[release-4.19] OCPBUGS-86727: Prevent SSRF via FQDN-typed EndpointSlices

[MrSanketkumar]

The OpenShift Router previously did not validate backend destinations resolved from FQDN-typed EndpointSlices. This allowed the usage of invalid EndpointSlices to target hostnames that resolves to restricted IPs (like the cloud metadata service at 169.254.169.254).

This commit disables the usage of EndpointSlices of type FQDN, and add validations on Endpoints to check if a restricted IP is being used before adding them to HAProxy endpoints Backend.

The implementation and disabling the usage of FQDN-backed endpoints is based on the following:

• RFE-2832 to implement support for ExternalName was considered and rejected due to security concerns, so OpenShift today does not support officially the usage of FQDN-based endpoints on router
• OCPBUGS-55506 relates to a mistake caused by the customer that caused unavailability and not the need to support FQDN-based names
• The behavior of an endpointslice of type FQDN is deprecated on Kubernetes
• The behavior of an endpointslice using an address that is not IPv4 or IPv6 (eg.: hostname) is unespecified by Kubernetes and has no usage.
• The hostname field on endpointslice is not used on router

This way, there is a common understanding that the usage of FQDN based addresses on Router was a mistake, and disabling it is the right fix.

Additional validations of the IP address on the generated endpointnt array is added to guarantee that no invalid nor restricted IP is used.

Backported : #819

[openshift-ci-robot]

@MrSanketkumar: This pull request references Jira Issue OCPBUGS-86727, which is invalid:

• expected dependent Jira Issue OCPBUGS-86728 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is ASSIGNED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

The OpenShift Router previously did not validate backend destinations resolved from FQDN-typed EndpointSlices. This allowed the usage of invalid EndpointSlices to target hostnames that resolves to restricted IPs (like the cloud metadata service at 169.254.169.254).

This commit disables the usage of EndpointSlices of type FQDN, and add validations on Endpoints to check if a restricted IP is being used before adding them to HAProxy endpoints Backend.

The implementation and disabling the usage of FQDN-backed endpoints is based on the following:

• RFE-2832 to implement support for ExternalName was considered and rejected due to security concerns, so OpenShift today does not support officially the usage of FQDN-based endpoints on router
• OCPBUGS-55506 relates to a mistake caused by the customer that caused unavailability and not the need to support FQDN-based names
• The behavior of an endpointslice of type FQDN is deprecated on Kubernetes
• The behavior of an endpointslice using an address that is not IPv4 or IPv6 (eg.: hostname) is unespecified by Kubernetes and has no usage.
• The hostname field on endpointslice is not used on router

This way, there is a common understanding that the usage of FQDN based addresses on Router was a mistake, and disabling it is the right fix.

Additional validations of the IP address on the generated endpointnt array is added to guarantee that no invalid nor restricted IP is used.

Backported : #819

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign knobunc for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 8a46165a-b290-482a-9c02-3225fb61dad9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

@MrSanketkumar: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[UdayYendva]

Cluster Version

oc get clusterversion

Output

NAME      VERSION                                                AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.19.0-0-2026-07-23-082431-test-ci-ln-b4pl7yb-latest   True        False         55m     Cluster version is 4.19.0-0-2026-07-23-082431-test-ci-ln-b4pl7yb-latest

---

SSRF Protection Validation - EndpointSlice Verification Results

Test Environment Setup

Create test namespace and service

oc create namespace ssrf-test

oc -n ssrf-test create service clusterip metadata-svc --tcp=80:80

oc -n ssrf-test patch svc metadata-svc --type=json \
-p='[{"op":"remove","path":"/spec/selector"}]'

Create route

CLUSTER_DOMAIN=$(oc get ingresses.config cluster -o jsonpath='{.spec.domain}')

oc -n ssrf-test expose svc metadata-svc \
--hostname=ssrf-test.${CLUSTER_DOMAIN}

Save URL

TEST_URL="http://ssrf-test.${CLUSTER_DOMAIN}/latest/meta-data/"

---

Test 1: FQDN EndpointSlice (Layer 1)

EndpointSlice

 cat <<EOF | oc apply -f -
apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
  name: test-fqdn
  namespace: ssrf-test
  labels:
    kubernetes.io/service-name: metadata-svc
addressType: FQDN
endpoints:
  - addresses:
      - "metadata.google.internal"
ports:
  - port: 80
EOF
Warning: spec.addressType: FQDN endpoints are deprecated
endpointslice.discovery.k8s.io/test-fqdn created

Verification

curl -s -o /dev/null -w "%{http_code}" $TEST_URL
503
 
oc -n openshift-ingress logs deployment/router-default | grep "unsupported address type"pe"
Found 2 pods, using pod/router-default-6fc447f4c5-2qpxz
I0717 06:18:42.188302       1 converter.go:18] "msg"="Skipping EndpointSlice with unsupported address type" "addressType"="FQDN" "logger"="endpointsubset" "name"="test-fqdn" "namespace"="ssrf-test"

---

Test 2: IPv6 Hex Metadata IP (Layer 2 Pass 2)

EndpointSlice

cat <<EOF | oc apply -f -
apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
  name: test-ipv6-metadata-hex
  namespace: ssrf-test
  labels:
    kubernetes.io/service-name: metadata-svc
addressType: IPv6
endpoints:
  - addresses:
      - "::a9fe:a9fe"
ports:
  - port: 80
EOF
endpointslice.discovery.k8s.io/test-ipv6-metadata-hex created

Verification

curl -s -o /dev/null -w "%{http_code}" $TEST_URL
503

oc -n openshift-ingress logs deployment/router-default | grep "restricted" | grep "a9fe"fe"
**Found 2 pods, using pod/router-default-6fc447f4c5-2qpxz
E0717 06:22:45.976337       1 extended_validator.go:70] "msg"="Skipping endpoint address with restricted or invalid IP" "error"="IP address 169.254.169.254 is a restricted link-local IP" "address"="::a9fe:a9fe" "logger"="controller"**

---

Test 3: IPv6 Hex Loopback (Layer 2 Pass 2)

EndpointSlice

cat <<EOF | oc apply -f -
apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
  name: test-ipv6-loopback-hex
  namespace: ssrf-test
  labels:
    kubernetes.io/service-name: metadata-svc
addressType: IPv6
endpoints:
  - addresses:
      - "::7f00:1"
ports:
  - port: 80
EOF
endpointslice.discovery.k8s.io/test-ipv6-loopback-hex created

Verification

curl -s -o /dev/null -w "%{http_code}" $TEST_URL
503

oc -n openshift-ingress logs deployment/router-default | grep "restricted" | grep "7f00"
Found 2 pods, using pod/router-default-6fc447f4c5-2qpxz
E0717 06:25:35.243202       1 extended_validator.go:70] "msg"="Skipping endpoint address with restricted or invalid IP" "error"="IP address 127.0.0.1 is a restricted loopback IP" "address"="::7f00:1" "logger"="controller"

---

Test 4: AWS IPv6 IMDS (Layer 2 Pass 1)

EndpointSlice

cat <<EOF | oc apply -f -
apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
  name: test-aws-ipv6-imds
  namespace: ssrf-test
  labels:
    kubernetes.io/service-name: metadata-svc
addressType: IPv6
endpoints:
  - addresses:
      - "fd00:ec2::254"
ports:
  - port: 80
EOF
endpointslice.discovery.k8s.io/test-aws-ipv6-imds created

Verification

curl -s -o /dev/null -w "%{http_code}" $TEST_URL
503

oc -n openshift-ingress logs deployment/router-default | grep "restricted" | grep "fd00"
Found 2 pods, using pod/router-default-6fc447f4c5-2qpxz
E0717 06:27:50.255380       1 extended_validator.go:70] "msg"="Skipping endpoint address with restricted or invalid IP" "error"="IP address fd00:ec2::254 is a restricted cloud metadata IP" "address"="fd00:ec2::254" "logger"="controller"

---

Test 5: IPv6 Loopback (Layer 2 Pass 1)

EndpointSlice

apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
  name: test-ipv6-loopback
  namespace: ssrf-test
  labels:
    kubernetes.io/service-name: metadata-svc
addressType: IPv6
endpoints:
  - addresses:
      - "::1"
ports:
  - port: 80

Verification

oc apply -f test-ipv6-loopback.yaml

curl -s -o /dev/null -w "%{http_code}" $TEST_URL

oc -n openshift-ingress logs deployment/router-default | grep "restricted" | grep "::1"

Output

Reason:
::1 is a reserved IPv6 loopback address.

Router log:
No output because EndpointSlice was not created.

---

Test 6: IPv6 Link-Local (Layer 2 Pass 1)

EndpointSlice

apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
  name: test-ipv6-linklocal
  namespace: ssrf-test
  labels:
    kubernetes.io/service-name: metadata-svc
addressType: IPv6
endpoints:
  - addresses:
      - "fe80::1"
ports:
  - port: 80

Verification

oc apply -f test-ipv6-linklocal.yaml

curl -s -o /dev/null -w "%{http_code}" $TEST_URL

oc -n openshift-ingress logs deployment/router-default | grep "restricted" | grep "fe80"

Output

Reason:
fe80::1 is a reserved IPv6 link-local address.

Router log:
No output because EndpointSlice was not created.

---

Test 7: IPv6 Multicast (Layer 2 Pass 1)

EndpointSlice

apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
  name: test-ipv6-multicast
  namespace: ssrf-test
  labels:
    kubernetes.io/service-name: metadata-svc
addressType: IPv6
endpoints:
  - addresses:
      - "ff02::1"
ports:
  - port: 80

Verification

oc apply -f test-ipv6-multicast.yaml

curl -s -o /dev/null -w "%{http_code}" $TEST_URL

oc -n openshift-ingress logs deployment/router-default | grep "restricted" | grep "ff02"

Output

Reason:
ff02::1 is a reserved multicast address.

Router log:
No output because EndpointSlice was not created.

---

Test 8: IPv6 Unspecified (Layer 2 Pass 1)

EndpointSlice

apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
  name: test-ipv6-unspecified
  namespace: ssrf-test
  labels:
    kubernetes.io/service-name: metadata-svc
addressType: IPv6
endpoints:
  - addresses:
      - "::"
ports:
  - port: 80

Verification

oc apply -f test-ipv6-unspecified.yaml

curl -s -o /dev/null -w "%{http_code}" $TEST_URL

oc -n openshift-ingress logs deployment/router-default | grep "restricted" | grep "unspecified"

Output

Reason:
:: is a reserved IPv6 unspecified address.

Router log:
No output because EndpointSlice was not created.

---

Test 9: Valid IPv6 Pass-Through

EndpointSlice

cat <<EOF | oc apply -f -
apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
  name: test-valid-ipv6
  namespace: ssrf-test
  labels:
    kubernetes.io/service-name: metadata-svc
addressType: IPv6
endpoints:
  - addresses:
      - "2001:db8::1"
ports:
  - port: 80
EOF
endpointslice.discovery.k8s.io/test-valid-ipv6 created

Verification

oc -n openshift-ingress logs deployment/router-default | grep "restricted" | grep "2001"
Found 2 pods, using pod/router-default-6fc447f4c5-2qpxz (EXPECTED)
Expected Results:
No log line found regarding this address being restricted.
The router accepts it as a valid backend.

---

Test 10: Normal Application Regression Test

oc -n ssrf-test new-app --image=openshift/hello-openshift --name=hello
oc -n ssrf-test expose svc hello --hostname=hello-test.${CLUSTER_DOMAIN}
# Wait for pod to be ready
oc -n ssrf-test wait --for=condition=ready pod -l app=hello --timeout=60s
--> Found container image 7af3297 (8 years old) from Docker Hub for "openshift/hello-openshift"

    * An image stream tag will be created as "hello:latest" that will track this image

--> Creating resources ...
    imagestream.image.openshift.io "hello" created
    deployment.apps "hello" created
    service "hello" created
--> Success
    Application is not exposed. You can expose services to the outside world by executing one or more of the commands below:
     'oc expose service/hello' 
    Run 'oc status' to view your app.
route.route.openshift.io/hello exposed

Verification

curl -s http://hello-test.${CLUSTER_DOMAIN}
Hello OpenShift!

Note

Kubernetes/OpenShift prevent the creation of EndpointSlices that reference special-purpose IP address ranges, including loopback (127.0.0.0/8, ::1/128), unspecified (0.0.0.0, ::), multicast (224.0.0.0/4, ff00::/8), and other non-routable address ranges such as link-local addresses (169.254.0.0/16, fe80::/10) because of the built-in validation implemented by Kubernetes/OpenShift.

Tests 5–8 are blocked by Kubernetes/OpenShift built-in EndpointSlice validation before reaching the router SSRF validation logic.

/verified by ci

[openshift-ci-robot]

@UdayYendva: This PR has been marked as verified by ci.

Details

In response to this:

Cluster Version

oc get clusterversion

Output

NAME      VERSION                                                AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.19.0-0-2026-07-23-082431-test-ci-ln-b4pl7yb-latest   True        False         55m     Cluster version is 4.19.0-0-2026-07-23-082431-test-ci-ln-b4pl7yb-latest

---

SSRF Protection Validation - EndpointSlice Verification Results

Test Environment Setup

Create test namespace and service

oc create namespace ssrf-test

oc -n ssrf-test create service clusterip metadata-svc --tcp=80:80

oc -n ssrf-test patch svc metadata-svc --type=json \
-p='[{"op":"remove","path":"/spec/selector"}]'

Create route

CLUSTER_DOMAIN=$(oc get ingresses.config cluster -o jsonpath='{.spec.domain}')

oc -n ssrf-test expose svc metadata-svc \
--hostname=ssrf-test.${CLUSTER_DOMAIN}

Save URL

TEST_URL="http://ssrf-test.${CLUSTER_DOMAIN}/latest/meta-data/"

---

Test 1: FQDN EndpointSlice (Layer 1)

EndpointSlice

cat <<EOF | oc apply -f -
apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
 name: test-fqdn
 namespace: ssrf-test
 labels:
   kubernetes.io/service-name: metadata-svc
addressType: FQDN
endpoints:
 - addresses:
     - "metadata.google.internal"
ports:
 - port: 80
EOF
Warning: spec.addressType: FQDN endpoints are deprecated
endpointslice.discovery.k8s.io/test-fqdn created

Verification

curl -s -o /dev/null -w "%{http_code}" $TEST_URL
503

oc -n openshift-ingress logs deployment/router-default | grep "unsupported address type"pe"
Found 2 pods, using pod/router-default-6fc447f4c5-2qpxz
I0717 06:18:42.188302       1 converter.go:18] "msg"="Skipping EndpointSlice with unsupported address type" "addressType"="FQDN" "logger"="endpointsubset" "name"="test-fqdn" "namespace"="ssrf-test"

---

Test 2: IPv6 Hex Metadata IP (Layer 2 Pass 2)

EndpointSlice

cat <<EOF | oc apply -f -
apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
 name: test-ipv6-metadata-hex
 namespace: ssrf-test
 labels:
   kubernetes.io/service-name: metadata-svc
addressType: IPv6
endpoints:
 - addresses:
     - "::a9fe:a9fe"
ports:
 - port: 80
EOF
endpointslice.discovery.k8s.io/test-ipv6-metadata-hex created

Verification

curl -s -o /dev/null -w "%{http_code}" $TEST_URL
503

oc -n openshift-ingress logs deployment/router-default | grep "restricted" | grep "a9fe"fe"
**Found 2 pods, using pod/router-default-6fc447f4c5-2qpxz
E0717 06:22:45.976337       1 extended_validator.go:70] "msg"="Skipping endpoint address with restricted or invalid IP" "error"="IP address 169.254.169.254 is a restricted link-local IP" "address"="::a9fe:a9fe" "logger"="controller"**

---

Test 3: IPv6 Hex Loopback (Layer 2 Pass 2)

EndpointSlice

cat <<EOF | oc apply -f -
apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
 name: test-ipv6-loopback-hex
 namespace: ssrf-test
 labels:
   kubernetes.io/service-name: metadata-svc
addressType: IPv6
endpoints:
 - addresses:
     - "::7f00:1"
ports:
 - port: 80
EOF
endpointslice.discovery.k8s.io/test-ipv6-loopback-hex created

Verification

curl -s -o /dev/null -w "%{http_code}" $TEST_URL
503

oc -n openshift-ingress logs deployment/router-default | grep "restricted" | grep "7f00"
Found 2 pods, using pod/router-default-6fc447f4c5-2qpxz
E0717 06:25:35.243202       1 extended_validator.go:70] "msg"="Skipping endpoint address with restricted or invalid IP" "error"="IP address 127.0.0.1 is a restricted loopback IP" "address"="::7f00:1" "logger"="controller"

---

Test 4: AWS IPv6 IMDS (Layer 2 Pass 1)

EndpointSlice

cat <<EOF | oc apply -f -
apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
 name: test-aws-ipv6-imds
 namespace: ssrf-test
 labels:
   kubernetes.io/service-name: metadata-svc
addressType: IPv6
endpoints:
 - addresses:
     - "fd00:ec2::254"
ports:
 - port: 80
EOF
endpointslice.discovery.k8s.io/test-aws-ipv6-imds created

Verification

curl -s -o /dev/null -w "%{http_code}" $TEST_URL
503

oc -n openshift-ingress logs deployment/router-default | grep "restricted" | grep "fd00"
Found 2 pods, using pod/router-default-6fc447f4c5-2qpxz
E0717 06:27:50.255380       1 extended_validator.go:70] "msg"="Skipping endpoint address with restricted or invalid IP" "error"="IP address fd00:ec2::254 is a restricted cloud metadata IP" "address"="fd00:ec2::254" "logger"="controller"

---

Test 5: IPv6 Loopback (Layer 2 Pass 1)

EndpointSlice

apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
 name: test-ipv6-loopback
 namespace: ssrf-test
 labels:
   kubernetes.io/service-name: metadata-svc
addressType: IPv6
endpoints:
 - addresses:
     - "::1"
ports:
 - port: 80

Verification

oc apply -f test-ipv6-loopback.yaml

curl -s -o /dev/null -w "%{http_code}" $TEST_URL

oc -n openshift-ingress logs deployment/router-default | grep "restricted" | grep "::1"

Output

Reason:
::1 is a reserved IPv6 loopback address.

Router log:
No output because EndpointSlice was not created.

---

Test 6: IPv6 Link-Local (Layer 2 Pass 1)

EndpointSlice

apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
 name: test-ipv6-linklocal
 namespace: ssrf-test
 labels:
   kubernetes.io/service-name: metadata-svc
addressType: IPv6
endpoints:
 - addresses:
     - "fe80::1"
ports:
 - port: 80

Verification

oc apply -f test-ipv6-linklocal.yaml

curl -s -o /dev/null -w "%{http_code}" $TEST_URL

oc -n openshift-ingress logs deployment/router-default | grep "restricted" | grep "fe80"

Output

Reason:
fe80::1 is a reserved IPv6 link-local address.

Router log:
No output because EndpointSlice was not created.

---

Test 7: IPv6 Multicast (Layer 2 Pass 1)

EndpointSlice

apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
 name: test-ipv6-multicast
 namespace: ssrf-test
 labels:
   kubernetes.io/service-name: metadata-svc
addressType: IPv6
endpoints:
 - addresses:
     - "ff02::1"
ports:
 - port: 80

Verification

oc apply -f test-ipv6-multicast.yaml

curl -s -o /dev/null -w "%{http_code}" $TEST_URL

oc -n openshift-ingress logs deployment/router-default | grep "restricted" | grep "ff02"

Output

Reason:
ff02::1 is a reserved multicast address.

Router log:
No output because EndpointSlice was not created.

---

Test 8: IPv6 Unspecified (Layer 2 Pass 1)

EndpointSlice

apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
 name: test-ipv6-unspecified
 namespace: ssrf-test
 labels:
   kubernetes.io/service-name: metadata-svc
addressType: IPv6
endpoints:
 - addresses:
     - "::"
ports:
 - port: 80

Verification

oc apply -f test-ipv6-unspecified.yaml

curl -s -o /dev/null -w "%{http_code}" $TEST_URL

oc -n openshift-ingress logs deployment/router-default | grep "restricted" | grep "unspecified"

Output

Reason:
:: is a reserved IPv6 unspecified address.

Router log:
No output because EndpointSlice was not created.

---

Test 9: Valid IPv6 Pass-Through

EndpointSlice

cat <<EOF | oc apply -f -
apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
 name: test-valid-ipv6
 namespace: ssrf-test
 labels:
   kubernetes.io/service-name: metadata-svc
addressType: IPv6
endpoints:
 - addresses:
     - "2001:db8::1"
ports:
 - port: 80
EOF
endpointslice.discovery.k8s.io/test-valid-ipv6 created

Verification

oc -n openshift-ingress logs deployment/router-default | grep "restricted" | grep "2001"
Found 2 pods, using pod/router-default-6fc447f4c5-2qpxz (EXPECTED)
Expected Results:
No log line found regarding this address being restricted.
The router accepts it as a valid backend.

---

Test 10: Normal Application Regression Test

oc -n ssrf-test new-app --image=openshift/hello-openshift --name=hello
oc -n ssrf-test expose svc hello --hostname=hello-test.${CLUSTER_DOMAIN}
# Wait for pod to be ready
oc -n ssrf-test wait --for=condition=ready pod -l app=hello --timeout=60s
--> Found container image 7af3297 (8 years old) from Docker Hub for "openshift/hello-openshift"

   * An image stream tag will be created as "hello:latest" that will track this image

--> Creating resources ...
   imagestream.image.openshift.io "hello" created
   deployment.apps "hello" created
   service "hello" created
--> Success
   Application is not exposed. You can expose services to the outside world by executing one or more of the commands below:
    'oc expose service/hello' 
   Run 'oc status' to view your app.
route.route.openshift.io/hello exposed

Verification

curl -s http://hello-test.${CLUSTER_DOMAIN}
Hello OpenShift!

Note

Kubernetes/OpenShift prevent the creation of EndpointSlices that reference special-purpose IP address ranges, including loopback (127.0.0.0/8, ::1/128), unspecified (0.0.0.0, ::), multicast (224.0.0.0/4, ff00::/8), and other non-routable address ranges such as link-local addresses (169.254.0.0/16, fe80::/10) because of the built-in validation implemented by Kubernetes/OpenShift.

Tests 5–8 are blocked by Kubernetes/OpenShift built-in EndpointSlice validation before reaching the router SSRF validation logic.

/verified by ci

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.