Summary

Make aicr bundle private by default for the agentgateway inference-gateway: when agentgateway is included and allowedSourceRanges is empty/unset, the bundler injects the private RFC1918 ranges into loadBalancerSourceRanges instead of emitting a LoadBalancer open to 0.0.0.0/0. The deployed gateway is reachable inside the cluster/VPC but denied to the public internet.

Motivation / Context

The inference-gateway defaulted open to the internet — an unset allowedSourceRanges rendered no loadBalancerSourceRanges, and Kubernetes treats that as allow-all. aicr bundle only printed a non-blocking warning. An unauthenticated, plaintext-HTTP inference endpoint open to the world is a real exposure (flagged on multiple clusters).

Fixes: #1373
Related: #1139, #1160, #1161

Type of Change

• New feature (security hardening)
• Documentation update
• Behavior change (open → private default; bundles still generate)

Component(s) Affected

• Bundlers (pkg/bundler, pkg/component/*)
• Core libraries — pkg/netutil
• Docs/examples (docs/)

Implementation Notes

resolveAgentgatewayExposure classifies agentgateway.allowedSourceRanges and resolves it default-then-validate:

• Unset/empty → injects agentgatewayDefaultSourceRanges (RFC1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) into the merged values + bundle note. Denies the public internet; keeps in-VPC reachability. Generation succeeds, so no-flag inference pipelines keep working.
• Scoped (valid canonical CIDRs, no any-source) → passes silently.
• Open (explicit 0.0.0.0/0 / ::/0) → allowed, logged loudly + bundle warning (deliberate opt-in).
• Invalid (bare-string --set, non-list, unparseable, or non-canonical CIDR) → ErrCodeInvalidRequest.

netutil.IsValidCIDR now uses netip.ParsePrefix and requires canonical form (p == p.Masked()) and rejects IPv4-mapped IPv6 prefixes (p.Addr().Is4In6()), so a CIDR like 1.2.3.4/24, 1.2.3.0/024, or ::ffff:192.12.2.0/120 is rejected at bundle time rather than failing Kubernetes 1.36+ strict CIDR validation at Service apply.

The default is a named constant, so switching to a deny-all sentinel (255.255.255.255/32) later is a one-line change. An internal-LB default (per-cloud annotations) is a possible follow-up (--internal), per #1373.

Design choice (private RFC1918 vs fail-closed vs deny-all): Kubernetes has no native deny-all for a LoadBalancer (empty = allow-all), so the default must be a real list. RFC1918 is "secure but not too limited" — no public exposure, gateway usable inside the VPC, and validate/conformance pass with no flags — without firewalling every deployment to one customer network. Note: the corporate VPN egresses from a public IP (216.228.127.128/30), so it is not covered by the RFC1918 default and still requires the flag — that's the intended private-vs-public separation.

Resolves the CI-breakage findings from cross-review: because no-flag bundles now generate (private) rather than error, runtime-install/generate-bundle.sh and the kwok inference lanes are unaffected — no per-workflow --set-json needed.

Testing

go test ./pkg/bundler/ ./pkg/netutil/...   # pass
golangci-lint run -c .golangci.yaml ./pkg/bundler/... ./pkg/netutil/...   # 0 issues

Manual end-to-end with a freshly built binary on an eks/h100/ubuntu/inference/dynamo recipe:

• no flag → generates; renders RFC1918 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 into the inference-gateway Service; bundle note recorded
• --set-json …='["216.228.127.128/30"]' → renders only the corp CIDR
• non-canonical / invalid CIDR → errors
• explicit 0.0.0.0/0 → generates with a loud warning

Verified on EKS cluster aicr3: redeploying agentgateway-post from a scoped bundle correctly reconciles loadBalancerSourceRanges onto the live inference-gateway Service (sentinel-swap test confirmed the field is live-controlled).

Updated chainsaw bundle-templates/agentgateway to assert the private-by-default render — all source-range checks match the rendered loadBalancerSourceRanges list entries (not the surrounding comments), confirming RFC1918 present and 0.0.0.0/0 absent. ai-conformance/offline and uat/{aws,gcp,azure}/cuj2-inference now exercise the default path (the redundant scoped --set-json was removed). Docs updated: component-catalog.md, cli-reference.md, bundling.md, plus the inline comments in recipes/components/agentgateway/values.yaml and manifests/inference-gateway.yaml.

Coverage: netutil.IsValidCIDR covered in cidr_test.go (incl. non-canonical rejection); resolveAgentgatewayExposure/classifyAgentgatewaySourceRanges covered by the rewritten TestResolveAgentgatewayExposure table (default-injection, scoped, any-source, invalid, non-canonical).

Risk Assessment

• Medium — Changes the default exposure for inference bundles (open → private), but bundles still generate/deploy and the change is isolated to one bundle-time step.

Rollout notes: No-flag inference bundles now deploy a private gateway instead of a public one. Operators who need public/VPN access pass --set-json agentgateway:allowedSourceRanges='["<cidr>"]' (corp VPN: 216.228.127.128/30) or '["0.0.0.0/0"]' for deliberate public exposure.

Release note (behavior change — inference-gateway open → private): The bundled agentgateway inference-gateway is now private by default. Operators who currently reach the endpoint from a public IP (corporate VPN egress, a public client) will be blocked on upgrade until they opt back in. Remediation: regenerate the bundle with --set-json agentgateway:allowedSourceRanges='["<your-cidr>"]' (or '["0.0.0.0/0"]' to restore the previous open behavior). This must be called out in the release notes.

Checklist

• Tests pass locally (affected packages, -race via make test scope)
• Linter passes (affected packages)
• I did not skip/disable tests to make CI green
• I added/updated tests for new functionality
• I updated docs if user-facing behavior changed
• Changes follow existing patterns in the codebase
• Commits are cryptographically signed (git commit -S)