From e99749585ab94eb6f36c449311acc68a69d94337 Mon Sep 17 00:00:00 2001
From: Timofei Larkin <lllamnyp@gmail.com>
Date: Wed, 5 Nov 2025 15:06:24 +0300
Subject: [PATCH] [vm] Remove egress restrictions on non-isolated vm

## What this PR does

Virtual machines with a public IP have a network policy that explicitly
allows them to communicate with the external internet. When created in a
non-isolated tenant that has no network policies by default, creating
such a policy, instead, **restricts** egress traffic originating from
the VM from going anywhere, __except__ the outside internet. Instead of
allowing VMs to communicate with the outside internet via a network
policy, this patch now adds a label to the VMs by which they will be
targetted by Cozystack's default network policies, if such policies
exist. When no policies are present, the VM's egress traffic will no
longer be policed. Resolves #1601.

### Release note

```release-note
[virtual-machine,vm-instance] Remove the egress network policy from
virtual machines and govern egress traffic by default network policies
instead, resolving the bug in #1601.
```

Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
---
 packages/apps/tenant/templates/networkpolicy.yaml | 15 +++++++++++++++
 .../apps/virtual-machine/templates/service.yaml   |  3 ---
 packages/apps/virtual-machine/templates/vm.yaml   |  3 ++-
 packages/apps/vm-instance/templates/service.yaml  |  3 ---
 packages/apps/vm-instance/templates/vm.yaml       |  3 ++-
 5 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/packages/apps/tenant/templates/networkpolicy.yaml b/packages/apps/tenant/templates/networkpolicy.yaml
index 84df6d11..269df3b8 100644
--- a/packages/apps/tenant/templates/networkpolicy.yaml
+++ b/packages/apps/tenant/templates/networkpolicy.yaml
@@ -34,6 +34,21 @@ spec:
       - world
 ---
 apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-world-egress
+  namespace: {{ include "tenant.name" . }}
+spec:
+  endpointSelector:
+    matchExpressions:
+    - key: policy.cozystack.io/allow-world-egress
+      operator: In
+      values: ["true"]
+  egress:
+  - toEntities:
+      - world
+---
+apiVersion: cilium.io/v2
 kind: CiliumClusterwideNetworkPolicy
 metadata:
   name: {{ include "tenant.name" . }}-egress
diff --git a/packages/apps/virtual-machine/templates/service.yaml b/packages/apps/virtual-machine/templates/service.yaml
index d9d77825..7fd9644c 100644
--- a/packages/apps/virtual-machine/templates/service.yaml
+++ b/packages/apps/virtual-machine/templates/service.yaml
@@ -49,6 +49,3 @@ spec:
           - port: {{ quote . }}
           {{- end }}
     {{- end }}
-  egress:
-  - toEntities:
-      - world
diff --git a/packages/apps/virtual-machine/templates/vm.yaml b/packages/apps/virtual-machine/templates/vm.yaml
index 1d7652e8..a24ac8b3 100644
--- a/packages/apps/virtual-machine/templates/vm.yaml
+++ b/packages/apps/virtual-machine/templates/vm.yaml
@@ -62,9 +62,10 @@ spec:
   template:
     metadata:
       annotations:
-        policy.cozystack.io/allow-external-communication: "false"
         kubevirt.io/allow-pod-bridge-network-live-migration: "true"
       labels:
+        policy.cozystack.io/allow-external-communication: "false"
+        policy.cozystack.io/allow-world-egress: "true"
         {{- include "virtual-machine.labels" . | nindent 8 }}
     spec:
       domain:
diff --git a/packages/apps/vm-instance/templates/service.yaml b/packages/apps/vm-instance/templates/service.yaml
index d1ef4df9..b6b52789 100644
--- a/packages/apps/vm-instance/templates/service.yaml
+++ b/packages/apps/vm-instance/templates/service.yaml
@@ -49,6 +49,3 @@ spec:
         - port: {{ quote . }}
         {{- end }}
     {{- end }}
-  egress:
-  - toEntities:
-      - world
diff --git a/packages/apps/vm-instance/templates/vm.yaml b/packages/apps/vm-instance/templates/vm.yaml
index e64ec2f6..a4292c73 100644
--- a/packages/apps/vm-instance/templates/vm.yaml
+++ b/packages/apps/vm-instance/templates/vm.yaml
@@ -26,9 +26,10 @@ spec:
   template:
     metadata:
       annotations:
-        policy.cozystack.io/allow-external-communication: "false"
         kubevirt.io/allow-pod-bridge-network-live-migration: "true"
       labels:
+        policy.cozystack.io/allow-external-communication: "false"
+        policy.cozystack.io/allow-world-egress: "true"
         {{- include "virtual-machine.labels" . | nindent 8 }}
     spec:
       domain: