Require explicit canonical network readiness targets

crates/lazaret-core/src/records/configuration.rs

@@ -22,6 +22,31 @@ pub struct NetworkConfigurationV1 {
     pub default_deny: Vec<String>,
 }
 
+#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct NetworkReadinessConfigurationV1 {
+    #[serde(default)]
+    pub denied: Vec<NetworkProbeTargetConfigurationV1>,
+    #[serde(default)]
+    pub permitted: Vec<NetworkProbeTargetConfigurationV1>,
+    #[serde(default)]
+    pub dns: Vec<DnsProbeTargetConfigurationV1>,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct NetworkProbeTargetConfigurationV1 {
+    pub address: String,
+    pub port: u16,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct DnsProbeTargetConfigurationV1 {
+    pub resolver: String,
+    pub query: String,
+}
+
 #[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
 #[serde(rename_all = "kebab-case")]
 pub enum VolumeKind {
@@ -81,6 +106,8 @@ pub struct ProfileConfigurationV1 {
     #[serde(default)]
     pub deny_egress: Vec<String>,
     #[serde(default)]
+    pub readiness: NetworkReadinessConfigurationV1,
+    #[serde(default)]
     pub env: BTreeMap<String, String>,
     #[serde(default)]
     pub volumes: Vec<VolumeConfigurationV1>,
@@ -194,6 +221,26 @@ pub struct ConfigurationFingerprintRecordV1 {
     pub volumes: Vec<ResolvedVolume>,
     pub effective_allow_prefixes: Vec<([u8; 4], u8)>,
     pub effective_deny_prefixes: Vec<([u8; 4], u8)>,
+    pub network_readiness: ResolvedNetworkReadinessV1,
     pub escalation_enabled: bool,
     pub auto_approval_rules: Vec<ResolvedAutoApprovalRule>,
 }
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct ResolvedNetworkReadinessV1 {
+    pub denied: Vec<ResolvedNetworkProbeTargetV1>,
+    pub permitted: Vec<ResolvedNetworkProbeTargetV1>,
+    pub dns: Vec<ResolvedDnsProbeTargetV1>,
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
+pub struct ResolvedNetworkProbeTargetV1 {
+    pub address: [u8; 4],
+    pub port: u16,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
+pub struct ResolvedDnsProbeTargetV1 {
+    pub resolver: [u8; 4],
+    pub query: String,
+}