@vellumai/credential-executor 0.11.10-dev.202609091224.201657f → 0.11.10-dev.202609091515.2bd0662

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/credential-executor",
-  "version": "0.11.10-dev.202609091224.201657f",
+  "version": "0.11.10-dev.202609091515.2bd0662",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/transport.test.ts

@@ -163,6 +163,10 @@ describe("health probes", () => {
     expect(src).toMatch(/\/readyz/);
     // Health server uses Bun.serve on a dedicated port, not the socket
     expect(src).toMatch(/startHealthServer\(\s*healthPort/);
+    // Kubelet httpGet targets the pod IP, so the probe listener must not
+    // bind loopback-only. Credential routes are gated with isLoopbackAddress.
+    expect(src).not.toMatch(/hostname:\s*"127\.0\.0\.1"/);
+    expect(src).toMatch(/isLoopbackAddress\(/);
   });
 
   test("getHealthPort defaults to 8090", () => {

package/src/http/loopback-address.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  isCesHttpProbePath,
+  isLoopbackAddress,
+} from "./loopback-address.js";
+
+describe("isLoopbackAddress", () => {
+  test("accepts IPv4 loopback", () => {
+    expect(isLoopbackAddress("127.0.0.1")).toBe(true);
+    expect(isLoopbackAddress("127.0.0.2")).toBe(true);
+  });
+
+  test("accepts IPv6 loopback and IPv4-mapped loopback", () => {
+    expect(isLoopbackAddress("::1")).toBe(true);
+    expect(isLoopbackAddress("::ffff:127.0.0.1")).toBe(true);
+  });
+
+  test("rejects non-loopback addresses", () => {
+    expect(isLoopbackAddress("10.0.0.1")).toBe(false);
+    expect(isLoopbackAddress("192.168.1.10")).toBe(false);
+    expect(isLoopbackAddress("8.8.8.8")).toBe(false);
+    expect(isLoopbackAddress("::ffff:10.0.0.1")).toBe(false);
+    expect(isLoopbackAddress("2001:db8::1")).toBe(false);
+  });
+});
+
+describe("isCesHttpProbePath", () => {
+  test("matches kubelet probe paths only", () => {
+    expect(isCesHttpProbePath("/healthz")).toBe(true);
+    expect(isCesHttpProbePath("/readyz")).toBe(true);
+    expect(isCesHttpProbePath("/v1/credentials")).toBe(false);
+    expect(isCesHttpProbePath("/v1/logs/export")).toBe(false);
+  });
+});

package/src/http/loopback-address.ts

@@ -0,0 +1,25 @@
+/**
+ * Strict loopback check for CES HTTP peers: 127.0.0.0/8 and ::1.
+ * IPv4-mapped IPv6 (`::ffff:127.0.0.1`) is treated as IPv4.
+ */
+export function isLoopbackAddress(addr: string): boolean {
+  const v4Mapped = addr.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i);
+  const normalized = v4Mapped ? v4Mapped[1] : addr;
+
+  if (normalized.includes(".")) {
+    const parts = normalized.split(".").map(Number);
+    if (
+      parts.length !== 4 ||
+      parts.some((p) => Number.isNaN(p) || p < 0 || p > 255)
+    ) {
+      return false;
+    }
+    return parts[0] === 127;
+  }
+
+  return normalized.toLowerCase() === "::1";
+}
+
+export function isCesHttpProbePath(pathname: string): boolean {
+  return pathname === "/healthz" || pathname === "/readyz";
+}

package/src/main.ts

@@ -51,6 +51,7 @@ import {
   type CredentialRouteDeps,
 } from "./http/credential-routes.js";
 import { handleLogExportRoute } from "./http/log-export-routes.js";
+import { isLoopbackAddress } from "./http/loopback-address.js";
 import { handleMetadataRoute } from "./http/metadata-routes.js";
 import { CES_MIGRATIONS } from "./migrations/registry.js";
 import { runCesMigrations } from "./migrations/runner.js";
@@ -246,9 +247,12 @@ function startHealthServer(
   signal: AbortSignal,
   credentialDeps: CredentialRouteDeps | null,
 ): ReturnType<typeof Bun.serve> {
+  // Listen on every interface so kubelet httpGet probes can hit the pod IP.
+  // Credential CRUD, metadata, and log export stay loopback-only: assistant
+  // and gateway in this pod call http://localhost:<CES_HEALTH_PORT>.
   const server = Bun.serve({
     port,
-    async fetch(req) {
+    async fetch(req, httpServer) {
       const url = new URL(req.url);
       if (url.pathname === "/healthz") {
         return new Response(JSON.stringify({ status: "ok" }), {
@@ -256,7 +260,7 @@ function startHealthServer(
         });
       }
       if (url.pathname === "/readyz") {
-        // Always return 200 — pod readiness must not depend on whether the
+        // Always return 200: pod readiness must not depend on whether the
         // assistant has connected.  When the CES feature flag is off the
         // assistant never connects, and a 503 here would block pod
         // scheduling during dark-launch.  The sidecar can't do useful work
@@ -275,6 +279,11 @@ function startHealthServer(
         );
       }
 
+      const peer = httpServer.requestIP(req)?.address;
+      if (!peer || !isLoopbackAddress(peer)) {
+        return new Response("Not Found", { status: 404 });
+      }
+
       // Credential CRUD routes (only if service token is configured)
       if (credentialDeps) {
         const metadataResponse = await handleMetadataRoute(req);