Skip to content

chore: bump egress to v1.0.2 #410

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Pangjiping wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore: bump egress to v1.0.2 #410

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion server/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -241,7 +241,7 @@ EOF
execd_image = "opensandbox/execd:v1.0.6"

[egress]
image = "opensandbox/egress:v1.0.1"
image = "opensandbox/egress:v1.0.2"
```
- Supported only in Docker bridge mode; requests with `networkPolicy` are rejected when `network_mode=host` or when `egress.image` is not configured.
- Main container shares the sidecar netns and explicitly drops `NET_ADMIN`; the sidecar keeps `NET_ADMIN` to manage iptables.
Expand Down
2 changes: 1 addition & 1 deletion server/README_zh.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -240,7 +240,7 @@ type = "docker"
execd_image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:v1.0.6"

[egress]
image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.0.1"
image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.0.2"
```

- 仅支持 Docker bridge 模式（`network_mode=host` 时会拒绝携带 `networkPolicy` 的请求，或当 `egress.image` 未配置时也会拒绝）。
Expand Down
4 changes: 2 additions & 2 deletions server/docker-compose.example.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,8 @@ configs:
execd_image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:v1.0.6"

[egress]
image = "opensandbox/egress:v1.0.1"
# image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.0.1"
image = "opensandbox/egress:v1.0.2"
# image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.0.2"

[docker]
network_mode = "bridge"
Expand Down
2 changes: 1 addition & 1 deletion server/example.config.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ execd_image = "opensandbox/execd:v1.0.6"
[egress]
# Egress configuration
# -----------------------------------------------------------------
image = "opensandbox/egress:v1.0.1"
image = "opensandbox/egress:v1.0.2"

[storage]
# Volume and storage configuration
Expand Down
2 changes: 1 addition & 1 deletion server/example.config.zh.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ execd_image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd
[egress]
# Egress configuration
# -----------------------------------------------------------------
image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.0.1"
image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.0.2"

[storage]
# 卷存储配置
Expand Down
2 changes: 1 addition & 1 deletion server/src/services/k8s/egress_helper.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ def build_egress_sidecar_container(
Example:
```python
sidecar = build_egress_sidecar_container(
egress_image="opensandbox/egress:v1.0.1",
egress_image="opensandbox/egress:v1.0.2",
network_policy=NetworkPolicy(
default_action="deny",
egress=[NetworkRule(action="allow", target="pypi.org")]
Expand Down
10 changes: 5 additions & 5 deletions server/tests/k8s/test_agent_sandbox_provider.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -590,7 +590,7 @@ def test_create_workload_with_network_policy_adds_sidecar(self, mock_k8s_client)
expires_at=expires_at,
execd_image="execd:latest",
network_policy=network_policy,
egress_image="opensandbox/egress:v1.0.1",
egress_image="opensandbox/egress:v1.0.2",
)

body = mock_api.create_namespaced_custom_object.call_args.kwargs["body"]
Expand All @@ -603,7 +603,7 @@ def test_create_workload_with_network_policy_adds_sidecar(self, mock_k8s_client)
# Find sidecar container
sidecar = next((c for c in containers if c["name"] == "egress"), None)
assert sidecar is not None
assert sidecar["image"] == "opensandbox/egress:v1.0.1"
assert sidecar["image"] == "opensandbox/egress:v1.0.2"

# Verify sidecar has environment variable
env_vars = {e["name"]: e["value"] for e in sidecar.get("env", [])}
Expand Down Expand Up @@ -642,7 +642,7 @@ def test_create_workload_with_network_policy_adds_ipv6_disable_sysctls(self, moc
expires_at=expires_at,
execd_image="execd:latest",
network_policy=network_policy,
egress_image="opensandbox/egress:v1.0.1",
egress_image="opensandbox/egress:v1.0.2",
)

body = mock_api.create_namespaced_custom_object.call_args.kwargs["body"]
Expand Down Expand Up @@ -691,7 +691,7 @@ def test_create_workload_with_network_policy_drops_net_admin_from_main_container
expires_at=expires_at,
execd_image="execd:latest",
network_policy=network_policy,
egress_image="opensandbox/egress:v1.0.1",
egress_image="opensandbox/egress:v1.0.2",
)

body = mock_api.create_namespaced_custom_object.call_args.kwargs["body"]
Expand Down Expand Up @@ -776,7 +776,7 @@ def test_egress_sidecar_contains_network_policy_in_env(self, mock_k8s_client):
expires_at=expires_at,
execd_image="execd:latest",
network_policy=network_policy,
egress_image="opensandbox/egress:v1.0.1",
egress_image="opensandbox/egress:v1.0.2",
)

body = mock_api.create_namespaced_custom_object.call_args.kwargs["body"]
Expand Down
12 changes: 6 additions & 6 deletions server/tests/k8s/test_batchsandbox_provider.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1300,7 +1300,7 @@ def test_create_workload_with_network_policy_adds_sidecar(self, mock_k8s_client)
expires_at=expires_at,
execd_image="execd:latest",
network_policy=network_policy,
egress_image="opensandbox/egress:v1.0.1",
egress_image="opensandbox/egress:v1.0.2",
)

body = mock_api.create_namespaced_custom_object.call_args.kwargs["body"]
Expand All @@ -1313,7 +1313,7 @@ def test_create_workload_with_network_policy_adds_sidecar(self, mock_k8s_client)
# Find sidecar container
sidecar = next((c for c in containers if c["name"] == "egress"), None)
assert sidecar is not None
assert sidecar["image"] == "opensandbox/egress:v1.0.1"
assert sidecar["image"] == "opensandbox/egress:v1.0.2"

# Verify sidecar has environment variable
env_vars = {e["name"]: e["value"] for e in sidecar.get("env", [])}
Expand Down Expand Up @@ -1352,7 +1352,7 @@ def test_create_workload_with_network_policy_adds_ipv6_disable_sysctls(self, moc
expires_at=expires_at,
execd_image="execd:latest",
network_policy=network_policy,
egress_image="opensandbox/egress:v1.0.1",
egress_image="opensandbox/egress:v1.0.2",
)

body = mock_api.create_namespaced_custom_object.call_args.kwargs["body"]
Expand Down Expand Up @@ -1401,7 +1401,7 @@ def test_create_workload_with_network_policy_drops_net_admin_from_main_container
expires_at=expires_at,
execd_image="execd:latest",
network_policy=network_policy,
egress_image="opensandbox/egress:v1.0.1",
egress_image="opensandbox/egress:v1.0.2",
)

body = mock_api.create_namespaced_custom_object.call_args.kwargs["body"]
Expand Down Expand Up @@ -1486,7 +1486,7 @@ def test_egress_sidecar_contains_network_policy_in_env(self, mock_k8s_client):
expires_at=expires_at,
execd_image="execd:latest",
network_policy=network_policy,
egress_image="opensandbox/egress:v1.0.1",
egress_image="opensandbox/egress:v1.0.2",
)

body = mock_api.create_namespaced_custom_object.call_args.kwargs["body"]
Expand Down Expand Up @@ -1579,7 +1579,7 @@ def test_create_workload_with_network_policy_works_with_template(self, mock_k8s_
expires_at=expires_at,
execd_image="execd:latest",
network_policy=network_policy,
egress_image="opensandbox/egress:v1.0.1",
egress_image="opensandbox/egress:v1.0.2",
)

body = mock_api.create_namespaced_custom_object.call_args.kwargs["body"]
Expand Down
24 changes: 12 additions & 12 deletions server/tests/k8s/test_egress_helper.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ class TestBuildEgressSidecarContainer:

def test_builds_container_with_basic_config(self):
"""Test that container is built with correct basic configuration."""
egress_image = "opensandbox/egress:v1.0.1"
egress_image = "opensandbox/egress:v1.0.2"
network_policy = NetworkPolicy(
default_action="deny",
egress=[
Expand All @@ -50,7 +50,7 @@ def test_builds_container_with_basic_config(self):

def test_contains_egress_rules_environment_variable(self):
"""Test that container includes OPENSANDBOX_EGRESS_RULES environment variable."""
egress_image = "opensandbox/egress:v1.0.1"
egress_image = "opensandbox/egress:v1.0.2"
network_policy = NetworkPolicy(
default_action="deny",
egress=[NetworkRule(action="allow", target="example.com")],
Expand All @@ -65,7 +65,7 @@ def test_contains_egress_rules_environment_variable(self):

def test_serializes_network_policy_correctly(self):
"""Test that network policy is correctly serialized to JSON."""
egress_image = "opensandbox/egress:v1.0.1"
egress_image = "opensandbox/egress:v1.0.2"
network_policy = NetworkPolicy(
default_action="deny",
egress=[
Expand All @@ -92,7 +92,7 @@ def test_serializes_network_policy_correctly(self):

def test_handles_empty_egress_rules(self):
"""Test that empty egress rules are handled correctly."""
egress_image = "opensandbox/egress:v1.0.1"
egress_image = "opensandbox/egress:v1.0.2"
network_policy = NetworkPolicy(
default_action="allow",
egress=[],
Expand All @@ -108,7 +108,7 @@ def test_handles_empty_egress_rules(self):

def test_handles_missing_default_action(self):
"""Test that missing default_action is handled (exclude_none=True)."""
egress_image = "opensandbox/egress:v1.0.1"
egress_image = "opensandbox/egress:v1.0.2"
network_policy = NetworkPolicy(
egress=[NetworkRule(action="allow", target="example.com")],
)
Expand All @@ -124,7 +124,7 @@ def test_handles_missing_default_action(self):

def test_security_context_has_net_admin_capability(self):
"""Test that security context includes NET_ADMIN capability."""
egress_image = "opensandbox/egress:v1.0.1"
egress_image = "opensandbox/egress:v1.0.2"
network_policy = NetworkPolicy(
default_action="deny",
egress=[],
Expand All @@ -139,7 +139,7 @@ def test_security_context_has_net_admin_capability(self):

def test_container_spec_is_valid_kubernetes_format(self):
"""Test that returned container spec is in valid Kubernetes format."""
egress_image = "opensandbox/egress:v1.0.1"
egress_image = "opensandbox/egress:v1.0.2"
network_policy = NetworkPolicy(
default_action="deny",
egress=[NetworkRule(action="allow", target="example.com")],
Expand All @@ -161,7 +161,7 @@ def test_container_spec_is_valid_kubernetes_format(self):

def test_handles_wildcard_domains(self):
"""Test that wildcard domains in egress rules are handled correctly."""
egress_image = "opensandbox/egress:v1.0.1"
egress_image = "opensandbox/egress:v1.0.2"
network_policy = NetworkPolicy(
default_action="deny",
egress=[
Expand Down Expand Up @@ -251,7 +251,7 @@ def test_adds_egress_sidecar_container(self):
default_action="deny",
egress=[NetworkRule(action="allow", target="example.com")],
)
egress_image = "opensandbox/egress:v1.0.1"
egress_image = "opensandbox/egress:v1.0.2"

apply_egress_to_spec(
pod_spec=pod_spec,
Expand All @@ -272,7 +272,7 @@ def test_adds_ipv6_disable_sysctls(self):
default_action="deny",
egress=[NetworkRule(action="allow", target="example.com")],
)
egress_image = "opensandbox/egress:v1.0.1"
egress_image = "opensandbox/egress:v1.0.2"

apply_egress_to_spec(
pod_spec=pod_spec,
Expand Down Expand Up @@ -303,7 +303,7 @@ def test_extends_existing_sysctls(self):
default_action="deny",
egress=[NetworkRule(action="allow", target="example.com")],
)
egress_image = "opensandbox/egress:v1.0.1"
egress_image = "opensandbox/egress:v1.0.2"

apply_egress_to_spec(
pod_spec=pod_spec,
Expand Down Expand Up @@ -337,7 +337,7 @@ def test_no_op_when_no_network_policy(self):
pod_spec=pod_spec,
containers=containers,
network_policy=None,
egress_image="opensandbox/egress:v1.0.1",
egress_image="opensandbox/egress:v1.0.2",
)

assert len(containers) == 0
Expand Down
Loading