[blacksoxx]

Overview

node-agent's NetworkPolicy gains an egress rule to the synchronizer pods on synchronizer.service.port when the synchronizer is installed, the counterpart of the ingress rule the synchronizer's policy already has for node-agent. kubevuln's policy gains the API server rule every other component renders from assets/api-server-egress-rules.yaml, and, when grypeOfflineDB.enabled is set, an egress rule to the grype-offline-db pods on 8080, the port behind the listingURL the cloudapi ConfigMap hands kubevuln. Both stay under the existing createEgressRules guard.

How to Test

helm dependency build charts/kubescape-operator
helm unittest charts/kubescape-operator

tests/networkpolicy_egress_test.yaml: the synchronizer rule is present when the synchronizer is installed and absent otherwise; the API server rule renders in both its forms (the default selector, and a pinned IP with port 6443); the grype-offline-db rule renders only when it is enabled; no egress renders when createEgressRules is off. The snapshot gains these rules in the four cases that render the two policies with egress on.

Related issues/PRs:

• Fixes With egress rules on, node-agent cannot reach the synchronizer and kubevuln cannot reach grype-offline-db or an API server off port 443 #980

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: f4aaeb9c-9d07-481f-8dce-0a44f14526dd

Commits

Reviewing files that changed from the base of the PR and between 78a5f10 and bca97e7.

Files ignored due to path filters: 1

• charts/kubescape-operator/tests/__snapshot__/snapshot_test.yaml.snap is excluded by !**/*.snap

Files selected for processing: 3

• charts/kubescape-operator/templates/kubevuln/networkpolicy.yaml
• charts/kubescape-operator/templates/node-agent/networkpolicy.yaml
• charts/kubescape-operator/tests/networkpolicy_egress_test.yaml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[matthyx]

Approve — no material blockers found in bca97e7637ce98f5dc3c42ace55ddeb1a129bd9a against main at 78a5f1013e5e4af653fc39b86e10a18fb7633e9b.

The fix is needed for #980: the target branch lacks node-agent → synchronizer and kubevuln → offline DB egress, and kubevuln cannot reach a configured API server on a non-443 port. The additions match destination pod labels and ports, reuse the existing API-server helper, and retain the component and createEgressRules guards. Independent correctness and architecture reviews found no introduced blockers. No dependencies or unrelated changes were added.

History: #768 / #762 establish the same API-server-helper pattern for prometheus-exporter; they do not fix kubevuln. #971 addresses obsolete operator ingress, and #977 addresses offline DB CronJob volumes, so neither supersedes this change. Searches across all PR states and issues used networkpolicy, egress, synchronizer, grype-offline-db, and api-server-egress-rules, with up to 100 results per query, plus local git history. No equivalent fix or explicit rejection of this approach was found. Closed matches #815 (already fixed elsewhere), #844 (moved to ARMO), and #928 (superseded by #929) concern different changes; their closure decisions do not reject these rules. This bounded search is not proof no other match exists.

Validation in a non-root, network-disabled, credential-free container:

• helm dependency build charts/kubescape-operator: passed.
• helm unittest -f tests/networkpolicy_egress_test.yaml charts/kubescape-operator: 6/6 passed; replacing just the two templates with target-branch versions produced 4 failures and 2 passes, confirming regression coverage.
• helm lint charts/kubescape-operator --set unittest=true --set clusterName=kind-kind: passed; git diff --check passed.
• Full helm unittest: head 199 passed / 20 failed; base 193 passed / 20 failed. Both have 38 snapshot mismatches under installed Helm 3.11.0-rc.2 / unittest 0.6.2, including AppArmor representation and null-value output. The full suite is not green locally; these failures also reproduce on base. All reported head CI checks are successful, but no Helm test CI result was listed. Live CNI traffic was not tested.

Pre-existing limitation: unequal synchronizer service/target ports are already blocked by its unchanged ingress policy. This PR follows that existing behavior; a separate correction should cover both directions. No outstanding inline threads or earlier changes-requested reviews existed at final recheck. Verdict: approve.