@namzu/sandbox 26.0.0 → 27.0.0

package/dist/backends/kubernetes/egress-policy.d.ts

@@ -430,6 +430,50 @@ export interface KubernetesPerSandboxEgressConfig {
      * leave `tlsServerNames` off for a domain list.
      */
     readonly narrowing?: KubernetesCiliumEgressNarrowing;
+    /**
+     * The identity the operator's fence bounds, spelled as the API server
+     * spells a user: `system:serviceaccount:<namespace>:<name>` for a
+     * ServiceAccount. When set, the fence check requires the policy's
+     * `matchConditions` to name exactly this identity
+     * (`request.userInfo.username == '<identity>'`), and refuses before any
+     * write when they name another one or none.
+     *
+     * Unset (the default), the identity is not checked: the shipped fence
+     * names `system:serviceaccount:namzu-sandboxes:namzu-sandbox-host`, and a
+     * host that authenticates as something else would otherwise hold the write
+     * verbs with a fence that never matches it — which reads exactly like an
+     * enforced one. Set it whenever you know who the host is.
+     */
+    readonly hostIdentity?: string;
+    /**
+     * The operator-pinned set of hosts and ports a host may grant. Names the
+     * `ConfigMap` that holds it; see
+     * `k8s/manifests/validatingadmissionpolicy-cilium-permitted-hosts.yaml`
+     * for the companion policy that enforces it at admission and the shape of
+     * the ConfigMap.
+     *
+     * Set, three things change and nothing else does:
+     *
+     *  - the fence check additionally proves the companion policy and its
+     *    binding (the policy name with `-hosts` appended, and its binding),
+     *    including that the binding's `paramRef` is THIS ConfigMap and denies
+     *    when it is missing;
+     *  - every `setNetworkPolicy` call with a non-empty list reads the
+     *    ConfigMap first and refuses locally, with a named error and nothing
+     *    written, a host or a port outside it. A narrowing that leaves a
+     *    host's ports unrestricted is a port outside any list;
+     *  - a missing or malformed ConfigMap refuses every such call.
+     *
+     * Unset (the default), none of that runs and behaviour is what it was.
+     */
+    readonly permittedHostsParam?: KubernetesPermittedHostsParam;
+}
+/** Where the operator-pinned permitted hosts and ports live. */
+export interface KubernetesPermittedHostsParam {
+    /** The `ConfigMap`'s name. */
+    readonly name: string;
+    /** Its namespace. */
+    readonly namespace: string;
 }
 /**
  * Default {@link KubernetesEgressConfig.profileLabelKey} — this backend's
@@ -507,10 +551,10 @@ export declare const DEFAULT_PER_SANDBOX_EGRESS_LABEL_KEY = "sandbox.namzu.ai/pe
  * belongs to.
  */
 export declare class KubernetesPerSandboxEgressConfigError extends Error {
-    readonly field: 'engine' | 'admissionPolicyName' | 'admissionPolicyBindingName' | 'labelKey';
+    readonly field: 'engine' | 'admissionPolicyName' | 'admissionPolicyBindingName' | 'labelKey' | 'hostIdentity' | 'permittedHostsParam.name' | 'permittedHostsParam.namespace';
     readonly value: string;
     readonly name = "KubernetesPerSandboxEgressConfigError";
-    constructor(field: 'engine' | 'admissionPolicyName' | 'admissionPolicyBindingName' | 'labelKey', value: string, reason: string);
+    constructor(field: 'engine' | 'admissionPolicyName' | 'admissionPolicyBindingName' | 'labelKey' | 'hostIdentity' | 'permittedHostsParam.name' | 'permittedHostsParam.namespace', value: string, reason: string);
 }
 /**
  * The per-sandbox selector label KEY this config asks for, or nothing at all
@@ -535,44 +579,23 @@ export declare function perSandboxEgressLabelKey(egress: KubernetesEgressConfig
  */
 export declare function assertPerSandboxEgressIsUsable(egress: KubernetesEgressConfig | undefined): void;
 /**
- * Named refusal for `config.egress.perSandbox` reaching an entry point that
- * can never carry the capability it configures: `createKubernetesWorkspace`.
- *
- * `perSandbox` exists to make `Sandbox.setNetworkPolicy` PRESENT on a TASK
- * handle, where the acquire creates the object each policy is named after and
- * owned by and stamps the per-sandbox pod label its selector matches, and
- * where the RBAC and the admission fence are the ones that bound the write.
- * A workspace's create path does none of that — it composes no per-sandbox
- * pod label and tracks no owner uid for one — so on that path the option
- * would be accepted and mean nothing at all: exactly the "declared and
- * silently unused" configuration this module refuses everywhere else. The
- * alternative, omitting the method and saying nothing, is how a host comes to
- * believe it narrowed a workspace's egress.
- *
- * NOT a variant of {@link KubernetesPerSandboxEgressConfigError}, which is
- * about a `perSandbox` value this backend cannot honour ANYWHERE (an engine
- * with no hostname concept, an unnamed fence). This one is about a `perSandbox`
- * value it honours perfectly well on the other entry point, so a caller
- * catching the sibling for a typo'd value does not also catch a correct
- * configuration aimed at the wrong path.
+ * Formerly the refusal of `config.egress.perSandbox` on
+ * `createKubernetesWorkspace` and `allocateKubernetesWorkspace`, which could
+ * not carry the capability. They carry it now: the workspace's pod template
+ * gets the per-sandbox selector label, the `Sandbox` owns the policies, and
+ * the handle serves `setNetworkPolicy`.
+ *
+ * Nothing throws this any more. It stays exported so an existing
+ * `catch (err) { if (err instanceof KubernetesWorkspacePerSandboxEgressConfigError) … }`
+ * keeps compiling and simply never matches; it will be removed in a later
+ * major.
+ *
+ * @deprecated No workspace entry point refuses `egress.perSandbox` any more.
  */
 export declare class KubernetesWorkspacePerSandboxEgressConfigError extends Error {
     readonly name = "KubernetesWorkspacePerSandboxEgressConfigError";
     constructor();
 }
-/**
- * Refuse `config.egress.perSandbox` on the entry point that cannot carry it —
- * `createKubernetesWorkspace`. See
- * {@link KubernetesWorkspacePerSandboxEgressConfigError}.
- *
- * Deliberately not {@link assertPerSandboxEgressIsUsable}, which validates the
- * same config for the path that DOES honour it: a workspace has nothing to
- * validate the option for, whatever its `engine` or `admissionPolicyName` say,
- * because it serves no `setNetworkPolicy` at all. Calling that validator here
- * instead would be worse than saying nothing — it would report a
- * `perSandbox` this deployment can use as if it were in use.
- */
-export declare function assertWorkspaceCarriesNoPerSandboxEgress(egress: KubernetesEgressConfig | undefined): void;
 /**
  * The ONE composer for a sandbox pod's `additionalPodMetadata.labels`.
  *
@@ -946,6 +969,13 @@ export declare const CONFIG_LEVEL_NARROWING_REFUSAL: HostsFitNarrowingContext;
  * still, before it reads the fence.
  */
 export declare function assertHostsFitNarrowing(allowedHosts: readonly string[], narrowing: KubernetesCiliumEgressNarrowing | undefined, context: HostsFitNarrowingContext): void;
+/**
+ * The port list a narrowed translation applies to `host`, before splitting
+ * out the TLS subset — see {@link KubernetesCiliumEgressNarrowing.ports}.
+ * `undefined` means no port restriction: the host's `toFQDNs` rule carries
+ * no `toPorts` at all.
+ */
+export declare function narrowedHostPorts(host: string, narrowing: KubernetesCiliumEgressNarrowing): readonly number[] | undefined;
 /**
  * One allowlist entry, expanded to the `toFQDNs` entries it means.
  *
@@ -1187,11 +1217,49 @@ export interface EgressAllowance {
         readonly kind: 'NetworkPolicy' | 'CiliumNetworkPolicy';
         readonly name: string;
     };
+    /**
+     * Further objects whose `spec` was compared to its translation by
+     * {@link verifyEgressPolicyApplied}, and which the union rule therefore
+     * does not judge rule by rule either. Set only by
+     * {@link unionEgressAllowance}: the post-write check of a per-sandbox
+     * policy is a question about TWO named objects, the operator's baseline
+     * and the policy just written.
+     */
+    readonly alsoNamed?: readonly {
+        readonly kind: 'NetworkPolicy' | 'CiliumNetworkPolicy';
+        readonly name: string;
+    }[];
 }
 /**
  * The allowance a translated policy expresses. See {@link EgressAllowance}.
  */
 export declare function egressAllowance(translated: KubernetesTranslatedEgressPolicy): EgressAllowance;
+/**
+ * What the pod may reach when TWO translated policies both select it: the
+ * operator's baseline and one per-sandbox policy this backend wrote.
+ *
+ * Kubernetes unions every policy that selects a pod, so the boundary a
+ * per-sandbox write is supposed to produce is exactly baseline PLUS the
+ * written policy, and a third policy allowing more than that is what the
+ * post-write check refuses. Each field is the union of the two sides':
+ *
+ *  - destinations and `toFQDNs` names concatenate;
+ *  - `permitsEverything` is either side's, and `permitsNothing` is both
+ *    sides' — a `no-network` baseline permits nothing, and a baseline that
+ *    permits nothing plus a per-sandbox policy that permits one name permits
+ *    that name, not nothing;
+ *  - DNS lookups: a side that permits nothing contributes no names, a side
+ *    that does not narrow DNS contributes every name, and the union of name
+ *    lists is their concatenation. This is the one field where the naive
+ *    union is wrong: a `no-network` baseline reports `'all'` because a core
+ *    policy "cannot narrow DNS", and taking that at face value would let any
+ *    other policy open the resolver to every name beside a narrowed grant.
+ *
+ * Both objects are marked as named: each had its `spec` compared to its own
+ * translation before this check runs, and neither's `.domain` entries (a
+ * `matchName` plus a `matchPattern`) are expressible in an allowance.
+ */
+export declare function unionEgressAllowance(baseline: EgressAllowance, added: EgressAllowance): EgressAllowance;
 /** One egress rule, judged against the translation. */
 export interface EgressRuleVerdict {
     readonly beyond: boolean | 'unknown';
@@ -1386,5 +1454,13 @@ export declare class KubernetesEgressPolicyUnionError extends Error {
  * acquire path's cleanup.
  */
 export declare function verifyEgressPolicyUnion(client: KubernetesClient, translated: KubernetesTranslatedEgressPolicy, target: EgressVerificationTarget, signal?: AbortSignal): Promise<void>;
+/**
+ * {@link verifyEgressPolicyUnion} against an allowance the caller already
+ * built — the entry point for a question about more than one translation,
+ * which is what the post-write check of a per-sandbox policy is: the pod's
+ * boundary is the baseline's allowance plus the written policy's, see
+ * {@link unionEgressAllowance}.
+ */
+export declare function verifyEgressPolicyUnionAgainst(client: KubernetesClient, allowance: EgressAllowance, target: EgressVerificationTarget, signal?: AbortSignal): Promise<void>;
 export {};
 //# sourceMappingURL=egress-policy.d.ts.map

package/dist/backends/kubernetes/egress-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"egress-policy.d.ts","sourceRoot":"","sources":["../../../src/backends/kubernetes/egress-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4EG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAKlD,OAAO,EACN,KAAK,aAAa,EAElB,KAAK,kBAAkB,EAWvB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAA8B,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AACnF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AAc5D;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,QAAQ,CAAA;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,MAAM,0BAA0B,GACnC;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IACA,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACvC,CAAA;AAEJ;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,YAAY,GAAG,0BAA0B,CAAA;AAE9E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,4BAA4B,GAAG,OAAO,GAAG,mBAAmB,CAAA;AAExE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,4BAA4B;IAC5C,kFAAkF;IAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,qCAAqC;IACrC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC3C;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAA;IAChE;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,4BAA4B,CAAA;IAC1D;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAA;IACxC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,4BAA4B,CAAA;IAC9C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,+BAA+B,CAAA;IAC1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,gCAAgC,CAAA;CACtD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,gCAAgC;IAChD;;;;;;;;OAQG;IACH,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;IACvC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAA;IAC5C;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,+BAA+B,CAAA;CACpD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC,oCAAoC,CAAA;AAEjF,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAwBD;;;;;;;;;;GAUG;AACH,qBAAa,kCAAmC,SAAQ,KAAK;IAI3D,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,iBAAiB;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM;IAJvB,SAAkB,IAAI,wCAAuC;gBAGnD,KAAK,EAAE,SAAS,GAAG,iBAAiB,EACpC,KAAK,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM;CAMf;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,sBAAsB,GAAG,SAAS,GACxC,kBAAkB,GAAG,SAAS,CAmBhC;AA+CD;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,sBAAsB,GAAG,SAAS,GAAG,IAAI,CAE5F;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oCAAoC,wCAAwC,CAAA;AAEzF;;;;;;;;;;;;GAYG;AACH,qBAAa,qCAAsC,SAAQ,KAAK;IAI9D,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,qBAAqB,GAAG,4BAA4B,GAAG,UAAU;IAC5F,QAAQ,CAAC,KAAK,EAAE,MAAM;IAJvB,SAAkB,IAAI,2CAA0C;gBAGtD,KAAK,EAAE,QAAQ,GAAG,qBAAqB,GAAG,4BAA4B,GAAG,UAAU,EACnF,KAAK,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM;CAMf;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACvC,MAAM,EAAE,sBAAsB,GAAG,SAAS,GACxC,MAAM,GAAG,SAAS,CA2BpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,sBAAsB,GAAG,SAAS,GAAG,IAAI,CAyC/F;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,8CAA+C,SAAQ,KAAK;IACxE,SAAkB,IAAI,oDAAmD;;CAOzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wCAAwC,CACvD,MAAM,EAAE,sBAAsB,GAAG,SAAS,GACxC,IAAI,CAGN;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,0BAA0B,CACzC,MAAM,EAAE,sBAAsB,GAAG,SAAS,EAC1C,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACtC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAalC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IAIzD,2EAA2E;IAC3E,QAAQ,CAAC,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7D,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,gBAAgB,EAAE,MAAM;IACjC,0DAA0D;IAC1D,QAAQ,CAAC,iBAAiB,EAAE,MAAM;IAClC,qEAAqE;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB;IAZtC,SAAkB,IAAI,sCAAqC;;IAG1D,2EAA2E;IAClE,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACpD,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM;IAC1B,uEAAuE;IAC9D,gBAAgB,EAAE,MAAM;IACjC,0DAA0D;IACjD,iBAAiB,EAAE,MAAM;IAClC,qEAAqE;IAC5D,OAAO,CAAC,EAAE,kBAAkB,YAAA;CAMtC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,kCAAmC,SAAQ,KAAK;IAI3D,uEAAuE;IACvE,QAAQ,CAAC,YAAY,EAAE,kBAAkB;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAN1D,SAAkB,IAAI,wCAAuC;;IAG5D,uEAAuE;IAC9D,YAAY,EAAE,kBAAkB,EAChC,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAM1D;AAED,8EAA8E;AAC9E,wBAAgB,8BAA8B,CAC7C,MAAM,EAAE,sBAAsB,GAAG,SAAS,GACxC,OAAO,CAET;AAED,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAA;CACrC;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACzC,MAAM,EAAE,kBAAkB,GACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAKlC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,gCAAgC;IAChD,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,qBAAqB,CAAA;IACtD;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAA;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CACpD;AASD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,mBAAmB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAW7F;AAED;;;;;;GAMG;AACH,qBAAa,wCAAyC,SAAQ,KAAK;IAGtD,QAAQ,CAAC,UAAU,EAAE,QAAQ,GAAG,UAAU;IAFtD,SAAkB,IAAI,8CAA6C;gBAE9C,UAAU,EAAE,QAAQ,GAAG,UAAU;CAKtD;AAED;;;;;;;GAOG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;IAI1D,QAAQ,CAAC,KAAK,EAAE,MAAM;IAHvB,SAAkB,IAAI,uCAAsC;gBAGlD,KAAK,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM;CASf;AAED;;;;;;;GAOG;AACH,qBAAa,yCAA0C,SAAQ,KAAK;IAIlE,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,sBAAsB;IAJxC,SAAkB,IAAI,+CAA8C;gBAG1D,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC,EAC1C,MAAM,EAAE,sBAAsB;CAMxC;AAUD;;;;;;;;;;;;GAYG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IAIzD,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHtB,SAAkB,IAAI,sCAAqC;gBAGjD,IAAI,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM;CAMf;AAKD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAyDpD;AAqBD;;;;;;;;GAQG;AACH;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAC5C,SAAS,EAAE,+BAA+B,EAC1C,SAAS,SAAoB,GAC3B,IAAI,CAkDN;AA2BD;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC9C,MAAM,EAAE,sBAAsB,EAC9B,MAAM,EAAE,sBAAsB,EAC9B,SAAS,CAAC,EAAE,+BAA+B,GACzC,IAAI,CAoBN;AAyMD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,wBAAwB;IACxC;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC1B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,EAAE,wBAE3C,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,wBAE5C,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,uBAAuB,CACtC,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,SAAS,EAAE,+BAA+B,GAAG,SAAS,EACtD,OAAO,EAAE,wBAAwB,GAC/B,IAAI,CASN;AAqED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAI5F;AA2DD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,kEAAkE;IAClE,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACzD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,mEAAmE;IACnE,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAA;IACnD,QAAQ,CAAC,SAAS,CAAC,EAAE,+BAA+B,CAAA;IACpD,+EAA+E;IAC/E,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,wBAAwB,EAAE,CAAA;IAC9D;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAA;CACjD;AAED,wBAAgB,yBAAyB,CACxC,OAAO,EAAE,2BAA2B,GAClC,gCAAgC,CAwElC;AAmBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,qBAAqB,CAC1C,MAAM,EAAE,sBAAsB,EAC9B,MAAM,EAAE,sBAAsB,EAC9B,MAAM,EAAE,kBAAkB,EAC1B,eAAe,CAAC,EAAE,+BAA+B,GAC/C,OAAO,CAAC,gCAAgC,CAAC,CAqC3C;AAED;;;;;;GAMG;AACH,qBAAa,qCAAsC,SAAQ,KAAK;IAI9D,QAAQ,CAAC,YAAY,EAAE,eAAe,GAAG,qBAAqB;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM;IAJtB,SAAkB,IAAI,2CAA0C;gBAGtD,YAAY,EAAE,eAAe,GAAG,qBAAqB,EACrD,IAAI,EAAE,MAAM;CAMtB;AAED,gFAAgF;AAChF,qBAAa,mCAAoC,SAAQ,KAAK;IAI5D,QAAQ,CAAC,YAAY,EAAE,eAAe,GAAG,qBAAqB;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM;IALxB,SAAkB,IAAI,yCAAwC;gBAGpD,YAAY,EAAE,eAAe,GAAG,qBAAqB,EACrD,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM;CAMxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,yBAAyB,CAC9C,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,gCAAgC,EAC5C,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAsJf;AAWD,2DAA2D;AAC3D,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACrB;AAuDD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAgB/D;AAyBD,mFAAmF;AACnF,UAAU,SAAS;IAClB,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACrB;AAKD,gEAAgE;AAChE,KAAK,UAAU,GACZ;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAA;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACpB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACpB,CAAA;AAEJ,UAAU,kBAAkB;IAC3B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,SAAS,EAAE,CAAA;CAC5C;AAED,kFAAkF;AAClF,UAAU,WAAW;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,SAAS,EAAE,CAAA;CAC5C;AAkBD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,YAAY,EAAE,SAAS,kBAAkB,EAAE,CAAA;IACpD;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAA;IACtC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,aAAa,EAAE,KAAK,GAAG,SAAS,MAAM,EAAE,CAAA;IACjD,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAA;IACnC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,oDAAoD;IACpD,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAA;IACnD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,WAAW,EAAE;QACrB,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,qBAAqB,CAAA;QACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KACrB,CAAA;CACD;AAsED;;GAEG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,gCAAgC,GAAG,eAAe,CA+F7F;AAqID,uDAAuD;AACvD,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,CAAA;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACxB;AA2WD,wCAAwC;AACxC,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACpD,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;IACvC,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED,0EAA0E;AAC1E,MAAM,MAAM,mBAAmB;AAC9B,qEAAqE;AACnE,QAAQ;AACV,kEAAkE;GAChE,eAAe;AACjB,oDAAoD;GAClD,iBAAiB;AACnB,iFAAiF;GAC/E,mBAAmB;AACrB,mDAAmD;GACjD,eAAe,CAAA;AAElB,6CAA6C;AAC7C,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,qBAAqB,CAAA;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAA;IACrC,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,mBAAmB,GAAG,sBAAsB,GAAG,qBAAqB,GAAG,eAAe,CAAA;AAElG;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,qBAAqB,CAAA;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC5C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAC9B;AA+CD,uFAAuF;AACvF,wBAAgB,sBAAsB,CACrC,KAAK,EAAE,SAAS,OAAO,EAAE,EACzB,MAAM,EAAE,wBAAwB,EAChC,SAAS,EAAE,eAAe,GACxB,oBAAoB,EAAE,CA6CxB;AAED,qEAAqE;AACrE,wBAAgB,wBAAwB,CACvC,KAAK,EAAE,SAAS,OAAO,EAAE,EACzB,MAAM,EAAE,wBAAwB,EAChC,SAAS,EAAE,eAAe,GACxB,oBAAoB,EAAE,CAqDxB;AAwDD,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,QAAQ,EAAE,SAAS,oBAAoB,EAAE,CAAA;IAClD,uEAAuE;IACvE,QAAQ,CAAC,OAAO,CAAC,EAAE;QAClB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;QAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KACxB,CAAA;CACD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAChC,SAAS,EAAE,SAAS,oBAAoB,EAAE,EAC1C,SAAS,EAAE,eAAe,GACxB,mBAAmB,CA8GrB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IAIzD,QAAQ,CAAC,OAAO,EAAE,mBAAmB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpD,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,SAAS,oBAAoB,EAAE;IAElD,iEAAiE;IACjE,QAAQ,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE;IAV/C,SAAkB,IAAI,sCAAqC;gBAGjD,OAAO,EAAE,mBAAmB,EAC5B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC3C,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC,EAC1C,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EAClD,OAAO,EAAE,MAAM;IACf,iEAAiE;IACxD,MAAM,GAAE,SAAS,kBAAkB,EAAO;CAMpD;AAuCD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,uBAAuB,CAC5C,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,gCAAgC,EAC5C,MAAM,EAAE,wBAAwB,EAChC,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAqDf"}
+{"version":3,"file":"egress-policy.d.ts","sourceRoot":"","sources":["../../../src/backends/kubernetes/egress-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4EG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAKlD,OAAO,EACN,KAAK,aAAa,EAElB,KAAK,kBAAkB,EAWvB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAA8B,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AACnF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AAc5D;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,QAAQ,CAAA;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,MAAM,0BAA0B,GACnC;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IACA,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACvC,CAAA;AAEJ;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,YAAY,GAAG,0BAA0B,CAAA;AAE9E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,4BAA4B,GAAG,OAAO,GAAG,mBAAmB,CAAA;AAExE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,4BAA4B;IAC5C,kFAAkF;IAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,qCAAqC;IACrC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC3C;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAA;IAChE;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,4BAA4B,CAAA;IAC1D;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAA;IACxC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,4BAA4B,CAAA;IAC9C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,+BAA+B,CAAA;IAC1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,gCAAgC,CAAA;CACtD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,gCAAgC;IAChD;;;;;;;;OAQG;IACH,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;IACvC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAA;IAC5C;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,+BAA+B,CAAA;IACpD;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,6BAA6B,CAAA;CAC5D;AAED,gEAAgE;AAChE,MAAM,WAAW,6BAA6B;IAC7C,8BAA8B;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,qBAAqB;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC1B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC,oCAAoC,CAAA;AAEjF,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAwBD;;;;;;;;;;GAUG;AACH,qBAAa,kCAAmC,SAAQ,KAAK;IAI3D,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,iBAAiB;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM;IAJvB,SAAkB,IAAI,wCAAuC;gBAGnD,KAAK,EAAE,SAAS,GAAG,iBAAiB,EACpC,KAAK,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM;CAMf;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,sBAAsB,GAAG,SAAS,GACxC,kBAAkB,GAAG,SAAS,CAmBhC;AA+CD;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,sBAAsB,GAAG,SAAS,GAAG,IAAI,CAE5F;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oCAAoC,wCAAwC,CAAA;AAEzF;;;;;;;;;;;;GAYG;AACH,qBAAa,qCAAsC,SAAQ,KAAK;IAI9D,QAAQ,CAAC,KAAK,EACX,QAAQ,GACR,qBAAqB,GACrB,4BAA4B,GAC5B,UAAU,GACV,cAAc,GACd,0BAA0B,GAC1B,+BAA+B;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM;IAXvB,SAAkB,IAAI,2CAA0C;gBAGtD,KAAK,EACX,QAAQ,GACR,qBAAqB,GACrB,4BAA4B,GAC5B,UAAU,GACV,cAAc,GACd,0BAA0B,GAC1B,+BAA+B,EACzB,KAAK,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM;CAMf;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACvC,MAAM,EAAE,sBAAsB,GAAG,SAAS,GACxC,MAAM,GAAG,SAAS,CA2BpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,sBAAsB,GAAG,SAAS,GAAG,IAAI,CA6D/F;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,8CAA+C,SAAQ,KAAK;IACxE,SAAkB,IAAI,oDAAmD;;CAOzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,0BAA0B,CACzC,MAAM,EAAE,sBAAsB,GAAG,SAAS,EAC1C,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACtC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAalC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IAIzD,2EAA2E;IAC3E,QAAQ,CAAC,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7D,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,gBAAgB,EAAE,MAAM;IACjC,0DAA0D;IAC1D,QAAQ,CAAC,iBAAiB,EAAE,MAAM;IAClC,qEAAqE;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB;IAZtC,SAAkB,IAAI,sCAAqC;;IAG1D,2EAA2E;IAClE,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACpD,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM;IAC1B,uEAAuE;IAC9D,gBAAgB,EAAE,MAAM;IACjC,0DAA0D;IACjD,iBAAiB,EAAE,MAAM;IAClC,qEAAqE;IAC5D,OAAO,CAAC,EAAE,kBAAkB,YAAA;CAMtC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,kCAAmC,SAAQ,KAAK;IAI3D,uEAAuE;IACvE,QAAQ,CAAC,YAAY,EAAE,kBAAkB;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAN1D,SAAkB,IAAI,wCAAuC;;IAG5D,uEAAuE;IAC9D,YAAY,EAAE,kBAAkB,EAChC,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAM1D;AAED,8EAA8E;AAC9E,wBAAgB,8BAA8B,CAC7C,MAAM,EAAE,sBAAsB,GAAG,SAAS,GACxC,OAAO,CAET;AAED,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAA;CACrC;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACzC,MAAM,EAAE,kBAAkB,GACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAKlC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,gCAAgC;IAChD,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,qBAAqB,CAAA;IACtD;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAA;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CACpD;AASD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,mBAAmB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAW7F;AAED;;;;;;GAMG;AACH,qBAAa,wCAAyC,SAAQ,KAAK;IAGtD,QAAQ,CAAC,UAAU,EAAE,QAAQ,GAAG,UAAU;IAFtD,SAAkB,IAAI,8CAA6C;gBAE9C,UAAU,EAAE,QAAQ,GAAG,UAAU;CAKtD;AAED;;;;;;;GAOG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;IAI1D,QAAQ,CAAC,KAAK,EAAE,MAAM;IAHvB,SAAkB,IAAI,uCAAsC;gBAGlD,KAAK,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM;CASf;AAED;;;;;;;GAOG;AACH,qBAAa,yCAA0C,SAAQ,KAAK;IAIlE,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,sBAAsB;IAJxC,SAAkB,IAAI,+CAA8C;gBAG1D,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC,EAC1C,MAAM,EAAE,sBAAsB;CAMxC;AAUD;;;;;;;;;;;;GAYG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IAIzD,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHtB,SAAkB,IAAI,sCAAqC;gBAGjD,IAAI,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM;CAMf;AAKD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAyDpD;AAqBD;;;;;;;;GAQG;AACH;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAC5C,SAAS,EAAE,+BAA+B,EAC1C,SAAS,SAAoB,GAC3B,IAAI,CAkDN;AA2BD;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC9C,MAAM,EAAE,sBAAsB,EAC9B,MAAM,EAAE,sBAAsB,EAC9B,SAAS,CAAC,EAAE,+BAA+B,GACzC,IAAI,CAoBN;AAyMD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,wBAAwB;IACxC;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC1B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,EAAE,wBAE3C,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,wBAE5C,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,uBAAuB,CACtC,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,SAAS,EAAE,+BAA+B,GAAG,SAAS,EACtD,OAAO,EAAE,wBAAwB,GAC/B,IAAI,CASN;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAChC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,+BAA+B,GACxC,SAAS,MAAM,EAAE,GAAG,SAAS,CAQ/B;AAkDD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAI5F;AA2DD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,kEAAkE;IAClE,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACzD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,mEAAmE;IACnE,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAA;IACnD,QAAQ,CAAC,SAAS,CAAC,EAAE,+BAA+B,CAAA;IACpD,+EAA+E;IAC/E,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,wBAAwB,EAAE,CAAA;IAC9D;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAA;CACjD;AAED,wBAAgB,yBAAyB,CACxC,OAAO,EAAE,2BAA2B,GAClC,gCAAgC,CAwElC;AAmBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,qBAAqB,CAC1C,MAAM,EAAE,sBAAsB,EAC9B,MAAM,EAAE,sBAAsB,EAC9B,MAAM,EAAE,kBAAkB,EAC1B,eAAe,CAAC,EAAE,+BAA+B,GAC/C,OAAO,CAAC,gCAAgC,CAAC,CAqC3C;AAED;;;;;;GAMG;AACH,qBAAa,qCAAsC,SAAQ,KAAK;IAI9D,QAAQ,CAAC,YAAY,EAAE,eAAe,GAAG,qBAAqB;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM;IAJtB,SAAkB,IAAI,2CAA0C;gBAGtD,YAAY,EAAE,eAAe,GAAG,qBAAqB,EACrD,IAAI,EAAE,MAAM;CAMtB;AAED,gFAAgF;AAChF,qBAAa,mCAAoC,SAAQ,KAAK;IAI5D,QAAQ,CAAC,YAAY,EAAE,eAAe,GAAG,qBAAqB;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM;IALxB,SAAkB,IAAI,yCAAwC;gBAGpD,YAAY,EAAE,eAAe,GAAG,qBAAqB,EACrD,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM;CAMxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,yBAAyB,CAC9C,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,gCAAgC,EAC5C,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAsJf;AAWD,2DAA2D;AAC3D,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACrB;AAuDD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAgB/D;AAyBD,mFAAmF;AACnF,UAAU,SAAS;IAClB,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACrB;AAKD,gEAAgE;AAChE,KAAK,UAAU,GACZ;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAA;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACpB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACpB,CAAA;AAEJ,UAAU,kBAAkB;IAC3B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,SAAS,EAAE,CAAA;CAC5C;AAED,kFAAkF;AAClF,UAAU,WAAW;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,SAAS,EAAE,CAAA;CAC5C;AAkBD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,YAAY,EAAE,SAAS,kBAAkB,EAAE,CAAA;IACpD;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAA;IACtC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,aAAa,EAAE,KAAK,GAAG,SAAS,MAAM,EAAE,CAAA;IACjD,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAA;IACnC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,oDAAoD;IACpD,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAA;IACnD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,WAAW,EAAE;QACrB,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,qBAAqB,CAAA;QACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KACrB,CAAA;IACD;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS;QAC7B,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,qBAAqB,CAAA;QACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KACrB,EAAE,CAAA;CACH;AAsED;;GAEG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,gCAAgC,GAAG,eAAe,CA+F7F;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,oBAAoB,CACnC,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE,eAAe,GACpB,eAAe,CAmBjB;AAqID,uDAAuD;AACvD,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,CAAA;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACxB;AA2WD,wCAAwC;AACxC,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACpD,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;IACvC,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED,0EAA0E;AAC1E,MAAM,MAAM,mBAAmB;AAC9B,qEAAqE;AACnE,QAAQ;AACV,kEAAkE;GAChE,eAAe;AACjB,oDAAoD;GAClD,iBAAiB;AACnB,iFAAiF;GAC/E,mBAAmB;AACrB,mDAAmD;GACjD,eAAe,CAAA;AAElB,6CAA6C;AAC7C,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,qBAAqB,CAAA;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAA;IACrC,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,mBAAmB,GAAG,sBAAsB,GAAG,qBAAqB,GAAG,eAAe,CAAA;AAElG;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,qBAAqB,CAAA;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC5C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAC9B;AAiDD,uFAAuF;AACvF,wBAAgB,sBAAsB,CACrC,KAAK,EAAE,SAAS,OAAO,EAAE,EACzB,MAAM,EAAE,wBAAwB,EAChC,SAAS,EAAE,eAAe,GACxB,oBAAoB,EAAE,CA6CxB;AAED,qEAAqE;AACrE,wBAAgB,wBAAwB,CACvC,KAAK,EAAE,SAAS,OAAO,EAAE,EACzB,MAAM,EAAE,wBAAwB,EAChC,SAAS,EAAE,eAAe,GACxB,oBAAoB,EAAE,CAqDxB;AAwDD,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,QAAQ,EAAE,SAAS,oBAAoB,EAAE,CAAA;IAClD,uEAAuE;IACvE,QAAQ,CAAC,OAAO,CAAC,EAAE;QAClB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;QAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KACxB,CAAA;CACD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAChC,SAAS,EAAE,SAAS,oBAAoB,EAAE,EAC1C,SAAS,EAAE,eAAe,GACxB,mBAAmB,CA8GrB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IAIzD,QAAQ,CAAC,OAAO,EAAE,mBAAmB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpD,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,SAAS,oBAAoB,EAAE;IAElD,iEAAiE;IACjE,QAAQ,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE;IAV/C,SAAkB,IAAI,sCAAqC;gBAGjD,OAAO,EAAE,mBAAmB,EAC5B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC3C,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC,EAC1C,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EAClD,OAAO,EAAE,MAAM;IACf,iEAAiE;IACxD,MAAM,GAAE,SAAS,kBAAkB,EAAO;CAMpD;AAuCD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,uBAAuB,CAC5C,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,gCAAgC,EAC5C,MAAM,EAAE,wBAAwB,EAChC,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;;;GAMG;AACH,wBAAsB,8BAA8B,CACnD,MAAM,EAAE,gBAAgB,EACxB,SAAS,EAAE,eAAe,EAC1B,MAAM,EAAE,wBAAwB,EAChC,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAoDf"}

package/dist/backends/kubernetes/egress-policy.js

@@ -314,53 +314,40 @@ export function assertPerSandboxEgressIsUsable(egress) {
     if (perSandbox.narrowing !== undefined) {
         assertCiliumNarrowingIsUsable(perSandbox.narrowing, 'perSandbox.narrowing');
     }
+    const { hostIdentity, permittedHostsParam } = perSandbox;
+    if (hostIdentity !== undefined && (hostIdentity === '' || hostIdentity.trim() !== hostIdentity)) {
+        throw new KubernetesPerSandboxEgressConfigError('hostIdentity', hostIdentity, 'is not a user name (an empty or space-padded identity matches nothing, so the fence check would refuse every write)');
+    }
+    if (permittedHostsParam !== undefined) {
+        for (const field of ['name', 'namespace']) {
+            const value = permittedHostsParam[field];
+            if (typeof value !== 'string' || value === '' || value.trim() !== value) {
+                throw new KubernetesPerSandboxEgressConfigError(`permittedHostsParam.${field}`, String(value), 'is not an object name (the parameter ConfigMap is named by both fields, and an empty or space-padded one names nothing, so every write would be refused)');
+            }
+        }
+    }
     perSandboxEgressLabelKey(egress);
 }
 /**
- * Named refusal for `config.egress.perSandbox` reaching an entry point that
- * can never carry the capability it configures: `createKubernetesWorkspace`.
- *
- * `perSandbox` exists to make `Sandbox.setNetworkPolicy` PRESENT on a TASK
- * handle, where the acquire creates the object each policy is named after and
- * owned by and stamps the per-sandbox pod label its selector matches, and
- * where the RBAC and the admission fence are the ones that bound the write.
- * A workspace's create path does none of that — it composes no per-sandbox
- * pod label and tracks no owner uid for one — so on that path the option
- * would be accepted and mean nothing at all: exactly the "declared and
- * silently unused" configuration this module refuses everywhere else. The
- * alternative, omitting the method and saying nothing, is how a host comes to
- * believe it narrowed a workspace's egress.
- *
- * NOT a variant of {@link KubernetesPerSandboxEgressConfigError}, which is
- * about a `perSandbox` value this backend cannot honour ANYWHERE (an engine
- * with no hostname concept, an unnamed fence). This one is about a `perSandbox`
- * value it honours perfectly well on the other entry point, so a caller
- * catching the sibling for a typo'd value does not also catch a correct
- * configuration aimed at the wrong path.
+ * Formerly the refusal of `config.egress.perSandbox` on
+ * `createKubernetesWorkspace` and `allocateKubernetesWorkspace`, which could
+ * not carry the capability. They carry it now: the workspace's pod template
+ * gets the per-sandbox selector label, the `Sandbox` owns the policies, and
+ * the handle serves `setNetworkPolicy`.
+ *
+ * Nothing throws this any more. It stays exported so an existing
+ * `catch (err) { if (err instanceof KubernetesWorkspacePerSandboxEgressConfigError) … }`
+ * keeps compiling and simply never matches; it will be removed in a later
+ * major.
+ *
+ * @deprecated No workspace entry point refuses `egress.perSandbox` any more.
  */
 export class KubernetesWorkspacePerSandboxEgressConfigError extends Error {
     name = 'KubernetesWorkspacePerSandboxEgressConfigError';
     constructor() {
-        super(`kubernetes: config.egress.perSandbox is set, but a KubernetesWorkspace cannot carry the capability it configures: Sandbox.setNetworkPolicy is implemented on a TASK handle, whose acquire creates the object each per-sandbox policy is named after and owned by and stamps the pod label its selector matches, while a workspace's create path composes no per-sandbox pod label and tracks no owner uid for one. Accepting the option here would declare a capability this path never serves — the silent downgrade this backend refuses on every other entry point — so it is refused before anything is sent. Drop egress.perSandbox from the configuration workspaces are created from (a backend serving task sandboxes can keep it), or create a task sandbox with it, where the method is present.`);
+        super('kubernetes: config.egress.perSandbox is set on a workspace entry point. This error is no longer thrown: workspaces serve per-sandbox egress.');
     }
 }
-/**
- * Refuse `config.egress.perSandbox` on the entry point that cannot carry it —
- * `createKubernetesWorkspace`. See
- * {@link KubernetesWorkspacePerSandboxEgressConfigError}.
- *
- * Deliberately not {@link assertPerSandboxEgressIsUsable}, which validates the
- * same config for the path that DOES honour it: a workspace has nothing to
- * validate the option for, whatever its `engine` or `admissionPolicyName` say,
- * because it serves no `setNetworkPolicy` at all. Calling that validator here
- * instead would be worse than saying nothing — it would report a
- * `perSandbox` this deployment can use as if it were in use.
- */
-export function assertWorkspaceCarriesNoPerSandboxEgress(egress) {
-    if (egress?.perSandbox === undefined)
-        return;
-    throw new KubernetesWorkspacePerSandboxEgressConfigError();
-}
 /**
  * The ONE composer for a sandbox pod's `additionalPodMetadata.labels`.
  *
@@ -1074,7 +1061,7 @@ export function assertHostsFitNarrowing(allowedHosts, narrowing, context) {
  * `undefined` means no port restriction: the host's `toFQDNs` rule carries
  * no `toPorts` at all.
  */
-function narrowedHostPorts(host, narrowing) {
+export function narrowedHostPorts(host, narrowing) {
     const explicit = narrowing.hostPorts?.[host] ?? narrowing.ports;
     if (explicit !== undefined)
         return explicit;
@@ -1821,6 +1808,49 @@ export function egressAllowance(translated) {
         namedObject: { kind: translated.kind, name: translated.name },
     };
 }
+/**
+ * What the pod may reach when TWO translated policies both select it: the
+ * operator's baseline and one per-sandbox policy this backend wrote.
+ *
+ * Kubernetes unions every policy that selects a pod, so the boundary a
+ * per-sandbox write is supposed to produce is exactly baseline PLUS the
+ * written policy, and a third policy allowing more than that is what the
+ * post-write check refuses. Each field is the union of the two sides':
+ *
+ *  - destinations and `toFQDNs` names concatenate;
+ *  - `permitsEverything` is either side's, and `permitsNothing` is both
+ *    sides' — a `no-network` baseline permits nothing, and a baseline that
+ *    permits nothing plus a per-sandbox policy that permits one name permits
+ *    that name, not nothing;
+ *  - DNS lookups: a side that permits nothing contributes no names, a side
+ *    that does not narrow DNS contributes every name, and the union of name
+ *    lists is their concatenation. This is the one field where the naive
+ *    union is wrong: a `no-network` baseline reports `'all'` because a core
+ *    policy "cannot narrow DNS", and taking that at face value would let any
+ *    other policy open the resolver to every name beside a narrowed grant.
+ *
+ * Both objects are marked as named: each had its `spec` compared to its own
+ * translation before this check runs, and neither's `.domain` entries (a
+ * `matchName` plus a `matchPattern`) are expressible in an allowance.
+ */
+export function unionEgressAllowance(baseline, added) {
+    const dnsOf = (side) => side.permitsNothing ? [] : side.dnsNarrowedTo;
+    const baselineDns = dnsOf(baseline);
+    const addedDns = dnsOf(added);
+    const dnsNarrowedTo = baselineDns === 'all' || addedDns === 'all'
+        ? 'all'
+        : [...new Set([...baselineDns, ...addedDns])];
+    return {
+        destinations: [...baseline.destinations, ...added.destinations],
+        fqdns: [...baseline.fqdns, ...added.fqdns],
+        dnsNarrowedTo,
+        permitsEverything: baseline.permitsEverything || added.permitsEverything,
+        permitsNothing: baseline.permitsNothing && added.permitsNothing,
+        policyKind: baseline.policyKind,
+        namedObject: baseline.namedObject,
+        alsoNamed: [...(baseline.alsoNamed ?? []), added.namedObject, ...(added.alsoNamed ?? [])],
+    };
+}
 // ---------------------------------------------------------------------------
 // Is one policy's rule inside the translation
 // ---------------------------------------------------------------------------
@@ -2327,7 +2357,8 @@ function unreadableEgressPolicy(kind, name, detail) {
  * earlier on the create path.
  */
 function isNamedObject(allowance, kind, name) {
-    return allowance.namedObject.kind === kind && allowance.namedObject.name === name;
+    const matches = (entry) => entry.kind === kind && entry.name === name;
+    return matches(allowance.namedObject) || (allowance.alsoNamed ?? []).some(matches);
 }
 /** Every core `NetworkPolicy` in the list, reduced to {@link EgressPolicyDocument}. */
 export function readCoreEgressPolicies(items, target, allowance) {
@@ -2663,7 +2694,16 @@ function formatEgressRemedy(refusal, unread) {
  * acquire path's cleanup.
  */
 export async function verifyEgressPolicyUnion(client, translated, target, signal) {
-    const allowance = egressAllowance(translated);
+    await verifyEgressPolicyUnionAgainst(client, egressAllowance(translated), target, signal);
+}
+/**
+ * {@link verifyEgressPolicyUnion} against an allowance the caller already
+ * built — the entry point for a question about more than one translation,
+ * which is what the post-write check of a per-sandbox policy is: the pod's
+ * boundary is the baseline's allowance plus the written policy's, see
+ * {@link unionEgressAllowance}.
+ */
+export async function verifyEgressPolicyUnionAgainst(client, allowance, target, signal) {
     const documents = [];
     try {
         documents.push(...readCoreEgressPolicies(await listPolicies(client, networkPolicyCollectionPath(target.namespace), 'networkpolicies', signal), target, allowance));