Translate AllowPort into Envoy egress RBAC policy - #5924
Closed
ChrisJBurns wants to merge 2 commits into
Closed
ChrisJBurns wants to merge 2 commits into
ChrisJBurns wants to merge 2 commits into
Conversation
ChrisJBurns
requested review from
JAORMX,
amirejaz,
aponcedeleonch,
blkt,
jhrozek,
rdimitrov,
reyortiz3 and
tgrunnagle
as code owners
July 22, 2026 20:38
ChrisJBurns
force-pushed
the
cburns/envoy-allow-port
branch
from
July 22, 2026 20:47
bb6ee6c to
a9e65d9
Compare
ChrisJBurns
force-pushed
the
cburns/envoy-e2e-enable
branch
from
July 22, 2026 20:48
fe7f377 to
ecae5e0
Compare
ChrisJBurns
force-pushed
the
cburns/envoy-allow-port
branch
from
July 22, 2026 20:57
a9e65d9 to
234c3fc
Compare
Squid enforces AllowPort via the allowed_ports ACL, AND-d with AllowHost.
The Envoy backend previously ignored AllowPort, leaving allowlisted hosts
reachable on any port — a parity regression.
Translate AllowPort into :authority suffix matchers (":80", ":443", …) in
the RBAC ALLOW filter, mirroring Squid's AND semantics:
- AllowHost + AllowPort → host AND port must match in the same policy
- AllowPort only → any host on listed ports
- AllowHost only → any port (unchanged)
- InsecureAllowAll → ignores AllowPort (same as Squid)
Uses :authority suffix matching so plain HTTP ("host:port") and HTTPS
CONNECT ("host:port") are both covered. Remove the Known Limitation entry
and add a parity row to the comparison table.
Closes #5915.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Exercises the AllowPort fix end-to-end: starts an Envoy isolated server with AllowHost:[example.com] + AllowPort:[443], then asserts that https://example.com succeeds and http://example.com is blocked. This closes the gap between unit tests (which verify the config shape) and runtime behaviour through a real Envoy container. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ChrisJBurns
force-pushed
the
cburns/envoy-allow-port
branch
from
July 22, 2026 20:57
234c3fc to
be9bc48
Compare
Collaborator
Author
|
Recreating stacked on renamed branch |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## cburns/envoy-e2e-enable #5924 +/- ##
===========================================================
+ Coverage 71.68% 71.70% +0.01%
===========================================================
Files 700 700
Lines 71918 71940 +22
===========================================================
+ Hits 51557 51582 +25
- Misses 16668 16669 +1
+ Partials 3693 3689 -4 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes the
AllowPortparity gap between the Envoy and Squid backends, and adds an e2e test that proves enforcement through a real Envoy container.Closes #5915. Part of #5900.
The problem
With
AllowHost: ["example.com"], AllowPort: [443], the intent is that only HTTPS traffic toexample.comis permitted. Squid enforced this. Envoy ignoredAllowPortentirely — plain HTTP toexample.com(port 80) also got through.The fix
AllowPortentries are translated into:authoritysuffix matchers (":443",":80", …) in the RBAC ALLOW filter. In Envoy's RBAC, a policy fires when all its permissions match, so adding a port permission to the same policy as the host regex gives AND semantics — matching Squid'sallowed_ports AND allowed_dstsACL combination.AllowHost+AllowPortAllowPortonlyAllowHostonlyInsecureAllowAllTests
TestBuildAllowlistPolicies_AllowPort— 4 unit table cases covering all combinations (config-shape level)NetworkIsolationEnvoy / AllowPort enforcement— e2e test against a real Envoy container: allowshttps://example.com(port 443), blockshttp://example.com(port 80)Type of change
Test plan
go build ./pkg/container/docker/...passesgolangci-lintcleanTestBuildAllowlistPolicies_AllowPortpassesgo test -c ./test/e2e/compilesAllowPort enforcementtest runs against real EnvoyGenerated with Claude Code