From 6e232aaf73945c11eb0b801b64ef7bbec5b69701 Mon Sep 17 00:00:00 2001 From: "Weigand, Matthias" Date: Wed, 7 Oct 2026 14:42:08 +0200 Subject: [PATCH] Allowlist Traefik and Calico helm chart repositories Add the public chart repositories of Traefik (traefik.github.io, helm.traefik.io) and Project Calico (docs.tigera.io) to the helm ecosystem defaults as exact hosts, with positive probes and child/sibling negative probes. --- internal/handlers/egress_allowlist_defaults.yaml | 8 ++++++++ internal/handlers/egress_allowlist_test.go | 8 ++++++++ 2 files changed, 16 insertions(+) diff --git a/internal/handlers/egress_allowlist_defaults.yaml b/internal/handlers/egress_allowlist_defaults.yaml index a4bc650..1899baf 100644 --- a/internal/handlers/egress_allowlist_defaults.yaml +++ b/internal/handlers/egress_allowlist_defaults.yaml @@ -604,6 +604,14 @@ ecosystem_default_domains: - prometheus-community.github.io - grafana.github.io - jaegertracing.github.io + # Traefik Labs' chart repo: traefik.github.io is the documented repo URL + # and serves the chart tarballs; helm.traefik.io is the legacy repo URL + # serving the same index.yaml (whose tarball URLs point at traefik.github.io). + - traefik.github.io + - helm.traefik.io + # Project Calico (Tigera) chart repo, the documented `helm repo add` URL for + # tigera-operator and crd.projectcalico.org.v1 (tarballs are on github.com). + - docs.tigera.io # GitHub-hosted or per-job configured; covered by github_infra_domains / git. # Note: additional per-job dependencies (e.g. pre_commit hooks that install # from other ecosystems) are covered because the handler applies the union of diff --git a/internal/handlers/egress_allowlist_test.go b/internal/handlers/egress_allowlist_test.go index a00e3fc..e8eda6b 100644 --- a/internal/handlers/egress_allowlist_test.go +++ b/internal/handlers/egress_allowlist_test.go @@ -729,6 +729,9 @@ func TestEgressAllowlist_NewEntriesDoNotWidenBeyondExactHosts(t *testing.T) { "https://evil.maven.artifacts.atlassian.com/maven", "https://evil.mirrors.huaweicloud.com/repository/npm", "https://evil.dotnetcli.blob.core.windows.net/payload", + "https://evil.traefik.github.io/payload", + "https://evil.helm.traefik.io/payload", + "https://evil.docs.tigera.io/payload", } // Sibling hosts: names sharing a parent with an added entry. These pin the @@ -744,6 +747,8 @@ func TestEgressAllowlist_NewEntriesDoNotWidenBeyondExactHosts(t *testing.T) { "https://attacker.artifacts.atlassian.com/maven", "https://attacker.huaweicloud.com/repository/npm", "https://attacker.julialang.org/bin", + "https://attacker.traefik.io/payload", + "https://attacker.tigera.io/payload", // Cloudsmith is multi-tenant with the tenant in the URL path, and the // allowlist authorizes the hostname only. Neither the tenant subdomain // form nor the shared download hosts may be globally allowed. @@ -918,6 +923,9 @@ func TestEgressAllowlist_AddedMissingDomainsAllowed(t *testing.T) { "https://prometheus-community.github.io/helm-charts/index.yaml", "https://grafana.github.io/helm-charts/index.yaml", "https://jaegertracing.github.io/helm-charts/index.yaml", + "https://traefik.github.io/charts/traefik/traefik-41.6.1.tgz", + "https://helm.traefik.io/traefik/index.yaml", + "https://docs.tigera.io/calico/charts/index.yaml", "https://cocoapods.org/pods/AFNetworking", } { assert.Nil(t, egressResult(t, h, allowed), "added host should be allowed: "+allowed)