From 158e2f2e1c03c2530d87306b002fd113b3673c6a Mon Sep 17 00:00:00 2001
From: Daniel Hobley <danielh@unity3d.com>
Date: Wed, 7 Oct 2026 13:01:51 +0200
Subject: [PATCH] Allowlist public Helm chart repositories for helm update jobs

Helm update jobs for several widely used charts can no longer read their chart index since egress enforcement was enabled, so dependabot-core logs "No update possible" and closes any open update PR.
Each host is the repository URL documented by its project, served from that project's own GitHub Pages site or custom domain, so they belong with the existing public chart repos as exact entries.
external-secrets.io is included because charts.external-secrets.io redirects index.yaml requests there.
---
 .../handlers/egress_allowlist_defaults.yaml   | 10 ++++++++++
 internal/handlers/egress_allowlist_test.go    | 19 +++++++++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/internal/handlers/egress_allowlist_defaults.yaml b/internal/handlers/egress_allowlist_defaults.yaml
index a4bc650..98c5d74 100644
--- a/internal/handlers/egress_allowlist_defaults.yaml
+++ b/internal/handlers/egress_allowlist_defaults.yaml
@@ -604,6 +604,16 @@ ecosystem_default_domains:
     - prometheus-community.github.io
     - grafana.github.io
     - jaegertracing.github.io
+    - kedacore.github.io
+    - kyverno.github.io
+    - argoproj.github.io
+    - open-telemetry.github.io
+    - kubernetes-sigs.github.io
+    - vmware-tanzu.github.io
+    - bitnami.github.io
+    - charts.external-secrets.io
+    # Redirect target of charts.external-secrets.io.
+    - external-secrets.io
   # GitHub-hosted or per-job configured; covered by github_infra_domains / git.
   # Note: additional per-job dependencies (e.g. pre_commit hooks that install
   # from other ecosystems) are covered because the handler applies the union of
diff --git a/internal/handlers/egress_allowlist_test.go b/internal/handlers/egress_allowlist_test.go
index a00e3fc..579279b 100644
--- a/internal/handlers/egress_allowlist_test.go
+++ b/internal/handlers/egress_allowlist_test.go
@@ -729,6 +729,15 @@ func TestEgressAllowlist_NewEntriesDoNotWidenBeyondExactHosts(t *testing.T) {
 		"https://evil.maven.artifacts.atlassian.com/maven",
 		"https://evil.mirrors.huaweicloud.com/repository/npm",
 		"https://evil.dotnetcli.blob.core.windows.net/payload",
+		"https://evil.kedacore.github.io/payload",
+		"https://evil.kyverno.github.io/payload",
+		"https://evil.argoproj.github.io/payload",
+		"https://evil.open-telemetry.github.io/payload",
+		"https://evil.kubernetes-sigs.github.io/payload",
+		"https://evil.vmware-tanzu.github.io/payload",
+		"https://evil.bitnami.github.io/payload",
+		"https://evil.charts.external-secrets.io/payload",
+		"https://evil.external-secrets.io/payload",
 	}
 
 	// Sibling hosts: names sharing a parent with an added entry. These pin the
@@ -744,6 +753,7 @@ func TestEgressAllowlist_NewEntriesDoNotWidenBeyondExactHosts(t *testing.T) {
 		"https://attacker.artifacts.atlassian.com/maven",
 		"https://attacker.huaweicloud.com/repository/npm",
 		"https://attacker.julialang.org/bin",
+		"https://attacker.external-secrets.io/payload",
 		// Cloudsmith is multi-tenant with the tenant in the URL path, and the
 		// allowlist authorizes the hostname only. Neither the tenant subdomain
 		// form nor the shared download hosts may be globally allowed.
@@ -918,6 +928,15 @@ func TestEgressAllowlist_AddedMissingDomainsAllowed(t *testing.T) {
 		"https://prometheus-community.github.io/helm-charts/index.yaml",
 		"https://grafana.github.io/helm-charts/index.yaml",
 		"https://jaegertracing.github.io/helm-charts/index.yaml",
+		"https://kedacore.github.io/charts/index.yaml",
+		"https://kyverno.github.io/kyverno/index.yaml",
+		"https://argoproj.github.io/argo-helm/index.yaml",
+		"https://open-telemetry.github.io/opentelemetry-helm-charts/index.yaml",
+		"https://kubernetes-sigs.github.io/external-dns/index.yaml",
+		"https://vmware-tanzu.github.io/helm-charts/index.yaml",
+		"https://bitnami.github.io/sealed-secrets/index.yaml",
+		"https://charts.external-secrets.io/index.yaml",
+		"https://external-secrets.io/index.yaml",
 		"https://cocoapods.org/pods/AFNetworking",
 	} {
 		assert.Nil(t, egressResult(t, h, allowed), "added host should be allowed: "+allowed)