From c79ab2bd341aa6b5aa20d34f4dd3423b1339f1dc Mon Sep 17 00:00:00 2001
From: marco <marco@drivenets.com>
Date: Tue, 26 May 2026 09:33:44 +0300
Subject: [PATCH] manifests/meshnet: sync to hardened drivenets fork v0.5.0-dn

Pulls in the meshnet-cni release v0.5.0-dn (msupinodn/meshnet-cni#2):

  * Image bumped from upstream
    us-west1-docker.pkg.dev/kne-external/kne/networkop/meshnet:v0.3.2
    to
    public.ecr.aws/drivenets/meshnet-cni:v0.5.0-dn

  * RBAC narrowed: drop verbs ["*"], pin to actually-exercised verbs on
    topologies (get/list/watch/update/patch) and gwirekobjs
    (+create/delete). Adds nodes get/list/watch so the daemon can build
    the peer-IP allowlist used by validatePeerNodeIP / handler.Get to
    reject SSRF attempts via tampered topology CR status.src_ip.

  * Adds explicit cpu limit (2) and aligns memory limits/requests with
    the meshnet-cni source-of-truth manifests.

  * Removes hostIPC: true (unused; meshnet relies on hostNetwork +
    Bidirectional netns mount, not shared IPC).

This lets internal docs use the same install URL with drivenets/ in
place of openconfig/ and get the hardened version automatically:

  kubectl apply -f \
    https://raw.githubusercontent.com/drivenets/kne/refs/heads/main/manifests/meshnet/grpc/manifest.yaml

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 manifests/meshnet/grpc/manifest.yaml  | 34 +++++++++++++++++++++------
 manifests/meshnet/vxlan/manifest.yaml | 34 +++++++++++++++++++++------
 2 files changed, 54 insertions(+), 14 deletions(-)

diff --git a/manifests/meshnet/grpc/manifest.yaml b/manifests/meshnet/grpc/manifest.yaml
index a49fa5ce..3a299b99 100644
--- a/manifests/meshnet/grpc/manifest.yaml
+++ b/manifests/meshnet/grpc/manifest.yaml
@@ -221,13 +221,31 @@ metadata:
     app: meshnet
   name: meshnet-clusterrole
 rules:
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get", "list", "watch"]
 - apiGroups:
   - networkop.co.uk
   resources:
   - topologies
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+  - patch
+- apiGroups:
+  - networkop.co.uk
+  resources:
   - gwirekobjs
   verbs:
-  - '*'
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
 - apiGroups:
   - networkop.co.uk
   resources:
@@ -235,7 +253,9 @@ rules:
   - gwirekobjs/spec
   - gwirekobjs/status
   verbs:
-  - '*'
+  - get
+  - update
+  - patch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -293,15 +313,16 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
-        image: us-west1-docker.pkg.dev/kne-external/kne/networkop/meshnet:v0.3.2
+        image: public.ecr.aws/drivenets/meshnet-cni:v0.5.0-dn
         imagePullPolicy: IfNotPresent
         name: meshnet
         resources:
           limits:
-            memory: 512Mi
+            cpu: "2"
+            memory: 10G
           requests:
-            cpu: 50m
-            memory: 256Mi
+            cpu: 200m
+            memory: 1G
         securityContext:
           privileged: true
         volumeMounts:
@@ -312,7 +333,6 @@ spec:
         - mountPath: /var/run/netns
           mountPropagation: Bidirectional
           name: var-run-netns
-      hostIPC: true
       hostNetwork: true
       hostPID: true
       nodeSelector:
diff --git a/manifests/meshnet/vxlan/manifest.yaml b/manifests/meshnet/vxlan/manifest.yaml
index 0346ed42..d9f808bb 100644
--- a/manifests/meshnet/vxlan/manifest.yaml
+++ b/manifests/meshnet/vxlan/manifest.yaml
@@ -221,13 +221,31 @@ metadata:
     app: meshnet
   name: meshnet-clusterrole
 rules:
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get", "list", "watch"]
 - apiGroups:
   - networkop.co.uk
   resources:
   - topologies
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+  - patch
+- apiGroups:
+  - networkop.co.uk
+  resources:
   - gwirekobjs
   verbs:
-  - '*'
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
 - apiGroups:
   - networkop.co.uk
   resources:
@@ -235,7 +253,9 @@ rules:
   - gwirekobjs/spec
   - gwirekobjs/status
   verbs:
-  - '*'
+  - get
+  - update
+  - patch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -293,15 +313,16 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
-        image: us-west1-docker.pkg.dev/kne-external/kne/networkop/meshnet:v0.3.2
+        image: public.ecr.aws/drivenets/meshnet-cni:v0.5.0-dn
         imagePullPolicy: IfNotPresent
         name: meshnet
         resources:
           limits:
-            memory: 512Mi
+            cpu: "2"
+            memory: 10G
           requests:
-            cpu: 50m
-            memory: 256Mi
+            cpu: 200m
+            memory: 1G
         securityContext:
           privileged: true
         volumeMounts:
@@ -312,7 +333,6 @@ spec:
         - mountPath: /var/run/netns
           mountPropagation: Bidirectional
           name: var-run-netns
-      hostIPC: true
       hostNetwork: true
       hostPID: true
       nodeSelector: