Allowlist Traefik and Calico helm chart repositories

[weg3mu]

What are you trying to accomplish?

Since proxy-egress-enforce was enabled (2026-10-01), helm update jobs for two widely used public charts can no longer reach their chart repositories:

proxy | GET https://helm.traefik.io:443/traefik/index.yaml
proxy | * egress not allowlisted helm.traefik.io
proxy | 403 https://helm.traefik.io:443/traefik/index.yaml
...
proxy | GET https://traefik.github.io:443/charts/traefik/traefik-41.6.1.tgz
proxy | * egress not allowlisted traefik.github.io
proxy | 403 https://traefik.github.io:443/charts/traefik/traefik-41.6.1.tgz
...
proxy | GET https://docs.tigera.io:443/calico/charts/index.yaml
proxy | * egress not allowlisted docs.tigera.io
proxy | 403 https://docs.tigera.io:443/calico/charts/index.yaml

The index fetch failure is silent: dependabot-core's helm updater logs Latest version is (empty), No update possible, and the job succeeds. The tarball failure surfaces as HelperSubprocessFailed in Dependabot::Helm::Helpers.update_lock.

This PR adds the three hosts to ecosystem_default_domains.helm under "Public HTTP chart repositories", next to charts.bitnami.com, charts.jetstack.io and the other public chart repos:

Host	Serves	Evidence it is public, provider-controlled
traefik.github.io	Traefik Labs' chart repo (index.yaml and chart .tgz)	Documented repo URL in traefik/traefik-helm-chart README (helm repo add traefik https://traefik.github.io/charts); GitHub Pages of the traefik org
helm.traefik.io	Legacy Traefik repo URL, still serving the same index.yaml. Its tarball URLs point to traefik.github.io	TLS cert CN=traefik.io (Google Trust Services), Cloudflare-fronted, anonymous 200 on /traefik/index.yaml
docs.tigera.io	Project Calico chart repo (tigera-operator, crd.projectcalico.org.v1). Tarballs are on github.com/projectcalico/calico/releases	Documented repo URL in projectcalico/calico charts/tigera-operator/README.md (helm repo add projectcalico https://docs.tigera.io/calico/charts); TLS cert CN=docs.tigera.io; CNAME tigera.netlify.com; anonymous 200 on /calico/charts/index.yaml

Why the defaults and not per-job registries: in dependabot.yml:

• These hosts are public and anonymous, so the defaults are the right home per the blocked-host docs.
• docs.tigera.io can't be reached through registries: at all. The config validator requires username/password (or token) on a helm-registry entry, and the helm handler then attaches Basic auth to every request to that host. The site is backed by S3, which rejects any non-SigV4 Authorization header with 400 InvalidArgument: Unsupported Authorization Type. So the only way for helm jobs to reach Calico's chart repo is an anonymous request, which these defaults make possible.

Anything you want to highlight for special attention from reviewers?

• Exact hosts only. traefik.github.io is one org's GitHub Pages host, in the same form as the existing prometheus-community.github.io / grafana.github.io entries. No *.github.io widening. helm.traefik.io and docs.tigera.io are exact as well.
• Docs host: docs.tigera.io also hosts Calico documentation. It is on the list because it is the canonical Helm chart repository, not for changelog links. Without it, Calico helm updates fail outright rather than degrading gracefully.

How will you know you've accomplished your goal?

• Positive probes added to TestEgressAllowlist_AddedMissingDomainsAllowed for a real path on each host.
• Child probes (evil.<host>) added to TestEgressAllowlist_NewEntriesDoNotWidenBeyondExactHosts, plus sibling probes attacker.traefik.io / attacker.tigera.io. Checked that the child probes bite: switching the three entries to leading-dot form makes the test fail with new entries must not widen to: https://evil.<host>/payload. Reverted afterwards.
• Probe safety and ownership checked with the verify_host routine from .github/skills/add-egress-allowlist-domain: all addresses are public, there were no redirects, and the cert subjects are as listed above.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
  script/test (Docker, -race -shuffle=on -count=2) passes; yamllint, gofmt -l, go vet ./... and go mod tidy -diff (the CI lint job) are clean.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[Copilot]

Copilot review overview

🟢 Approval recommended

The exact-host entries are appropriately scoped, supported by provider documentation, and covered by positive and boundary tests.

Review effort: Balanced
Findings: None

What changed in this PR

Adds exact-host egress access for public Traefik and Calico Helm chart repositories.

Changes:

• Allowlist three provider-controlled Helm repository hosts.
• Add positive and exact-host boundary regression probes.

File	Description
internal/​handlers/​egress_allowlist_defaults.yaml	Adds Traefik and Calico chart hosts.
internal/​handlers/​egress_allowlist_test.go	Verifies allowed paths and blocks child/sibling hosts.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.