Feat: Add egressEnforcement opt-out for proxy-sidecar mode

charts/kagenti-operator/crds/agent.kagenti.dev_agentruntimes.yaml

@@ -94,6 +94,32 @@
                 - lite
                 - waypoint
                 type: string
+              egressEnforcement:
+                description: |-
+                  EgressEnforcement controls whether the proxy-init init container is
+                  injected for fail-closed egress capture in proxy-sidecar / lite modes.
+
+                  Values:
+                    enforce-redirect (default) — proxy-init is injected with iptables
+                                      rules that transparently REDIRECT egress bypassing
+                                      HTTP_PROXY to AuthBridge's transparent listener.
+                                      Requires NET_ADMIN capability and a kernel that
+                                      supports iptables (legacy or nft).
+                    none             — proxy-init is NOT injected. Egress enforcement
+                                      relies on HTTP_PROXY (cooperative) + inbound
+                                      AuthBridge on destinations + NetworkPolicy.
+                                      Use on platforms where iptables is unavailable
+                                      (e.g. ROSA HCP, managed OpenShift).
+
+                  Resolution: AgentRuntime CR > namespace authbridge-runtime-config
+                  egressEnforcement field > "enforce-redirect" (default).
+
+                  Does not affect envoy-sidecar mode, which always uses proxy-init
+                  for its structural iptables redirect.
+                enum:
+                - enforce-redirect
+                - none
+                type: string
               identity:
                 description: Identity specifies optional per-workload identity overrides
                 properties:
@@ -421,7 +447,7 @@
                     lastTransitionTime:
                       description: |-
                         lastTransitionTime is the last time the condition transitioned from one status to another.
                         This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                       format: date-time
                       type: string
                     message:
@@ -433,7 +459,7 @@
                     observedGeneration:
                       description: |-
                         observedGeneration represents the .metadata.generation that the condition was set based upon.
                         For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                         with respect to the current state of the instance.
                       format: int64
                       minimum: 0

charts/kagenti-operator/crds/agent.kagenti.dev_authorizationpolicies.yaml

@@ -1,109 +1,157 @@
+---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.1
   name: authorizationpolicies.agent.kagenti.dev
 spec:
   group: agent.kagenti.dev
   names:
     kind: AuthorizationPolicy
     listKind: AuthorizationPolicyList
     plural: authorizationpolicies
-    singular: authorizationpolicy
     shortNames:
-      - ap
+    - ap
+    singular: authorizationpolicy
   scope: Namespaced
   versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-      subresources:
-        status: {}
-      additionalPrinterColumns:
-        - name: Scope
-          type: string
-          jsonPath: .spec.scope
-        - name: ClientID
-          type: string
-          jsonPath: .spec.clientID
-        - name: Hash
-          type: string
-          jsonPath: .status.bundleHash
-          priority: 1
-        - name: Age
-          type: date
-          jsonPath: .metadata.creationTimestamp
-      schema:
-        openAPIV3Schema:
-          type: object
-          required:
-            - spec
-          properties:
-            spec:
-              type: object
-              required:
-                - scope
-                - policies
-              properties:
-                scope:
-                  type: string
-                  enum:
-                    - global
-                    - namespace
-                    - client
-                  default: client
-                clientID:
-                  type: string
-                  maxLength: 253
-                  pattern: "^[a-z0-9]([a-z0-9._-]*[a-z0-9])?$"
-                policies:
-                  type: array
-                  minItems: 1
-                  items:
-                    type: object
-                    required:
-                      - path
-                      - content
-                    properties:
-                      path:
-                        type: string
-                        minLength: 1
-                        pattern: "^[a-z0-9][a-z0-9/_.-]*\\.rego$"
-                      content:
-                        type: string
-                        minLength: 1
-              x-kubernetes-validations:
-                - rule: "self.scope == 'client' ? self.clientID != '' : true"
-                  message: "clientID is required when scope is 'client'"
-                - rule: "self.scope != 'client' ? !has(self.clientID) || self.clientID == '' : true"
-                  message: "clientID must not be set when scope is 'global' or 'namespace'"
-            status:
-              type: object
-              properties:
-                bundleHash:
-                  type: string
-                lastBuilt:
-                  type: string
-                  format: date-time
-                conditions:
-                  type: array
-                  items:
-                    type: object
-                    required:
-                      - type
-                      - status
-                    properties:
-                      type:
-                        type: string
-                      status:
-                        type: string
-                        enum:
-                          - "True"
-                          - "False"
-                          - "Unknown"
-                      lastTransitionTime:
-                        type: string
-                        format: date-time
-                      reason:
-                        type: string
-                      message:
-                        type: string
+  - additionalPrinterColumns:
+    - jsonPath: .spec.scope
+      name: Scope
+      type: string
+    - jsonPath: .spec.clientID
+      name: ClientID
+      type: string
+    - jsonPath: .status.bundleHash
+      name: Hash
+      priority: 1
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              clientID:
+                maxLength: 253
+                pattern: ^[a-z0-9]([a-z0-9._-]*[a-z0-9])?$
+                type: string
+              policies:
+                items:
+                  properties:
+                    content:
+                      minLength: 1
+                      type: string
+                    path:
+                      minLength: 1
+                      pattern: ^[a-z0-9][a-z0-9/_.-]*\.rego$
+                      type: string
+                  required:
+                  - content
+                  - path
+                  type: object
+                minItems: 1
+                type: array
+              scope:
+                default: client
+                enum:
+                - global
+                - namespace
+                - client
+                type: string
+            required:
+            - policies
+            - scope
+            type: object
+          status:
+            properties:
+              bundleHash:
+                type: string
+              conditions:
+                items:
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+              lastBuilt:
+                format: date-time
+                type: string
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}

charts/kagenti-operator/values.yaml

@@ -234,6 +234,16 @@ defaults:
     # (nft) or "iptables-legacy" to force a backend where detection is undesired.
     iptablesCmd: ""
 
+    # Platform-level governance: which egressEnforcement modes workloads may select.
+    # The webhook overrides the resolved value to the first entry when the
+    # workload's choice is not in this list.
+    #   ["enforce-redirect"]             — no opt-out allowed (iptables required)
+    #   ["none"]                         — iptables disabled cluster-wide (ROSA HCP)
+    #   ["enforce-redirect", "none"]     — workloads choose (default)
+    allowedEgressEnforcement:
+      - enforce-redirect
+      - none
+
   # Resource defaults (conservative for dev)
   # Note: requests must be <= limits
   resources:

kagenti-operator/api/v1alpha1/agentruntime_types.go

@@ -114,6 +114,31 @@ type AgentRuntimeSpec struct {
 	// +kubebuilder:default=permissive
 	// +kubebuilder:validation:Enum=disabled;permissive;strict
 	MTLSMode string `json:"mtlsMode,omitempty"`
+
+	// EgressEnforcement controls whether the proxy-init init container is
+	// injected for fail-closed egress capture in proxy-sidecar / lite modes.
+	//
+	// Values:
+	//   enforce-redirect (default) — proxy-init is injected with iptables
+	//                     rules that transparently REDIRECT egress bypassing
+	//                     HTTP_PROXY to AuthBridge's transparent listener.
+	//                     Requires NET_ADMIN capability and a kernel that
+	//                     supports iptables (legacy or nft).
+	//   none             — proxy-init is NOT injected. Egress enforcement
+	//                     relies on HTTP_PROXY (cooperative) + inbound
+	//                     AuthBridge on destinations + NetworkPolicy.
+	//                     Use on platforms where iptables is unavailable
+	//                     (e.g. ROSA HCP, managed OpenShift).
+	//
+	// Resolution: AgentRuntime CR > namespace authbridge-runtime-config
+	// egressEnforcement field > "enforce-redirect" (default).
+	//
+	// Does not affect envoy-sidecar mode, which always uses proxy-init
+	// for its structural iptables redirect.
+	//
+	// +optional
+	// +kubebuilder:validation:Enum=enforce-redirect;none
+	EgressEnforcement string `json:"egressEnforcement,omitempty"`
 }
 
 // IdentitySpec configures workload identity for an AgentRuntime.

kagenti-operator/config/crd/bases/agent.kagenti.dev_agentruntimes.yaml

@@ -94,6 +94,32 @@ spec:
                 - lite
                 - waypoint
                 type: string
+              egressEnforcement:
+                description: |-
+                  EgressEnforcement controls whether the proxy-init init container is
+                  injected for fail-closed egress capture in proxy-sidecar / lite modes.
+
+                  Values:
+                    enforce-redirect (default) — proxy-init is injected with iptables
+                                      rules that transparently REDIRECT egress bypassing
+                                      HTTP_PROXY to AuthBridge's transparent listener.
+                                      Requires NET_ADMIN capability and a kernel that
+                                      supports iptables (legacy or nft).
+                    none             — proxy-init is NOT injected. Egress enforcement
+                                      relies on HTTP_PROXY (cooperative) + inbound
+                                      AuthBridge on destinations + NetworkPolicy.
+                                      Use on platforms where iptables is unavailable
+                                      (e.g. ROSA HCP, managed OpenShift).
+
+                  Resolution: AgentRuntime CR > namespace authbridge-runtime-config
+                  egressEnforcement field > "enforce-redirect" (default).
+
+                  Does not affect envoy-sidecar mode, which always uses proxy-init
+                  for its structural iptables redirect.
+                enum:
+                - enforce-redirect
+                - none
+                type: string
               identity:
                 description: Identity specifies optional per-workload identity overrides
                 properties: