Skip to content

Commit 3c64b42

Browse files
ninan-nnninan-nn
authored
Merge pull request #601 from alibaba/bump/egress-v1.0.4
chore: bump egress to v1.0.4
2 parents 59692c2 + 536412f commit 3c64b42

File tree

10 files changed

+39
-39
lines changed

10 files changed

+39
-39
lines changed

‎kubernetes/charts/opensandbox-server/values.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,6 @@ configToml: |
7474
batchsandbox_template_file = "/etc/opensandbox/example.batchsandbox-template.yaml"
7575
7676
[egress]
77-
image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.0.3"
77+
image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.0.4"
7878
mode = "dns+nft"
7979

‎server/docker-compose.example.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ configs:
1212
execd_image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:v1.0.9"
1313
1414
[egress]
15-
image = "opensandbox/egress:v1.0.3"
16-
# image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.0.3"
15+
image = "opensandbox/egress:v1.0.4"
16+
# image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.0.4"
1717
1818
[docker]
1919
network_mode = "bridge"

‎server/opensandbox_server/examples/example.config.k8s.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,6 @@ mode = "direct"
7878
[egress]
7979
# Egress configuration
8080
# -----------------------------------------------------------------
81-
image = "opensandbox/egress:v1.0.3"
81+
image = "opensandbox/egress:v1.0.4"
8282
# Enforcement: "dns" (DNS proxy only) or "dns+nft" (nftables + DNS).
8383
mode = "dns"

‎server/opensandbox_server/examples/example.config.k8s.zh.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,6 @@ mode = "direct"
7979
[egress]
8080
# Egress configuration
8181
# -----------------------------------------------------------------
82-
image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.0.3"
82+
image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.0.4"
8383
# Enforcement: "dns" (DNS proxy only) or "dns+nft" (nftables + DNS).
8484
mode = "dns"

‎server/opensandbox_server/examples/example.config.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ execd_image = "opensandbox/execd:v1.0.9"
4545
[egress]
4646
# Egress configuration
4747
# -----------------------------------------------------------------
48-
image = "opensandbox/egress:v1.0.3"
48+
image = "opensandbox/egress:v1.0.4"
4949
# Enforcement: "dns" (DNS proxy only) or "dns+nft" (nftables + DNS).
5050
mode = "dns"
5151

‎server/opensandbox_server/examples/example.config.zh.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ execd_image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd
4242
[egress]
4343
# Egress configuration
4444
# -----------------------------------------------------------------
45-
image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.0.3"
45+
image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.0.4"
4646
# Enforcement: "dns" (DNS proxy only) or "dns+nft" (nftables + DNS).
4747
mode = "dns"
4848

‎server/tests/k8s/test_agent_sandbox_provider.py‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -520,7 +520,7 @@ def test_create_workload_with_network_policy_adds_sidecar(self, mock_k8s_client)
520520
expires_at=expires_at,
521521
execd_image="execd:latest",
522522
network_policy=network_policy,
523-
egress_image="opensandbox/egress:v1.0.3",
523+
egress_image="opensandbox/egress:v1.0.4",
524524
)
525525

526526
body = mock_k8s_client.create_custom_object.call_args.kwargs["body"]
@@ -533,7 +533,7 @@ def test_create_workload_with_network_policy_adds_sidecar(self, mock_k8s_client)
533533
# Find sidecar container
534534
sidecar = next((c for c in containers if c["name"] == "egress"), None)
535535
assert sidecar is not None
536-
assert sidecar["image"] == "opensandbox/egress:v1.0.3"
536+
assert sidecar["image"] == "opensandbox/egress:v1.0.4"
537537

538538
# Verify sidecar has environment variable
539539
env_vars = {e["name"]: e["value"] for e in sidecar.get("env", [])}
@@ -570,7 +570,7 @@ def test_create_workload_with_network_policy_persists_annotation_and_sidecar_tok
570570
expires_at=None,
571571
execd_image="execd:latest",
572572
network_policy=NetworkPolicy(default_action="deny", egress=[]),
573-
egress_image="opensandbox/egress:v1.0.3",
573+
egress_image="opensandbox/egress:v1.0.4",
574574
annotations={SANDBOX_EGRESS_AUTH_TOKEN_METADATA_KEY: "egress-token"},
575575
egress_auth_token="egress-token",
576576
)
@@ -602,7 +602,7 @@ def test_create_workload_with_egress_mode_dns_nft(self, mock_k8s_client):
602602
expires_at=None,
603603
execd_image="execd:latest",
604604
network_policy=NetworkPolicy(default_action="deny", egress=[]),
605-
egress_image="opensandbox/egress:v1.0.3",
605+
egress_image="opensandbox/egress:v1.0.4",
606606
egress_mode=EGRESS_MODE_DNS_NFT,
607607
)
608608

@@ -636,7 +636,7 @@ def test_create_workload_with_network_policy_does_not_add_pod_ipv6_sysctls(self,
636636
expires_at=expires_at,
637637
execd_image="execd:latest",
638638
network_policy=network_policy,
639-
egress_image="opensandbox/egress:v1.0.3",
639+
egress_image="opensandbox/egress:v1.0.4",
640640
)
641641

642642
body = mock_k8s_client.create_custom_object.call_args.kwargs["body"]
@@ -676,7 +676,7 @@ def test_create_workload_with_network_policy_drops_net_admin_from_main_container
676676
expires_at=expires_at,
677677
execd_image="execd:latest",
678678
network_policy=network_policy,
679-
egress_image="opensandbox/egress:v1.0.3",
679+
egress_image="opensandbox/egress:v1.0.4",
680680
)
681681

682682
body = mock_k8s_client.create_custom_object.call_args.kwargs["body"]
@@ -759,7 +759,7 @@ def test_egress_sidecar_contains_network_policy_in_env(self, mock_k8s_client):
759759
expires_at=expires_at,
760760
execd_image="execd:latest",
761761
network_policy=network_policy,
762-
egress_image="opensandbox/egress:v1.0.3",
762+
egress_image="opensandbox/egress:v1.0.4",
763763
)
764764

765765
body = mock_k8s_client.create_custom_object.call_args.kwargs["body"]

‎server/tests/k8s/test_batchsandbox_provider.py‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1225,7 +1225,7 @@ def test_create_workload_with_network_policy_adds_sidecar(self, mock_k8s_client)
12251225
expires_at=expires_at,
12261226
execd_image="execd:latest",
12271227
network_policy=network_policy,
1228-
egress_image="opensandbox/egress:v1.0.3",
1228+
egress_image="opensandbox/egress:v1.0.4",
12291229
)
12301230

12311231
body = mock_k8s_client.create_custom_object.call_args.kwargs["body"]
@@ -1238,7 +1238,7 @@ def test_create_workload_with_network_policy_adds_sidecar(self, mock_k8s_client)
12381238
# Find sidecar container
12391239
sidecar = next((c for c in containers if c["name"] == "egress"), None)
12401240
assert sidecar is not None
1241-
assert sidecar["image"] == "opensandbox/egress:v1.0.3"
1241+
assert sidecar["image"] == "opensandbox/egress:v1.0.4"
12421242

12431243
# Verify sidecar has environment variable
12441244
env_vars = {e["name"]: e["value"] for e in sidecar.get("env", [])}
@@ -1275,7 +1275,7 @@ def test_create_workload_with_network_policy_persists_annotation_and_sidecar_tok
12751275
expires_at=None,
12761276
execd_image="execd:latest",
12771277
network_policy=NetworkPolicy(default_action="deny", egress=[]),
1278-
egress_image="opensandbox/egress:v1.0.3",
1278+
egress_image="opensandbox/egress:v1.0.4",
12791279
annotations={SANDBOX_EGRESS_AUTH_TOKEN_METADATA_KEY: "egress-token"},
12801280
egress_auth_token="egress-token",
12811281
)
@@ -1307,7 +1307,7 @@ def test_create_workload_with_egress_mode_dns_nft(self, mock_k8s_client):
13071307
expires_at=None,
13081308
execd_image="execd:latest",
13091309
network_policy=NetworkPolicy(default_action="deny", egress=[]),
1310-
egress_image="opensandbox/egress:v1.0.3",
1310+
egress_image="opensandbox/egress:v1.0.4",
13111311
egress_mode=EGRESS_MODE_DNS_NFT,
13121312
)
13131313

@@ -1342,7 +1342,7 @@ def test_create_workload_with_network_policy_does_not_add_pod_ipv6_sysctls(self,
13421342
expires_at=expires_at,
13431343
execd_image="execd:latest",
13441344
network_policy=network_policy,
1345-
egress_image="opensandbox/egress:v1.0.3",
1345+
egress_image="opensandbox/egress:v1.0.4",
13461346
)
13471347

13481348
body = mock_k8s_client.create_custom_object.call_args.kwargs["body"]
@@ -1382,7 +1382,7 @@ def test_create_workload_with_network_policy_drops_net_admin_from_main_container
13821382
expires_at=expires_at,
13831383
execd_image="execd:latest",
13841384
network_policy=network_policy,
1385-
egress_image="opensandbox/egress:v1.0.3",
1385+
egress_image="opensandbox/egress:v1.0.4",
13861386
)
13871387

13881388
body = mock_k8s_client.create_custom_object.call_args.kwargs["body"]
@@ -1465,7 +1465,7 @@ def test_egress_sidecar_contains_network_policy_in_env(self, mock_k8s_client):
14651465
expires_at=expires_at,
14661466
execd_image="execd:latest",
14671467
network_policy=network_policy,
1468-
egress_image="opensandbox/egress:v1.0.3",
1468+
egress_image="opensandbox/egress:v1.0.4",
14691469
)
14701470

14711471
body = mock_k8s_client.create_custom_object.call_args.kwargs["body"]
@@ -1556,7 +1556,7 @@ def test_create_workload_with_network_policy_works_with_template(self, mock_k8s_
15561556
expires_at=expires_at,
15571557
execd_image="execd:latest",
15581558
network_policy=network_policy,
1559-
egress_image="opensandbox/egress:v1.0.3",
1559+
egress_image="opensandbox/egress:v1.0.4",
15601560
)
15611561

15621562
body = mock_k8s_client.create_custom_object.call_args.kwargs["body"]

‎server/tests/k8s/test_egress_helper.py‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ class TestEgressSidecarViaApply:
5353

5454
def test_builds_container_with_basic_config(self):
5555
"""Test that container is built with correct basic configuration."""
56-
egress_image = "opensandbox/egress:v1.0.3"
56+
egress_image = "opensandbox/egress:v1.0.4"
5757
network_policy = NetworkPolicy(
5858
default_action="deny",
5959
egress=[
@@ -70,7 +70,7 @@ def test_builds_container_with_basic_config(self):
7070

7171
def test_contains_egress_rules_environment_variable(self):
7272
"""Test that container includes OPENSANDBOX_EGRESS_RULES environment variable."""
73-
egress_image = "opensandbox/egress:v1.0.3"
73+
egress_image = "opensandbox/egress:v1.0.4"
7474
network_policy = NetworkPolicy(
7575
default_action="deny",
7676
egress=[NetworkRule(action="allow", target="example.com")],
@@ -86,7 +86,7 @@ def test_contains_egress_rules_environment_variable(self):
8686
assert env_vars[1]["value"] == EGRESS_MODE_DNS
8787

8888
def test_contains_egress_token_when_provided(self):
89-
egress_image = "opensandbox/egress:v1.0.3"
89+
egress_image = "opensandbox/egress:v1.0.4"
9090
network_policy = NetworkPolicy(
9191
default_action="deny",
9292
egress=[NetworkRule(action="allow", target="example.com")],
@@ -103,7 +103,7 @@ def test_contains_egress_token_when_provided(self):
103103
assert env_vars[EGRESS_MODE_ENV] == EGRESS_MODE_DNS
104104

105105
def test_egress_mode_dns_nft(self):
106-
egress_image = "opensandbox/egress:v1.0.3"
106+
egress_image = "opensandbox/egress:v1.0.4"
107107
network_policy = NetworkPolicy(
108108
default_action="deny",
109109
egress=[NetworkRule(action="allow", target="example.com")],
@@ -120,7 +120,7 @@ def test_egress_mode_dns_nft(self):
120120

121121
def test_serializes_network_policy_correctly(self):
122122
"""Test that network policy is correctly serialized to JSON."""
123-
egress_image = "opensandbox/egress:v1.0.3"
123+
egress_image = "opensandbox/egress:v1.0.4"
124124
network_policy = NetworkPolicy(
125125
default_action="deny",
126126
egress=[
@@ -145,7 +145,7 @@ def test_serializes_network_policy_correctly(self):
145145

146146
def test_handles_empty_egress_rules(self):
147147
"""Test that empty egress rules are handled correctly."""
148-
egress_image = "opensandbox/egress:v1.0.3"
148+
egress_image = "opensandbox/egress:v1.0.4"
149149
network_policy = NetworkPolicy(
150150
default_action="allow",
151151
egress=[],
@@ -161,7 +161,7 @@ def test_handles_empty_egress_rules(self):
161161

162162
def test_handles_missing_default_action(self):
163163
"""Test that missing default_action is handled (exclude_none=True)."""
164-
egress_image = "opensandbox/egress:v1.0.3"
164+
egress_image = "opensandbox/egress:v1.0.4"
165165
network_policy = NetworkPolicy(
166166
egress=[NetworkRule(action="allow", target="example.com")],
167167
)
@@ -176,7 +176,7 @@ def test_handles_missing_default_action(self):
176176

177177
def test_security_context_adds_net_admin_not_privileged(self):
178178
"""Egress sidecar uses NET_ADMIN only (IPv6 is disabled in execd init when egress is on)."""
179-
egress_image = "opensandbox/egress:v1.0.3"
179+
egress_image = "opensandbox/egress:v1.0.4"
180180
network_policy = NetworkPolicy(
181181
default_action="deny",
182182
egress=[],
@@ -190,14 +190,14 @@ def test_security_context_adds_net_admin_not_privileged(self):
190190

191191
def test_no_command_uses_image_entrypoint(self):
192192
container = _egress_container(
193-
"opensandbox/egress:v1.0.3",
193+
"opensandbox/egress:v1.0.4",
194194
NetworkPolicy(default_action="deny", egress=[]),
195195
)
196196
assert "command" not in container
197197

198198
def test_container_spec_is_valid_kubernetes_format(self):
199199
"""Test that returned container spec is in valid Kubernetes format."""
200-
egress_image = "opensandbox/egress:v1.0.3"
200+
egress_image = "opensandbox/egress:v1.0.4"
201201
network_policy = NetworkPolicy(
202202
default_action="deny",
203203
egress=[NetworkRule(action="allow", target="example.com")],
@@ -218,7 +218,7 @@ def test_container_spec_is_valid_kubernetes_format(self):
218218

219219
def test_handles_wildcard_domains(self):
220220
"""Test that wildcard domains in egress rules are handled correctly."""
221-
egress_image = "opensandbox/egress:v1.0.3"
221+
egress_image = "opensandbox/egress:v1.0.4"
222222
network_policy = NetworkPolicy(
223223
default_action="deny",
224224
egress=[
@@ -264,7 +264,7 @@ def test_adds_egress_sidecar_container(self):
264264
default_action="deny",
265265
egress=[NetworkRule(action="allow", target="example.com")],
266266
)
267-
egress_image = "opensandbox/egress:v1.0.3"
267+
egress_image = "opensandbox/egress:v1.0.4"
268268

269269
apply_egress_to_spec(
270270
containers,
@@ -283,7 +283,7 @@ def test_does_not_touch_unrelated_pod_state(self):
283283
default_action="deny",
284284
egress=[NetworkRule(action="allow", target="example.com")],
285285
)
286-
egress_image = "opensandbox/egress:v1.0.3"
286+
egress_image = "opensandbox/egress:v1.0.4"
287287

288288
apply_egress_to_spec(
289289
containers,
@@ -308,7 +308,7 @@ def test_preserves_existing_pod_sysctls_when_not_passed_in(self):
308308
default_action="deny",
309309
egress=[NetworkRule(action="allow", target="example.com")],
310310
)
311-
egress_image = "opensandbox/egress:v1.0.3"
311+
egress_image = "opensandbox/egress:v1.0.4"
312312

313313
apply_egress_to_spec(
314314
containers,
@@ -330,7 +330,7 @@ def test_no_op_when_no_network_policy(self):
330330
apply_egress_to_spec(
331331
containers,
332332
None,
333-
"opensandbox/egress:v1.0.3",
333+
"opensandbox/egress:v1.0.4",
334334
)
335335

336336
assert len(containers) == 0

‎server/tests/k8s/test_kubernetes_service.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -232,7 +232,7 @@ async def test_create_sandbox_with_network_policy_passes_egress_token_and_annota
232232
self, k8s_service, create_sandbox_request
233233
):
234234
create_sandbox_request.network_policy = NetworkPolicy(default_action="deny", egress=[])
235-
k8s_service.app_config.egress = EgressConfig(image="opensandbox/egress:v1.0.3")
235+
k8s_service.app_config.egress = EgressConfig(image="opensandbox/egress:v1.0.4")
236236
k8s_service.workload_provider.create_workload.return_value = {
237237
"name": "test-id", "uid": "uid-1"
238238
}
@@ -259,7 +259,7 @@ async def test_create_sandbox_with_network_policy_passes_egress_mode_dns_nft_fro
259259
):
260260
create_sandbox_request.network_policy = NetworkPolicy(default_action="deny", egress=[])
261261
k8s_service.app_config.egress = EgressConfig(
262-
image="opensandbox/egress:v1.0.3",
262+
image="opensandbox/egress:v1.0.4",
263263
mode=EGRESS_MODE_DNS_NFT,
264264
)
265265
k8s_service.workload_provider.create_workload.return_value = {

0 commit comments

Comments
 (0)