alasio 7.0.0 → 9.0.0

package/dist/cli/src/manifests/network-policies.js

@@ -1,22 +1,24 @@
-import { COMPUTE_PORT } from "../../../neon/control/branches.js";
+import { COMPUTE_CTL_PORT, COMPUTE_PORT } from "../../../neon/control/branches.js";
 import { BRANCH_FORK_PORT } from "../../../src/branch/names.js";
+import { POOL_LABEL } from "../../../src/binder/names.js";
+import { NET_MODE_LABEL } from "../../../src/kube/sandbox-shape.js";
 import { NODE_AGENT_PORT } from "../../../src/node-agent/names.js";
 import { forksForBranches, sessionsNamespace } from "./alasio.js";
-import { BRANCH_LABEL, COLLECTOR_PORT, collectorRuns, componentName, given, grafanaRuns, labels, MAIN_ENVIRONMENT, NAMESPACE, nodeAgentRuns, RELEASE, selectorLabels, } from "./common.js";
+import { GATEWAY_COMPONENT, SCRAPER_COMPONENT } from "./collector.js";
+import { BRANCH_LABEL, COLLECTOR_PORT, collectorRuns, componentName, given, grafanaRuns, labels, lakeRuns, MAIN_ENVIRONMENT, NAMESPACE, nodeAgentRuns, RELEASE, selectorLabels, } from "./common.js";
 import { replicated } from "./disruption.js";
 import { GOSSIP_PORT } from "./grafana.js";
-import { LAKE_QUERY_PORT } from "./lake.js";
+import { INTAKE_COMPONENT, LAKE_QUERY_PORT, LOADER_COMPONENT, QUERY_COMPONENT, RECONCILE_COMPONENT } from "./lake.js";
+import { LOG, LOG_COMPONENT, LOG_CONTROLLER_PORT, LOG_METRICS_PORT, LOG_PORT } from "./log.js";
+import { WEBHOOK, WEBHOOK_COMPONENT, WEBHOOK_HEALTH_PORT } from "./webhook.js";
 import { BACKUP_COMPONENT, COMPONENTS, FILER, FILER_STORE, GATEWAY, LIFECYCLE_COMPONENT, MASTER, METRICS_PORT, RESTORE_COMPONENTS, RESTORE_SOURCE, VOLUME_SERVER, } from "./object-store.js";
 import { PROXY_PORT } from "./neon.js";
-import { CONTROLLER_POD_LABELS, JOB_POD_SELECTOR, MOUNT_POD_LABELS, NODE_POD_LABELS } from "./juicefs-csi.js";
 import { VALKEY_PORT } from "./valkey.js";
+import { FOLDER_PORT, foldersRun } from "./folders.js";
 import { JUICEFS_ADMIN } from "./workspace-storage.js";
-/** The label of every session's pod, which alasio gives it. */
-const SESSION = { "alasio.dev/workload": "session" };
+import { GATEWAY as SANDBOX_GATEWAY_NAME, GATEWAY_COMPONENT as SANDBOX_GATEWAY_COMPONENT, GATEWAY_PORT as SANDBOX_GATEWAY_PORT, POOL_POD_PORT, RECEIVER, RECEIVER_COMPONENT, sandboxServiceRuns, } from "./sandbox-gateway.js";
 /** The namespace `name`, as a peer's selector. */
 const namespaceNamed = (name) => ({ matchLabels: { "kubernetes.io/metadata.name": name } });
-/** The alasio pod of `environment`, as a peer. */
-const alasioOf = ({ namespace }) => ({ namespaceSelector: namespaceNamed(namespace), podSelector: { matchLabels: selectorLabels("alasio") } });
 /** Every branch environment's namespace, as a peer's selector, by the label each has. */
 const BRANCH_NAMESPACES = { matchExpressions: [{ key: BRANCH_LABEL, operator: "Exists" }] };
 /** The labels of the data stack's pods, which its policy admits each other by. */
@@ -33,62 +35,47 @@ function policy(name, namespace, component, spec) {
     return { apiVersion: "networking.k8s.io/v1", kind: "NetworkPolicy", metadata: { name, namespace, labels: labels(component) }, spec };
 }
 /**
- * Sessions: nothing in or out but bayma from their alasio, its telemetry receiver (the
- * one egress of a session without internet), and, for a session with internet, the
- * public internet, none of the cluster's or its network's private addresses. A branch
- * environment's sessions are its alasio's alone, as main's are main's.
+ * Sessions: nothing in or out of their namespace's pods but what the sandbox service's
+ * pools' policies admit (poolPolicies): a pod of no pool reaches nothing, and nothing it.
  */
 function sessionPolicies(config, environment) {
-    const { blockedCidrs } = config.sessions;
-    const namespace = sessionsNamespace(config, environment);
-    const alasio = alasioOf(environment);
-    return [
-        policy("default-deny", namespace, "session", { podSelector: {}, policyTypes: ["Ingress", "Egress"] }),
-        policy("bayma-from-alasio", namespace, "session", {
-            podSelector: { matchLabels: SESSION },
-            policyTypes: ["Ingress"],
-            ingress: [{ from: [alasio], ports: [{ protocol: "TCP", port: 7290 }] }],
-        }),
-        policy("telemetry-to-alasio", namespace, "session", {
-            podSelector: { matchLabels: SESSION },
-            policyTypes: ["Egress"],
-            egress: [{ to: [alasio], ports: [{ protocol: "TCP", port: config.telemetry.receiverPort }] }],
-        }),
-        policy("full-internet", namespace, "session", {
-            podSelector: { matchLabels: { ...SESSION, "alasio.dev/net-mode": "full" } },
-            policyTypes: ["Egress"],
-            egress: [{ to: [{ ipBlock: { cidr: "0.0.0.0/0", except: [...blockedCidrs] } }] }],
-        }),
-    ];
+    return [policy("default-deny", sessionsNamespace(config, environment), "session", { podSelector: {}, policyTypes: ["Ingress", "Egress"] })];
 }
 /** The object store's parts, of the stack, to each of which partPolicies and gatewayPolicy admit what talks to it alone. */
 const PARTS = [COMPONENTS.gateway, COMPONENTS.master, COMPONENTS.volumeServer, COMPONENTS.filer];
 /** A component of main's, as a peer from any namespace. */
 const ofMain = (component) => ({ namespaceSelector: namespaceNamed(NAMESPACE), podSelector: { matchLabels: selectorLabels(component) } });
+/** The computes' components: a primary's, and its read replica's. */
+const COMPUTES = ["neon-compute", "neon-compute-ro"];
+/** The stack's pods that what talks to each of them alone reaches: the object store's parts, and the log. */
+const APART = [...PARTS, LOG_COMPONENT];
 /**
- * Neon's services, the lake and their jobs reach each other, but the compute, which
- * takes its clients' sessions from main's Neon proxy alone, which every client connects
- * through, neon-control's, which wakes it and counts its sessions, and the collector's
- * scrapes of compute_ctl's metrics. In a branch environment, its lake and compute
- * likewise, but for the scrapes, as the collector scrapes main's compute alone. The object
- * store's parts, of the stack too, are reached as partPolicies and gatewayPolicy say alone.
+ * Neon's services, the lake and their jobs reach each other, but the computes, primary
+ * and read replica, which take their clients' sessions from main's Neon proxy alone,
+ * which every client connects through, and neon-control's, which wakes them and counts
+ * their sessions, and on compute_ctl's port neon-control's, which gives them their specs
+ * anew, and the collector's scraper's scrapes of its metrics. In a branch environment, its
+ * lake and computes likewise, but for the scrapes, as the scraper scrapes main's computes
+ * alone. The object store's parts and the log, of the stack too, are reached as
+ * partPolicies, gatewayPolicy and logPolicy say alone.
  */
 function neonPolicies({ namespace }) {
     return [
         policy(componentName("neon"), namespace, "neon", {
-            podSelector: { matchLabels: STACK, matchExpressions: [{ key: "app.kubernetes.io/component", operator: "NotIn", values: [...PARTS, "neon-compute"] }] },
+            podSelector: { matchLabels: STACK, matchExpressions: [{ key: "app.kubernetes.io/component", operator: "NotIn", values: [...APART, ...COMPUTES] }] },
             policyTypes: ["Ingress"],
             ingress: [{ from: [{ podSelector: { matchLabels: STACK } }] }],
         }),
-        policy(componentName("neon-compute"), namespace, "neon", {
-            podSelector: { matchLabels: selectorLabels("neon-compute") },
+        ...COMPUTES.map((component) => policy(componentName(component), namespace, "neon", {
+            podSelector: { matchLabels: selectorLabels(component) },
             policyTypes: ["Ingress"],
             ingress: [
                 { from: [ofMain("neon-proxy"), ofMain("neon-control")], ports: [{ protocol: "TCP", port: COMPUTE_PORT }] },
-                // The collector scrapes main's compute_ctl alone (collector.ts).
-                ...(namespace === NAMESPACE ? [{ from: [ofMain("collector")], ports: [{ protocol: "TCP", port: 3080 }] }] : []),
+                { from: [ofMain("neon-control")], ports: [{ protocol: "TCP", port: COMPUTE_CTL_PORT }] },
+                // The collector's scraper scrapes main's computes' compute_ctl alone (collector.ts).
+                ...(namespace === NAMESPACE ? [{ from: [ofMain(SCRAPER_COMPONENT)], ports: [{ protocol: "TCP", port: COMPUTE_CTL_PORT }] }] : []),
             ],
-        }),
+        })),
     ];
 }
 /**
@@ -127,30 +114,23 @@ function branchStoragePolicy(config) {
     });
 }
 /**
- * Workspace storage's metadata and data are reached by JuiceFS's own pods alone (its
- * controller, its node service, the mount pods it runs and the Jobs that delete volumes'
- * directories, in the driver's namespace) and alasio's JuiceFS admin pods: Valkey takes no
- * other connection but the stack's collector's, which reads its metrics, and the bundled
- * object store takes theirs on its S3 port beside the stack's own, and Valkey's, whose pod
- * formats the file system. The driver's Jobs are told by no label of their own, so any
- * Job's pod in its namespace is admitted, which the credentials of each still guard.
+ * Workspace storage's metadata and data are reached by JuiceFS's clients alone, alasio's
+ * JuiceFS admin pods, the nodes' mount among them: Valkey takes, beside theirs, the node
+ * agents', which set workspaces' quotas on it, and no other connection but the collector's
+ * scraper's, which reads its metrics; and the bundled object store takes theirs on its S3
+ * port beside the stack's own, and Valkey's, whose pod formats the file system.
  */
 function workspaceStoragePolicies(config) {
-    const driverNamespace = { matchLabels: { "kubernetes.io/metadata.name": config.workspaceStorage.csi.namespace } };
-    const juicefs = [
-        { namespaceSelector: driverNamespace, podSelector: { matchLabels: MOUNT_POD_LABELS } },
-        { namespaceSelector: driverNamespace, podSelector: { matchLabels: CONTROLLER_POD_LABELS } },
-        { namespaceSelector: driverNamespace, podSelector: { matchLabels: NODE_POD_LABELS } },
-        { namespaceSelector: driverNamespace, podSelector: JOB_POD_SELECTOR },
-        { namespaceSelector: { matchLabels: { "kubernetes.io/metadata.name": NAMESPACE } }, podSelector: { matchLabels: JUICEFS_ADMIN } },
-    ];
+    const juicefs = [{ podSelector: { matchLabels: JUICEFS_ADMIN } }];
+    // The node agents, which set workspaces' quotas on the metadata engine, and reach no object store of it.
+    const quotas = nodeAgentRuns(config) ? [NODE_AGENT] : [];
     return [
         policy(componentName("valkey"), NAMESPACE, "valkey", {
             podSelector: { matchLabels: selectorLabels("valkey") },
             policyTypes: ["Ingress"],
             ingress: [
-                { from: juicefs, ports: [{ protocol: "TCP", port: VALKEY_PORT }] },
-                { from: [{ podSelector: { matchLabels: selectorLabels("collector") } }], ports: [{ protocol: "TCP", port: VALKEY_PORT }] },
+                { from: [...juicefs, ...quotas], ports: [{ protocol: "TCP", port: VALKEY_PORT }] },
+                { from: [{ podSelector: { matchLabels: selectorLabels(SCRAPER_COMPONENT) } }], ports: [{ protocol: "TCP", port: VALKEY_PORT }] },
             ],
         }),
         ...(config.objectStore.bundled.enabled
@@ -165,7 +145,7 @@ function workspaceStoragePolicies(config) {
 /**
  * The bundled object store's parts behind its gateways, each reached by what talks to it
  * alone, on its HTTP and gRPC ports (SeaweedFS's gRPC port is the HTTP port's plus 10000),
- * and by the collector on its metrics port:
+ * and by the collector's scraper on its metrics port:
  *
  * - the masters, by each other, in Raft, and by every part that asks them where volumes
  *   are, or registers: the volume servers, the filers, the gateways (whose sidecar makes
@@ -176,17 +156,25 @@ function workspaceStoragePolicies(config) {
  * - the filers, by each other, which follow each other's changes, the gateways, and the
  *   lifecycle pass, which replays their log.
  *
- * The stack's other pods, which reach the store through its gateways, reach none of them.
+ * And each environment's lake's reconciliation, main's and branch environments', reaches the
+ * filers, masters and volume servers on their HTTP ports alone, which it asks whether a file
+ * the store fails a read of has its data still (neon/lake/src/reconcile.ts's gone). The
+ * stack's other pods, which reach the store through its gateways, reach none of them.
  */
 function partPolicies() {
     const of = (component) => ({ podSelector: { matchLabels: selectorLabels(component) } });
     const ports = (http) => [http, http + 10_000].map((port) => ({ protocol: "TCP", port }));
+    const reconciliations = [
+        ofMain(RECONCILE_COMPONENT),
+        { namespaceSelector: BRANCH_NAMESPACES, podSelector: { matchLabels: selectorLabels(RECONCILE_COMPONENT) } },
+    ];
     const part = (name, component, http, from) => policy(name, NAMESPACE, component, {
         podSelector: { matchLabels: selectorLabels(component) },
         policyTypes: ["Ingress"],
         ingress: [
             { from: from.map(of), ports: ports(http) },
-            { from: [of("collector")], ports: [{ protocol: "TCP", port: METRICS_PORT }] },
+            { from: reconciliations, ports: [{ protocol: "TCP", port: http }] },
+            { from: [of(SCRAPER_COMPONENT)], ports: [{ protocol: "TCP", port: METRICS_PORT }] },
         ],
     });
     const { gateway, master, volumeServer, filer } = COMPONENTS;
@@ -200,7 +188,7 @@ function partPolicies() {
  * The bundled object store's gateways take the stack's pods on their S3 port, the
  * store's endpoint (and branch environments' and workspace storage's, as their own
  * policies say); the lifecycle pass alone on their gRPC port, through which it deletes;
- * and the collector alone on their metrics port.
+ * and the collector's scraper alone on their metrics port.
  */
 function gatewayPolicy() {
     return policy(GATEWAY, NAMESPACE, COMPONENTS.gateway, {
@@ -209,13 +197,13 @@ function gatewayPolicy() {
         ingress: [
             { from: [{ podSelector: { matchLabels: STACK } }], ports: [{ protocol: "TCP", port: 8333 }] },
             { from: [{ podSelector: { matchLabels: selectorLabels(LIFECYCLE_COMPONENT) } }], ports: [{ protocol: "TCP", port: 18_333 }] },
-            { from: [{ podSelector: { matchLabels: selectorLabels("collector") } }], ports: [{ protocol: "TCP", port: METRICS_PORT }] },
+            { from: [{ podSelector: { matchLabels: selectorLabels(SCRAPER_COMPONENT) } }], ports: [{ protocol: "TCP", port: METRICS_PORT }] },
         ],
     });
 }
 /**
  * The bundled object store's filer store takes no connection but its filers', the
- * collector's, which reads its metrics, and its backups': it is not of the data stack,
+ * collector's scraper's, which reads its metrics, and its backups': it is not of the data stack,
  * whose pods reach each other. As `alasio restore-filer-store` puts a backup back, the
  * Valkey that serves it is reached by the Job that loads it alone.
  */
@@ -227,26 +215,95 @@ function filerStorePolicies() {
         ingress: [{ from: from.map(of), ports: [{ protocol: "TCP", port: VALKEY_PORT }] }],
     });
     return [
-        valkey(FILER_STORE, COMPONENTS.filerStore, [COMPONENTS.filer, "collector", BACKUP_COMPONENT]),
+        valkey(FILER_STORE, COMPONENTS.filerStore, [COMPONENTS.filer, SCRAPER_COMPONENT, BACKUP_COMPONENT]),
         valkey(RESTORE_SOURCE, RESTORE_COMPONENTS.source, [RESTORE_COMPONENTS.restore]),
     ];
 }
 /**
- * The telemetry collector takes OTLP from alasio, the node agents and folder workspaces'
- * bayma, beside the stack's own pods (neonPolicies), and from branch environments'
- * alasio, compute and lake, and from nothing else: sessions' telemetry reaches it through
- * their alasio's receiver alone.
+ * KEDA's operator, which reads what it scales on: alasio's, or, where the cluster's own KEDA
+ * scales alasio (autoscaling.keda.enabled false), the operator its release manifest
+ * labels, in any namespace.
+ */
+const kedaOperator = (config) => config.autoscaling.keda.enabled
+    ? { podSelector: { matchLabels: selectorLabels("keda-operator") } }
+    : { namespaceSelector: {}, podSelector: { matchLabels: { "app.kubernetes.io/name": "keda-operator" } } };
+/**
+ * The log takes its clients on their port from the collector's gateway, the webhook intake
+ * and the sandbox gateway, which write to it, and the lake's intake, KEDA's operator (kedaOperator), and
+ * each environment's alasio and lake loader, main's and branch environments', which read
+ * it, alone; its controllers' port, and its clients' as its brokers reach each other,
+ * from its own nodes; and its metrics port from the collector's scraper.
+ */
+function logPolicy(config) {
+    const of = (component) => ({ podSelector: { matchLabels: selectorLabels(component) } });
+    const operator = kedaOperator(config);
+    return policy(LOG, NAMESPACE, LOG_COMPONENT, {
+        podSelector: { matchLabels: selectorLabels(LOG_COMPONENT) },
+        policyTypes: ["Ingress"],
+        ingress: [
+            { from: [of(LOG_COMPONENT)], ports: [LOG_PORT, LOG_CONTROLLER_PORT].map((port) => ({ protocol: "TCP", port })) },
+            {
+                from: [
+                    of(GATEWAY_COMPONENT),
+                    of(WEBHOOK_COMPONENT),
+                    ...(sandboxServiceRuns(config) ? [of(SANDBOX_GATEWAY_COMPONENT)] : []),
+                    of(INTAKE_COMPONENT),
+                    operator,
+                    of("alasio"),
+                    of(LOADER_COMPONENT),
+                    { namespaceSelector: BRANCH_NAMESPACES, podSelector: { matchLabels: selectorLabels("alasio") } },
+                    { namespaceSelector: BRANCH_NAMESPACES, podSelector: { matchLabels: selectorLabels(LOADER_COMPONENT) } },
+                ],
+                ports: [{ protocol: "TCP", port: LOG_PORT }],
+            },
+            { from: [of(SCRAPER_COMPONENT)], ports: [{ protocol: "TCP", port: LOG_METRICS_PORT }] },
+        ],
+    });
+}
+/**
+ * The webhook intake takes its port from webhook.sources alone, Telegram's ranges, where it
+ * is on this machine's public address, and from anywhere else: a LoadBalancer Service takes
+ * those alone, and the cluster in Docker is reached from this machine. On the machine, the
+ * policy is what guards the port: what is forwarded to a pod, the policy's controller
+ * accepts ahead of the machine's firewall, which never sees it (cli/src/cluster/node.ts);
+ * the machine itself is admitted to its own pods all the same. It takes its health's port
+ * from the collector's scraper; it reaches the cluster's DNS and the log's brokers alone,
+ * so nothing it is sent can make it reach anything else.
+ */
+function webhookPolicy(config) {
+    const sources = config.webhook.exposure === "hostAddress" ? config.webhook.sources : ["0.0.0.0/0"];
+    return policy(WEBHOOK, NAMESPACE, WEBHOOK_COMPONENT, {
+        podSelector: { matchLabels: selectorLabels(WEBHOOK_COMPONENT) },
+        policyTypes: ["Ingress", "Egress"],
+        ingress: [
+            { from: sources.map((cidr) => ({ ipBlock: { cidr } })), ports: [{ protocol: "TCP", port: config.webhook.port }] },
+            { from: [{ podSelector: { matchLabels: selectorLabels(SCRAPER_COMPONENT) } }], ports: [{ protocol: "TCP", port: WEBHOOK_HEALTH_PORT }] },
+        ],
+        egress: [
+            {
+                to: [{ namespaceSelector: { matchLabels: { "kubernetes.io/metadata.name": "kube-system" } }, podSelector: { matchLabels: { "k8s-app": "kube-dns" } } }],
+                ports: [{ protocol: "UDP", port: 53 }, { protocol: "TCP", port: 53 }],
+            },
+            { to: [{ podSelector: { matchLabels: selectorLabels(LOG_COMPONENT) } }], ports: [{ protocol: "TCP", port: LOG_PORT }] },
+        ],
+    });
+}
+/**
+ * The telemetry collector's gateway takes OTLP from alasio, the node agents, and the sandbox
+ * service's gateway and receiver, beside the stack's own pods (neonPolicies), its scraper
+ * among them, and from branch environments' alasio, compute and lake, and from nothing else:
+ * sessions' and folder instances' telemetry reaches it through a receiver alone, their
+ * alasio's or the sandbox service's.
  */
 function collectorPolicy(config) {
-    const { host } = config;
-    return policy(componentName("collector"), NAMESPACE, "collector", {
-        podSelector: { matchLabels: selectorLabels("collector") },
+    return policy(componentName("collector"), NAMESPACE, GATEWAY_COMPONENT, {
+        podSelector: { matchLabels: selectorLabels(GATEWAY_COMPONENT) },
         policyTypes: ["Ingress"],
         ingress: [{
                 from: [
                     { podSelector: { matchLabels: selectorLabels("alasio") } },
                     ...(nodeAgentRuns(config) ? [NODE_AGENT] : []),
-                    ...(host.enabled ? [{ namespaceSelector: namespaceNamed(host.namespace) }] : []),
+                    ...(sandboxServiceRuns(config) ? [SANDBOX_GATEWAY, SANDBOX_RECEIVER] : []),
                     { namespaceSelector: BRANCH_NAMESPACES, podSelector: { matchLabels: selectorLabels("alasio") } },
                     { namespaceSelector: BRANCH_NAMESPACES, podSelector: { matchLabels: STACK } },
                 ],
@@ -279,20 +336,30 @@ function grafanaPolicies({ sessions, grafana: { scaling } }) {
                 ...(gossip.length > 0 ? [{ to: [grafana], ports: gossip }] : []),
                 CLUSTER_DNS,
                 { to: [{ podSelector: { matchLabels: selectorLabels("neon-proxy") } }], ports: [{ protocol: "TCP", port: PROXY_PORT }] },
-                { to: [{ podSelector: { matchLabels: selectorLabels("lake") } }], ports: [{ protocol: "TCP", port: LAKE_QUERY_PORT }] },
+                { to: [{ podSelector: { matchLabels: selectorLabels(QUERY_COMPONENT) } }], ports: [{ protocol: "TCP", port: LAKE_QUERY_PORT }] },
                 // The addresses sessions with internet may not reach, the cluster's and its network's, are Grafana's too.
                 { to: [{ ipBlock: { cidr: "0.0.0.0/0", except: [...sessions.blockedCidrs] } }], ports: [{ protocol: "TCP", port: 443 }] },
             ],
         }),
         admitted("neon-proxy", PROXY_PORT),
-        admitted("lake", LAKE_QUERY_PORT),
+        admitted(QUERY_COMPONENT, LAKE_QUERY_PORT),
     ];
 }
+/** The lake's readers take KEDA's operator on their query port, which asks any of them how many queries the pool has not answered (their /pool). */
+function lakeQueryPolicy(config) {
+    return policy(componentName(`${QUERY_COMPONENT}-from-autoscaler`), NAMESPACE, QUERY_COMPONENT, {
+        podSelector: { matchLabels: selectorLabels(QUERY_COMPONENT) },
+        policyTypes: ["Ingress"],
+        ingress: [{ from: [kedaOperator(config)], ports: [{ protocol: "TCP", port: LAKE_QUERY_PORT }] }],
+    });
+}
 /**
- * The node agents take alasio's calls, on their API's port, and nothing else; they reach
- * the cluster's DNS, the object store's S3 port, the bundled one's or the operator's at
- * any address, and the collector where it runs, and nothing else. The bundled object
- * store admits them.
+ * The node agents take the sandbox service's gateway's calls alone, which attaches workspaces
+ * and saves and restores sandboxes through them, on their API's port, and nothing else, the
+ * gateway alone holding the token they take (./node-agent.ts); they reach the cluster's
+ * DNS, the object store's S3 port, the bundled one's or the operator's at any address,
+ * workspace storage's metadata engine, which they set workspaces' quotas on, and the collector
+ * where it runs, and nothing else. The bundled object store, and the metadata engine, admit them.
  */
 function nodeAgentPolicies(config) {
     const { bundled, external } = config.objectStore;
@@ -305,10 +372,11 @@ function nodeAgentPolicies(config) {
         policy(componentName("node-agent"), NAMESPACE, "node-agent", {
             ...NODE_AGENT,
             policyTypes: ["Ingress", "Egress"],
-            ingress: [{ from: [{ podSelector: { matchLabels: selectorLabels("alasio") } }], ports: [{ protocol: "TCP", port: NODE_AGENT_PORT }] }],
+            ingress: sandboxServiceRuns(config) ? [{ from: [SANDBOX_GATEWAY], ports: [{ protocol: "TCP", port: NODE_AGENT_PORT }] }] : [],
             egress: [
                 CLUSTER_DNS,
                 objectStore,
+                ...(config.workspaceStorage.enabled ? [{ to: [{ podSelector: { matchLabels: selectorLabels("valkey") } }], ports: [{ protocol: "TCP", port: VALKEY_PORT }] }] : []),
                 ...(collectorRuns(config) ? [{ to: [{ podSelector: { matchLabels: selectorLabels("collector") } }], ports: [{ protocol: "TCP", port: COLLECTOR_PORT }] }] : []),
             ],
         }),
@@ -321,19 +389,103 @@ function nodeAgentPolicies(config) {
             : []),
     ];
 }
+/** The pods of the sandbox service's pools (./sandbox-gateway.ts), free or bound, as a selector: by the label each has of its pool. */
+const POOLED = { matchExpressions: [{ key: POOL_LABEL, operator: "Exists" }] };
+/** The sandbox service's gateway's pods, as a peer. */
+const SANDBOX_GATEWAY = { podSelector: { matchLabels: selectorLabels(SANDBOX_GATEWAY_COMPONENT) } };
+/** The sandbox service's receiver's pods, as a peer. */
+const SANDBOX_RECEIVER = { podSelector: { matchLabels: selectorLabels(RECEIVER_COMPONENT) } };
+/**
+ * The cluster's API server, as an egress rule: its addresses on its ports, as `alasio up`
+ * read them (../api-server.ts); or, where it could not, anywhere, which up warns of.
+ */
+function apiServerRule(apiServer) {
+    if (!apiServer)
+        return {};
+    return { to: apiServer.addresses.map((address) => ({ ipBlock: { cidr: `${address}/32` } })), ports: apiServer.ports.map((port) => ({ protocol: "TCP", port })) };
+}
+/**
+ * The sandbox service's pools' pods (./sandbox-gateway.ts) of `environment`, free or bound:
+ * they take main's gateway alone, on bayma's port, and reach main's receiver alone, on its
+ * port, at the address their binding gives them, and a pod with internet the public internet
+ * beside, none of the cluster's or its network's private addresses, as a session does.
+ */
+function poolPolicies(config, environment) {
+    const namespace = sessionsNamespace(config, environment);
+    return [
+        policy(componentName("sandboxes"), namespace, "session", {
+            podSelector: POOLED,
+            policyTypes: ["Ingress", "Egress"],
+            ingress: [{ from: [{ namespaceSelector: namespaceNamed(NAMESPACE), ...SANDBOX_GATEWAY }], ports: [{ protocol: "TCP", port: POOL_POD_PORT }] }],
+            egress: [{ to: [{ namespaceSelector: namespaceNamed(NAMESPACE), ...SANDBOX_RECEIVER }], ports: [{ protocol: "TCP", port: config.telemetry.receiverPort }] }],
+        }),
+        policy(componentName("sandboxes-full-internet"), namespace, "session", {
+            podSelector: { ...POOLED, matchLabels: { [NET_MODE_LABEL]: "full" } },
+            policyTypes: ["Egress"],
+            egress: [{ to: [{ ipBlock: { cidr: "0.0.0.0/0", except: [...config.sessions.blockedCidrs] } }] }],
+        }),
+    ];
+}
 /**
- * alasio takes no connections but its sessions' telemetry, and, main, where it forks
- * sessions for branch environments, their alasio's asking it to (src/branch/fork.ts).
+ * The sandbox service's gateway and receiver, which take what sandboxes send, and so reach
+ * what they need of the cluster alone:
+ *
+ * - the gateway takes main's alasio and each branch environment's, which bind through it, its own replicas, which pass each
+ *   other what is bound on the pods each holds, and KEDA's operator (kedaOperator), which asks
+ *   it how many binds wait for a pool, on its port alone; it reaches the cluster's DNS, the
+ *   pools' pods of every environment on bayma's port, the node agents, its replicas, the
+ *   log, which it writes each environment's events to, the collector where it runs, and the
+ *   API server;
+ * - the receiver takes the pools' pods alone, of main's sessions and of branch environments',
+ *   on its port; it reaches the cluster's DNS, the collector where it runs, and the API server.
+ *
+ * The API server is reached at its addresses, as `apiServer` says (apiServerRule).
+ */
+function sandboxServicePolicies(config, apiServer) {
+    const port = config.telemetry.receiverPort;
+    const pools = [
+        { namespaceSelector: namespaceNamed(sessionsNamespace(config, MAIN_ENVIRONMENT)), podSelector: POOLED },
+        { namespaceSelector: BRANCH_NAMESPACES, podSelector: POOLED },
+    ];
+    // Folder conversations' instances, which the gateway binds and the receiver takes the telemetry of as of the pools' pods.
+    const folders = foldersRun(config) ? [{ namespaceSelector: namespaceNamed(config.host.namespace), podSelector: POOLED }] : [];
+    const collector = collectorRuns(config)
+        ? [{ to: [{ podSelector: { matchLabels: selectorLabels(GATEWAY_COMPONENT) } }], ports: [{ protocol: "TCP", port: COLLECTOR_PORT }] }]
+        : [];
+    return [
+        policy(SANDBOX_GATEWAY_NAME, NAMESPACE, SANDBOX_GATEWAY_COMPONENT, {
+            ...SANDBOX_GATEWAY,
+            policyTypes: ["Ingress", "Egress"],
+            ingress: [{
+                    from: [{ podSelector: { matchLabels: selectorLabels("alasio") } }, { namespaceSelector: BRANCH_NAMESPACES, podSelector: { matchLabels: selectorLabels("alasio") } }, SANDBOX_GATEWAY, kedaOperator(config)],
+                    ports: [{ protocol: "TCP", port: SANDBOX_GATEWAY_PORT }],
+                }],
+            egress: [
+                CLUSTER_DNS,
+                { to: [...pools, ...folders], ports: [{ protocol: "TCP", port: POOL_POD_PORT }] },
+                { to: [NODE_AGENT], ports: [{ protocol: "TCP", port: NODE_AGENT_PORT }] },
+                { to: [SANDBOX_GATEWAY], ports: [{ protocol: "TCP", port: SANDBOX_GATEWAY_PORT }] },
+                // The log, its events written to it.
+                { to: [{ podSelector: { matchLabels: selectorLabels(LOG_COMPONENT) } }], ports: [{ protocol: "TCP", port: LOG_PORT }] },
+                ...collector,
+                apiServerRule(apiServer),
+            ],
+        }),
+        policy(RECEIVER, NAMESPACE, RECEIVER_COMPONENT, {
+            ...SANDBOX_RECEIVER,
+            policyTypes: ["Ingress", "Egress"],
+            ingress: [{ from: [...pools, ...folders], ports: [{ protocol: "TCP", port }] }],
+            egress: [CLUSTER_DNS, ...collector, apiServerRule(apiServer)],
+        }),
+    ];
+}
+/**
+ * alasio takes no connections but, main, where it forks sessions for branch environments,
+ * their alasio's asking it to (src/branch/fork.ts).
  */
 function alasioPolicy(config, environment) {
     const forks = environment.branch === null && forksForBranches(config);
     const ingress = [
-        ...(config.sessions.enabled
-            ? [{
-                    from: [{ namespaceSelector: namespaceNamed(sessionsNamespace(config, environment)), podSelector: { matchLabels: SESSION } }],
-                    ports: [{ protocol: "TCP", port: config.telemetry.receiverPort }],
-                }]
-            : []),
         ...(forks
             ? [{ from: [{ namespaceSelector: BRANCH_NAMESPACES, podSelector: { matchLabels: selectorLabels("alasio") } }], ports: [{ protocol: "TCP", port: BRANCH_FORK_PORT }] }]
             : []),
@@ -346,33 +498,44 @@ function alasioPolicy(config, environment) {
 }
 /**
  * The NetworkPolicies of the alasio of `environment`, unless they are turned off: main's,
- * and those that admit branch environments to what of main's they share; or a branch
+ * and those that admit branch environments to what of main's they share, what reaches its
+ * API server reaching it where `apiServer` says (../api-server.ts); or a branch
  * environment's own.
  */
-export function networkPolicyObjects(config, environment = MAIN_ENVIRONMENT) {
+export function networkPolicyObjects(config, environment = MAIN_ENVIRONMENT, apiServer = null) {
     if (!config.networkPolicies.enabled)
         return [];
     const { sessions, host } = config;
     if (environment.branch !== null) {
-        return [...(sessions.enabled ? sessionPolicies(config, environment) : []), alasioPolicy(config, environment), ...neonPolicies(environment)];
+        return [
+            ...(sessions.enabled ? sessionPolicies(config, environment) : []),
+            ...(sandboxServiceRuns(config) ? poolPolicies(config, environment) : []),
+            alasioPolicy(config, environment),
+            ...neonPolicies(environment),
+        ];
     }
     return [
         ...(sessions.enabled ? sessionPolicies(config, environment) : []),
-        // Folder workspaces' bayma is reached by alasio alone; what it reaches is the machine's.
-        ...(host.enabled
-            ? [policy("bayma-from-alasio", host.namespace, "folder-bayma", {
+        // Folder conversations' instances are reached by the sandbox gateway alone, which binds them; what they reach is the machine's.
+        ...(foldersRun(config)
+            ? [policy("folders-from-gateway", host.namespace, "folder-bayma", {
+                    // Every pod of the namespace, which none but a folder instance's may be.
                     podSelector: {},
                     policyTypes: ["Ingress"],
-                    ingress: [{ from: [alasioOf(environment)], ports: [{ protocol: "TCP", port: 7290 }] }],
+                    ingress: [{ from: [{ namespaceSelector: namespaceNamed(NAMESPACE), ...SANDBOX_GATEWAY }], ports: [{ protocol: "TCP", port: FOLDER_PORT }] }],
                 })]
             : []),
         alasioPolicy(config, environment),
         ...(config.neon.enabled ? [...neonPolicies(environment), proxyPolicy(), branchStoragePolicy(config)] : []),
-        ...(config.neon.enabled && config.objectStore.bundled.enabled ? [gatewayPolicy(), ...partPolicies(), ...filerStorePolicies()] : []),
+        ...(config.objectStore.bundled.enabled ? [gatewayPolicy(), ...partPolicies(), ...filerStorePolicies()] : []),
+        logPolicy(config),
+        webhookPolicy(config),
         ...(collectorRuns(config) ? [collectorPolicy(config)] : []),
         ...(grafanaRuns(config) ? grafanaPolicies(config) : []),
+        ...(lakeRuns(config) ? [lakeQueryPolicy(config)] : []),
         ...(config.workspaceStorage.enabled ? workspaceStoragePolicies(config) : []),
         ...(nodeAgentRuns(config) ? nodeAgentPolicies(config) : []),
+        ...(sandboxServiceRuns(config) ? [...poolPolicies(config, environment), ...sandboxServicePolicies(config, apiServer)] : []),
     ];
 }
 //# sourceMappingURL=network-policies.js.map