Repository navigation
feat(sandbox): allow egress to private IP space via allowed_ips policy field - #60
Merged
Merged
Conversation
…y field Add an allowed_ips field to NetworkEndpoint that accepts CIDR notation and exact IPs, enabling sandboxes to reach private IP space under policy control while maintaining SSRF protections for loopback and link-local addresses. Three modes are supported: - Default (no allowed_ips): all private IPs blocked (existing behavior) - Host + allowlist: domain must resolve to an IP in allowed_ips - Hostless allowlist (no host): any domain allowed if resolved IP matches Closes #59
Adds a new skill that investigates a plain-language problem description by deeply exploring the codebase, then creates a structured GitHub issue with technical findings. Serves as a prequel to build-from-issue — maps vague ideas to concrete, buildable issues.
…E2E verification - Add explicit guardrail: agent-ready label must only be applied by humans - Add Phase 2 E2E verification: cluster:deploy + test:e2e:sandbox with retry loop, triggered when e2e/ files are modified - Add E2E attestation comment on PRs since CI does not yet run E2E tests
Collaborator
Author
E2E Test AttestationCommit: Test SummaryAll 41 E2E tests pass, including:
Full Test List
NotesInitial E2E failures were caused by k3s containerd caching a stale sandbox image ( |
…etch Render allowed_ips CIDR entries under each network endpoint, show hostless endpoints as *:port, annotate rules with 'private IP' when allowed_ips is present, and switch fetch_sandbox_detail to use the GetSandboxPolicy RPC so the TUI shows the current versioned policy instead of the immutable creation-time snapshot. Also add private-ip-routing example and cluster_pods dev policy entry for demonstrating private IP egress from sandboxes.
drew
pushed a commit
that referenced
this pull request
Mar 16, 2026
…y field (#60) * feat(sandbox): allow egress to private IP space via allowed_ips policy field Add an allowed_ips field to NetworkEndpoint that accepts CIDR notation and exact IPs, enabling sandboxes to reach private IP space under policy control while maintaining SSRF protections for loopback and link-local addresses. Three modes are supported: - Default (no allowed_ips): all private IPs blocked (existing behavior) - Host + allowlist: domain must resolve to an IP in allowed_ips - Hostless allowlist (no host): any domain allowed if resolved IP matches Co-authored-by: John Myers <[email protected]>
6 tasks
Bobbins228
pushed a commit
to Bobbins228/OpenShell
that referenced
this pull request
Sep 30, 2026
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #59
Adds an
allowed_ipsfield toNetworkEndpointthat accepts CIDR notation and exact IPs, enabling sandboxes to reach private IP space under policy control while maintaining SSRF protections.repeated string allowed_ips = 8toNetworkEndpointinsandbox.protois_always_blocked_ip(),resolve_and_check_allowed_ips(),parse_allowed_ips()functions; modified SSRF check inhandle_tcp_connection()to branch onallowed_ipspresenceendpoint_allowedclause, refactoredmatched_endpoint_configwithendpoint_matches_requestandendpoint_has_extended_confighelpers to flowallowed_ipsthrough to the proxyallowed_ipsfield toNetworkEndpointDefinnavigator-policycrate, madehostoptional for hostless endpointsarchitecture/security-policy.mdwith three-mode behavior, updatedgenerate-sandbox-policyskill with private IP examplesThree Modes
hostonly, noallowed_ipshost+allowed_ipsallowed_ipsonly (nohost)Loopback (
127.0.0.0/8) and link-local (169.254.0.0/16) are always blocked regardless ofallowed_ips.Test Plan
is_always_blocked_ip,parse_allowed_ips,resolve_and_check_allowed_ips, OPAallowed_ipsquery across all 3 modes, and proto round-tripmise run pre-commitpasses (format, lint, test, python)