merge: upstream/main + recover wildcards/signing on projection-v1 - #43

Merged

entlein merged 52 commits into

mainfrom

merge/upstream-profile-rearch

May 16, 2026

Commits on Apr 27, 2026

Replace AP and NN cache with CP (#788)
matthyx
authored
7c2c899
feat: extract client CA file from kubelet config YAML and enhance service file handling (#791)
matthyx
authored
95c2862
add learning period label to TS CPs (#797)
matthyx
authored
6f9697e

Commits on Apr 29, 2026

perf: switch to kubescape/syft v1.32.0-ks.2 + disable file catalogers (#798)

authored
dbe9a16

Commits on May 4, 2026

fix: record exec path symmetric with rule-side resolver (#800)
slashben
authored
bfd6059
implement Rule-Aware Profile Projection (#799)

matthyx
and
claude
authored
11e632f

Commits on May 6, 2026

get services from API, removing sidecar requirement (#772)

matthyx
and
claude
authored
2d768cb

Commits on May 10, 2026

tests(resources): 20 NetworkNeighborhood fixtures for v0.0.2 wildcard surface
Entlein
committed
9e85635
feat(nn): rewire CEL functions to use storage networkmatch
Entlein
committed
b966200
test(nn): fixture-walk parser + behaviour gate
Entlein
committed
efdae31
chore: drop k8sstormcenter/storage from go.sum
Entlein
committed
f848fd3
chore: gitignore .claude + pin storage to fork ref carrying networkmatch
Entlein
committed
8bddfc7
fix(nn): address CodeRabbit review on PR #41
Entlein
committed
f6d2c96
chore(deps): bump storage SHA to 0910dc3f (CR round 2)
Entlein
committed
07d4bc0
chore(deps): bump storage SHA to 02c4438f (CR round 3)
Entlein
committed
bb5702a
fix(nn): address CodeRabbit round 2 on PR #41
Entlein
committed
f89fc80
test(nn): pin wildcard/CIDR semantics on deprecated IPAddress (CR round 3)
Entlein
committed
4c90e22

Commits on May 12, 2026

fix: improve logging for rules with missing profileDataRequired (#803)
matthyx
authored
cc59fa0

Commits on May 13, 2026

perf(nn): amortise CompileIP/CompileDNS via per-container matcher cache
Entlein
committed
93e6e1b
fix(matcher_cache): atomic-pointer lazy init + unconditional staleness replace (CR #42)
Entlein
committed
419ebba
test(matcher_cache): add start barrier to concurrency test (CR #42 round 2)
Entlein
committed
05ce6d9
merge: upstream/main into feat/network-wildcards-matcher-cache
Entlein
committed
9c28506
feat: recover wildcards + exec-args matching on top of upstream projection
Entlein
committed
d714d21
fix: address CodeRabbit round 1 on PR #43
Entlein
committed
f59cc69
fix: restore fork's .github and tests/chart from main (lost during upstream merge)
Entlein
committed
8a46346
fix(parse): get_exec_path 3-arg overload — symmetric with recording
Entlein
committed
033eb2f
fix(exporters): expose exepath label in alertmanager alerts
Entlein
committed
29a9de4
fix(chart): bind 'Signed profile tampered' (R1016) so Test_31 fires
Entlein
committed
e28dd10
fix(main): wire SetTamperAlertExporter so R1016 actually fires
Entlein
committed
4f96f8c

Commits on May 14, 2026

chore(review): address rabbit feedback on PR #43
Entlein
committed
31a3fb1
ci(component-tests): restore Test_03/04/05/09 to the matrix
Entlein
committed
54ab05f
fix(profilecache): invoke tamper verification on user-overlay load (Test_31)
Entlein
committed
eff03ad
test(component): rewrite Test_32 — isolate R0040 from R0001 conflation
Entlein
committed
a2ab272
test(component): Test_32 — enumerate bare-name path variants in profile
Entlein
committed
c3b692e
test(projection): pin user-overlay Execs → projected.Execs.Values contract
Entlein
committed
ac911cf
fix(projection): fold user-overlay identity into SyncChecksum (Test_32 root cause)
Entlein
committed
f80f349
diag(exec): log Execs.Values keys on ap.was_executed miss (task #61)
Entlein
committed
290cb61
fix(exec-path): prefer absolute argv[0] over kernel exepath (symlink-faithful)
Entlein
committed
9a6eb35
test(component): Test_32 — match profile to symlink-faithful argv[0]
Entlein
committed
656deb5
fix(rules+test): non-blocking notifier fan-out + drop dead was_path_opened_with_flags + R0003 noise gate in Test_09
Entlein
committed
12cfea6
test(component): Test_09 — also exclude R0006 SA-token from FP gate
Entlein
committed
246f961

Commits on May 15, 2026

fix(rules+cache): five CodeRabbit findings on NA PR #43
Entlein
committed
f3e3d20
fix(cache): propagate ctx through RBCache add/delete/modify helpers
Entlein
committed
8b34f59
chore(chart): restore profileDataRequired field in rules CRD schema
Entlein
committed
1b8f4b8
chore(chart): restore profileProjection runtime config block
Entlein
committed
6371181
chore(chart): restore profileDataRequired on all 20 rules
Entlein
committed
8a63e3c
chore(chart): restore state-block filters on R0006, R0008, R1009
Entlein
committed
007d760
fix(chart): revert R1006 profileDependency from 2 (NotRequired) to 1 (Optional)
Entlein
committed
2e2077b
restore: ap.was_path_opened_with_flags CEL helper
Entlein
committed
92d3aca
test(applicationprofile): restore was_path_opened_with_flags integration test
Entlein
committed
ea4e657
Revert "fix(cache): propagate ctx through RBCache add/delete/modify helpers"
Entlein
committed
6f45ec2

Commits on May 16, 2026

release/sbob-rc1: TDD fixes for upstream NA rabbit findings (#807, #808) (#44)

entlein
and
Entlein
authored
dd83f4a