Feat: ConfigMap-driven workflow HTTP denylist and SSRF hardening

[roguepikachu]

Description of your changes

Adds ConfigMap-driven HTTP denylist support on top of the default private-address / SSRF hardening for workflow HTTP requests (request / provider http).

Controllers can load a denylist ConfigMap (denyHosts, denyCIDRs) at startup, watch it for updates, and fail closed on missing/invalid ConfigMaps when the flag is set. Also includes a startup fix so the initial load uses the API reader instead of the cache client (cache is not ready before mgr.Start).

Helm wiring:

• workflow.disableWorkflowHTTP
• workflow.blockPrivateHTTPAddresses
• workflow.httpDeny.configMapName

I have:

• Read and followed KubeVela's contribution process.
• Related Docs updated properly. In a new feature or configuration option, an update to the documentation is necessary.
• Run make reviewable to ensure this PR is ready for review.
• Added backport release-x.y labels to auto-backport this PR if necessary.

How has this code been tested

• Unit tests for pkg/utils/httpguard and HTTP provider deny-host paths.
• k3d pair with KubeVela mainline (fix/ssrf-workflow-http-guard): controllers Ready, ConfigMap reload logged, WorkflowRun to http://blocked.example.com/path failed with blocked SSRF host: blocked.example.com.

Special notes for your reviewer

• Merge this first. KubeVela main and the release backports depend on a published workflow revision that includes these commits.
• Companion KubeVela PR will follow after maintainers cut a private fork / publishable workflow SHA if needed for the CVE timeline.
• Related release PRs (after this lands / is tagged as needed):
  • release-0.6 backport for KubeVela 1.9
  • pin-based branch for KubeVela 1.10 (v0.6.3-0.20250717221743-56b80cee4121)

---

Summary by cubic

Adds default SSRF hardening for workflow HTTP requests with a ConfigMap-driven denylist and strict provider-level enforcement, plus Helm feature gates and a validated CUE ConfigTemplate. Also fixes Docker image builds by including the new HTTP deny wiring.

• New Features

  • pkg/utils/httpguard: blocks link-local and cloud-metadata by default; pre-checks URL host and revalidates redirects; always validates dials (overrides DialContext, wraps custom DialTLSContext) via net.Dialer.Control; disables inherited HTTP proxy; normalizes trailing-dot FQDNs and IPv6 zone IDs; parser rejects schemes/ports/paths/whitespace.
  • ConfigMap denylist (denyCIDRs, denyHosts, supports *.suffix): loaded at startup via API Reader; hot-reloaded; startup fails closed on missing/invalid; later invalid updates keep last good. Configured via --workflow-http-deny-configmap-name; controller namespace from POD_NAMESPACE (defaults to vela-system).
  • Provider integration (pkg/providers/http): SecureTransport enforces policy; DisableWorkflowHTTP blocks all requests; BlockPrivateHTTPAddresses adds RFC1918/ULA blocking; URL host and each redirect are revalidated. Helm values: workflow.disableWorkflowHTTP, workflow.blockPrivateHTTPAddresses, workflow.httpDeny.configMapName.
  • Validated config template: charts/vela-workflow/config-templates/workflow-http-deny.cue with usage in config-templates/README.md; raw ConfigMap remains supported.

• Bug Fixes

  • Dockerfiles copy cmd/http_deny.go and build from ./cmd to fix image build failures.

^{Written for commit b2ce418. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 13 files

<sub>Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[codecov]

Codecov Report

❌ Patch coverage is 27.01754% with 208 lines in your changes missing coverage. Please review.
✅ Project coverage is 24.70%. Comparing base (d7db9c4) to head (b2ce418).
⚠️ Report is 19 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/utils/httpguard/deny_config.go	0.00%	68 Missing ⚠️
pkg/utils/httpguard/deny_source.go	24.35%	56 Missing and 3 partials ⚠️
pkg/utils/httpguard/policy.go	38.94%	35 Missing and 23 partials ⚠️
pkg/providers/http/http.go	31.57%	9 Missing and 4 partials ⚠️
pkg/utils/httpguard/transport.go	60.00%	6 Missing and 4 partials ⚠️

❌ Your patch check has failed because the patch coverage (27.01%) is below the target coverage (70.00%). You can increase the patch coverage or adjust the target coverage.

❗ There is a different number of reports uploaded between BASE (d7db9c4) and HEAD (b2ce418). Click for more details.

HEAD has 1 upload less than BASE

Flag	BASE (d7db9c4)	HEAD (b2ce418)
unit-test	1	0

Additional details and impacted files

@@             Coverage Diff             @@
##             main     #235       +/-   ##
===========================================
- Coverage   62.49%   24.70%   -37.80%     
===========================================
  Files          62       68        +6     
  Lines        4415     5510     +1095     
===========================================
- Hits         2759     1361     -1398     
- Misses       1324     3884     +2560     
+ Partials      332      265       -67     

Flag	Coverage Δ
e2etests	24.70% <27.01%> (?)
unit-test	?

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[cubic-dev-ai]

All reported issues were addressed across 13 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 3 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic</sub>