[Low] NetworkPolicyName keeps only 20 bits of hash, so two WorkerPools can map to the same NetworkPolicy #2934

Summary

resources.NetworkPolicyName truncates the WorkerPool name to 30 characters and appends the first 5 hex characters of its SHA-256 (20 bits). The controller applies the policy with client.ForceOwnership, so a second WorkerPool in the same namespace whose name collides takes over the first pool's NetworkPolicy and rewrites its pod selector.

Details

internal/resources/networkpolicy.go#L26-L38:

func NetworkPolicyName(wpName string) string {
	sum := sha256.Sum256([]byte(wpName))
	hash := hex.EncodeToString(sum[:])
	if len(hash) > 5 {
		hash = hash[:5]
	}
	truncated := wpName
	if len(truncated) > 30 {
		truncated = truncated[:30]
	}
	// Trim trailing hyphens to prevent double hyphens when appending "-<hash>".
	truncated = strings.TrimRight(truncated, "-")
	return fmt.Sprintf("substrate-%s-%s", truncated, hash)
}

Applied in cmd/atecontroller/internal/controllers/networkpolicy_controller.go#L81-L85 with client.ForceOwnership.

Two names that share their first 30 characters only need a 20-bit collision, which takes about a million SHA-256 attempts.

Impact

Low: it needs permission to create WorkerPools in the victim pool's namespace. That is already a highly privileged capability (#2084), and NetworkPolicies are namespace-scoped. Accidental collisions are also possible with long, similar pool names. Either way, the result is that the victim pool's workers lose router-only ingress isolation.

Suggested fix

Use at least 10 hex characters (40 bits) of the hash, or derive the name from the WorkerPool UID. Before applying, refuse to take over a NetworkPolicy whose ate.dev/worker-pool label or owner reference names a different pool.