egress: a promoted-template claim takes the tenant policy alone - #99
Merged
Conversation
#81 made the effective policy a strict pool ∩ tenant intersection, and a key with no pool policy denies. A promoted template never has a pool — Promote and DeleteTemplate refuse pooled keys, and refill would build a golden for a name that is no image — so every promoted-template claim became default-deny regardless of the tenant's allow-list, closing the none lane's only route out for on-demand claims. Treat the missing pool layer as absent rather than empty: with no pool configured for the key, a tenant claim takes its own policy whole; a configured pool without a policy still grants nothing, and root claims of promoted templates stay denied for want of any layer. Closes #98.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #98.
What
Since #81,
pool.effectivePolicyreturns no evaluator unless a pool policy exists for the claim's key. A promoted template never has one —Promote/DeleteTemplaterefuse keys a configured pool owns (pooledHash), and the refill loop wouldbuildGoldena template name that is not an image — so every promoted-template claim was default-deny regardless of the tenant'segressblock, and the none lane's only route out was closed for on-demand claims (a bake warmup through the guest's127.0.0.1:3128relay failed 45/45 on v0.1.6 and passed 45/45 on 218eee1 with the same config).This keeps #81's contract for pooled keys and treats a missing pool layer as absent rather than empty:
rt:24.04claim on a node withoutpoolsis the latter): a tenant claim takes the tenant policy alone; a root claim stays denied (no layer at all).m.pools[key]is the discriminator, so a pool configured withwarm: 0and noegressstill denies exactly as #81 intended. Residual, accepted:m.poolsis API-mutable, so draining a policy-less pool viaSetPoolsturns its key unpooled and a later tenant cold-boot claim of it takes the tenant policy — no secret is involved (a policy-less pool has none), it takes an operator drain, and the guest gets only the tenant's own allow-list.Changes
sandboxd/pool/egress.goeffectivePolicy.sandboxd/pool/egress_test.goTestEffectivePolicyComposition: cases now say whether the key is pooled; adds "tenant on a promoted template" (armed with the tenant policy) and "root on a promoted template" (denied); "tenant on a policyless pool" keeps expecting deny.docs/egress.md: the promoted-template rule next to the intersection rule.Gates
go build ./...,go test ./...(sandboxd),make go-lint(golangci-lint run + fmt, GOOS linux+darwin) all clean.