drivenets / kne

39%

LAST BUILD ON BRANCH main

branch: SELECT

CHANGE BRANCH

x

Sync Branches

• No branch selected
• add-node-selector-only
• dependabot/go_modules/golang.org/x/crypto-0.45.0
• fix/exclude-eth0-from-interface-count
• main
• marco/add_azure_lb_annotations
• marco/add_node_selector
• marco/delete_wait
• marco/support_mcdnos_model
• marco/update_cdnos_manifest
• security-fixes-and-version
• sync/meshnet-v0.5.0-dn

Build # 26437130142

Build Type

push

github

Committed by msupinodn

Commit Message

manifests/meshnet: sync to hardened drivenets fork v0.5.0-dn

Pulls in the meshnet-cni release v0.5.0-dn (msupinodn/meshnet-cni#2):

  * Image bumped from upstream
    us-west1-docker.pkg.dev/kne-external/kne/networkop/meshnet:v0.3.2
    to
    public.ecr.aws/drivenets/meshnet-cni:v0.5.0-dn

  * RBAC narrowed: drop verbs ["*"], pin to actually-exercised verbs on
    topologies (get/list/watch/update/patch) and gwirekobjs
    (+create/delete). Adds nodes get/list/watch so the daemon can build
    the peer-IP allowlist used by validatePeerNodeIP / handler.Get to
    reject SSRF attempts via tampered topology CR status.src_ip.

  * Adds explicit cpu limit (2) and aligns memory limits/requests with
    the meshnet-cni source-of-truth manifests.

  * Removes hostIPC: true (unused; meshnet relies on hostNetwork +
    Bidirectional netns mount, not shared IPC).

This lets internal docs use the same install URL with drivenets/ in
place of openconfig/ and get the hardened version automatically:

  kubectl apply -f \
    https://raw.githubusercontent.com/drivenets/kne/refs/heads/main/manifests/meshnet/grpc/manifest.yaml

Co-authored-by: Cursor <cursoragent@cursor.com>

Coverage Stats

4858 of 12307 relevant lines covered (39.47%)

0.45 hits per line