Repository navigation
Bind the routed Email probe source candidate in the read-only observer #5432
Description
🤖 Generated by the Agentic Engineer
Description
The production Email observer successfully checked local health and the node host-address candidate while Kubernetes remained unready. Node routing evidence identifies a separate local Cilium source candidate that the observer does not bind or classify. Its current result therefore cannot decide whether the routed candidate matches the application's stored access rules.
Expected outcome
Extend the existing opt-in, read-only observer to bind the mail Pod's CiliumNode to the same Node identity before and after collection, and classify its single local Cilium address against the same complete bounded access-rule inventory. Emit only fixed classifications. Missing, ambiguous, stale or changed metadata must be inconclusive. Keep the existing host result and credential/output restrictions.
Acceptance criteria
- A regression reproduces the unclassified routed-address candidate, and malformed, ambiguous and changed bindings fail closed.
- Current-head CI and substantive review pass, followed by protected merge.
- A first-attempt main-only production observation records the bounded result, or explicitly records an inconclusive result and its limits.
- No application rule, probe, network policy or production workload is changed by the observer. A candidate match is not represented as wire-source proof or recovery.
Part of #5412. The parent remains open for root-cause repair and sustained service recovery.
Metadata
Metadata
Assignees
Labels
Type
Fields
Priority
Effort
Projects
- Status
Activity
chore: agent-claim #5432 nonce=b9a1621e765831ecd042acf2432bb9c0
chore: agent-claim #5432 nonce=dd20114f68d64098b635d300298cb5c2
devantler commentedon Oct 27, 2026
The extended read-only observer has a complete bound production result. Run 40471085937, first attempt at reviewed main
8a91c6e5a99da1a3dfb9a79977eaa41c3491f63c, returned:MAIL_PROBE_PATHS=ALL_LOCAL_TARGETS_HTTP_200MAIL_ACCESS_STATE=OTHER_ACTIVE_STORED_BLOCKSMAIL_CILIUM_ACCESS_STATE=STORED_CILIUM_BLOCK_MATCHMAIL_KUBERNETES_READY=FALSEThe fixed local health requests passed, while the bound Cilium candidate matched an active stored block with no matching allow override. Pod/runtime, Node, CiliumNode, targets, public configuration and credential-input bindings remained stable through collection. This is an observed problem (exit 1). The candidate matches the separately observed node routing choice; neither metadata nor stored rules alone attest an actual socket source or the application's in-memory cache.
The next repair decision needs the matching rule's origin and scope. No access rule, probe, network policy, workload or mailbox data was changed by this observation. #5412 remains open for root-cause repair, sustained readiness and authenticated external administration. Main validation passed for this observer revision; the separate release publication authorization failure is under investigation and is not cleared by that validation.