From 21af87e85b9d59fc335bf0ee6e8ebf95c286f888 Mon Sep 17 00:00:00 2001 From: Ben Liderman <18233089+benldrmn@users.noreply.github.com> Date: Mon, 20 Jul 2026 02:37:34 +0300 Subject: [PATCH 1/2] strip operator-owned labels and annotations from pod template --- .../operator/controller/sandbox_controller.go | 18 ++++++ .../controller/sandbox_controller_pod_test.go | 58 +++++++++++++++++++ 2 files changed, 76 insertions(+) diff --git a/internal/operator/controller/sandbox_controller.go b/internal/operator/controller/sandbox_controller.go index 7c6a2573..b60bf7c1 100644 --- a/internal/operator/controller/sandbox_controller.go +++ b/internal/operator/controller/sandbox_controller.go @@ -20,6 +20,7 @@ import ( "maps" "path/filepath" "strconv" + "strings" "time" corev1 "k8s.io/api/core/v1" @@ -109,6 +110,17 @@ const ( LabelAllowIPv6Internet = "isola.run/allow-ipv6-internet-egress" LabelAllowClusterDNS = "isola.run/allow-cluster-dns" + // labelAllowPrefix namespaces the egress-authorization labels the operator owns. + // The Helm NetworkPolicies grant egress by selecting on these, so a pod template + // must not carry them or it would self-authorize access the Network spec never granted. + labelAllowPrefix = "isola.run/allow-" + + // gvisorAnnotationPrefix namespaces the gVisor runtime annotations the operator owns + // (overlay2, qdisc rate limiting, and namespace-scoped rootfs.upper restore paths). + // A pod template must not carry these or it could weaken the sandbox or point a + // rootfs restore at another namespace's tar. + gvisorAnnotationPrefix = "dev.gvisor." + // SidecarVersionAnnotation records on the sandbox pod the isola-operator // GitVersion at the moment the pod was created. Sandbox.Status.SidecarVersion // is a mirror of this annotation; the pod is the durable source of truth so @@ -275,6 +287,9 @@ func (r *SandboxReconciler) CreateSandboxPod(ctx context.Context, sandbox *sandb // This prevents templates from overriding app.kubernetes.io/* etc. labels := make(map[string]string) maps.Copy(labels, sandbox.Spec.PodTemplate.Labels) + maps.DeleteFunc(labels, func(k, _ string) bool { + return strings.HasPrefix(k, labelAllowPrefix) + }) // Standard Kubernetes recommended labels (https://kubernetes.io/docs/concepts/overview/working-with-objects/common-labels/) labels["app.kubernetes.io/name"] = "isola-sandbox" @@ -290,6 +305,9 @@ func (r *SandboxReconciler) CreateSandboxPod(ctx context.Context, sandbox *sandb annotations := make(map[string]string, len(sandbox.Spec.PodTemplate.Annotations)) maps.Copy(annotations, sandbox.Spec.PodTemplate.Annotations) + maps.DeleteFunc(annotations, func(k, _ string) bool { + return strings.HasPrefix(k, gvisorAnnotationPrefix) + }) sandboxPod := &corev1.Pod{ ObjectMeta: metav1.ObjectMeta{ diff --git a/internal/operator/controller/sandbox_controller_pod_test.go b/internal/operator/controller/sandbox_controller_pod_test.go index 7bd84eb1..518a35f1 100644 --- a/internal/operator/controller/sandbox_controller_pod_test.go +++ b/internal/operator/controller/sandbox_controller_pod_test.go @@ -178,6 +178,64 @@ var _ = Describe("Sandbox Controller", func() { Expect(pod.Annotations).To(HaveKeyWithValue("dev.gvisor.flag.overlay2", "root:self")) }) + It("should strip operator-owned egress-authorization labels from the pod template", func() { + sandboxName := "sandbox-strip-labels" + + // A template that pre-sets the allow-* labels the Helm NetworkPolicies + // select on would self-authorize egress the Network spec never granted. + createSandbox(ctx, sandboxName, func(s *sandboxv1alpha1.Sandbox) { + s.Spec.PodTemplate.Labels = map[string]string{ + LabelAllowIPv4Internet: "true", + LabelAllowClusterDNS: "true", + "team": "blue", + } + }) + defer deleteSandbox(ctx, sandboxName) + + podName := sandboxName + "-pod" + defer deletePod(ctx, podName) + + _, err := doReconcile(ctx, reconciler, sandboxName) + Expect(err).NotTo(HaveOccurred()) + + pod := getPod(ctx, podName) + Expect(pod).NotTo(BeNil()) + Expect(pod.Labels).NotTo(HaveKey(LabelAllowIPv4Internet)) + Expect(pod.Labels).NotTo(HaveKey(LabelAllowClusterDNS)) + // Benign template labels are preserved. + Expect(pod.Labels).To(HaveKeyWithValue("team", "blue")) + }) + + It("should strip operator-owned gVisor annotations from the pod template", func() { + sandboxName := "sandbox-strip-annotations" + + // A template that pre-sets dev.gvisor.* could weaken the sandbox or point + // a rootfs restore at another namespace's tar, bypassing namespace scoping. + createSandbox(ctx, sandboxName, func(s *sandboxv1alpha1.Sandbox) { + s.Spec.PodTemplate.Annotations = map[string]string{ + "dev.gvisor.tar.rootfs.upper.sandbox": "/host/snapshots/victim/secret.tar", + "dev.gvisor.flag.qdisc": "tbf", + "team": "blue", + } + }) + defer deleteSandbox(ctx, sandboxName) + + podName := sandboxName + "-pod" + defer deletePod(ctx, podName) + + _, err := doReconcile(ctx, reconciler, sandboxName) + Expect(err).NotTo(HaveOccurred()) + + pod := getPod(ctx, podName) + Expect(pod).NotTo(BeNil()) + Expect(pod.Annotations).NotTo(HaveKey("dev.gvisor.tar.rootfs.upper.sandbox")) + Expect(pod.Annotations).NotTo(HaveKey("dev.gvisor.flag.qdisc")) + // The operator's own gVisor annotation is still applied. + Expect(pod.Annotations).To(HaveKeyWithValue("dev.gvisor.flag.overlay2", "root:self")) + // Benign template annotations are preserved. + Expect(pod.Annotations).To(HaveKeyWithValue("team", "blue")) + }) + It("should inject sleep infinity when no command is specified", func() { sandboxName := "sandbox-default-cmd" From e67ace7c250dd62c06a09103dc087a134be6c5ae Mon Sep 17 00:00:00 2001 From: Ben Liderman <18233089+benldrmn@users.noreply.github.com> Date: Mon, 20 Jul 2026 20:16:10 +0300 Subject: [PATCH 2/2] remove redundant comment --- internal/operator/controller/sandbox_controller.go | 7 ------- .../operator/controller/sandbox_controller_pod_test.go | 7 ------- 2 files changed, 14 deletions(-) diff --git a/internal/operator/controller/sandbox_controller.go b/internal/operator/controller/sandbox_controller.go index b60bf7c1..0e3f905d 100644 --- a/internal/operator/controller/sandbox_controller.go +++ b/internal/operator/controller/sandbox_controller.go @@ -110,15 +110,8 @@ const ( LabelAllowIPv6Internet = "isola.run/allow-ipv6-internet-egress" LabelAllowClusterDNS = "isola.run/allow-cluster-dns" - // labelAllowPrefix namespaces the egress-authorization labels the operator owns. - // The Helm NetworkPolicies grant egress by selecting on these, so a pod template - // must not carry them or it would self-authorize access the Network spec never granted. labelAllowPrefix = "isola.run/allow-" - // gvisorAnnotationPrefix namespaces the gVisor runtime annotations the operator owns - // (overlay2, qdisc rate limiting, and namespace-scoped rootfs.upper restore paths). - // A pod template must not carry these or it could weaken the sandbox or point a - // rootfs restore at another namespace's tar. gvisorAnnotationPrefix = "dev.gvisor." // SidecarVersionAnnotation records on the sandbox pod the isola-operator diff --git a/internal/operator/controller/sandbox_controller_pod_test.go b/internal/operator/controller/sandbox_controller_pod_test.go index 518a35f1..dddb5ac9 100644 --- a/internal/operator/controller/sandbox_controller_pod_test.go +++ b/internal/operator/controller/sandbox_controller_pod_test.go @@ -181,8 +181,6 @@ var _ = Describe("Sandbox Controller", func() { It("should strip operator-owned egress-authorization labels from the pod template", func() { sandboxName := "sandbox-strip-labels" - // A template that pre-sets the allow-* labels the Helm NetworkPolicies - // select on would self-authorize egress the Network spec never granted. createSandbox(ctx, sandboxName, func(s *sandboxv1alpha1.Sandbox) { s.Spec.PodTemplate.Labels = map[string]string{ LabelAllowIPv4Internet: "true", @@ -202,15 +200,12 @@ var _ = Describe("Sandbox Controller", func() { Expect(pod).NotTo(BeNil()) Expect(pod.Labels).NotTo(HaveKey(LabelAllowIPv4Internet)) Expect(pod.Labels).NotTo(HaveKey(LabelAllowClusterDNS)) - // Benign template labels are preserved. Expect(pod.Labels).To(HaveKeyWithValue("team", "blue")) }) It("should strip operator-owned gVisor annotations from the pod template", func() { sandboxName := "sandbox-strip-annotations" - // A template that pre-sets dev.gvisor.* could weaken the sandbox or point - // a rootfs restore at another namespace's tar, bypassing namespace scoping. createSandbox(ctx, sandboxName, func(s *sandboxv1alpha1.Sandbox) { s.Spec.PodTemplate.Annotations = map[string]string{ "dev.gvisor.tar.rootfs.upper.sandbox": "/host/snapshots/victim/secret.tar", @@ -230,9 +225,7 @@ var _ = Describe("Sandbox Controller", func() { Expect(pod).NotTo(BeNil()) Expect(pod.Annotations).NotTo(HaveKey("dev.gvisor.tar.rootfs.upper.sandbox")) Expect(pod.Annotations).NotTo(HaveKey("dev.gvisor.flag.qdisc")) - // The operator's own gVisor annotation is still applied. Expect(pod.Annotations).To(HaveKeyWithValue("dev.gvisor.flag.overlay2", "root:self")) - // Benign template annotations are preserved. Expect(pod.Annotations).To(HaveKeyWithValue("team", "blue")) })