ci: add dl.k8s.io to egress policy allowlist for toolchain (#533)

Azure · Oct 19, 2024 · eb5326e · eb5326e
1 parent 4ce57d9
commit eb5326e
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 3 deletions.
diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
@@ -23,8 +23,10 @@ jobs:
       with:
         disable-telemetry: true
         egress-policy: block
-        allowed-endpoints: >
+        allowed-endpoints: > # dl.k8s.io is for 1.25 CI only
+          *.dl.k8s.io:443
           api.github.com:443
+          dl.k8s.io:443
           coveralls.io:443
           github.com:443
           objects.githubusercontent.com:443

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -15,8 +15,10 @@ jobs:
       with:
         disable-telemetry: true
         egress-policy: block
-        allowed-endpoints: >
+        allowed-endpoints: > # dl.k8s.io is for 1.25 CI only
+          *.dl.k8s.io:443
           api.github.com:443
+          dl.k8s.io:443
           github.com:443
           objects.githubusercontent.com:443
           proxy.golang.org:443

diff --git a/hack/toolchain.sh b/hack/toolchain.sh
@@ -41,7 +41,7 @@ kubebuilder() {
     if [[ "${K8S_VERSION}" = "1.25.x" ]] && [[ "$OSTYPE" == "linux"* ]]; then
         for binary in 'kube-apiserver' 'kubectl'; do
             rm $KUBEBUILDER_ASSETS/$binary
-            wget -P $KUBEBUILDER_ASSETS dl.k8s.io/v1.25.16/bin/linux/"${arch}"/${binary}
+            wget -P $KUBEBUILDER_ASSETS https://dl.k8s.io/v1.25.16/bin/linux/"${arch}"/${binary}
             chmod +x $KUBEBUILDER_ASSETS/$binary
         done
     fi