[freeqaz]

Problem

Two chart values become NetworkPolicy peers almost verbatim:

• gatewayRouting.sandbox.ingressPeers checked only matchLabels; ipBlock.cidr, ipBlock.except and matchExpressions were pasted with toYaml.
• openshellGit.clients checked only that both selectors carried matchLabels, not their keys or values.

helm template therefore rendered, for example, ipBlock.cidr: 10.0.0.0/33, operator: Equals with key bad key!, or matchLabels: {kubernetes.io/metadata.name: "openshell system"}. The Kubernetes API (ValidateLabelSelector, ParseCIDR) refuses each one when Helm applies the NetworkPolicy, after other objects of the release have already changed. An unknown key such as podSelectors was rendered as written. Finding 2336.

Change

• New shared helpers in templates/_network-policies.tpl:
  • openclaw.networkPolicy.peer: the peer must be either ipBlock or selectors, with no unknown fields. A field set to null counts as unset, as the API server reads it.
  • openclaw.networkPolicy.selector: matchLabels goes through the existing openclaw.networkPolicy.matchLabels. For matchExpressions it checks the key, the operator (In/NotIn/Exists/DoesNotExist) and that the values fit the operator.
  • openclaw.networkPolicy.cidr: the IPv4/IPv6 parser that gatewayRouting.remoteNodeCidrs already used, moved out so it can be shared. It produces the same messages for that field.
  • openclaw.networkPolicy.labelKey: split out of the matchLabels helper.
• gateway-routing.yaml and openshell-git.yaml run each peer through openclaw.networkPolicy.peer. The rendered YAML does not change for valid input.
• Docs: a one-sentence note in docs/guides/deploy/native-admin.md and a breaking-change notice.
• egressAuthority.clients has the same gap but belongs to the credential proxy listener, so it is left for a separate change.

Verification

• New test "NetworkPolicy peers from values are refused before install" in tests/integration/production-kubernetes-packaging.test.mjs:
  • It fails on main with "Missing expected rejection".
  • With the fix it passes. It covers 9 invalid ingress-peer shapes and 2 invalid openshellGit.clients shapes, plus valid controls: 0.0.0.0/0 with except, ::/0, and matchExpressions using NotIn and Exists.
• The test matches each refusal on Helm's stderr, not the error message (which also carries the --set command line), and checks that valid peers, including a null sibling field, render exactly as written.
• Whole file: 104 pass, 0 fail; pinned 20/20 at 2 CPUs on a remote test VM on the final head.
• Internal review: approve-with-nits. Applied: stderr assertions (the operator case had passed for the wrong reason), null fields read as unset, more unknown-field and value cases, a --set-string hint for non-string expression values, leading-zero octets named in the notice. Mutants for the operator, unknown ipBlock field and null-field checks are caught. This includes the existing remoteNodeCidrs and peer-label tests, which exercise the moved CIDR parser and label-key helper.
• tests/integration/installation-change-preflight.test.mjs: 7 pass. eslint and prettier are clean on the touched files.

Risks

• Low. The only newly refused values are ones the API server would refuse anyway, plus unknown peer keys. Unknown keys are the one case that may have applied before, depending on field validation, so there is a notice.
• ipBlock.except containment inside cidr is not checked.
• This PR and fix(openshell): check sandbox policy settings at controller startup #3499 both add an entry at the top of breaking-changes.md. Whichever lands second needs a trivial merge of main.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review in progress

ClawSweeper is reviewing this revision. This supersedes any previous blocked status.

View the workflow run.