[alan-bentley-pgh]

---

🤖 written by Claude (start)

Closes #3526

Summary

• Adds a Policies page with an Egress Policies tab: search, a namespace filter and a details page with a "Used by" table.
• Adds a create and edit form that checks the CRD's rules before saving.
• The agent form now picks policies from its namespace, and agent details link to them.
• Adds EgressPolicyService (list, get, create, update, delete) and gives the management role write access to egresspolicies.
• A stale update now returns Aborted from the shared kubecrud path, so the form can ask for a reload.
• An agent whose EgressPoliciesApplied condition is false no longer shows as failed.

Testing

1. In ui/, set ENABLE_MOCK_UI=true in .env, then run yarn dev. Mock mode serves fixtures, not real data.
2. Open /policies. Search, filter by namespace, and open a policy.
3. Create a policy with a wildcard origin and authentication. The form blocks the save.
4. Edit an agent and select the policy. The policy's page lists the agent under "Used by".
5. Delete the policy.

For a real cluster, run scripts/setup-cluster/setup-cluster.sh and repeat with policies applied through kubectl.

---

🤖 written by Claude (end)

[Charlesthebird]

This automated review is a first pass. A manual review will follow once the blockers are addressed.

---

The name check rejects dotted names, so a policy created with kubectl as api.github.com can't be saved from the edit page. The sidebar label and not-found page asks are inline.

⚠️ What I checked

• ✅ Form rules vs the CRD in egresspolicy_types.go: origin pattern, length caps, blocked headers, one of secretKeyRef/actorJwt, audiences, token lifetime, wildcard without auth, 1–64 destinations.
• ✅ Stale save: kubecrud returns Aborted, the form shows the reload prompt, and the mock does the same.
• ✅ Status: EgressPoliciesApplied=False no longer marks an agent failed; old observedGeneration reads as not reported.
• ✅ Agent form caps refs at 16 and drops the field when cleared.
• ✅ RBAC: method policy covers all five RPCs, management role adds write verbs, kubecrud checks auth per call.
• Resource name validation on create and edit.

---

Written by 🤖

[Charlesthebird]

Adding a couple of notes here:

Could the code around “EgressPoliciesPage” and text for that page also be updated to make it match up with the idea that this is a “Policies” page, with a list of "Egress Policies" and then specify that it’s “Create Egress Policy” at the top?

You could use the structure from the agents page to explain the egress policy and what it is, and then include one tab for "Egress Policies". This could be a small simple diagram, and the text here could be concise and match the style from the agents page.

[alan-bentley-pgh]

The section is now a Policies page with one Egress Policies tab, a "Create egress policy" button and a short overview with a diagram, in 7bf0fa82. The tab follows the agents page's ?tab= pattern, and policy pages live under /policies/egress/.

---

🤖 written by Claude

[alan-bentley-pgh]

Re-recorded on a real kind cluster at 7bf0fa82, with real policies, agents and a sandbox template. "Before" is the base UI on the same cluster and data.

• Policies page: sidebar entry, overview diagram, Egress Policies tab, search and namespace filter
• Policy details: Secret name only, and applied state per policy
• Form: a wildcard origin with auth and a Cookie header are rejected, and a dotted-name policy is edited and saved
• Agent form and agent details: the policy select and the policy list
• Delete warning, Not Found entry, and a dotted URL loaded through the image's nginx
• A missing policy no longer marks an agent "Update failed"

reel-full.mp4

Screenshots

Before	After
Before: no Policies page in the sidebar	After: overview with a diagram
—	After: every policy, with origins, auth and Used by
—	After: search by origin finds package-mirrors
—	After: namespace filter shows platform only
Before: no policy details page	After: destinations, Secret name and key only
—	After: Used by, with type, links and applied state
—	After: Applied here, though release-notes also lists a missing policy
Before: no egress policy form	After: a wildcard origin can't use authentication
—	After: Cookie can't carry a credential
—	After: ci-artifacts created and read back
—	After: api.github.com saved with the new destination
Before: no egress policies field on the agent form	After: only kagent policies are offered
—	After: switching to platform offers only warehouse
Before: Details lists no egress policies	After: Details lists the agent's egress policies
Before: no policy to delete	After: deleting an in-use policy warns first
Before: no Policies entry	After: Policies listed on the Not Found page
Before: a dotted policy URL has no page	After: full load of a dotted URL through the image's nginx
Before: a missing egress policy shows as Update failed	After: a missing egress policy no longer marks the agent failed

---

🤖 written by Claude