Signed-off-by: entlein <einentlein@gmail.com>

Signed-off-by: entlein <einentlein@gmail.com>

…rt if delcared and violated

Signed-off-by: entlein <einentlein@gmail.com>

Let a ContainerProfile allowlist cluster-infrastructure egress/ingress by
Service name, Service label selector, or host entity instead of a broad
ipAddresses serviceCIDR that blinds R0011/R0012 to lateral movement.

Each serviceRef/serviceSelector/entity neighbor resolves at projection time
to the concrete ClusterIP + backing-endpoint (or node/gateway) IPs it stands
for, carrying its own ports, and is appended as an ordinary selector-free
ipAddresses neighbor. The existing port-sensitive address matcher enforces
it unchanged; unresolved selectors contribute nothing (never a match-all).

- pkg/networkpeer: Resolve/Matches/ResolveIPs + Lister over Service,
  EndpointSlice and Node informers, with a generation counter so a profile
  projected before the informers synced re-projects once the view changes.
- objectcache/reconciler: mark profiles that use service resolution and
  re-project them when the lister generation advances; plain profiles keep
  the identical old fast-skip path.
- cmd/main.go: cluster-wide Service/EndpointSlice informers + a node-scoped
  Node informer, started non-blocking (no WaitForCacheSync on the hot path).
- fail closed on ServiceSelector MatchExpressions / empty matchLabels and on
  any namespaceSelector other than kubernetes.io/metadata.name=<ns>.
- Test_50 component test (serviceRef egress allowed, external egress still
  fires R0011) + resolve/expand/lister unit tests + fixture-lint R-NN-12
  extended to accept the new target fields.

Depends on the storage schema fields ServiceRefNamespace/ServiceRefName/
ServiceSelector/Entity; go.mod pins the fork's storage until the companion
upstream storage PR lands.

Signed-off-by: tanzee <einentlein@gmail.com>

…rviceRef

Component test Test_50 now generates its traffic from a real Flux
source-controller reconciling HelmRepository CRs instead of exec'ing curl,
and its ContainerProfile is network-only (no syscalls/execs, which only add
false-positive surface to a network test).

The profile names every peer as a Kubernetes object: serviceRef
default/kubernetes for the apiserver, serviceRef kube-system/kube-dns for
resolution, and a serviceSelector role=helm-repo fanning across the two repo
Services. The negative is the lateral move a serviceCIDR entry hides: the
HelmRepository URL is repointed at a sibling Service on the same port that
the selector does not cover, and the controller fetches it itself.
Verified on kind: 0 alerts for the named peers, R0011 within 15s for the
sibling.

Fixes found while validating end to end:
- ClusterRole was missing discovery.k8s.io/endpointslices, so the informer
  was forbidden and Service endpoint IPs never resolved — the feature
  silently degraded to ClusterIP-only.
- Service/EndpointSlice informers are now gated behind
  networkServiceResolutionEnabled and strip managedFields/annotations (and
  per-endpoint fields beyond Addresses) via SetTransform, so agents that do
  not use the feature pay no cluster-wide list+watch and the cache stays
  small on those that do.
- serviceRef/serviceSelector now also imply the Service cluster FQDN as a
  dnsName, so a client dialling the Service by name is allowlisted without a
  parallel dnsNames entry.
- specFromNeighbor no longer allocates a discarded port slice for every
  plain ipAddresses neighbor.
- R0011 no longer excludes private destinations: in-cluster lateral movement
  is exactly what this feature exists to expose.

Signed-off-by: tanzee <einentlein@gmail.com>

Relaxing the shipped R0011 to fire on private destinations made kube-dns
egress alert for every workload that does not name it: Test_21 gained a
spurious R0011 and Test_28 lost allowed_fusioncore_no_alert and
mitm_coredns_poisoning. Restore the stock expression and express the
internal-egress predicate as a test-only rule (R9911) bound by podSelector to
this suite's pods, so nothing outside it changes.

Verified on kind: Test_50 passes both phases against the stock ruleset, and
Test_21 + all six Test_28 subtests are green again.

Signed-off-by: tanzee <einentlein@gmail.com>

Hardcoding the flag in the ConfigMap made it impossible to measure the
feature's cost against itself. Expose it as nodeAgent.config.networkServiceResolution
(on in the test chart, so Test_50 still exercises it) so an A/B can toggle
resolution without rebuilding the image.

Signed-off-by: tanzee <einentlein@gmail.com>

The CEL result cache keys on SpecHash + SyncChecksum. Re-projecting a
serviceRef/serviceSelector/entity profile against a moved cluster view changes
neither: SpecHash tracks the rule projection spec, and SyncChecksum comes from a
learned CP annotation an authored profile does not carry at all. So a result
computed before the Service/EndpointSlice informers filled — 'this ClusterIP is
not in egress' — was served from the LRU indefinitely, and the re-projection the
lister generation correctly triggered had no observable effect. Egress to an
allowlisted Service kept alerting.

Carry the resolution generation on the projected profile and include it in the
key, so the cache moves whenever the resolved addresses can have moved.

Signed-off-by: tanzee <einentlein@gmail.com>

R0011 keeps its external-only scope (!is_private_ip); internal traffic gets its
own rule instead of widening R0011 — rewriting R0011's scope broke Test_21/28
(kube-dns FPs) when tried in the fork CT.

R0012 alerts on OUTGOING to private addresses (loopback excluded — is_private_ip
counts 127.0.0.1/::1 as private) not allowlisted by the profile's egress
addresses, which includes serviceRef/serviceSelector-resolved entries. Uses the
port-aware matcher; behaves address-only until the port projection lands, then
becomes port-sensitive with no rules change. A selector clause
(was_selector_in_egress) is added one-line when the peer-selector fields merge.
Same defaults as R0011; uniqueId keyed on addr_port_proto; bound in the default
binding (new rule names are inert until bound).

Signed-off-by: tanzee <einentlein@gmail.com>

Per design review: R0011 (egress) and R0012 (ingress, new) are symmetric twins.
Neither uses is_private_ip — internal and external peers are treated alike, so
lateral movement to unlisted internal peers alerts; only loopback is excluded.
Allowlisting internal traffic is the profile's job (addresses, resolved
serviceRef/serviceSelector entries), not the rule's.

Both use the port-aware matcher (address-only until port projection lands).
On HOST (incoming) events the gadget's dstAddr/dstPort carry the remote peer
and local port. R0011's scope widens to internal egress: component tests whose
profiles do not list kube-dns et al. will alert until their profiles do —
that pressure is the feature.

Signed-off-by: tanzee <einentlein@gmail.com>

…t/network-v2

# Conflicts:
#	pkg/objectcache/projection_types.go

…into feat/network-v2

# Conflicts:
#	tests/chart/templates/node-agent/default-rules.yaml

portalerts carried its own copy of the celnetworkselector peer-selector
functions; the merge kept both and the package no longer compiled. One copy
remains.

Signed-off-by: tanzee <einentlein@gmail.com>

…xes)

Signed-off-by: tanzee <einentlein@gmail.com>

… twin

The scoped R9911 rule and its binding are gone — the widened R0011 covers
internal egress, so the decoy pivot asserts the shipped rule. Test_51 mirrors
it for ingress: nginx serves a serviceRef-listed client (flux
source-controller, resolution covers its ClusterIP and pod endpoint IPs) with
zero R0012, then an unlisted k6 client joins and R0012 must fire. Both use
only real controller/loadgen traffic.

Signed-off-by: tanzee <einentlein@gmail.com>

…eset

Deployable over any kubescape install to replace the stock rules; namespace
templated. A drift test pins the chart copy to the CI-validated test-chart
copy so the shipped semantics are always the tested ones.

Signed-off-by: tanzee <einentlein@gmail.com>