From e0fc363cbfedddc2883a0a76aa2e1bfba2a9a133 Mon Sep 17 00:00:00 2001 From: rtrm Date: Thu, 6 Aug 2026 14:11:30 +0200 Subject: [PATCH] fix(chart): fail rendering instead of opening the port when a policy rule has no peers A rule with an empty from/to list matches every source or destination, so enabling the ingress restriction without addresses opened the port while looking restrictive. The ingress case now aborts the render with an explicit message, and the internal egress rule is skipped when its list is empty (no destination allowed) rather than rendered wide open. --- chart/templates/network-policy.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/chart/templates/network-policy.yaml b/chart/templates/network-policy.yaml index 029de5f..810ae69 100644 --- a/chart/templates/network-policy.yaml +++ b/chart/templates/network-policy.yaml @@ -9,6 +9,9 @@ spec: matchLabels: {{ include "labels.standard" . | nindent 6 }} policyTypes: {{- if .Values.networkPolicy.ingress.enabled }} + {{- if not .Values.networkPolicy.ingress.allowedBlocks }} + {{- fail "networkPolicy.ingress.enabled needs networkPolicy.ingress.allowedBlocks: a rule with no peers under `from` matches every source, so an empty list would open the port instead of restricting it" }} + {{- end }} - Ingress {{- end }} - Egress