chisel-operator
chisel-operator copied to clipboard
Cross-namespace ExitNodeProvisioner selection inside LB service still tries to find ENP in same namespace as the service itself
If the service's provisioner selection is namespace/provisioner
, the ExitNode deployed will be in the service's namespace, but unprovisionable because it's not namespace/provisioner
too, and the provisioner is not in the same namespace
How to reproduce
- Create ENP object in a namespace, e.g
foo
namedbaz
- Create another LoadBalancer Service in namespace
bar
, with annotation pointing tofoo/baz
, AKA ENPfoo
inbaz
Expected result
ExitNode should be inside bar
, but annotation should point to foo/baz
. Instead it points to just baz
, but we don't have bar/baz
as an ENP
This may also allow someone to hijack an Exit Node's ENP by simply creating a new ENP at bar/baz