fix: [NPM] policy translation and resource-bound hardening - #4831

Closed

Isaiah Raya (rayaisaiah) wants to merge 23 commits into

isaiahraya/npm-policy-translation-hardening

Commits on Sep 8, 2026

fix: [NPM] compile multi-value namespaceSelector NotIn as a single conjunction

Isaiah Raya (rayaisaiah)
and
Copilot
committed
ca504e6
fix: [NPM] scope negation-only namespaceSelector matches to cluster namespaces

Isaiah Raya (rayaisaiah)
and
Copilot
committed
59a508b
fix: [NPM] bound namespaceSelector flattening

Isaiah Raya (rayaisaiah)
and
Copilot
committed
8f7f77e
fix: [NPM] canonicalize ipBlock CIDRs and stop reporting failed translation as success

Isaiah Raya (rayaisaiah)
and
Copilot
committed
7685e64
fix: [NPM] bound the NPM HTTP API and stop enabling its debug routes by default

Isaiah Raya (rayaisaiah)
and
Copilot
committed
4316b62
chore: [NPM] address lint findings in the changed files

Isaiah Raya (rayaisaiah)
and
Copilot
committed
180828a
test: [NPM] cover every negation-only namespaceSelector operator and its rendered rule

Isaiah Raya (rayaisaiah)
and
Copilot
committed
ba72911
fix: [NPM] bound generated rules per policy and keep CIDR canonicalization on the Linux path

Isaiah Raya (rayaisaiah)
and
Copilot
committed
5de95df
fix: [NPM] materialize ipsets in the kernel only when a policy references them

Isaiah Raya (rayaisaiah)
and
Copilot
committed
f359ab3
fix: [NPM] keep the rule budget off the direct-rule path and make two tests meaningful

Isaiah Raya (rayaisaiah)
and
Copilot
committed
f6475ce
fix: [NPM] check the rule budget per port and record translation errors once

Isaiah Raya (rayaisaiah)
and
Copilot
committed
9a43e20
chore: [NPM] address lint findings in the changed files

Isaiah Raya (rayaisaiah)
and
Copilot
committed
7352af9
fix: [NPM] make the rule ceiling exact and refuse an except NPM cannot program

Isaiah Raya (rayaisaiah)
and
Copilot
committed
0566315
fix: [NPM] bound a rule that lists ports and no peers

Isaiah Raya (rayaisaiah)
and
Copilot
committed
6b0e17f
chore: [NPM] keep the new error messages bounded and conventional

Isaiah Raya (rayaisaiah)
and
Copilot
committed
b9818fb
fix: [NPM] let a policy land exactly on the rule ceiling

Isaiah Raya (rayaisaiah)
and
Copilot
committed
f1fa41f
chore: [NPM] name the status code the cache handler returns

Isaiah Raya (rayaisaiah)
and
Copilot
committed
33f8f7f

Commits on Sep 10, 2026

fix: [NPM] serve the debug and profiling routes to the node only

Isaiah Raya (rayaisaiah)
and
Copilot
committed
39fcc27
fix: [NPM] bound how many ipsets the inventory metric reports

Isaiah Raya (rayaisaiah)
and
Copilot
committed
31faeea
fix: [NPM] mount the profiling handlers at the profile prefix

Isaiah Raya (rayaisaiah)
and
Copilot
committed
4b767e9
fix: [NPM] bound the matches a namespaceSelector expands into

Isaiah Raya (rayaisaiah)
and
Copilot
committed
a1982d9
fix: [NPM] bound a selector that carries only matchLabels

Isaiah Raya (rayaisaiah)
and
Copilot
committed
02f6e93

Commits on Sep 11, 2026

fix: [NPM] bound a selector across its branches and keep the rule ceiling exact

Isaiah Raya (rayaisaiah)
and
Copilot
committed
be25db2