[virtual-machine] Revert per-vm network policies by kvaps · Pull Request #1611 · cozystack/cozystack

Andrei Kvapil (kvaps) · 2025-11-07T10:37:19Z

Signed-off-by: Andrei Kvapil [email protected]

What this PR does

Revert per-vm network policies functionality introduced by #1611
As it is not working as expected any way.

This is temporary solution before implementing full-fledged security groups in Cozystack

fixes #1601
alternative solution: #1602

Release note

[virtual-machine] Revert per-vm network policies

Signed-off-by: Andrei Kvapil <[email protected]>

coderabbitai · 2025-11-07T10:37:30Z

Walkthrough

Network policy restrictions and related annotations are removed from virtual machine and instance templates. The tenant template's endpoint selector is changed to select all endpoints instead of filtering based on external communication policy settings.

Changes

Cohort / File(s)	Change Summary
Network Policy Removal (Service Templates) `packages/apps/virtual-machine/templates/service.yaml`, `packages/apps/vm-instance/templates/service.yaml`	Entire CiliumNetworkPolicy manifest blocks removed, eliminating network policy creation while preserving Service resources.
External Communication Annotation Removal `packages/apps/virtual-machine/templates/vm.yaml`, `packages/apps/vm-instance/templates/vm.yaml`	Removed `policy.cozystack.io/allow-external-communication: "false"` annotation from template metadata; other annotations and labels unchanged.
Tenant Network Policy Endpoint Update `packages/apps/tenant/templates/networkpolicy.yaml`	Changed `endpointSelector` from filtered expressions to empty selector `{}`, now selecting all endpoints for external communication policy instead of excluding restricted ones.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Verify the intent of removing network policies is documented or follows agreed security posture changes
Confirm that removing the policy.cozystack.io/allow-external-communication: "false" annotation doesn't introduce unintended network access
Validate that the tenant's permissive endpoint selector ({}) aligns with desired network segmentation

Suggested reviewers

lllamnyp

Poem

🐰 Restrictions lifted, network flows free,
No more walls between you and me,
Endpoints open, policies unbound,
In cozy stacks, new pathways found!

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title '[virtual-machine] Revert per-vm network policies' clearly and concisely summarizes the main change: reverting network policy configurations across virtual-machine related templates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch revert-vm-net-pol

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist · 2025-11-07T10:37:37Z

Summary of Changes

Hello Andrei Kvapil (@kvaps), I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request reverts the implementation of per-virtual machine network policies. The changes involve removing specific CiliumNetworkPolicy definitions and associated policy.cozystack.io/allow-external-communication annotations from virtual machine and VM instance templates. Additionally, a tenant-level network policy's endpoint selector has been generalized. The overall intent is to simplify network policy management by moving away from fine-grained, per-VM network controls.

Highlights

Removed Per-VM Cilium Network Policies: The dedicated CiliumNetworkPolicy resources that previously defined network rules for virtual machines and VM instances have been entirely removed from their respective service templates.
Removed External Communication Annotation: The policy.cozystack.io/allow-external-communication: "false" annotation, which was used to control external communication, has been removed from both virtual machine and VM instance templates.
Broadened Tenant Network Policy Scope: The endpointSelector for the allow-external-communication NetworkPolicy in the tenant application has been generalized by removing specific matchExpressions, effectively broadening its application scope.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	Gemini (@gemini-code-assist)	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request reverts the per-virtual-machine network policy feature. The changes correctly remove the per-VM CiliumNetworkPolicy resources and associated annotations from the virtual-machine and vm-instance charts, and simplify the tenant-wide allow-external-communication policy to apply to all pods. While the revert is logical, I've identified a potential high-severity issue. The removed per-VM policies allowed ingress from other pods in the cluster (fromEntities: - cluster). This rule appears to be missing from the tenant-wide policy that now governs the VMs, which could break previously working intra-cluster communication.

github-actions · 2025-11-07T14:48:14Z

Successfully created backport PR for release-0.37:

[Backport release-0.37] [virtual-machine] Revert per-vm network policies #1613

…ies (#1613) # Description Backport of #1611 to `release-0.37`.

Signed-off-by: Andrei Kvapil <[email protected]>  ## What this PR does Revert per-vm network policies functionality introduced by #1611 As it is not working as expected any way. This is temporary solution before implementing full-fledged security groups in Cozystack fixes #1601 alternative solution: #1602 ### Release note  ```release-note [virtual-machine] Revert per-vm network policies ```

[virtual-machine] Revert per-vm network policies

2f0657f

Signed-off-by: Andrei Kvapil <[email protected]>

Andrei Kvapil (kvaps) requested review from Timofei Larkin (lllamnyp) and Nikita (nbykov0) as code owners November 7, 2025 10:37

dosubot Bot added the size/M This PR changes 30-99 lines, ignoring generated files label Nov 7, 2025

gemini-code-assist Bot reviewed Nov 7, 2025

View reviewed changes

Andrei Kvapil (kvaps) added the kind/backport Categorizes issue or PR as requiring a backport to the current release line label Nov 7, 2025

Timofei Larkin (lllamnyp) approved these changes Nov 7, 2025

View reviewed changes

dosubot Bot added the lgtm This PR has been approved by a maintainer label Nov 7, 2025

Andrei Kvapil (kvaps) merged commit 83c3b0c into main Nov 7, 2025
1 check passed

Andrei Kvapil (kvaps) deleted the revert-vm-net-pol branch November 7, 2025 14:48

github-actions Bot mentioned this pull request Nov 7, 2025

[Backport release-0.37] [virtual-machine] Revert per-vm network policies #1613

Merged

Andrei Kvapil (kvaps) added a commit that referenced this pull request Nov 7, 2025

[Backport release-0.37] [virtual-machine] Revert per-vm network polic…

d3ea169

…ies (#1613) # Description Backport of #1611 to `release-0.37`.

Andrei Kvapil (kvaps) added a commit that referenced this pull request Nov 7, 2025

[Backport release-0.37] [virtual-machine] Revert per-vm network polic…

5f5a9df

…ies (#1613) # Description Backport of #1611 to `release-0.37`.

coderabbitai Bot mentioned this pull request Nov 26, 2025

Add changelogs for v0.37.* and v0.38.0 #1658

Merged

Navigation Menu

Repository navigation

[virtual-machine] Revert per-vm network policies - #1611

[virtual-machine] Revert per-vm network policies#1611
Andrei Kvapil (kvaps) merged 1 commit into
mainfrom
revert-vm-net-pol

Andrei Kvapil (kvaps) commented Nov 7, 2025 •

edited

Loading

Uh oh!

coderabbitai Bot commented Nov 7, 2025 •

edited

Loading

Uh oh!

gemini-code-assist Bot commented Nov 7, 2025

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

github-actions Bot commented Nov 7, 2025

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Andrei Kvapil (kvaps) commented Nov 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does

Release note

Uh oh!

coderabbitai Bot commented Nov 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Suggested reviewers

Poem

Pre-merge checks and finishing touches

Uh oh!

gemini-code-assist Bot commented Nov 7, 2025

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

github-actions Bot commented Nov 7, 2025

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Andrei Kvapil (kvaps) commented Nov 7, 2025 •

edited

Loading

coderabbitai Bot commented Nov 7, 2025 •

edited

Loading