@opensoha/contracts 0.1.27 → 0.2.0

package/resource/runtime/network_topology_builder_test.go

@@ -0,0 +1,186 @@
+package runtime
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	cr "github.com/opensoha/soha/contracts/resource"
+)
+
+func topologyFixture(source, namespace, name, body string) cr.NetworkTopologySourceResult {
+	definition, _ := cr.LookupNetworkTopologySource(source)
+	var raw map[string]any
+	_ = json.Unmarshal([]byte(body), &raw)
+	metadata, _ := raw["metadata"].(map[string]any)
+	if metadata == nil {
+		metadata = map[string]any{}
+	}
+	metadata["name"] = name
+	metadata["namespace"] = namespace
+	metadata["uid"] = name + "-uid"
+	metadata["resourceVersion"] = "1"
+	raw["metadata"] = metadata
+	projected, err := cr.ProjectNetworkTopologyObject(source, raw)
+	if err != nil {
+		panic(err)
+	}
+	content, _ := json.Marshal(projected)
+	return cr.NetworkTopologySourceResult{Coverage: cr.NetworkTopologyCoverage{SourceID: source, Provider: definition.Provider, Namespace: namespace, State: "available"}, Objects: []cr.NetworkTopologySourceObject{{Resource: cr.ResourceRef{ClusterID: "c", APIVersion: strings.TrimPrefix(definition.Group+"/"+definition.Version, "/"), Kind: definition.Kind, Namespace: namespace, Name: name, UID: name + "-uid"}, Content: string(content)}}}
+}
+func fixtureView(sources ...cr.NetworkTopologySourceResult) cr.NetworkTopologyView {
+	return BuildNetworkTopology("c", "team", cr.NetworkTopologySnapshot{Sources: sources})
+}
+
+func TestNetworkTopologyCoverageIncludesDeniedEntriesBeyondQueryLimit(t *testing.T) {
+	sources := make([]cr.NetworkTopologySourceResult, topologyCoverageLimit+1)
+	for i := range sources {
+		sources[i].Coverage = cr.NetworkTopologyCoverage{SourceID: "kubernetes.services", State: "denied"}
+	}
+	view := fixtureView(sources[:cr.NetworkTopologyMaxQueries+2]...)
+	if view.Truncated || len(view.Coverage) != cr.NetworkTopologyMaxQueries+2 {
+		t.Fatalf("coverage was capped at the issued-query limit: %d, truncated=%v", len(view.Coverage), view.Truncated)
+	}
+	view = fixtureView(sources...)
+	if !view.Truncated || len(view.Coverage) != topologyCoverageLimit {
+		t.Fatalf("coverage exceeded the public limit: %d, truncated=%v", len(view.Coverage), view.Truncated)
+	}
+}
+func TestTopologyKeepsIngressRuleBackendPortsAndEndpointEvidence(t *testing.T) {
+	view := fixtureView(
+		topologyFixture("kubernetes.ingresses", "team", "entry", `{"spec":{"rules":[{"host":"a.test","http":{"paths":[{"path":"/a","pathType":"Prefix","backend":{"service":{"name":"web","port":{"number":80}}}}]}},{"host":"b.test","http":{"paths":[{"path":"/b","backend":{"service":{"name":"web","port":{"number":81}}}}]}}]}}`),
+		topologyFixture("kubernetes.services", "team", "web", `{"spec":{"ports":[{"name":"http","port":80,"targetPort":8080},{"name":"other","port":81,"targetPort":8081}],"selector":{"app":"web"}}}`),
+		topologyFixture("kubernetes.endpointslices", "team", "web-1", `{"ports":[{"name":"http","port":8080}],"endpoints":[{"addresses":["10.1.1.1"],"targetRef":{"kind":"Pod","name":"web-1","uid":"web-1-uid"},"conditions":{"serving":true}}]}`),
+		topologyFixture("kubernetes.pods", "team", "web-1", `{"metadata":{"labels":{"app":"web"}},"status":{"phase":"Running"}}`),
+	)
+	rules := map[string]bool{}
+	ports := map[string]bool{}
+	for _, node := range view.Nodes {
+		if node.Rule != nil {
+			group := node.Rule.MatchGroups[0]
+			rules[group[0].Value+group[1].Value] = true
+		}
+	}
+	for _, edge := range view.Edges {
+		if edge.Relation == "forwards" {
+			ports[edge.Port] = true
+		}
+	}
+	if len(rules) != 2 || !rules["a.test/a"] || !rules["b.test/b"] || !ports["80"] || !ports["81"] {
+		t.Fatalf("flattened routes: %+v %+v", rules, ports)
+	}
+	// Selector matching remains a separate declared relation, never endpoint proof.
+	for _, edge := range view.Edges {
+		if edge.Relation == "selects" && (edge.ResolutionState != "resolved" || !strings.Contains(edge.Note, "Selector match only")) {
+			t.Fatal("selector must stay separate from endpoint readiness")
+		}
+	}
+}
+func TestTopologyPreservesZeroWeightMirrorAndCycles(t *testing.T) {
+	view := fixtureView(
+		topologyFixture("traefik.ingressroutes", "team", "route", `{"spec":{"entryPoints":["web"],"routes":[{"match":"Host(\"a.test\")","services":[{"name":"weighted","kind":"TraefikService","weight":0}]}]}}`),
+		topologyFixture("traefik.traefikservices", "team", "weighted", `{"spec":{"weighted":{"services":[{"name":"web","port":80,"weight":0},{"name":"weighted","kind":"TraefikService","weight":2}]},"mirroring":{"name":"web","port":80,"mirrors":[{"name":"shadow","port":80,"percent":15}]}}}`),
+		topologyFixture("kubernetes.services", "team", "web", `{"spec":{"type":"ExternalName","externalName":"upstream.example","ports":[{"port":80}]}}`),
+	)
+	zero := false
+	mirror := false
+	cycle := false
+	for _, edge := range view.Edges {
+		zero = zero || (edge.Weight != nil && *edge.Weight == 0)
+		mirror = mirror || (edge.Relation == "mirrors" && edge.MirrorPercent != nil && *edge.MirrorPercent == 15)
+	}
+	for _, node := range view.Nodes {
+		cycle = cycle || node.ResolutionState == "unsupported_fragment"
+	}
+	if !zero || !mirror || !cycle {
+		t.Fatalf("lost semantics zero=%v mirror=%v cycle=%v", zero, mirror, cycle)
+	}
+	if len(view.Nodes) > 200 || len(view.Edges) > 400 {
+		t.Fatal("graph budget exceeded")
+	}
+}
+func TestTopologyNeverLeaksInvisibleCrossNamespaceReferences(t *testing.T) {
+	view := fixtureView(cr.NetworkTopologySourceResult{Coverage: cr.NetworkTopologyCoverage{SourceID: "gateway.referencegrants", Namespace: "private", State: "available"}}, topologyFixture("gateway.httproutes", "team", "route", `{"spec":{"parentRefs":[{"name":"hidden-gateway","namespace":"private"}],"rules":[{"backendRefs":[{"name":"hidden-service","namespace":"private","port":80}]}]}}`))
+	data, _ := json.Marshal(struct {
+		Nodes  []cr.NetworkTopologyGraphNode
+		Edges  []cr.NetworkTopologyGraphEdge
+		Traces []cr.NetworkTopologyTraceView
+	}{view.Nodes, view.Edges, view.Traces})
+	if strings.Contains(string(data), "hidden-service") || strings.Contains(string(data), "hidden-gateway") || strings.Contains(string(data), "private") {
+		t.Fatalf("hidden reference escaped: %s", data)
+	}
+}
+func TestTopologyAPISIXStreamAndExternalUpstream(t *testing.T) {
+	view := fixtureView(topologyFixture("apisix.apisixroutes", "team", "route", `{"spec":{"stream":[{"name":"dns","protocol":"UDP","match":{"ingressPort":53},"backend":{"serviceName":"dns","servicePort":53}}]}}`), topologyFixture("apisix.apisixupstreams", "team", "dns", `{"spec":{"scheme":"udp","externalNodes":[{"type":"Domain","name":"resolver.example","port":53,"weight":1}]}}`))
+	udp := false
+	external := false
+	for _, node := range view.Nodes {
+		udp = udp || node.Protocol == "UDP"
+		external = external || (node.Type == "external" && node.Label == "resolver.example")
+	}
+	if !udp || !external {
+		t.Fatalf("missing UDP/external: %+v", view)
+	}
+}
+
+func TestTopologyEndpointSliceUsesReadyPortAndPodUID(t *testing.T) {
+	service := topologyFixture("kubernetes.services", "team", "web", `{"spec":{"ports":[{"name":"http","port":80,"targetPort":8080,"protocol":"TCP"}]}}`)
+	endpoints := topologyFixture("kubernetes.endpointslices", "team", "web-endpoints", `{"metadata":{"labels":{"kubernetes.io/service-name":"web"}},"ports":[{"name":"http","port":8080,"protocol":"TCP"}],"endpoints":[{"targetRef":{"kind":"Pod","name":"web-1","uid":"web-1-uid"},"conditions":{"serving":true}}]}`)
+	pod := topologyFixture("kubernetes.pods", "team", "web-1", `{}`)
+	view := fixtureView(service, endpoints, pod)
+	resolved := false
+	for _, edge := range view.Edges {
+		if edge.Relation == "resolves" && strings.Contains(edge.Target, "web-1-uid") && edge.ResolutionState == "resolved" {
+			resolved = true
+		}
+	}
+	if !resolved {
+		t.Fatal("ready=nil EndpointSlice with matching service label, port and Pod UID did not resolve")
+	}
+	endpoints.Objects[0].Content = strings.Replace(endpoints.Objects[0].Content, `"uid":"web-1-uid"`, `"uid":"old-pod-uid"`, 1)
+	view = fixtureView(service, endpoints, pod)
+	for _, node := range view.Nodes {
+		if node.Type == "pod" {
+			t.Fatal("stale Pod UID resolved to its replacement")
+		}
+	}
+}
+func TestTopologyGatewayGrantListenerAndZeroWeight(t *testing.T) {
+	route := topologyFixture("gateway.httproutes", "team", "route", `{"spec":{"parentRefs":[{"name":"gateway","namespace":"infra","sectionName":"https"}],"rules":[{"backendRefs":[{"name":"web","namespace":"backend","port":80,"weight":0},{"name":"web","namespace":"backend","port":80,"weight":2}]}]}}`)
+	gateway := topologyFixture("gateway.gateways", "infra", "gateway", `{"spec":{"listeners":[{"name":"https","port":443,"protocol":"HTTPS","allowedRoutes":{"namespaces":{"from":"All"}}}]}}`)
+	service := topologyFixture("kubernetes.services", "backend", "web", `{"spec":{"type":"ExternalName","externalName":"upstream.example","ports":[{"port":80}]}}`)
+	grant := topologyFixture("gateway.referencegrants", "backend", "allow", `{"spec":{"from":[{"group":"gateway.networking.k8s.io","kind":"HTTPRoute","namespace":"team"}],"to":[{"group":"","kind":"Service","name":"web"}]}}`)
+	view := fixtureView(route, gateway, service, grant)
+	zero, parent := false, false
+	for _, edge := range view.Edges {
+		zero = zero || (edge.Relation == "weights" && edge.Weight != nil && *edge.Weight == 0 && edge.TotalWeight != nil && *edge.TotalWeight == 2 && edge.ResolutionState == "resolved")
+		parent = parent || (edge.Relation == "matches" && strings.Contains(edge.Source, "gateway-uid") && edge.ResolutionState == "resolved")
+	}
+	if !zero || !parent {
+		t.Fatalf("lost granted backend/listener/zero semantics: %+v", view.Edges)
+	}
+	view = fixtureView(route, gateway, service, cr.NetworkTopologySourceResult{Coverage: cr.NetworkTopologyCoverage{SourceID: "gateway.referencegrants", Namespace: "backend", State: "available"}})
+	for _, edge := range view.Edges {
+		if edge.Relation == "weights" && edge.ResolutionState == "resolved" {
+			t.Fatal("cross-namespace backend resolved without ReferenceGrant")
+		}
+	}
+}
+
+func TestTopologyRejectsRouteProtocolServicePortMismatch(t *testing.T) {
+	route := topologyFixture("kubernetes.ingresses", "team", "http", `{"spec":{"rules":[{"http":{"paths":[{"path":"/","backend":{"service":{"name":"dns","port":{"number":53}}}}]}}]}}`)
+	service := topologyFixture("kubernetes.services", "team", "dns", `{"spec":{"type":"ExternalName","externalName":"dns.example","ports":[{"port":53,"protocol":"UDP"}]}}`)
+	view := fixtureView(route, service)
+	found := false
+	for _, edge := range view.Edges {
+		if edge.Relation == "forwards" {
+			found = true
+			if edge.ResolutionState != "unresolved" {
+				t.Fatal("HTTP ingress accepted a UDP Service port")
+			}
+		}
+	}
+	if !found {
+		t.Fatal("missing configured relationship")
+	}
+}

package/resource/runtime/network_topology_declarations.go

@@ -0,0 +1,329 @@
+package runtime
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	cr "github.com/opensoha/soha/contracts/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+)
+
+// declarations adds only structured Kubernetes references. It never interprets
+// arbitrary provider spec, certificate bytes, or policy as live connectivity.
+func (g *topologyGraph) declarations(prioritized string) {
+	for _, o := range g.ordered {
+		if g.budgetReached() || g.ctx.Err() != nil {
+			return
+		}
+		if o.id() != prioritized {
+			g.objectDeclarations(o)
+		}
+	}
+}
+
+func (g *topologyGraph) objectDeclarations(o topologyObject) {
+	switch o.ref.Kind {
+	case "Ingress":
+		g.declaredRef(o, "networking.k8s.io/v1", "IngressClass", "", text(at(o.body, "spec", "ingressClassName")), "uses-class", "spec.ingressClassName", "")
+		for i, tls := range items(at(o.body, "spec", "tls")) {
+			g.declaredRef(o, "v1", "Secret", o.ref.Namespace, text(tls["secretName"]), "uses-secret", fmt.Sprintf("spec.tls[%d].secretName", i), "")
+		}
+	case "Gateway":
+		g.declaredRef(o, "gateway.networking.k8s.io/v1", "GatewayClass", "", text(at(o.body, "spec", "gatewayClassName")), "uses-class", "spec.gatewayClassName", "")
+		g.gatewayCertificates(o)
+	case "IngressClass":
+		g.classParameters(o, object(at(o.body, "spec", "parameters")), "spec.parameters")
+	case "GatewayClass":
+		g.classParameters(o, object(at(o.body, "spec", "parametersRef")), "spec.parametersRef")
+	case "BackendTLSPolicy":
+		g.backendTLSPolicy(o)
+	case "NetworkPolicy":
+		g.networkPolicy(o)
+	}
+}
+
+func topologySourceFor(kind, api string) (cr.NetworkTopologySourceDefinition, bool) {
+	for _, d := range cr.NetworkTopologySources() {
+		if d.Kind == kind && topologyDefinitionAPI(d, api) {
+			return d, true
+		}
+	}
+	return cr.NetworkTopologySourceDefinition{}, false
+}
+
+func (g *topologyGraph) declaredRef(o topologyObject, api, kind, namespace, name, relation, path, section string) *cr.NetworkTopologyGraphEdge {
+	if name == "" {
+		return &cr.NetworkTopologyGraphEdge{}
+	}
+	source := g.objectNode(o, "backend-group", topologyProvider(o.source), "")
+	ref := cr.ResourceRef{ClusterID: g.view.ClusterID, APIVersion: api, Kind: kind, Namespace: namespace, Name: name, ScopeMode: cr.ResourceScopeModeNamespace}
+	if namespace == "" {
+		ref.ScopeMode = cr.ResourceScopeModeCluster
+	}
+	target := topologyObject{ref: ref}
+	state := "unknown"
+	if api == "" {
+		state = "unsupported_fragment"
+	}
+	if d, ok := topologySourceFor(kind, api); ok {
+		if g.completeSource(d.ID, namespace) {
+			state = "not_found"
+		}
+		if actual, ok := g.objects[topologyKey(kind, namespace, name)]; ok && actual.ref.APIVersion == api {
+			target = actual
+			state = "resolved"
+		}
+	}
+	// Secret existence is never inferred from an ordinary object projection.
+	if kind == "Secret" && api == "v1" {
+		state = "unresolved"
+	}
+	id := ""
+	if state == "unsupported_fragment" {
+		id = g.unknown(source, kind, namespace, name, state)
+	} else if state == "unknown" || kind == "Secret" && api == "v1" {
+		// The public topology has no per-node product permission filter. Keep a
+		// declaration identity private for Graph's later authorization pass only.
+		id = g.unknown(source, kind, namespace, name, state)
+		g.hiddenRefs[id] = target.ref
+	} else {
+		id = g.objectNode(target, "backend-group", topologyProvider(o.source), "")
+		if state != "resolved" {
+			g.state(id, state)
+		}
+	}
+	edge := g.link(source, id, relation, "", "")
+	edge.SourceRef = &o.ref
+	edge.FieldPath = path
+	edge.SectionName = section
+	edge.ResolutionState = state
+	return edge
+}
+func topologyProvider(source string) string {
+	d, _ := cr.LookupNetworkTopologySource(source)
+	return firstTopology(d.Provider, "kubernetes")
+}
+
+func (g *topologyGraph) classParameters(o topologyObject, ref map[string]any, path string) {
+	kind, name := text(ref["kind"]), text(ref["name"])
+	group := firstTopology(text(ref["group"]), text(ref["apiGroup"]))
+	if kind == "" || name == "" {
+		return
+	}
+	namespace := text(ref["namespace"])
+	if text(ref["scope"]) == "Namespace" && namespace == "" {
+		return
+	}
+	api := topologyReferenceAPI(group, kind)
+	g.declaredRef(o, api, kind, namespace, name, "parameters", path, "")
+}
+func topologyReferenceAPI(group, kind string) string {
+	for _, d := range cr.NetworkTopologySources() {
+		if d.Group == group && d.Kind == kind {
+			return strings.TrimPrefix(d.Group+"/"+d.Version, "/")
+		}
+	}
+	if group == "" && kind == "Secret" {
+		return "v1"
+	}
+	// No version is guessed for an unsupported parameter kind.
+	return ""
+}
+func (g *topologyGraph) gatewayCertificates(o topologyObject) {
+	for i, l := range items(at(o.body, "spec", "listeners")) {
+		for j, r := range items(at(l, "tls", "certificateRefs")) {
+			group, kind := text(r["group"]), firstTopology(text(r["kind"]), "Secret")
+			ns := firstTopology(text(r["namespace"]), o.ref.Namespace)
+			authorized := ns == o.ref.Namespace || g.referenceAuthorized(o, group, kind, ns, text(r["name"]))
+			edge := g.declaredRef(o, topologyReferenceAPI(group, kind), kind, ns, text(r["name"]), "uses-secret", fmt.Sprintf("spec.listeners[%d].tls.certificateRefs[%d]", i, j), text(l["name"]))
+			edge.Protocol = text(l["protocol"])
+			edge.Port = text(l["port"])
+			if !authorized {
+				edge.ResolutionState = g.grantResolution(ns)
+			}
+			if group != "" || kind != "Secret" {
+				edge.ResolutionState = "unsupported_fragment"
+			}
+			edge.Note = "Certificate reference only; TLS activation is unverified"
+		}
+	}
+}
+func (g *topologyGraph) backendTLSPolicy(o topologyObject) {
+	refs := items(at(o.body, "spec", "targetRefs"))
+	path := "spec.targetRefs"
+	if len(refs) == 0 {
+		if ref := object(at(o.body, "spec", "targetRef")); len(ref) > 0 {
+			refs = append(refs, ref)
+			path = "spec.targetRef"
+		}
+	}
+	for i, r := range refs {
+		targetPath := path
+		if path == "spec.targetRefs" {
+			targetPath = fmt.Sprintf("%s[%d]", path, i)
+		}
+		kind, name, section := text(r["kind"]), text(r["name"]), text(r["sectionName"])
+		api := topologyReferenceAPI(text(r["group"]), kind)
+		edge := g.declaredRef(o, api, kind, o.ref.Namespace, name, "targets", targetPath, section)
+		if api == "v1" && kind == "Service" && section != "" && edge.ResolutionState == "resolved" {
+			service := g.objects[topologyKey(kind, o.ref.Namespace, name)]
+			resolveBackendTLSServiceSection(edge, service, section)
+		}
+	}
+	for i, r := range items(at(o.body, "spec", "validation", "caCertificateRefs")) {
+		group, kind := text(r["group"]), firstTopology(text(r["kind"]), "ConfigMap")
+		edge := g.declaredRef(o, topologyReferenceAPI(group, kind), kind, o.ref.Namespace, text(r["name"]), "uses-config", fmt.Sprintf("spec.validation.caCertificateRefs[%d]", i), "")
+		if group != "" || kind != "ConfigMap" {
+			edge.ResolutionState = "unsupported_fragment"
+		}
+		edge.Note = "CA reference only; trust and certificate validity are unverified"
+	}
+}
+
+func resolveBackendTLSServiceSection(edge *cr.NetworkTopologyGraphEdge, service topologyObject, section string) {
+	for _, port := range items(at(service.body, "spec", "ports")) {
+		if text(port["name"]) == section {
+			edge.Port = text(port["port"])
+			edge.Protocol = firstTopology(text(port["protocol"]), "TCP")
+			return
+		}
+	}
+	edge.ResolutionState = "unresolved"
+	edge.Note = "Declared Service port name was not observed"
+}
+
+// A grant is an OR of from entries AND an OR of to entries, scoped to
+// the target namespace. Partial/unavailable grant coverage never confirms it.
+func (g *topologyGraph) referenceAuthorized(o topologyObject, group, kind, namespace, name string) bool {
+	if namespace == o.ref.Namespace {
+		return true
+	}
+	if !g.completeSource("gateway.referencegrants", namespace) {
+		return false
+	}
+	fromGroup := strings.Split(o.ref.APIVersion, "/")[0]
+	for _, grant := range g.ordered {
+		if g.ctx.Err() != nil || g.budgetReached() {
+			return false
+		}
+		if grant.source != "gateway.referencegrants" || grant.ref.Namespace != namespace {
+			continue
+		}
+		from, to := false, false
+		for _, r := range items(at(grant.body, "spec", "from")) {
+			if text(r["namespace"]) == o.ref.Namespace && text(r["kind"]) == o.ref.Kind && text(r["group"]) == fromGroup {
+				from = true
+			}
+		}
+		for _, r := range items(at(grant.body, "spec", "to")) {
+			if text(r["group"]) == group && text(r["kind"]) == kind && (text(r["name"]) == "" || text(r["name"]) == name) {
+				to = true
+			}
+		}
+		if from && to {
+			edge := g.link(g.objectNode(grant, "backend-group", "gateway", ""), g.objectNode(o, "entry", "gateway", ""), "authorizes-reference", "", "")
+			edge.SourceRef = &grant.ref
+			edge.FieldPath = "spec.from+spec.to"
+			edge.Note = "Authorizes a declared reference; does not carry traffic"
+			return true
+		}
+	}
+	return false
+}
+func (g *topologyGraph) grantResolution(namespace string) string {
+	if g.completeSource("gateway.referencegrants", namespace) {
+		return "unresolved"
+	}
+	return "unknown"
+}
+
+func topologySelectorMatches(selector, values map[string]any) bool {
+	if selector == nil {
+		return false
+	}
+	raw, err := json.Marshal(selector)
+	if err != nil {
+		return false
+	}
+	var s metav1.LabelSelector
+	if json.Unmarshal(raw, &s) != nil {
+		return false
+	}
+	compiled, err := metav1.LabelSelectorAsSelector(&s)
+	if err != nil {
+		return false
+	}
+	set := labels.Set{}
+	for k, v := range values {
+		if value, ok := v.(string); ok {
+			set[k] = value
+		}
+	}
+	return compiled.Matches(set)
+}
+
+func (g *topologyGraph) networkPolicy(o topologyObject) {
+	id := g.objectNode(o, "backend-group", "kubernetes", "")
+	selected := object(at(o.body, "spec", "podSelector"))
+	for _, pod := range g.ordered {
+		if g.budgetReached() || g.ctx.Err() != nil {
+			return
+		}
+		if pod.source == "kubernetes.pods" && pod.ref.Namespace == o.ref.Namespace && topologySelectorMatches(selected, object(at(pod.body, "metadata", "labels"))) {
+			edge := g.link(id, g.objectNode(pod, "pod", "kubernetes", ""), "selects", "", "")
+			edge.FieldPath = "spec.podSelector"
+			edge.Note = "Selected Pod only; policy enforcement and connectivity are unverified"
+		}
+	}
+	for _, direction := range []string{"ingress", "egress"} {
+		peerField := "from"
+		if direction == "egress" {
+			peerField = "to"
+		}
+		for i, rule := range items(at(o.body, "spec", direction)) {
+			if len(items(rule[peerField])) == 0 {
+				g.properties(id, cr.NetworkTopologyProperty{Name: fmt.Sprintf("spec.%s[%d].%s", direction, i, peerField), Value: "All peers declared; connectivity is unverified"})
+			}
+			for j, peer := range items(rule[peerField]) {
+				path := fmt.Sprintf("spec.%s[%d].%s[%d]", direction, i, peerField, j)
+				if block := object(peer["ipBlock"]); len(block) > 0 {
+					g.properties(id, cr.NetworkTopologyProperty{Name: path + ".ipBlock", Value: text(block["cidr"]) + " except " + strings.Join(texts(block["except"]), ",") + "; declared CIDRs only"})
+					continue
+				}
+				g.policyPeers(o, id, peer, path)
+			}
+		}
+	}
+}
+func (g *topologyGraph) policyPeers(o topologyObject, id string, peer map[string]any, path string) {
+	ps, hasPod := peer["podSelector"]
+	ns, hasNS := peer["namespaceSelector"]
+	if !hasPod && !hasNS {
+		g.properties(id, cr.NetworkTopologyProperty{Name: path, Value: "All peers declared; connectivity is unverified"})
+		return
+	}
+	for _, pod := range g.ordered {
+		if g.budgetReached() || g.ctx.Err() != nil {
+			return
+		}
+		if pod.source != "kubernetes.pods" {
+			continue
+		}
+		if hasNS {
+			namespace, ok := g.objects[topologyKey("Namespace", "", pod.ref.Namespace)]
+			if !ok || !g.completeSource("kubernetes.namespaces", "") || !topologySelectorMatches(object(ns), object(at(namespace.body, "metadata", "labels"))) {
+				continue
+			}
+		} else if pod.ref.Namespace != o.ref.Namespace {
+			continue
+		}
+		if hasPod && !topologySelectorMatches(object(ps), object(at(pod.body, "metadata", "labels"))) {
+			continue
+		}
+		edge := g.link(id, g.objectNode(pod, "pod", "kubernetes", ""), "policy-peer", "", "")
+		edge.FieldPath = path
+		edge.Note = "Peer selector match (namespace AND pod within this entry; entries OR); no live connectivity inferred"
+	}
+}

package/resource/runtime/network_topology_test.go

@@ -9,7 +9,7 @@ import (
 	"strings"
 	"testing"
 
-	cr "github.com/opensoha/soha-contracts/resource"
+	cr "github.com/opensoha/soha/contracts/resource"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/rest"
 )

package/resource/runtime/node_drain.go

@@ -5,7 +5,7 @@ import (
 	"errors"
 	"sync"
 
-	"github.com/opensoha/soha-contracts/resource"
+	"github.com/opensoha/soha/contracts/resource"
 	policyv1 "k8s.io/api/policy/v1"
 	policyv1beta1 "k8s.io/api/policy/v1beta1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"

package/resource/runtime/node_drain_test.go

@@ -7,7 +7,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/opensoha/soha-contracts/resource"
+	"github.com/opensoha/soha/contracts/resource"
 	policyv1 "k8s.io/api/policy/v1"
 	policyv1beta1 "k8s.io/api/policy/v1beta1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"