From 79bb7b9eb958a27d1e08fffad4fc36f926cf8331 Mon Sep 17 00:00:00 2001 From: Cesar Wong Date: Wed, 15 Apr 2026 13:51:38 -0400 Subject: [PATCH] fix(support): add AWS ISO domains to konnectivity IsCloudAPI The konnectivity proxy was missing AWS ISO (classified) region domains from its cloud API detection. This prevented the ingress operator from adding these domains to the NO_PROXY list, blocking direct communication with endpoints in those namespaces. Add the following AWS ISO domain suffixes: - .c2s.ic.gov (AWS ISO / C2S) - .hci.ic.gov (AWS ISO / HCI) - .sc2s.sgov.gov (AWS ISO-B / SC2S) Fixes: OCPBUGS-77040 Co-Authored-By: Claude Opus 4.6 --- support/konnectivityproxy/dialer.go | 4 ++++ support/konnectivityproxy/dialer_test.go | 20 ++++++++++++++++++++ 2 files changed, 24 insertions(+) diff --git a/support/konnectivityproxy/dialer.go b/support/konnectivityproxy/dialer.go index c487d70e811b..cfe3a307d851 100644 --- a/support/konnectivityproxy/dialer.go +++ b/support/konnectivityproxy/dialer.go @@ -457,6 +457,7 @@ func (kh *konnectivityHealth) isHealthy() bool { // actually end up proxying or not depends on the env for this binary. // DNS domains. The API list can be found below: // AWS: https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints +// AWS ISO: https://docs.aws.amazon.com/general/latest/gr/aws-iso_region.html // AZURE: https://docs.microsoft.com/en-us/rest/api/azure/#how-to-call-azure-rest-apis-with-curl // IBMCLOUD: https://cloud.ibm.com/apidocs/iam-identity-token-api#endpoints func (p *konnectivityProxy) IsCloudAPI(host string) bool { @@ -475,6 +476,9 @@ func (p *konnectivityProxy) IsCloudAPI(host string) bool { return false } if strings.HasSuffix(host, ".amazonaws.com") || + strings.HasSuffix(host, ".c2s.ic.gov") || + strings.HasSuffix(host, ".hci.ic.gov") || + strings.HasSuffix(host, ".sc2s.sgov.gov") || strings.HasSuffix(host, ".microsoftonline.com") || strings.HasSuffix(host, ".azure.com") || strings.HasSuffix(host, ".cloud.ibm.com") { diff --git a/support/konnectivityproxy/dialer_test.go b/support/konnectivityproxy/dialer_test.go index f3662c594c90..ed49d4a2a936 100644 --- a/support/konnectivityproxy/dialer_test.go +++ b/support/konnectivityproxy/dialer_test.go @@ -306,6 +306,26 @@ func TestIsCloudAPI(t *testing.T) { description: "IBM Cloud API endpoints should be detected", }, + // Valid AWS ISO cloud API hosts + { + name: "When host is valid AWS ISO C2S API it should return true", + host: "s3.c2s.ic.gov", + expected: true, + description: "AWS ISO C2S endpoints should be detected", + }, + { + name: "When host is valid AWS ISO HCI API it should return true", + host: "iam.hci.ic.gov", + expected: true, + description: "AWS ISO HCI endpoints should be detected", + }, + { + name: "When host is valid AWS ISO-B SC2S API it should return true", + host: "s3.sc2s.sgov.gov", + expected: true, + description: "AWS ISO-B SC2S endpoints should be detected", + }, + // False positive scenarios that were fixed { name: "When host contains azure.com but is not azure.com it should return false",