claude-bot
b0ddbe0dfd
Addresses the blocking review finding on #504. The "step pods call the server back on :8000" rule was attached to the namespace baseline, which uses endpointSelector: {}. A toPorts block narrows the port, not the destination workload — that is governed solely by the enclosing policy's endpointSelector. So the rule granted woodpecker-ci access to :8000 on every pod in the namespace, and the CNPG instance manager serves its status API on :8000 (server.yaml:94 uses the same port). Arbitrary repo-supplied build steps would have had a route to wp-pg's instance manager. That is the same endpointSelector:{}-means-blanket-grant failure this PR exists to escape, reproduced inside the fix. Removed rather than rescoped: there is no woodpecker server in this namespace until stage 2, so the rule was premature as well as wrong. It lands there as its own policy selecting the server pod, the way woodpecker-allow-rotators already scopes its :8000 rule. The baseline now carries no port-scoped rules at all, so nothing in it can be mistaken for workload scoping, and a comment warns why that must stay true. Also from the review: - Corrected the KS attribution. The network policies ship with infrastructure-crds (infrastructure/post-crds includes ../network-policies/), not the top-level infrastructure KS. The ordering conclusion is unchanged — infrastructure-crds dependsOn infrastructure, and woodpecker dependsOn both — but the comments named the wrong one. - Documented why the baseline has no egress section, instead of leaving it to read as an oversight. Writing that ruleset in stage 2, with the server and agent present, beats guessing it now and breaking the WAL archiving this stage exists to verify. - Dropped the monitoring -> :9187 rule from wp-pg-allow-cnpg-operator. The baseline already allows the monitoring namespace unrestricted, so it added no coverage while implying scoping it did not provide. - Added a cilium-dbg policy trace step to the runbook. dry-run validates manifest shape, not Cilium semantics, and would not have caught this bug. Co-Authored-By: Claude Bot <claude-bot@renner.uno>