feat(acl): admit GF Darwin worker route (TIN-2998)

constants.dhall

@@ -47,6 +47,8 @@ let tag =
       , ci_agent = "tag:ci-agent"
       , kvm_proxy = "tag:kvm-proxy"
       , tag_authority = "tag:tag-authority"
+      , gf_reapi_cell_egress = "tag:gf-reapi-cell-egress"
+      , gf_reapi_darwin_worker = "tag:gf-reapi-darwin-worker"
       }
 
 let host =

fragments/core.dhall

@@ -117,6 +117,14 @@ let tagOwners
       , { mapKey = C.tag.tag_authority
         , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ]
         }
+      , { mapKey = C.tag.gf_reapi_cell_egress
+        , mapValue =
+          [ C.tag.k8s_operator, C.autogroup.admin, C.group.dollhouse_admins ]
+        }
+      , { mapKey = C.tag.gf_reapi_darwin_worker
+        , mapValue =
+          [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ]
+        }
       ]
 
 let acls

grants.json

@@ -39,4 +39,8 @@
 	"src": ["tag:dollhouse"],
 	"dst": ["tag:dollhouse"],
 	"app": {"tailscale.com/cap/relay": [{}]}
+}, {
+	"src": ["tag:gf-reapi-cell-egress"],
+	"dst": ["tag:gf-reapi-darwin-worker"],
+	"ip": ["tcp:8981"]
 }]

tests/test_policy_contract.py

@@ -31,6 +31,55 @@ def test_honey_does_not_receive_broad_kubernetes_acl_access(self) -> None:
         }
         self.assertNotIn(broad_rule, self.policy["acls"])
 
+    def test_gf_reapi_route_tags_have_exact_owners(self) -> None:
+        self.assertCountEqual(
+            self.policy["tagOwners"]["tag:gf-reapi-cell-egress"],
+            [
+                "tag:k8s-operator",
+                "autogroup:admin",
+                "group:dollhouse-admins",
+            ],
+        )
+        self.assertCountEqual(
+            self.policy["tagOwners"]["tag:gf-reapi-darwin-worker"],
+            [
+                "tag:tag-authority",
+                "autogroup:admin",
+                "group:dollhouse-admins",
+            ],
+        )
+        self.assertNotIn(
+            "tag:k8s-operator",
+            self.policy["tagOwners"]["tag:gf-reapi-darwin-worker"],
+        )
+
+    def test_gf_reapi_darwin_route_is_single_port_and_tag_scoped(self) -> None:
+        expected = {
+            "src": ["tag:gf-reapi-cell-egress"],
+            "dst": ["tag:gf-reapi-darwin-worker"],
+            "ip": ["tcp:8981"],
+        }
+        route_tags = {
+            "tag:gf-reapi-cell-egress",
+            "tag:gf-reapi-darwin-worker",
+        }
+        references = []
+        for surface in ("acls", "grants"):
+            for rule in self.policy[surface]:
+                endpoints = [
+                    endpoint
+                    for key in ("src", "dst")
+                    for endpoint in rule.get(key, [])
+                ]
+                if any(
+                    endpoint == tag or endpoint.startswith(f"{tag}:")
+                    for endpoint in endpoints
+                    for tag in route_tags
+                ):
+                    references.append((surface, rule))
+
+        self.assertEqual(references, [("grants", expected)])
+
 
 if __name__ == "__main__":
     unittest.main()