny enhancements:

Should we close #340 then?

I asked Bowei Du (@bowei) to close #340

Bowei Du (bowei)

LGTM -- apart from busybox comment

Bowei Du (bowei) · 2026-07-28T06:48:43Z

+			Containers: []corev1.Container{
+				{
+					Name:    "probe",
+					Image:   "busybox@sha256:1487d0af5f52b4ba31c7e465126ee2123fe3f2305d638e7827681e7cf6c83d5e",


I remember there are some issues with busybox license. Can we use a different image for this?

Which license issue are you referring to?

https://github.com/search?q=repo%3Aagent-substrate%2Fsubstrate%20busybox&type=code: there are several places in the codebase using busybox.

You can find this in a web search: "Busybox license issues". You can probably replace with "toybox" -- I just remember in some projects, we ended up replacing all instances of Busybox

You need to rebase

Rebased the PR.

I sent out #579 to gate copyleft base images in Dockerfiles.

Referencing busybox docker images is okay, and should not have license issues.

Eitan Yarmush (EItanya) · 2026-07-29T13:09:10Z

+								WithMatchLabels(map[string]string{"kubernetes.io/metadata.name": ateSystemNamespace})).
+							WithPodSelector(metav1ac.LabelSelector().
+								WithMatchLabels(map[string]string{"app": atenetRouterAppName})),


Bowei Du (@bowei), will this be the official documented way to ensure that an ingress which is used besides the OOTB will pass NetworkPolicy?

What is "OOTB"?

Restrict Ingress to Workers and hence Actors to be only from the Router component. This makes the atecontroller responsible for K8s level network policy Note: this is a belts-and-suspenders model as this applies on the Worker level. This will be refined further with Actor-specific policies.

- Add ate.dev/worker-pool label to NetworkPolicy metadata and remove Egress management to allow default egress behavior - Define ateSystemNamespace and atenetRouterAppName constants for Ingress peer selectors - Centralize deterministic NetworkPolicy naming logic (resources.NetworkPolicyName) and prevent trailing hyphens - Add comprehensive E2E test suite for networkpolicy covering control plane reconciliation, positive data plane verification (authorized ingress via atenet-router), and negative data plane verification (unauthorized ingress blocking)

haiyanmeng · 2026-07-29T14:12:46Z

/rerun

Bowei Du (bowei) · 2026-07-29T15:41:59Z

Looks like the request parking e2e test is failing.

Bowei Du (bowei) · 2026-07-29T15:42:21Z

Can we check that it's not related to this change.

Bowei Du (bowei)

code lgtm ; tests are not passing (yet)

haiyanmeng · 2026-07-29T17:43:35Z

Bowei Du (@bowei) , a rerun of the presubmit succeeded. I also ran the parking e2e test locally 10+ times, they all succeeded.

I think we can treat it a rare flakiess for now. I will investigate it more if this comes back.

haiyanmeng force-pushed the pr-340 branch 3 times, most recently from 0af3ac5 to 5eba34e Compare July 22, 2026 19:08

Eitan Yarmush (EItanya) reviewed Jul 22, 2026

View reviewed changes

haiyanmeng mentioned this pull request Jul 22, 2026

Add basic network policy for Ingress to Workers #340

Closed

Bowei Du (bowei) reviewed Jul 28, 2026

View reviewed changes

haiyanmeng requested a review from Bowei Du (bowei) July 28, 2026 10:37

Eitan Yarmush (EItanya) reviewed Jul 29, 2026

View reviewed changes

haiyanmeng force-pushed the pr-340 branch from 5eba34e to c7ef588 Compare July 29, 2026 13:17

haiyanmeng force-pushed the pr-340 branch from c7ef588 to 47c3370 Compare July 29, 2026 13:31

Bowei Du (bowei) approved these changes Jul 29, 2026

View reviewed changes

Bowei Du (bowei) merged commit 53aac5b into agent-substrate:main Jul 29, 2026
13 of 15 checks passed

haiyanmeng mentioned this pull request Jul 29, 2026

Harden interior net filtering rules #175

Open

Uh oh!

Conversation

haiyanmeng commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Eitan Yarmush (EItanya) commented Jul 22, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

haiyanmeng commented Jul 22, 2026

Uh oh!

Bowei Du (bowei) left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

haiyanmeng commented Jul 29, 2026

Uh oh!

Bowei Du (bowei) commented Jul 29, 2026

Uh oh!

Bowei Du (bowei) commented Jul 29, 2026

Uh oh!

Bowei Du (bowei) left a comment

Choose a reason for hiding this comment

Uh oh!

haiyanmeng commented Jul 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

haiyanmeng commented Jul 22, 2026 •

edited

Loading