Commit d2bc261

# metallb speaker memberlist gossip is bound on both TCP and UDP on

# host-network. Cilium PortProtocol matches all transport protocols

# (TCP+UDP+SCTP) when `protocol:` is "ANY", omitted, or empty — so the

# other entries in this list already cover their (single-protocol)

# listeners. The explicit `protocol: ANY` on 7946 is documentation of

# intent for the one multi-protocol listener in the set; it is not a

# behavior change vs. omitting the field. Cluster peers still reach

# 7946 via the ingress fromEntities[cluster,host] clause below

# regardless of the deny.

- port: "7946"

protocol: ANY

- port: "9120" # metallb speaker metrics (HTTPS, host-network)

- port: "9121" # metallb legacy FRR metrics (HTTPS, host-network; only bound when speaker.frr.enabled=true escape hatch is engaged)

- port: "9140" # metallb frr-k8s controller metrics (HTTPS, host-network)

- port: "9141" # metallb frr-k8s FRR metrics (HTTPS, host-network)

- port: "9443" # etcd kube-rbac-proxy host-network bind (cozy-monitoring DaemonSet); metallb controller also binds 9443 on pod-IP for its webhook — pod-IP is out of scope for this world-deny but the port number collides

- port: "19443" # metallb frr-k8s statuscleaner webhook (HTTPS, host-network)

suite: cilium-networkpolicy port-deny invariants

release:

name: cilium-networkpolicy

namespace: cozy-cilium-networkpolicy

templates:

- templates/networkpolicy.yaml

tests:

- it: denies world ingress to every metallb v0.16 host-network listener

# These ports are opened on host-network by metallb v0.16:

# 7946 — speaker memberlist gossip (TCP/UDP). Cluster peers still

# reach it via the ingress fromEntities[cluster,host] clause

# on the same policy; the deny only blocks `world`.

# 9120 — speaker metrics (HTTPS).

# 9121 — legacy FRR metrics (HTTPS, only bound when the escape hatch

# speaker.frr.enabled=true is engaged; kept in the denylist

# defensively so the escape hatch stays safe).

# 9140 — frr-k8s controller metrics (HTTPS, DaemonSet).

# 9141 — frr-k8s FRR metrics (HTTPS, DaemonSet).

# 19443 — frr-k8s statuscleaner webhook (HTTPS, Deployment with

# hostNetwork: true and master+control-plane tolerations).

# The deny list MUST cover all six; missing any one leaks the

# corresponding endpoint to world on any node that schedules the pod.

# Port 9443 is bound on host-network by the cozy-monitoring etcd

# kube-rbac-proxy DaemonSet — asserted separately below; metallb

# controller webhook collides on the same port number but on pod-IP,

# out of scope for this world-deny.

asserts:

# 7946 carries memberlist gossip on both TCP and UDP. Cilium's

# PortProtocol matches all transport protocols when "ANY", omitted,

# or empty, so this entry would be a functional no-op without

# `protocol: ANY` too — the assertion pins the explicit-intent

# marker as the contract for the one multi-protocol listener, so a

# future edit that drops `protocol: ANY` (and silently relies on

# the implicit match) fails this test.

- contains:

path: spec.ingressDeny[0].toPorts[0].ports

content:

port: "7946"

protocol: ANY

- contains:

path: spec.ingressDeny[0].toPorts[0].ports

content:

port: "9120"

- contains:

path: spec.ingressDeny[0].toPorts[0].ports

content:

port: "9121"

- contains:

path: spec.ingressDeny[0].toPorts[0].ports

content:

port: "9140"

- contains:

path: spec.ingressDeny[0].toPorts[0].ports

content:

port: "9141"

- contains:

path: spec.ingressDeny[0].toPorts[0].ports

content:

port: "19443"

- it: denies world ingress to the host-network 9443 listener (etcd kube-rbac-proxy)

# The host-network bind on port 9443 belongs to the cozy-monitoring

# kube-rbac-proxy DaemonSet

# (packages/system/monitoring-agents/templates/etcd-proxy-scrape.yaml,

# --secure-listen-address=$(NODE_IP):9443). Port 9443 is ALSO bound by

# the metallb controller Deployment as its webhook server, but on pod-IP

# (non-host-network), which is out of scope for this world-deny. Pin the

# entry here so a future PR that drops the cozy-monitoring stack does

# not silently remove this deny — the port-number collision with the

# metallb controller webhook does not give that webhook any protection

# under this policy regardless.

asserts:

- contains:

path: spec.ingressDeny[0].toPorts[0].ports

content:

port: "9443"

- it: drops the stale frr-mode metrics port now that frrk8s is the default

# Port 7473 was metallb's legacy FRR-mode metrics endpoint. v0.16 disables

# FRR mode by default and migrates BGP to frr-k8s; the port is no longer

# bound by anything cozystack ships, so listing it in the deny rule is

# misleading.

asserts:

- notContains:

path: spec.ingressDeny[0].toPorts[0].ports

content:

port: "7473"

helm pull metallb/metallb --version 0.16.1 --untar --untardir charts

test:

helm unittest .

--platform=linux/amd64 \

version: 0.16.1

version: 0.0.25

digest: sha256:91f6f08e93bcfc87c9388e5b063b814754151fced237f489cc84feaf5cf13584

generated: "2026-05-27T22:48:56.242027047+02:00"

appVersion: v0.16.1

version: 0.16.1

version: 0.0.25

version: 0.16.1

| https://metallb.github.io/frr-k8s | frr-k8s | 0.0.25 |

| controller.livenessProbe.port | int | `17472` | |

| controller.readinessProbe.port | int | `17472` | |

| controller.webhookMode | string | `"enabled"` | |

| frr-k8s.prometheus.serviceMonitor.enabled | bool | `false` | Enable Prometheus ServiceMonitor for frr-k8s metrics. |

| frrk8s.enabled | bool | `true` | If set, enables frrk8s as a backend. This is mutually exclusive to frr mode. |

| frrk8s.external | bool | `false` | If true, uses an external frr-k8s installation instead of the bundled subchart. |

| frrk8s.namespace | string | `""` | Namespace where external frr-k8s is installed (only used when external=true). |

| networkpolicies.apiPort | int | `6443` | |

| networkpolicies.defaultDeny | bool | `false` | |

| networkpolicies.enabled | bool | `false` | |

| prometheus.metricsPort | int | `9120` | |

| speaker.bgpDebounceTimeout | string | `nil` | BGP debounce timeout for FRR configuration reloads, in milliseconds. Only applies when BGP type is frr. Default (when unset) is 3000 ms. This feature is experimental |

| speaker.frr.enabled | bool | `false` | |

| speaker.frr.image.tag | string | `"10.5.3"` | |

| speaker.frr.metricsPort | int | `9121` | |

| speaker.initContainers.cpFrrFiles.resources | object | `{}` | |

| speaker.initContainers.cpMetrics.resources | object | `{}` | |

| speaker.initContainers.cpReloader.resources | object | `{}` | |

| speaker.livenessProbe.port | int | `17472` | |

| speaker.readinessProbe.port | int | `17472` | |

| tls.cipherSuites | string | `""` | Comma-separated list of TLS cipher suites. If empty, uses Go defaults. Only applies to TLS 1.2. |

| tls.controllerMetricsTLSSecret | string | `""` | The name of the secret to be mounted in the controller pod to provide TLS certificates for metrics endpoints. If not present, a self-signed certificate is auto-generated. |

| tls.curvePreferences | string | `""` | Comma-separated list of numeric CurveID values (e.g. 29,4588). See https://pkg.go.dev/crypto/tls#CurveID. If empty, uses Go defaults. |

| tls.minVersion | string | `""` | Minimum TLS version (VersionTLS12 or VersionTLS13). Defaults to VersionTLS13. |

| tls.speakerMetricsTLSSecret | string | `""` | The name of the secret to be mounted in the speaker pod to provide TLS certificates for metrics endpoints. If not present, a self-signed certificate is auto-generated. |

appVersion: v0.16.1

version: 0.16.1