SecurityGroup: membership-only group projects to a CiliumNetworkPolicy that Cilium 1.19 marks invalid #5129

Describe the bug

A SecurityGroup with attachments but no ingress/egress rules projects to a CiliumNetworkPolicy that Cilium 1.19 marks invalid. pkg/apis/sdn/DESIGN.md §5 states that the always-emitted ingress: [] keeps such a membership-only policy schema-valid, but the Cilium agent rejects it: the CNP status shows Valid=False with rule must have at least one of Ingress, IngressDeny, Egress, EgressDeny. An empty list is treated as an absent section.

Environment

• Cozystack v1.6.5
• Cilium 1.19.5, chained (cni-chaining-mode: generic-veth) on kube-ovn
• Provider: on-prem

To Reproduce

1. Create a SecurityGroup with only spec.attachments (for example [{kind: VMInstance, name: some-vm}]).
2. kubectl get cnp <name> -o jsonpath='{.status.conditions}'.

Expected behaviour

A membership-only SecurityGroup projects to a policy Cilium accepts as valid. It is what fromSG/toSG peers rely on: a group that only defines membership.

Actual behaviour

The CNP is VALID=False. The membership labels are still stamped by the securitygroup-controller, and fromSG references to the group still match (verified), so today the effect is a policy reported as broken rather than a traffic difference. But any tooling or status derived from the CNP's Valid condition reports the group as failed, and the design document's claim does not hold on Cilium 1.19.

Logs

{"type":"Valid","status":"False","message":"rule must have at least one of Ingress, IngressDeny, Egress, EgressDeny"}

Additional context

A rule section that selects nothing without enabling default-deny for that direction would keep the policy valid and inert, for example one ingress rule whose peer matches no endpoint together with enableDefaultDeny: {ingress: false, egress: false}. The projection and its reverse projection (which hides the empty section) would both need to change.

Checklist

• I have checked the documentation
• I have searched for similar issues
• I have included all required information
• I have provided clear steps to reproduce
• I have included relevant logs