Azure / kube-egress-gateway / 41857924076

75%

push

github

fix: authorize BYO publicIpPrefixId via administrator-set Azure tag (#1389)

* Authorize BYO public IP prefix via administrator-set Azure tag

A namespaced StaticGatewayConfiguration may reference an arbitrary BYO public IP
prefix by ARM ID. The controller resolves and attaches that prefix with the
privileged cluster identity, so without an authorization check a namespace
tenant could cause an administrator-owned prefix to be attached to the gateway
and originate egress traffic from a trusted source IP.

This adds a fail-closed authorization check on the BYO prefix path: the prefix
must carry the Azure resource tag 'kube-egress-gateway-allowed-namespaces' whose
value lists the allowed namespaces (comma/semicolon separated, or '*'). The
controller reads the tag from the prefix it already fetches and rejects the
request unless the StaticGatewayConfiguration's namespace is listed.

Setting this tag requires Azure write access to the prefix, which a namespace
tenant does not have, so it is an administrator-controlled authorization signal
that needs no API or control-plane changes. Managed (controller-created)
prefixes are unaffected; only tenant-supplied BYO prefixes are checked.

* feat: add BYO prefix authorization migration warnings

Default enforcement to false, surface actionable SGC warnings with documentation guidance, and expose enforcement through CLI and deployment settings.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: align BYO prefix test with Azure network SDK v12

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: compare BYO prefix authorization tag keys case-insensitively

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

27 of 31 new or added lines in 3 files covered. (87.1%)

3404 of 4527 relevant lines covered (75.19%)

0.76 hits per line