Skip to content

chore: bump egress to v1.0.4 #601

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ninan-nn merged 1 commit into from
Mar 30, 2026
Merged

chore: bump egress to v1.0.4 #601

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion kubernetes/charts/opensandbox-server/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,6 @@ configToml: |
batchsandbox_template_file = "/etc/opensandbox/example.batchsandbox-template.yaml"
[egress]
image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.0.3"
image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.0.4"
mode = "dns+nft"
4 changes: 2 additions & 2 deletions server/docker-compose.example.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,8 @@ configs:
execd_image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:v1.0.9"
[egress]
image = "opensandbox/egress:v1.0.3"
# image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.0.3"
image = "opensandbox/egress:v1.0.4"
# image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.0.4"
[docker]
network_mode = "bridge"
Expand Down
2 changes: 1 addition & 1 deletion server/opensandbox_server/examples/example.config.k8s.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,6 @@ mode = "direct"
[egress]
# Egress configuration
# -----------------------------------------------------------------
image = "opensandbox/egress:v1.0.3"
image = "opensandbox/egress:v1.0.4"
# Enforcement: "dns" (DNS proxy only) or "dns+nft" (nftables + DNS).
mode = "dns"
2 changes: 1 addition & 1 deletion server/opensandbox_server/examples/example.config.k8s.zh.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,6 @@ mode = "direct"
[egress]
# Egress configuration
# -----------------------------------------------------------------
image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.0.3"
image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.0.4"
# Enforcement: "dns" (DNS proxy only) or "dns+nft" (nftables + DNS).
mode = "dns"
2 changes: 1 addition & 1 deletion server/opensandbox_server/examples/example.config.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ execd_image = "opensandbox/execd:v1.0.9"
[egress]
# Egress configuration
# -----------------------------------------------------------------
image = "opensandbox/egress:v1.0.3"
image = "opensandbox/egress:v1.0.4"
# Enforcement: "dns" (DNS proxy only) or "dns+nft" (nftables + DNS).
mode = "dns"

Expand Down
2 changes: 1 addition & 1 deletion server/opensandbox_server/examples/example.config.zh.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ execd_image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd
[egress]
# Egress configuration
# -----------------------------------------------------------------
image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.0.3"
image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.0.4"
# Enforcement: "dns" (DNS proxy only) or "dns+nft" (nftables + DNS).
mode = "dns"

Expand Down
14 changes: 7 additions & 7 deletions server/tests/k8s/test_agent_sandbox_provider.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -520,7 +520,7 @@ def test_create_workload_with_network_policy_adds_sidecar(self, mock_k8s_client)
expires_at=expires_at,
execd_image="execd:latest",
network_policy=network_policy,
egress_image="opensandbox/egress:v1.0.3",
egress_image="opensandbox/egress:v1.0.4",
)

body = mock_k8s_client.create_custom_object.call_args.kwargs["body"]
Expand All @@ -533,7 +533,7 @@ def test_create_workload_with_network_policy_adds_sidecar(self, mock_k8s_client)
# Find sidecar container
sidecar = next((c for c in containers if c["name"] == "egress"), None)
assert sidecar is not None
assert sidecar["image"] == "opensandbox/egress:v1.0.3"
assert sidecar["image"] == "opensandbox/egress:v1.0.4"

# Verify sidecar has environment variable
env_vars = {e["name"]: e["value"] for e in sidecar.get("env", [])}
Expand Down Expand Up @@ -570,7 +570,7 @@ def test_create_workload_with_network_policy_persists_annotation_and_sidecar_tok
expires_at=None,
execd_image="execd:latest",
network_policy=NetworkPolicy(default_action="deny", egress=[]),
egress_image="opensandbox/egress:v1.0.3",
egress_image="opensandbox/egress:v1.0.4",
annotations={SANDBOX_EGRESS_AUTH_TOKEN_METADATA_KEY: "egress-token"},
egress_auth_token="egress-token",
)
Expand Down Expand Up @@ -602,7 +602,7 @@ def test_create_workload_with_egress_mode_dns_nft(self, mock_k8s_client):
expires_at=None,
execd_image="execd:latest",
network_policy=NetworkPolicy(default_action="deny", egress=[]),
egress_image="opensandbox/egress:v1.0.3",
egress_image="opensandbox/egress:v1.0.4",
egress_mode=EGRESS_MODE_DNS_NFT,
)

Expand Down Expand Up @@ -636,7 +636,7 @@ def test_create_workload_with_network_policy_does_not_add_pod_ipv6_sysctls(self,
expires_at=expires_at,
execd_image="execd:latest",
network_policy=network_policy,
egress_image="opensandbox/egress:v1.0.3",
egress_image="opensandbox/egress:v1.0.4",
)

body = mock_k8s_client.create_custom_object.call_args.kwargs["body"]
Expand Down Expand Up @@ -676,7 +676,7 @@ def test_create_workload_with_network_policy_drops_net_admin_from_main_container
expires_at=expires_at,
execd_image="execd:latest",
network_policy=network_policy,
egress_image="opensandbox/egress:v1.0.3",
egress_image="opensandbox/egress:v1.0.4",
)

body = mock_k8s_client.create_custom_object.call_args.kwargs["body"]
Expand Down Expand Up @@ -759,7 +759,7 @@ def test_egress_sidecar_contains_network_policy_in_env(self, mock_k8s_client):
expires_at=expires_at,
execd_image="execd:latest",
network_policy=network_policy,
egress_image="opensandbox/egress:v1.0.3",
egress_image="opensandbox/egress:v1.0.4",
)

body = mock_k8s_client.create_custom_object.call_args.kwargs["body"]
Expand Down
16 changes: 8 additions & 8 deletions server/tests/k8s/test_batchsandbox_provider.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1225,7 +1225,7 @@ def test_create_workload_with_network_policy_adds_sidecar(self, mock_k8s_client)
expires_at=expires_at,
execd_image="execd:latest",
network_policy=network_policy,
egress_image="opensandbox/egress:v1.0.3",
egress_image="opensandbox/egress:v1.0.4",
)

body = mock_k8s_client.create_custom_object.call_args.kwargs["body"]
Expand All @@ -1238,7 +1238,7 @@ def test_create_workload_with_network_policy_adds_sidecar(self, mock_k8s_client)
# Find sidecar container
sidecar = next((c for c in containers if c["name"] == "egress"), None)
assert sidecar is not None
assert sidecar["image"] == "opensandbox/egress:v1.0.3"
assert sidecar["image"] == "opensandbox/egress:v1.0.4"

# Verify sidecar has environment variable
env_vars = {e["name"]: e["value"] for e in sidecar.get("env", [])}
Expand Down Expand Up @@ -1275,7 +1275,7 @@ def test_create_workload_with_network_policy_persists_annotation_and_sidecar_tok
expires_at=None,
execd_image="execd:latest",
network_policy=NetworkPolicy(default_action="deny", egress=[]),
egress_image="opensandbox/egress:v1.0.3",
egress_image="opensandbox/egress:v1.0.4",
annotations={SANDBOX_EGRESS_AUTH_TOKEN_METADATA_KEY: "egress-token"},
egress_auth_token="egress-token",
)
Expand Down Expand Up @@ -1307,7 +1307,7 @@ def test_create_workload_with_egress_mode_dns_nft(self, mock_k8s_client):
expires_at=None,
execd_image="execd:latest",
network_policy=NetworkPolicy(default_action="deny", egress=[]),
egress_image="opensandbox/egress:v1.0.3",
egress_image="opensandbox/egress:v1.0.4",
egress_mode=EGRESS_MODE_DNS_NFT,
)

Expand Down Expand Up @@ -1342,7 +1342,7 @@ def test_create_workload_with_network_policy_does_not_add_pod_ipv6_sysctls(self,
expires_at=expires_at,
execd_image="execd:latest",
network_policy=network_policy,
egress_image="opensandbox/egress:v1.0.3",
egress_image="opensandbox/egress:v1.0.4",
)

body = mock_k8s_client.create_custom_object.call_args.kwargs["body"]
Expand Down Expand Up @@ -1382,7 +1382,7 @@ def test_create_workload_with_network_policy_drops_net_admin_from_main_container
expires_at=expires_at,
execd_image="execd:latest",
network_policy=network_policy,
egress_image="opensandbox/egress:v1.0.3",
egress_image="opensandbox/egress:v1.0.4",
)

body = mock_k8s_client.create_custom_object.call_args.kwargs["body"]
Expand Down Expand Up @@ -1465,7 +1465,7 @@ def test_egress_sidecar_contains_network_policy_in_env(self, mock_k8s_client):
expires_at=expires_at,
execd_image="execd:latest",
network_policy=network_policy,
egress_image="opensandbox/egress:v1.0.3",
egress_image="opensandbox/egress:v1.0.4",
)

body = mock_k8s_client.create_custom_object.call_args.kwargs["body"]
Expand Down Expand Up @@ -1556,7 +1556,7 @@ def test_create_workload_with_network_policy_works_with_template(self, mock_k8s_
expires_at=expires_at,
execd_image="execd:latest",
network_policy=network_policy,
egress_image="opensandbox/egress:v1.0.3",
egress_image="opensandbox/egress:v1.0.4",
)

body = mock_k8s_client.create_custom_object.call_args.kwargs["body"]
Expand Down
30 changes: 15 additions & 15 deletions server/tests/k8s/test_egress_helper.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ class TestEgressSidecarViaApply:

def test_builds_container_with_basic_config(self):
"""Test that container is built with correct basic configuration."""
egress_image = "opensandbox/egress:v1.0.3"
egress_image = "opensandbox/egress:v1.0.4"
network_policy = NetworkPolicy(
default_action="deny",
egress=[
Expand All @@ -70,7 +70,7 @@ def test_builds_container_with_basic_config(self):

def test_contains_egress_rules_environment_variable(self):
"""Test that container includes OPENSANDBOX_EGRESS_RULES environment variable."""
egress_image = "opensandbox/egress:v1.0.3"
egress_image = "opensandbox/egress:v1.0.4"
network_policy = NetworkPolicy(
default_action="deny",
egress=[NetworkRule(action="allow", target="example.com")],
Expand All @@ -86,7 +86,7 @@ def test_contains_egress_rules_environment_variable(self):
assert env_vars[1]["value"] == EGRESS_MODE_DNS

def test_contains_egress_token_when_provided(self):
egress_image = "opensandbox/egress:v1.0.3"
egress_image = "opensandbox/egress:v1.0.4"
network_policy = NetworkPolicy(
default_action="deny",
egress=[NetworkRule(action="allow", target="example.com")],
Expand All @@ -103,7 +103,7 @@ def test_contains_egress_token_when_provided(self):
assert env_vars[EGRESS_MODE_ENV] == EGRESS_MODE_DNS

def test_egress_mode_dns_nft(self):
egress_image = "opensandbox/egress:v1.0.3"
egress_image = "opensandbox/egress:v1.0.4"
network_policy = NetworkPolicy(
default_action="deny",
egress=[NetworkRule(action="allow", target="example.com")],
Expand All @@ -120,7 +120,7 @@ def test_egress_mode_dns_nft(self):

def test_serializes_network_policy_correctly(self):
"""Test that network policy is correctly serialized to JSON."""
egress_image = "opensandbox/egress:v1.0.3"
egress_image = "opensandbox/egress:v1.0.4"
network_policy = NetworkPolicy(
default_action="deny",
egress=[
Expand All @@ -145,7 +145,7 @@ def test_serializes_network_policy_correctly(self):

def test_handles_empty_egress_rules(self):
"""Test that empty egress rules are handled correctly."""
egress_image = "opensandbox/egress:v1.0.3"
egress_image = "opensandbox/egress:v1.0.4"
network_policy = NetworkPolicy(
default_action="allow",
egress=[],
Expand All @@ -161,7 +161,7 @@ def test_handles_empty_egress_rules(self):

def test_handles_missing_default_action(self):
"""Test that missing default_action is handled (exclude_none=True)."""
egress_image = "opensandbox/egress:v1.0.3"
egress_image = "opensandbox/egress:v1.0.4"
network_policy = NetworkPolicy(
egress=[NetworkRule(action="allow", target="example.com")],
)
Expand All @@ -176,7 +176,7 @@ def test_handles_missing_default_action(self):

def test_security_context_adds_net_admin_not_privileged(self):
"""Egress sidecar uses NET_ADMIN only (IPv6 is disabled in execd init when egress is on)."""
egress_image = "opensandbox/egress:v1.0.3"
egress_image = "opensandbox/egress:v1.0.4"
network_policy = NetworkPolicy(
default_action="deny",
egress=[],
Expand All @@ -190,14 +190,14 @@ def test_security_context_adds_net_admin_not_privileged(self):

def test_no_command_uses_image_entrypoint(self):
container = _egress_container(
"opensandbox/egress:v1.0.3",
"opensandbox/egress:v1.0.4",
NetworkPolicy(default_action="deny", egress=[]),
)
assert "command" not in container

def test_container_spec_is_valid_kubernetes_format(self):
"""Test that returned container spec is in valid Kubernetes format."""
egress_image = "opensandbox/egress:v1.0.3"
egress_image = "opensandbox/egress:v1.0.4"
network_policy = NetworkPolicy(
default_action="deny",
egress=[NetworkRule(action="allow", target="example.com")],
Expand All @@ -218,7 +218,7 @@ def test_container_spec_is_valid_kubernetes_format(self):

def test_handles_wildcard_domains(self):
"""Test that wildcard domains in egress rules are handled correctly."""
egress_image = "opensandbox/egress:v1.0.3"
egress_image = "opensandbox/egress:v1.0.4"
network_policy = NetworkPolicy(
default_action="deny",
egress=[
Expand Down Expand Up @@ -264,7 +264,7 @@ def test_adds_egress_sidecar_container(self):
default_action="deny",
egress=[NetworkRule(action="allow", target="example.com")],
)
egress_image = "opensandbox/egress:v1.0.3"
egress_image = "opensandbox/egress:v1.0.4"

apply_egress_to_spec(
containers,
Expand All @@ -283,7 +283,7 @@ def test_does_not_touch_unrelated_pod_state(self):
default_action="deny",
egress=[NetworkRule(action="allow", target="example.com")],
)
egress_image = "opensandbox/egress:v1.0.3"
egress_image = "opensandbox/egress:v1.0.4"

apply_egress_to_spec(
containers,
Expand All @@ -308,7 +308,7 @@ def test_preserves_existing_pod_sysctls_when_not_passed_in(self):
default_action="deny",
egress=[NetworkRule(action="allow", target="example.com")],
)
egress_image = "opensandbox/egress:v1.0.3"
egress_image = "opensandbox/egress:v1.0.4"

apply_egress_to_spec(
containers,
Expand All @@ -330,7 +330,7 @@ def test_no_op_when_no_network_policy(self):
apply_egress_to_spec(
containers,
None,
"opensandbox/egress:v1.0.3",
"opensandbox/egress:v1.0.4",
)

assert len(containers) == 0
Expand Down
4 changes: 2 additions & 2 deletions server/tests/k8s/test_kubernetes_service.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -232,7 +232,7 @@ async def test_create_sandbox_with_network_policy_passes_egress_token_and_annota
self, k8s_service, create_sandbox_request
):
create_sandbox_request.network_policy = NetworkPolicy(default_action="deny", egress=[])
k8s_service.app_config.egress = EgressConfig(image="opensandbox/egress:v1.0.3")
k8s_service.app_config.egress = EgressConfig(image="opensandbox/egress:v1.0.4")
k8s_service.workload_provider.create_workload.return_value = {
"name": "test-id", "uid": "uid-1"
}
Expand All @@ -259,7 +259,7 @@ async def test_create_sandbox_with_network_policy_passes_egress_mode_dns_nft_fro
):
create_sandbox_request.network_policy = NetworkPolicy(default_action="deny", egress=[])
k8s_service.app_config.egress = EgressConfig(
image="opensandbox/egress:v1.0.3",
image="opensandbox/egress:v1.0.4",
mode=EGRESS_MODE_DNS_NFT,
)
k8s_service.workload_provider.create_workload.return_value = {
Expand Down
Loading