From 3083aec42baca7348ef1d974006af612b1f73cd4 Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Wed, 25 Dec 2024 12:51:00 -0300
Subject: [PATCH 01/33] Add policy to exclude env vars.

---
 mirrord/operator/src/crd/policy.rs | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/mirrord/operator/src/crd/policy.rs b/mirrord/operator/src/crd/policy.rs
index 4560055da07..c24aa06be02 100644
--- a/mirrord/operator/src/crd/policy.rs
+++ b/mirrord/operator/src/crd/policy.rs
@@ -1,3 +1,5 @@
+use std::collections::HashSet;
+
 use kube::CustomResource;
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
@@ -51,6 +53,8 @@ pub struct MirrordPolicySpec {
     // TODO: make the k8s list type be set/map to prevent duplicates.
     /// List of features and operations blocked by this policy.
     pub block: Vec<BlockedFeature>,
+
+    pub env_vars_exclude: HashSet<String>,
 }
 
 /// Custom cluster-wide resource for policies that limit what mirrord features users can use.
@@ -78,6 +82,8 @@ pub struct MirrordClusterPolicySpec {
     // TODO: make the k8s list type be set/map to prevent duplicates.
     /// List of features and operations blocked by this policy.
     pub block: Vec<BlockedFeature>,
+
+    pub env_vars_exclude: HashSet<String>,
 }
 
 #[test]

From 6182f1ff1cf211869b902ec061646b6a4611a5f7 Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Wed, 25 Dec 2024 15:28:47 -0300
Subject: [PATCH 02/33] docs

---
 mirrord/operator/src/crd/policy.rs | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/mirrord/operator/src/crd/policy.rs b/mirrord/operator/src/crd/policy.rs
index c24aa06be02..36c623e9b80 100644
--- a/mirrord/operator/src/crd/policy.rs
+++ b/mirrord/operator/src/crd/policy.rs
@@ -54,6 +54,10 @@ pub struct MirrordPolicySpec {
     /// List of features and operations blocked by this policy.
     pub block: Vec<BlockedFeature>,
 
+    /// List of environment variables that should be excluded when using mirrord.
+    ///
+    /// These environment variables won't be retieved from the target even if the user
+    /// specifies them in their `feature.env.include` mirrord config.
     pub env_vars_exclude: HashSet<String>,
 }
 
@@ -83,6 +87,10 @@ pub struct MirrordClusterPolicySpec {
     /// List of features and operations blocked by this policy.
     pub block: Vec<BlockedFeature>,
 
+    /// List of environment variables that should be excluded when using mirrord.
+    ///
+    /// These environment variables won't be retieved from the target even if the user
+    /// specifies them in their `feature.env.include` mirrord config.
     pub env_vars_exclude: HashSet<String>,
 }
 

From 4aac1180c14a9d4ea91a84f28f33563f1bae6ce4 Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Wed, 25 Dec 2024 15:30:04 -0300
Subject: [PATCH 03/33] changelog

---
 changelog.d/+103-policy-env-vars-exclude.added.md | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 changelog.d/+103-policy-env-vars-exclude.added.md

diff --git a/changelog.d/+103-policy-env-vars-exclude.added.md b/changelog.d/+103-policy-env-vars-exclude.added.md
new file mode 100644
index 00000000000..2e1bde95ebd
--- /dev/null
+++ b/changelog.d/+103-policy-env-vars-exclude.added.md
@@ -0,0 +1 @@
+Add policy to exclude env vars.

From 864de0b921430bfc85284bdab50338fb80f1534c Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Wed, 25 Dec 2024 16:03:39 -0300
Subject: [PATCH 04/33] fix tests

---
 tests/src/operator/policies.rs | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/tests/src/operator/policies.rs b/tests/src/operator/policies.rs
index 829157d5d02..605f14f3653 100644
--- a/tests/src/operator/policies.rs
+++ b/tests/src/operator/policies.rs
@@ -127,6 +127,7 @@ fn block_steal_without_qualifiers() -> PolicyTestCase {
                 target_path: None,
                 selector: None,
                 block: vec![BlockedFeature::Steal],
+                env_vars_exclude: Default::default(),
             },
         ),
         service_b_can_steal: No,
@@ -145,6 +146,7 @@ fn block_steal_with_path_pattern() -> PolicyTestCase {
                 target_path: Some("*-service-a*".into()),
                 selector: None,
                 block: vec![BlockedFeature::Steal],
+                env_vars_exclude: Default::default(),
             },
         ),
         service_b_can_steal: EvenWithoutFilter,
@@ -163,6 +165,7 @@ fn block_unfiltered_steal_with_path_pattern() -> PolicyTestCase {
                 target_path: Some("*-service-a*".into()),
                 selector: None,
                 block: vec![BlockedFeature::StealWithoutFilter],
+                env_vars_exclude: Default::default(),
             },
         ),
         service_b_can_steal: EvenWithoutFilter,
@@ -181,6 +184,7 @@ fn block_unfiltered_steal_with_deployment_path_pattern() -> PolicyTestCase {
                 target_path: Some("deploy/*service-a*".into()),
                 selector: None,
                 block: vec![BlockedFeature::StealWithoutFilter],
+                env_vars_exclude: Default::default(),
             },
         ),
         service_a_can_steal: OnlyWithFilter,
@@ -205,6 +209,7 @@ fn block_steal_with_label_selector() -> PolicyTestCase {
                     )])),
                 }),
                 block: vec![BlockedFeature::Steal],
+                env_vars_exclude: Default::default(),
             },
         ),
         service_b_can_steal: EvenWithoutFilter,
@@ -230,6 +235,7 @@ fn block_steal_with_unmatching_policy() -> PolicyTestCase {
                     )])),
                 }),
                 block: vec![BlockedFeature::Steal],
+                env_vars_exclude: Default::default(),
             },
         ),
         service_b_can_steal: EvenWithoutFilter,
@@ -370,6 +376,7 @@ pub async fn create_cluster_policy_and_try_to_mirror(
                 target_path: Some("*-service-a*".into()),
                 selector: None,
                 block: vec![BlockedFeature::Mirror],
+                env_vars_exclude: Default::default(),
             },
         ),
     )

From eb375dba055a99c6b87743fa9c874924ab24574f Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Thu, 26 Dec 2024 18:22:42 -0300
Subject: [PATCH 05/33] Make policy optional for backwards compat.

---
 mirrord/operator/src/crd/policy.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/mirrord/operator/src/crd/policy.rs b/mirrord/operator/src/crd/policy.rs
index 36c623e9b80..8014a6c4d3d 100644
--- a/mirrord/operator/src/crd/policy.rs
+++ b/mirrord/operator/src/crd/policy.rs
@@ -58,7 +58,7 @@ pub struct MirrordPolicySpec {
     ///
     /// These environment variables won't be retieved from the target even if the user
     /// specifies them in their `feature.env.include` mirrord config.
-    pub env_vars_exclude: HashSet<String>,
+    pub env_vars_exclude: Option<HashSet<String>>,
 }
 
 /// Custom cluster-wide resource for policies that limit what mirrord features users can use.
@@ -91,7 +91,7 @@ pub struct MirrordClusterPolicySpec {
     ///
     /// These environment variables won't be retieved from the target even if the user
     /// specifies them in their `feature.env.include` mirrord config.
-    pub env_vars_exclude: HashSet<String>,
+    pub env_vars_exclude: Option<HashSet<String>>,
 }
 
 #[test]

From 14f79ffa24b0908242429333041b41ee3d94ea4d Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Thu, 26 Dec 2024 18:23:51 -0300
Subject: [PATCH 06/33] typo

---
 mirrord/operator/src/crd/policy.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mirrord/operator/src/crd/policy.rs b/mirrord/operator/src/crd/policy.rs
index 8014a6c4d3d..6fcc2fdd533 100644
--- a/mirrord/operator/src/crd/policy.rs
+++ b/mirrord/operator/src/crd/policy.rs
@@ -89,7 +89,7 @@ pub struct MirrordClusterPolicySpec {
 
     /// List of environment variables that should be excluded when using mirrord.
     ///
-    /// These environment variables won't be retieved from the target even if the user
+    /// These environment variables won't be retrieved from the target even if the user
     /// specifies them in their `feature.env.include` mirrord config.
     pub env_vars_exclude: Option<HashSet<String>>,
 }

From 391cb02c5bd773ac48c3a44879a2ad3934e22d14 Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Thu, 26 Dec 2024 18:24:14 -0300
Subject: [PATCH 07/33] other typo

---
 mirrord/operator/src/crd/policy.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mirrord/operator/src/crd/policy.rs b/mirrord/operator/src/crd/policy.rs
index 6fcc2fdd533..60cbf84a5ea 100644
--- a/mirrord/operator/src/crd/policy.rs
+++ b/mirrord/operator/src/crd/policy.rs
@@ -56,7 +56,7 @@ pub struct MirrordPolicySpec {
 
     /// List of environment variables that should be excluded when using mirrord.
     ///
-    /// These environment variables won't be retieved from the target even if the user
+    /// These environment variables won't be retrieved from the target even if the user
     /// specifies them in their `feature.env.include` mirrord config.
     pub env_vars_exclude: Option<HashSet<String>>,
 }

From 49194e7162e7adefad75ea78626b63668b49d143 Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Mon, 30 Dec 2024 11:45:06 -0300
Subject: [PATCH 08/33] default serde and more explicit docs

---
 mirrord/operator/src/crd/policy.rs | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/mirrord/operator/src/crd/policy.rs b/mirrord/operator/src/crd/policy.rs
index 60cbf84a5ea..9515639f0f6 100644
--- a/mirrord/operator/src/crd/policy.rs
+++ b/mirrord/operator/src/crd/policy.rs
@@ -91,7 +91,12 @@ pub struct MirrordClusterPolicySpec {
     ///
     /// These environment variables won't be retrieved from the target even if the user
     /// specifies them in their `feature.env.include` mirrord config.
-    pub env_vars_exclude: Option<HashSet<String>>,
+    ///
+    /// Variable names can be matched using `*` and `?` where `?` matches exactly one occurrence of
+    /// any character and `*` matches arbitrary many (including zero) occurrences of any character,
+    /// e.g. `DATABASE_*` will match `DATABASE_URL` and `DATABASE_PORT`.
+    #[serde(default)]
+    pub env_vars_exclude: HashSet<String>,
 }
 
 #[test]

From ba65c1c19345c63fbf173ebe6d8d3f388b2aafda Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Tue, 31 Dec 2024 11:29:02 -0300
Subject: [PATCH 09/33] fix mismatching policy

---
 mirrord/operator/src/crd/policy.rs | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/mirrord/operator/src/crd/policy.rs b/mirrord/operator/src/crd/policy.rs
index 9515639f0f6..eaf894d4739 100644
--- a/mirrord/operator/src/crd/policy.rs
+++ b/mirrord/operator/src/crd/policy.rs
@@ -58,7 +58,12 @@ pub struct MirrordPolicySpec {
     ///
     /// These environment variables won't be retrieved from the target even if the user
     /// specifies them in their `feature.env.include` mirrord config.
-    pub env_vars_exclude: Option<HashSet<String>>,
+    ///
+    /// Variable names can be matched using `*` and `?` where `?` matches exactly one occurrence of
+    /// any character and `*` matches arbitrary many (including zero) occurrences of any character,
+    /// e.g. `DATABASE_*` will match `DATABASE_URL` and `DATABASE_PORT`.
+    #[serde(default)]
+    pub env_vars_exclude: HashSet<String>,
 }
 
 /// Custom cluster-wide resource for policies that limit what mirrord features users can use.

From dd4844e8ddda38d513e61732dfca224e60ce3636 Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Tue, 31 Dec 2024 11:57:26 -0300
Subject: [PATCH 10/33] make it look more like config

---
 Cargo.lock                         | 682 ++++++++++++++---------------
 mirrord/operator/src/crd/policy.rs |  23 +-
 2 files changed, 342 insertions(+), 363 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 97d292477e5..2cfeea353a5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -65,7 +65,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e01ed3140b2f8d422c68afa1ed2e85d996ea619c988ac834d255db32138655cb"
 dependencies = [
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -182,7 +182,7 @@ dependencies = [
  "actix-router",
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -309,9 +309,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.94"
+version = "1.0.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1fd03a028ef38ba2276dce7e33fcd6369c158a1bca17946c4b1b701891c1ff7"
+checksum = "34ac096ce696dc2fcabef30516bb13c0a68a11d30131d3df6f04711467681b04"
 
 [[package]]
 name = "apple-codesign"
@@ -358,7 +358,7 @@ dependencies = [
  "reqwest 0.11.27",
  "ring",
  "scroll",
- "semver 1.0.23",
+ "semver 1.0.24",
  "serde",
  "serde_json",
  "serde_yaml",
@@ -440,7 +440,7 @@ checksum = "965c2d33e53cb6b267e148a4cb0760bc01f4904c1cd4bb4002a085bb016d1490"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
  "synstructure 0.13.1",
 ]
 
@@ -463,7 +463,7 @@ checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -478,9 +478,9 @@ dependencies = [
 
 [[package]]
 name = "async-broadcast"
-version = "0.7.1"
+version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20cd0e2e25ea8e5f7e9df04578dc6cf5c83577fd09b1a46aaf5c85e1c33f2a7e"
+checksum = "435a87a52755b8f27fcf321ac4f04b2802e337c8c4872923137471ec39c37532"
 dependencies = [
  "event-listener",
  "event-listener-strategy",
@@ -508,7 +508,7 @@ checksum = "3b43422f69d8ff38f95f1b2bb76517c91589a924d1559a0e935d7c8ce0274c11"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -540,7 +540,7 @@ checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -557,7 +557,7 @@ checksum = "721cae7de5c34fbb2acd27e21e6d2cf7b886dce0c27388d46c4e6c47ea4318dd"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -583,9 +583,9 @@ checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
 
 [[package]]
 name = "aws-config"
-version = "1.5.10"
+version = "1.5.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b49afaa341e8dd8577e1a2200468f98956d6eda50bcf4a53246cc00174ba924"
+checksum = "649316840239f4e58df0b7f620c428f5fababbbca2d504488c641534050bd141"
 dependencies = [
  "aws-credential-types",
  "aws-runtime",
@@ -594,7 +594,7 @@ dependencies = [
  "aws-sdk-sts",
  "aws-smithy-async",
  "aws-smithy-http",
- "aws-smithy-json 0.60.7",
+ "aws-smithy-json",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
@@ -625,9 +625,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-rs"
-version = "1.11.1"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f47bb8cc16b669d267eeccf585aea077d0882f4777b1c1f740217885d6e6e5a3"
+checksum = "f409eb70b561706bf8abba8ca9c112729c481595893fd06a2dd9af8ed8441148"
 dependencies = [
  "aws-lc-sys",
  "paste",
@@ -636,24 +636,23 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-sys"
-version = "0.23.1"
+version = "0.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2101df3813227bbaaaa0b04cd61c534c7954b22bd68d399b440be937dc63ff7"
+checksum = "923ded50f602b3007e5e63e3f094c479d9c8a9b42d7f4034e4afe456aa48bfd2"
 dependencies = [
  "bindgen",
  "cc",
  "cmake",
  "dunce",
  "fs_extra",
- "libc",
  "paste",
 ]
 
 [[package]]
 name = "aws-runtime"
-version = "1.4.4"
+version = "1.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5ac934720fbb46206292d2c75b57e67acfc56fe7dfd34fb9a02334af08409ea"
+checksum = "44f6f1124d6e19ab6daf7f2e615644305dc6cb2d706892a8a8c0b98db35de020"
 dependencies = [
  "aws-credential-types",
  "aws-sigv4",
@@ -676,15 +675,15 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-sqs"
-version = "1.50.0"
+version = "1.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d0a1bb53c15b172e67d1ed2576514a998397f91205c475e3278125a98134732"
+checksum = "f9466fd797274f6c55454ea5aac51fc55a9bac6ca2116ed32cfb3134bb3fbcf0"
 dependencies = [
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
  "aws-smithy-http",
- "aws-smithy-json 0.61.1",
+ "aws-smithy-json",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
@@ -698,15 +697,15 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-sso"
-version = "1.50.0"
+version = "1.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05ca43a4ef210894f93096039ef1d6fa4ad3edfabb3be92b80908b9f2e4b4eab"
+checksum = "cb25f7129c74d36afe33405af4517524df8f74b635af8c2c8e91c1552b8397b2"
 dependencies = [
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
  "aws-smithy-http",
- "aws-smithy-json 0.61.1",
+ "aws-smithy-json",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
@@ -720,15 +719,15 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-ssooidc"
-version = "1.51.0"
+version = "1.53.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abaf490c2e48eed0bb8e2da2fb08405647bd7f253996e0f93b981958ea0f73b0"
+checksum = "d03a3d5ef14851625eafd89660a751776f938bf32f309308b20dcca41c44b568"
 dependencies = [
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
  "aws-smithy-http",
- "aws-smithy-json 0.61.1",
+ "aws-smithy-json",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
@@ -742,15 +741,15 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-sts"
-version = "1.51.0"
+version = "1.53.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b68fde0d69c8bfdc1060ea7da21df3e39f6014da316783336deff0a9ec28f4bf"
+checksum = "cf3a9f073ae3a53b54421503063dfb87ff1ea83b876f567d92e8b8d9942ba91b"
 dependencies = [
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
  "aws-smithy-http",
- "aws-smithy-json 0.61.1",
+ "aws-smithy-json",
  "aws-smithy-query",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
@@ -788,9 +787,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-async"
-version = "1.2.1"
+version = "1.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62220bc6e97f946ddd51b5f1361f78996e704677afc518a4ff66b7a72ea1378c"
+checksum = "427cb637d15d63d6f9aae26358e1c9a9c09d5aa490d64b09354c8217cfef0f28"
 dependencies = [
  "futures-util",
  "pin-project-lite",
@@ -817,15 +816,6 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "aws-smithy-json"
-version = "0.60.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4683df9469ef09468dad3473d129960119a0d3593617542b7d52086c8486f2d6"
-dependencies = [
- "aws-smithy-types",
-]
-
 [[package]]
 name = "aws-smithy-json"
 version = "0.61.1"
@@ -847,9 +837,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-runtime"
-version = "1.7.4"
+version = "1.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f20685047ca9d6f17b994a07f629c813f08b5bce65523e47124879e60103d45"
+checksum = "a05dd41a70fc74051758ee75b5c4db2c0ca070ed9229c3df50e9475cda1cb985"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-http",
@@ -862,7 +852,7 @@ dependencies = [
  "http-body 0.4.6",
  "http-body 1.0.1",
  "httparse",
- "hyper 0.14.31",
+ "hyper 0.14.32",
  "hyper-rustls 0.24.2",
  "once_cell",
  "pin-project-lite",
@@ -891,9 +881,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-types"
-version = "1.2.9"
+version = "1.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fbd94a32b3a7d55d3806fe27d98d3ad393050439dd05eb53ece36ec5e3d3510"
+checksum = "38ddc9bd6c28aeb303477170ddd183760a956a03e083b3902a990238a7e3792d"
 dependencies = [
  "base64-simd",
  "bytes",
@@ -952,7 +942,7 @@ dependencies = [
  "http 1.2.0",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-util",
  "itoa",
  "matchit",
@@ -969,7 +959,7 @@ dependencies = [
  "sync_wrapper 1.0.2",
  "tokio",
  "tokio-tungstenite",
- "tower 0.5.1",
+ "tower 0.5.2",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -1017,7 +1007,7 @@ dependencies = [
  "cfg-if",
  "libc",
  "miniz_oxide",
- "object 0.36.5",
+ "object 0.36.7",
  "rustc-demangle",
  "windows-targets 0.52.6",
 ]
@@ -1119,7 +1109,7 @@ dependencies = [
  "regex",
  "rustc-hash 1.1.0",
  "shlex",
- "syn 2.0.90",
+ "syn 2.0.93",
  "which 4.4.2",
 ]
 
@@ -1217,7 +1207,7 @@ dependencies = [
  "hex",
  "http 1.2.0",
  "http-body-util",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-named-pipe",
  "hyper-util",
  "hyperlocal",
@@ -1228,7 +1218,7 @@ dependencies = [
  "serde_json",
  "serde_repr",
  "serde_urlencoded",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
  "tokio-util",
  "tower-service",
@@ -1279,9 +1269,9 @@ dependencies = [
 
 [[package]]
 name = "bstr"
-version = "1.11.0"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a68f1f47cdf0ec8ee4b941b2eee2a80cb796db73118c0dd09ac63fbe405be22"
+checksum = "786a307d683a5bf92e6fd5fd69a7eb613751668d1d8d67d802846dfe367c62c8"
 dependencies = [
  "memchr",
  "serde",
@@ -1306,9 +1296,9 @@ dependencies = [
 
 [[package]]
 name = "bytemuck"
-version = "1.20.0"
+version = "1.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b37c88a63ffd85d15b406896cc343916d7cf57838a847b3a6f2ca5d39a5695a"
+checksum = "ef657dfab802224e671f5818e9a4935f9b1957ed18e58292690cc39e7a4092a3"
 
 [[package]]
 name = "byteorder"
@@ -1390,9 +1380,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.2"
+version = "1.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f34d93e62b03caf570cccc334cbc6c2fceca82f39211051345108adcba3eebdc"
+checksum = "8d6dbb628b8f8555f86d0323c2eb39e3ec81901f4b83e091db8a6a76d316a333"
 dependencies = [
  "jobserver",
  "libc",
@@ -1422,9 +1412,9 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
 [[package]]
 name = "chrono"
-version = "0.4.38"
+version = "0.4.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401"
+checksum = "7e36cc9d416881d2e24f9a963be5fb1cd90966419ac844274161d10488b3e825"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
@@ -1502,9 +1492,9 @@ dependencies = [
 
 [[package]]
 name = "clap_complete"
-version = "4.5.38"
+version = "4.5.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9647a559c112175f17cf724dc72d3645680a883c58481332779192b0d8e7a01"
+checksum = "ac2e663e3e3bed2d32d065a8404024dad306e699a04263ec59919529f803aee9"
 dependencies = [
  "clap",
 ]
@@ -1518,7 +1508,7 @@ dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -1553,15 +1543,15 @@ dependencies = [
 
 [[package]]
 name = "console"
-version = "0.15.8"
+version = "0.15.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e1f83fc076bd6dd27517eacdf25fef6c4dfe5f1d7448bafaaf3a26f13b5e4eb"
+checksum = "ea3c6ecd8059b57859df5c69830340ed3c41d30e3da0c1cbed90a96ac853041b"
 dependencies = [
- "encode_unicode 0.3.6",
- "lazy_static",
+ "encode_unicode",
  "libc",
- "unicode-width 0.1.14",
- "windows-sys 0.52.0",
+ "once_cell",
+ "unicode-width 0.2.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -1592,9 +1582,9 @@ dependencies = [
 
 [[package]]
 name = "const_panic"
-version = "0.2.10"
+version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "013b6c2c3a14d678f38cd23994b02da3a1a1b6a5d1eedddfe63a5a5f11b13a81"
+checksum = "53857514f72ee4a2b583de67401e3ff63a5472ca4acf289d09a9ea7636dfec17"
 
 [[package]]
 name = "containerd-client"
@@ -1684,18 +1674,18 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-channel"
-version = "0.5.13"
+version = "0.5.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33480d6946193aa8033910124896ca395333cae7e2d1113d1fef6c3272217df2"
+checksum = "06ba6d68e24814cb8de6bb986db8222d3a027d15872cabc0d18817bc3c0e4471"
 dependencies = [
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-deque"
-version = "0.8.5"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613f8cc01fe9cf1a3eb3d7f488fd2fa8388403e97039e2f73692932e291a770d"
+checksum = "9dd111b7b7f7d55b72c0a6ae361660ee5853c9af73f70c3c2ef6858b950e2e51"
 dependencies = [
  "crossbeam-epoch",
  "crossbeam-utils",
@@ -1712,9 +1702,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.20"
+version = "0.8.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22ec99545bb0ed0ea7bb9b8e1e9122ea386ff8a48c0922e43f36d45ab09e0e80"
+checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
 
 [[package]]
 name = "crunchy"
@@ -1799,7 +1789,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a2785755761f3ddc1492979ce1e48d2c00d09311c39e4466429188f3dd6501"
 dependencies = [
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -1831,7 +1821,7 @@ checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -1855,7 +1845,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "strsim",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -1866,7 +1856,7 @@ checksum = "d336a2a514f6ccccaa3e09b02d41d35330c07ddf03a62165fcec10bb561c7806"
 dependencies = [
  "darling_core",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -1942,7 +1932,7 @@ dependencies = [
  "darling",
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -1952,7 +1942,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ab63b0e2bf4d5928aff72e83a7dace85d7bba5fe12dcc3c5a572d78caffd3f3c"
 dependencies = [
  "derive_builder_core",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -1965,7 +1955,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustc_version",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -2064,7 +2054,7 @@ checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -2126,7 +2116,7 @@ dependencies = [
  "enum-ordinalize",
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -2154,12 +2144,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "encode_unicode"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a357d28ed41a50f9c765dbfe56cbc04a64e53e5fc58ba79fbc34c10ef3df831f"
-
 [[package]]
 name = "encode_unicode"
 version = "1.0.0"
@@ -2184,7 +2168,7 @@ dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -2204,7 +2188,7 @@ checksum = "0d28318a75d4aead5c4db25382e8ef717932d0346600cacae6357eb5941bc5ff"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -2216,19 +2200,25 @@ dependencies = [
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
 name = "env_filter"
-version = "0.1.2"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f2c92ceda6ceec50f43169f9ee8424fe2db276791afde7b2cd8bc084cb376ab"
+checksum = "186e05a59d4c50738528153b83b0b0194d3a29507dfec16eccd4b342903397d0"
 dependencies = [
  "log",
  "regex",
 ]
 
+[[package]]
+name = "env_home"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7f84e12ccf0a7ddc17a6c41c93326024c42920d7ee630d04950e6926645c0fe"
+
 [[package]]
 name = "env_logger"
 version = "0.10.2"
@@ -2244,9 +2234,9 @@ dependencies = [
 
 [[package]]
 name = "env_logger"
-version = "0.11.5"
+version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13fa619b91fb2381732789fc5de83b45675e882f66623b7d8cb4f643017018d"
+checksum = "dcaee3d8e3cfc3fd92428d477bc97fc29ec8716d180c0d74c643bb26166660e0"
 dependencies = [
  "anstream",
  "anstyle",
@@ -2374,9 +2364,9 @@ dependencies = [
 
 [[package]]
 name = "fastrand"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "486f806e73c5707928240ddc295403b1b93c96a02038563881c4a2fd84b81ac4"
+checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
 
 [[package]]
 name = "ff"
@@ -2451,9 +2441,9 @@ checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
 [[package]]
 name = "foldhash"
-version = "0.1.3"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f81ec6369c545a7d40e4589b5597581fa1c441fe1cce96dd1de43159910a36a2"
+checksum = "a0d2fde1f7b3d48b8395d5f2de76c18a528bd6a9cdde438df747bfcba3e05d6f"
 
 [[package]]
 name = "form_urlencoded"
@@ -2476,7 +2466,7 @@ version = "0.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fcca6a476beb610ebeab9c0bc60b3535aa103b52a2c265dc9d3d26209bea666c"
 dependencies = [
- "reqwest 0.12.9",
+ "reqwest 0.12.11",
  "tar",
  "xz",
 ]
@@ -2595,7 +2585,7 @@ checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -2667,7 +2657,7 @@ dependencies = [
  "proc-macro-error2",
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -2678,9 +2668,9 @@ checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
 
 [[package]]
 name = "glob"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2fabcfbdc87f4758337ca535fb41a6d701b65693ce38287d856d1674551ec9b"
+checksum = "a8d1add55171497b4705a648c6b583acafb01d58050a51727785f0b2c8e0a2b2"
 
 [[package]]
 name = "globset"
@@ -2859,7 +2849,7 @@ dependencies = [
  "once_cell",
  "rand",
  "serde",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tinyvec",
  "tokio",
  "tracing",
@@ -2883,7 +2873,7 @@ dependencies = [
  "resolv-conf",
  "serde",
  "smallvec",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
  "tracing",
 ]
@@ -2908,17 +2898,17 @@ dependencies = [
 
 [[package]]
 name = "hmac-sha256"
-version = "1.1.7"
+version = "1.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3688e69b38018fec1557254f64c8dc2cc8ec502890182f395dbb0aa997aa5735"
+checksum = "4a8575493d277c9092b988c780c94737fb9fd8651a1001e16bee3eccfc1baedb"
 
 [[package]]
 name = "home"
-version = "0.5.9"
+version = "0.5.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3d1354bf6b7235cb4a0576c2619fd4ed18183f689b12b006a0ee7329eeff9a5"
+checksum = "589533453244b0995c858700322199b2becb13b627df2851f64a2775d024abcf"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -3027,9 +3017,9 @@ checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
 
 [[package]]
 name = "hyper"
-version = "0.14.31"
+version = "0.14.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c08302e8fa335b151b788c775ff56e7a03ae64ff85c548ee820fecb70356e85"
+checksum = "41dfc780fdec9373c01bae43289ea34c972e40ee3c9f6b3c8801a35f35586ce7"
 dependencies = [
  "bytes",
  "futures-channel",
@@ -3051,9 +3041,9 @@ dependencies = [
 
 [[package]]
 name = "hyper"
-version = "1.5.1"
+version = "1.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97818827ef4f364230e16705d4706e2897df2bb60617d6ca15d598025a3c481f"
+checksum = "256fb8d4bd6413123cc9d91832d78325c48ff41677595be797d90f42969beae0"
 dependencies = [
  "bytes",
  "futures-channel",
@@ -3080,8 +3070,8 @@ dependencies = [
  "futures-util",
  "headers",
  "http 1.2.0",
- "hyper 1.5.1",
- "hyper-rustls 0.27.3",
+ "hyper 1.5.2",
+ "hyper-rustls 0.27.5",
  "hyper-util",
  "pin-project-lite",
  "rustls-native-certs 0.7.3",
@@ -3097,7 +3087,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "73b7d8abf35697b81a825e386fc151e0d503e8cb5fcb93cc8669c376dfd6f278"
 dependencies = [
  "hex",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -3113,7 +3103,7 @@ checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590"
 dependencies = [
  "futures-util",
  "http 0.2.12",
- "hyper 0.14.31",
+ "hyper 0.14.32",
  "log",
  "rustls 0.21.12",
  "rustls-native-certs 0.6.3",
@@ -3123,16 +3113,16 @@ dependencies = [
 
 [[package]]
 name = "hyper-rustls"
-version = "0.27.3"
+version = "0.27.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08afdbb5c31130e3034af566421053ab03787c640246a446327f550d11bcb333"
+checksum = "2d191583f3da1305256f22463b9bb0471acad48a4e534a5218b9963e9c1f59b2"
 dependencies = [
  "futures-util",
  "http 1.2.0",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-util",
  "log",
- "rustls 0.23.19",
+ "rustls 0.23.20",
  "rustls-native-certs 0.8.1",
  "rustls-pki-types",
  "tokio",
@@ -3149,7 +3139,7 @@ checksum = "51c227614c208f7e7c2e040526912604a1a957fe467c9c2f5b06c5d032337dab"
 dependencies = [
  "async-socks5",
  "http 1.2.0",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-util",
  "thiserror 1.0.69",
  "tokio",
@@ -3162,7 +3152,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
 dependencies = [
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -3180,7 +3170,7 @@ dependencies = [
  "futures-util",
  "http 1.2.0",
  "http-body 1.0.1",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "pin-project-lite",
  "socket2",
  "tokio",
@@ -3196,7 +3186,7 @@ checksum = "986c5ce3b994526b3cd75578e62554abd09f0899d6206de48b3e96ab34ccc8c7"
 dependencies = [
  "hex",
  "http-body-util",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -3341,7 +3331,7 @@ checksum = "1ec89e9337638ecdc08744df490b221a7399bf8d164eb52a665454e60e075ad6"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -3389,9 +3379,9 @@ dependencies = [
 
 [[package]]
 name = "impl-more"
-version = "0.1.8"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aae21c3177a27788957044151cc2800043d127acaa460a47ebb9b84dfa2c6aa0"
+checksum = "e8a5a9a0ff0086c7a148acb942baaabeadf9504d10400b5a05645853729b9cd2"
 
 [[package]]
 name = "indexmap"
@@ -3462,7 +3452,7 @@ dependencies = [
  "socket2",
  "widestring",
  "windows-sys 0.48.0",
- "winreg 0.50.0",
+ "winreg",
 ]
 
 [[package]]
@@ -3518,7 +3508,7 @@ name = "issue1317"
 version = "3.128.0"
 dependencies = [
  "actix-web",
- "env_logger 0.11.5",
+ "env_logger 0.11.6",
  "tokio",
  "tracing",
 ]
@@ -3605,9 +3595,9 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.74"
+version = "0.3.76"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a865e038f7f6ed956f788f0d7d60c541fff74c7bd74272c5d4cf15c63743e705"
+checksum = "6717b6b5b077764fb5966237269cb3c64edddde4b14ce42647430a78ced9e7b7"
 dependencies = [
  "once_cell",
  "wasm-bindgen",
@@ -3684,9 +3674,9 @@ dependencies = [
 
 [[package]]
 name = "konst"
-version = "0.3.15"
+version = "0.3.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "298ddf99f06a97c1ecd0e910932662b7842855046234b0d0376d35d93add087f"
+checksum = "4381b9b00c55f251f2ebe9473aef7c117e96828def1a7cb3bd3f0f903c6894e9"
 dependencies = [
  "const_panic",
  "konst_kernel",
@@ -3729,9 +3719,9 @@ dependencies = [
  "http 1.2.0",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-http-proxy",
- "hyper-rustls 0.27.3",
+ "hyper-rustls 0.27.5",
  "hyper-socks2",
  "hyper-timeout",
  "hyper-util",
@@ -3740,7 +3730,7 @@ dependencies = [
  "kube-core",
  "pem",
  "rand",
- "rustls 0.23.19",
+ "rustls 0.23.20",
  "rustls-pemfile 2.2.0",
  "secrecy",
  "serde",
@@ -3750,7 +3740,7 @@ dependencies = [
  "tokio",
  "tokio-tungstenite",
  "tokio-util",
- "tower 0.5.1",
+ "tower 0.5.2",
  "tower-http",
  "tracing",
 ]
@@ -3781,7 +3771,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "serde_json",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -3831,9 +3821,9 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
 
 [[package]]
 name = "libc"
-version = "0.2.167"
+version = "0.2.169"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09d6582e104315a817dff97f75133544b2e094ee22447d2acf4a74e189ba06fc"
+checksum = "b5aba8db14291edd000dfcc4d620c7ebfb122c613afb886ca8803fa4e128a20a"
 
 [[package]]
 name = "libloading"
@@ -3972,8 +3962,8 @@ dependencies = [
  "clap",
  "glob",
  "rand",
- "syn 2.0.90",
- "thiserror 2.0.4",
+ "syn 2.0.93",
+ "thiserror 2.0.9",
  "tracing",
  "tracing-subscriber",
 ]
@@ -4040,7 +4030,7 @@ checksum = "23c9b935fbe1d6cbd1dac857b54a688145e2d93f48db36010514d0f612d0ad67"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -4077,9 +4067,9 @@ checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
 [[package]]
 name = "miniz_oxide"
-version = "0.8.0"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2d80299ef12ff69b16a84bb182e3b9df68b5a91574d3d4fa6e41b65deec4df1"
+checksum = "4ffbe83022cedc1d264172192511ae958937694cd57ce297164951b8b3568394"
 dependencies = [
  "adler2",
 ]
@@ -4109,7 +4099,7 @@ dependencies = [
  "futures",
  "http-body-util",
  "humantime",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-util",
  "k8s-openapi",
  "kube",
@@ -4133,23 +4123,23 @@ dependencies = [
  "rand",
  "rcgen",
  "regex",
- "reqwest 0.12.9",
+ "reqwest 0.12.11",
  "rstest",
- "rustls 0.23.19",
+ "rustls 0.23.20",
  "rustls-pemfile 2.2.0",
- "semver 1.0.23",
+ "semver 1.0.24",
  "serde",
  "serde_json",
  "socket2",
  "tempfile",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
  "tokio-rustls 0.26.1",
  "tokio-stream",
  "tokio-util",
  "tracing",
  "tracing-subscriber",
- "which 7.0.0",
+ "which 7.0.1",
 ]
 
 [[package]]
@@ -4172,7 +4162,7 @@ dependencies = [
  "http 1.2.0",
  "http-body-util",
  "httparse",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-util",
  "iptables",
  "k8s-cri",
@@ -4187,20 +4177,20 @@ dependencies = [
  "rawsocket",
  "rcgen",
  "rstest",
- "rustls 0.23.19",
- "semver 1.0.23",
+ "rustls 0.23.20",
+ "semver 1.0.24",
  "serde",
  "serde_json",
  "socket2",
  "streammap-ext",
  "test_bin",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
  "tokio-rustls 0.26.1",
  "tokio-stream",
  "tokio-util",
  "tonic",
- "tower 0.5.1",
+ "tower 0.5.2",
  "tracing",
  "tracing-subscriber",
  "wildmatch",
@@ -4214,7 +4204,7 @@ dependencies = [
  "assert-json-diff",
  "base64 0.22.1",
  "drain",
- "reqwest 0.12.9",
+ "reqwest 0.12.11",
  "serde",
  "serde_json",
  "tokio",
@@ -4232,10 +4222,10 @@ dependencies = [
  "k8s-openapi",
  "kube",
  "pem",
- "reqwest 0.12.9",
+ "reqwest 0.12.11",
  "serde",
  "serde_yaml",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
  "tracing",
  "whoami",
@@ -4260,7 +4250,7 @@ dependencies = [
  "serde_json",
  "serde_yaml",
  "tera",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "toml 0.8.19",
  "tracing",
 ]
@@ -4272,7 +4262,7 @@ dependencies = [
  "proc-macro2",
  "proc-macro2-diagnostics",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -4284,7 +4274,7 @@ dependencies = [
  "log",
  "miette",
  "mirrord-intproxy-protocol",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
  "tokio-util",
  "tracing",
@@ -4300,7 +4290,7 @@ dependencies = [
  "futures",
  "h2 0.4.7",
  "http-body-util",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-util",
  "mirrord-analytics",
  "mirrord-config",
@@ -4309,13 +4299,13 @@ dependencies = [
  "mirrord-operator",
  "mirrord-protocol",
  "rand",
- "reqwest 0.12.9",
+ "reqwest 0.12.11",
  "rstest",
- "rustls 0.23.19",
+ "rustls 0.23.20",
  "rustls-pemfile 2.2.0",
- "semver 1.0.23",
+ "semver 1.0.24",
  "serde",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
  "tokio-rustls 0.26.1",
  "tokio-stream",
@@ -4328,7 +4318,7 @@ version = "3.128.0"
 dependencies = [
  "bincode",
  "mirrord-protocol",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
 ]
 
@@ -4350,7 +4340,7 @@ dependencies = [
  "serde",
  "serde_json",
  "shellexpand",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
  "tokio-retry",
  "tracing",
@@ -4371,7 +4361,7 @@ dependencies = [
  "frida-gum",
  "futures",
  "hashbrown 0.15.2",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "libc",
  "mirrord-config",
  "mirrord-console",
@@ -4393,7 +4383,7 @@ dependencies = [
  "tempfile",
  "test-cdylib",
  "tests",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
  "tracing",
  "tracing-subscriber",
@@ -4405,7 +4395,7 @@ version = "3.128.0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -4414,8 +4404,8 @@ version = "3.128.0"
 dependencies = [
  "proc-macro2",
  "proc-macro2-diagnostics",
- "semver 1.0.23",
- "syn 2.0.90",
+ "semver 1.0.24",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -4428,7 +4418,7 @@ dependencies = [
  "futures",
  "http 1.2.0",
  "http-body-util",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-util",
  "k8s-openapi",
  "kube",
@@ -4441,11 +4431,11 @@ dependencies = [
  "rand",
  "rstest",
  "schemars",
- "semver 1.0.23",
+ "semver 1.0.24",
  "serde",
  "serde_json",
  "serde_yaml",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
  "tokio-tungstenite",
  "tracing",
@@ -4473,14 +4463,14 @@ dependencies = [
  "hickory-resolver",
  "http-body-util",
  "http-serde",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "libc",
  "mirrord-macros",
  "nix 0.29.0",
- "semver 1.0.23",
+ "semver 1.0.24",
  "serde",
  "socket2",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
  "tokio-stream",
  "tracing",
@@ -4491,12 +4481,12 @@ name = "mirrord-sip"
 version = "3.128.0"
 dependencies = [
  "apple-codesign",
- "object 0.36.5",
+ "object 0.36.7",
  "once_cell",
  "tempfile",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tracing",
- "which 7.0.0",
+ "which 7.0.1",
 ]
 
 [[package]]
@@ -4509,9 +4499,9 @@ dependencies = [
  "kube",
  "mirrord-protocol",
  "pnet_packet",
- "semver 1.0.23",
+ "semver 1.0.24",
  "serde_yaml",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
  "tracing",
  "tun2",
@@ -4540,7 +4530,7 @@ dependencies = [
  "cfg-if",
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -4714,7 +4704,7 @@ checksum = "ed3955f1a9c7c0c15e092f9c887db08b1fc683305fdf6eb6684f22555355e202"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -4778,9 +4768,9 @@ dependencies = [
 
 [[package]]
 name = "object"
-version = "0.36.5"
+version = "0.36.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aedf0a2d09c573ed1d8d85b30c119153926a2b36dce0ab28322c09a117a4683e"
+checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
 dependencies = [
  "flate2",
  "memchr",
@@ -4800,7 +4790,7 @@ dependencies = [
  "serde_json",
  "strum",
  "strum_macros",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
 ]
 
 [[package]]
@@ -4962,7 +4952,7 @@ dependencies = [
  "proc-macro2",
  "proc-macro2-diagnostics",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -4992,20 +4982,20 @@ checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
 
 [[package]]
 name = "pest"
-version = "2.7.14"
+version = "2.7.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "879952a81a83930934cbf1786752d6dedc3b1f29e8f8fb2ad1d0a36f377cf442"
+checksum = "8b7cafe60d6cf8e62e1b9b2ea516a089c008945bb5a275416789e7db0bc199dc"
 dependencies = [
  "memchr",
- "thiserror 1.0.69",
+ "thiserror 2.0.9",
  "ucd-trie",
 ]
 
 [[package]]
 name = "pest_derive"
-version = "2.7.14"
+version = "2.7.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d214365f632b123a47fd913301e14c946c61d1c183ee245fa76eb752e59a02dd"
+checksum = "816518421cfc6887a0d62bf441b6ffb4536fcc926395a69e1a85852d4363f57e"
 dependencies = [
  "pest",
  "pest_generator",
@@ -5013,22 +5003,22 @@ dependencies = [
 
 [[package]]
 name = "pest_generator"
-version = "2.7.14"
+version = "2.7.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb55586734301717aea2ac313f50b2eb8f60d2fc3dc01d190eefa2e625f60c4e"
+checksum = "7d1396fd3a870fc7838768d171b4616d5c91f6cc25e377b673d714567d99377b"
 dependencies = [
  "pest",
  "pest_meta",
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
 name = "pest_meta"
-version = "2.7.14"
+version = "2.7.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b75da2a70cf4d9cb76833c990ac9cd3923c9a8905a8929789ce347c84564d03d"
+checksum = "e1e58089ea25d717bfd31fb534e4f3afcc2cc569c70de3e239778991ea3b7dea"
 dependencies = [
  "once_cell",
  "pest",
@@ -5100,7 +5090,7 @@ checksum = "3c0f5fad0874fc7abcd4d750e76917eaebbecaa2c20bde22e1dbeeba8beb758c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -5217,7 +5207,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "regex",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -5286,9 +5276,9 @@ dependencies = [
 
 [[package]]
 name = "predicates"
-version = "3.1.2"
+version = "3.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e9086cc7640c29a356d1a29fd134380bee9d8f79a17410aa76e7ad295f42c97"
+checksum = "a5d19ee57562043d37e82899fade9a22ebab7be9cef5026b07fda9cdd4293573"
 dependencies = [
  "anstyle",
  "predicates-core",
@@ -5296,15 +5286,15 @@ dependencies = [
 
 [[package]]
 name = "predicates-core"
-version = "1.0.8"
+version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae8177bee8e75d6846599c6b9ff679ed51e882816914eec639944d7c9aa11931"
+checksum = "727e462b119fe9c93fd0eb1429a5f7647394014cf3c04ab2c0350eeb09095ffa"
 
 [[package]]
 name = "predicates-tree"
-version = "1.0.11"
+version = "1.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41b740d195ed3166cd147c8047ec98db0e22ec019eb8eeb76d343b795304fb13"
+checksum = "72dd2d6d381dfb73a193c7fca536518d7caee39fc8503f74e7dc0be0531b425c"
 dependencies = [
  "predicates-core",
  "termtree",
@@ -5317,7 +5307,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "64d1ec885c64d0457d564db4ec299b2dae3f9c02808b8ad9c3a089c591b18033"
 dependencies = [
  "proc-macro2",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -5327,7 +5317,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eea25e07510aa6ab6547308ebe3c036016d162b8da920dbb079e3ba8acf3d95a"
 dependencies = [
  "csv",
- "encode_unicode 1.0.0",
+ "encode_unicode",
  "is-terminal",
  "lazy_static",
  "term",
@@ -5371,7 +5361,7 @@ dependencies = [
  "proc-macro-error-attr2",
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -5391,7 +5381,7 @@ checksum = "af066a9c399a26e020ada66a034357a868728e72cd426f3adcd35f80d88d88c8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
  "version_check",
  "yansi",
 ]
@@ -5423,9 +5413,9 @@ dependencies = [
 
 [[package]]
 name = "prost"
-version = "0.13.3"
+version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b0487d90e047de87f984913713b85c601c05609aad5b0df4b4573fbf69aa13f"
+checksum = "2c0fef6c4230e4ccf618a35c59d7ede15dea37de8427500f50aff708806e42ec"
 dependencies = [
  "bytes",
  "prost-derive",
@@ -5433,11 +5423,10 @@ dependencies = [
 
 [[package]]
 name = "prost-build"
-version = "0.13.3"
+version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c1318b19085f08681016926435853bbf7858f9c082d0999b80550ff5d9abe15"
+checksum = "d0f3e5beed80eb580c68e2c600937ac2c4eedabdfd5ef1e5b7ea4f3fba84497b"
 dependencies = [
- "bytes",
  "heck 0.5.0",
  "itertools 0.13.0",
  "log",
@@ -5448,37 +5437,37 @@ dependencies = [
  "prost",
  "prost-types",
  "regex",
- "syn 2.0.90",
+ "syn 2.0.93",
  "tempfile",
 ]
 
 [[package]]
 name = "prost-derive"
-version = "0.13.3"
+version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9552f850d5f0964a4e4d0bf306459ac29323ddfbae05e35a7c0d35cb0803cc5"
+checksum = "157c5a9d7ea5c2ed2d9fb8f495b64759f7816c7eaea54ba3978f0d63000162e3"
 dependencies = [
  "anyhow",
  "itertools 0.13.0",
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
 name = "prost-types"
-version = "0.13.3"
+version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4759aa0d3a6232fb8dbdb97b61de2c20047c68aca932c7ed76da9d788508d670"
+checksum = "cc2f1e56baa61e93533aebc21af4d2134b70f66275e0fcdf3cbe43d77ff7e8fc"
 dependencies = [
  "prost",
 ]
 
 [[package]]
 name = "quanta"
-version = "0.12.3"
+version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e5167a477619228a0b284fac2674e3c388cba90631d7b7de620e6f1fcd08da5"
+checksum = "773ce68d0bb9bc7ef20be3536ffe94e223e1f365bd374108b2659fac0c65cfe6"
 dependencies = [
  "crossbeam-utils",
  "libc",
@@ -5515,9 +5504,9 @@ dependencies = [
  "quinn-proto",
  "quinn-udp",
  "rustc-hash 2.1.0",
- "rustls 0.23.19",
+ "rustls 0.23.20",
  "socket2",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tokio",
  "tracing",
 ]
@@ -5533,10 +5522,10 @@ dependencies = [
  "rand",
  "ring",
  "rustc-hash 2.1.0",
- "rustls 0.23.19",
+ "rustls 0.23.20",
  "rustls-pki-types",
  "slab",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "tinyvec",
  "tracing",
  "web-time",
@@ -5544,9 +5533,9 @@ dependencies = [
 
 [[package]]
 name = "quinn-udp"
-version = "0.5.7"
+version = "0.5.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d5a626c6807713b15cac82a6acaccd6043c9a5408c24baae07611fec3f243da"
+checksum = "1c40286217b4ba3a71d644d752e6a0b71f13f1b6a2c5311acfcbe0c2418ed904"
 dependencies = [
  "cfg_aliases",
  "libc",
@@ -5558,9 +5547,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.37"
+version = "1.0.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5b9d34b8991d19d98081b46eacdd8eb58c6f2b201139f7c5f643cc155a633af"
+checksum = "0e4dccaaaf89514f546c693ddc140f729f958c247918a13380cccc6078391acc"
 dependencies = [
  "proc-macro2",
 ]
@@ -5692,9 +5681,9 @@ dependencies = [
 
 [[package]]
 name = "rcgen"
-version = "0.13.1"
+version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54077e1872c46788540de1ea3d7f4ccb1983d12f9aa909b234468676c1a36779"
+checksum = "75e669e5202259b5314d1ea5397316ad400819437857b90861765f24c4cf80a2"
 dependencies = [
  "pem",
  "ring",
@@ -5716,9 +5705,9 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.5.7"
+version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b6dfecf2c74bce2466cabf93f6664d6998a69eb21e39f4207930065b27b771f"
+checksum = "03a862b389f93e68874fbf580b9de08dd02facb9a788ebadaf4a3fd33cf58834"
 dependencies = [
  "bitflags 2.6.0",
 ]
@@ -5804,7 +5793,7 @@ dependencies = [
  "h2 0.3.26",
  "http 0.2.12",
  "http-body 0.4.6",
- "hyper 0.14.31",
+ "hyper 0.14.32",
  "hyper-rustls 0.24.2",
  "ipnet",
  "js-sys",
@@ -5829,14 +5818,14 @@ dependencies = [
  "wasm-bindgen-futures",
  "web-sys",
  "webpki-roots 0.25.4",
- "winreg 0.50.0",
+ "winreg",
 ]
 
 [[package]]
 name = "reqwest"
-version = "0.12.9"
+version = "0.12.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a77c62af46e79de0a562e1a9849205ffcb7fc1238876e9bd743357570e04046f"
+checksum = "7fe060fe50f524be480214aba758c71f99f90ee8c83c5a36b5e9e1d568eb4eb3"
 dependencies = [
  "base64 0.22.1",
  "bytes",
@@ -5847,8 +5836,8 @@ dependencies = [
  "http 1.2.0",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.5.1",
- "hyper-rustls 0.27.3",
+ "hyper 1.5.2",
+ "hyper-rustls 0.27.5",
  "hyper-util",
  "ipnet",
  "js-sys",
@@ -5858,7 +5847,7 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "quinn",
- "rustls 0.23.19",
+ "rustls 0.23.20",
  "rustls-native-certs 0.8.1",
  "rustls-pemfile 2.2.0",
  "rustls-pki-types",
@@ -5869,6 +5858,7 @@ dependencies = [
  "tokio",
  "tokio-rustls 0.26.1",
  "tokio-socks",
+ "tower 0.5.2",
  "tower-service",
  "url",
  "wasm-bindgen",
@@ -5929,7 +5919,7 @@ dependencies = [
  "regex",
  "relative-path",
  "rustc_version",
- "syn 2.0.90",
+ "syn 2.0.93",
  "unicode-ident",
 ]
 
@@ -5995,7 +5985,7 @@ version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
 dependencies = [
- "semver 1.0.23",
+ "semver 1.0.24",
 ]
 
 [[package]]
@@ -6009,15 +5999,15 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.41"
+version = "0.38.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7f649912bc1495e167a6edee79151c84b1bad49748cb4f1f1167f459f6224f6"
+checksum = "f93dc38ecbab2eb790ff964bb77fa94faf256fd3e73285fd7ba0903b76bedb85"
 dependencies = [
  "bitflags 2.6.0",
  "errno 0.3.10",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -6048,9 +6038,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.19"
+version = "0.23.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "934b404430bb06b3fae2cba809eb45a1ab1aecd64491213d7c3301b88393f8d1"
+checksum = "5065c3f250cbd332cd894be57c40fa52387247659b14a2d6041d121547903b1b"
 dependencies = [
  "aws-lc-rs",
  "log",
@@ -6096,7 +6086,7 @@ dependencies = [
  "openssl-probe",
  "rustls-pki-types",
  "schannel",
- "security-framework 3.0.1",
+ "security-framework 3.1.0",
 ]
 
 [[package]]
@@ -6119,9 +6109,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.10.0"
+version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "16f1201b3c9a7ee8039bcadc17b7e605e2945b27eee7631788c1bd2b0643674b"
+checksum = "d2bf47e6ff922db3825eb750c4e2ff784c6ff8fb9e13046ef6a1d1c5401b0b37"
 dependencies = [
  "web-time",
 ]
@@ -6150,9 +6140,9 @@ dependencies = [
 
 [[package]]
 name = "rustversion"
-version = "1.0.18"
+version = "1.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e819f2bc632f285be6d7cd36e25940d45b2391dd6d9b939e79de557f7014248"
+checksum = "f7c45b9784283f1b2e7fb61b42047c2fd678ef0960d4f6f1eba131594cc369d4"
 
 [[package]]
 name = "ruzstd"
@@ -6227,7 +6217,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "serde_derive_internals",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -6253,7 +6243,7 @@ checksum = "7f81c2fde025af7e69b1d1420531c8a8811ca898919db177141a85313b1cb932"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -6304,9 +6294,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework"
-version = "3.0.1"
+version = "3.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1415a607e92bec364ea2cf9264646dcce0f91e6d65281bd6f2819cca3bf39c8"
+checksum = "81d3f8c9bfcc3cbb6b0179eb57042d75b1582bdc65c3cb95f3fa999509c03cbc"
 dependencies = [
  "bitflags 2.6.0",
  "core-foundation 0.10.0",
@@ -6317,9 +6307,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.12.1"
+version = "2.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa39c7303dc58b5543c94d22c1766b0d31f2ee58306363ea622b10bbc075eaa2"
+checksum = "1863fd3768cd83c56a7f60faa4dc0d403f1b6df0a38c3c25f44b7894e45370d5"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -6337,9 +6327,9 @@ dependencies = [
 
 [[package]]
 name = "semver"
-version = "1.0.23"
+version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b"
+checksum = "3cb6eb87a131f756572d7fb904f6e7b68633f09cca868c5df1c4b8d1a694bbba"
 dependencies = [
  "serde",
 ]
@@ -6352,9 +6342,9 @@ checksum = "388a1df253eca08550bef6c72392cfe7c30914bf41df5269b68cbd6ff8f570a3"
 
 [[package]]
 name = "serde"
-version = "1.0.215"
+version = "1.0.217"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6513c1ad0b11a9376da888e3e0baa0077f1aed55c17f50e7b2397136129fb88f"
+checksum = "02fc4265df13d6fa1d00ecff087228cc0a2b5f3c0e87e258d8b94a156e984c70"
 dependencies = [
  "serde_derive",
 ]
@@ -6371,13 +6361,13 @@ dependencies = [
 
 [[package]]
 name = "serde_derive"
-version = "1.0.215"
+version = "1.0.217"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad1e866f866923f252f05c889987993144fb74e722403468a4ebd70c3cd756c0"
+checksum = "5a9bf7cf98d04a2b28aead066b7496853d4779c9cc183c440dbac457641e19a0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -6388,14 +6378,14 @@ checksum = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.133"
+version = "1.0.134"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7fceb2473b9166b2294ef05efcb65a3db80803f0b03ef86a5fc88a2b85ee377"
+checksum = "d00f4175c42ee48b15416f6193a959ba3a0d67fc699a0db9ad12df9f83991c7d"
 dependencies = [
  "itoa",
  "memchr",
@@ -6421,7 +6411,7 @@ checksum = "6c64451ba24fc7a6a2d60fc75dd9c83c90903b19028d4eff35e88fc1e86564e9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -6447,9 +6437,9 @@ dependencies = [
 
 [[package]]
 name = "serde_with"
-version = "3.11.0"
+version = "3.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e28bdad6db2b8340e449f7108f020b3b092e8583a9e3fb82713e1d4e71fe817"
+checksum = "d6b6f7f2fcb69f747921f79f3926bd1e203fce4fef62c268dd3abfb6d86029aa"
 dependencies = [
  "base64 0.22.1",
  "chrono",
@@ -6696,7 +6686,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustversion",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -6739,9 +6729,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.90"
+version = "2.0.93"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "919d3b74a5dd0ccd15aeb8f93e7006bd9e14c295087c9896a110f490752bcf31"
+checksum = "9c786062daee0d6db1132800e623df74274a0a87322d8e183338e01b3d98d058"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6783,7 +6773,7 @@ checksum = "c8af7666ab7b6390ab78131fb5b0fce11d6b7a6951602017c35fa82800708971"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -6907,9 +6897,9 @@ dependencies = [
 
 [[package]]
 name = "termtree"
-version = "0.4.1"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3369f5ac52d5eb6ab48c6b4ffdc8efbcad6b89c765749064ba298f2c68a16a76"
+checksum = "8f50febec83f5ee1df3015341d8bd429f2d1cc62bcba7ea2076759d315084683"
 
 [[package]]
 name = "test-cdylib"
@@ -6943,7 +6933,7 @@ dependencies = [
  "futures",
  "futures-util",
  "http-body-util",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-util",
  "json-patch",
  "jsonptr",
@@ -6953,9 +6943,9 @@ dependencies = [
  "mirrord-operator",
  "rand",
  "regex",
- "reqwest 0.12.9",
+ "reqwest 0.12.11",
  "rstest",
- "rustls 0.23.19",
+ "rustls 0.23.20",
  "serde",
  "serde_json",
  "tempfile",
@@ -6985,11 +6975,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.4"
+version = "2.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f49a1853cf82743e3b7950f77e0f4d622ca36cf4317cba00c767838bac8d490"
+checksum = "f072643fd0190df67a8bab670c20ef5d8737177d6ac6b2e9a236cb096206b2cc"
 dependencies = [
- "thiserror-impl 2.0.4",
+ "thiserror-impl 2.0.9",
 ]
 
 [[package]]
@@ -7000,18 +6990,18 @@ checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.4"
+version = "2.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8381894bb3efe0c4acac3ded651301ceee58a15d47c2e34885ed1908ad667061"
+checksum = "7b50fa271071aae2e6ee85f842e2e28ba8cd2c5fb67f11fcb1fd70b276f9e7d4"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -7076,9 +7066,9 @@ dependencies = [
 
 [[package]]
 name = "tinyvec"
-version = "1.8.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "445e881f4f6d382d5f27c034e25eb92edd7c784ceab92a0937db7f2e9471b938"
+checksum = "022db8904dfa342efe721985167e9fcd16c29b226db4397ed752a761cfce81e8"
 dependencies = [
  "tinyvec_macros",
 ]
@@ -7115,7 +7105,7 @@ checksum = "693d596312e88961bc67d7f1f97af8a70227d9f90c31bba5806eec004978d752"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -7145,7 +7135,7 @@ version = "0.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5f6d0975eaace0cf0fcadee4e4aaa5da15b5c079146f2cffb67c113be122bf37"
 dependencies = [
- "rustls 0.23.19",
+ "rustls 0.23.20",
  "tokio",
 ]
 
@@ -7257,7 +7247,7 @@ dependencies = [
  "http 1.2.0",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.5.1",
+ "hyper 1.5.2",
  "hyper-timeout",
  "hyper-util",
  "percent-encoding",
@@ -7283,7 +7273,7 @@ dependencies = [
  "prost-build",
  "prost-types",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -7308,14 +7298,14 @@ dependencies = [
 
 [[package]]
 name = "tower"
-version = "0.5.1"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2873938d487c3cfb9aed7546dc9f2711d867c9f90c46b889989a2cb84eba6b4f"
+checksum = "d039ad9159c98b70ecfd540b2573b97f7f52c3e8d9f8ad57a24b916a536975f9"
 dependencies = [
  "futures-core",
  "futures-util",
  "pin-project-lite",
- "sync_wrapper 0.1.2",
+ "sync_wrapper 1.0.2",
  "tokio",
  "tokio-util",
  "tower-layer",
@@ -7373,7 +7363,7 @@ checksum = "395ae124c09f9e6918a2310af6038fba074bcf474ac352496d5910dd59a2226d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -7774,9 +7764,9 @@ checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.97"
+version = "0.2.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d15e63b4482863c109d70a7b8706c1e364eb6ea449b201a76c5b89cedcec2d5c"
+checksum = "a474f6281d1d70c17ae7aa6a613c87fce69a127e2624002df63dcb39d6cf6396"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -7785,24 +7775,23 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.97"
+version = "0.2.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d36ef12e3aaca16ddd3f67922bc63e48e953f126de60bd33ccc0101ef9998cd"
+checksum = "5f89bb38646b4f81674e8f5c3fb81b562be1fd936d84320f3264486418519c79"
 dependencies = [
  "bumpalo",
  "log",
- "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.47"
+version = "0.4.49"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9dfaf8f50e5f293737ee323940c7d8b08a66a95a419223d9f41610ca08b0833d"
+checksum = "38176d9b44ea84e9184eff0bc34cc167ed044f816accfe5922e54d84cf48eca2"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -7813,9 +7802,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.97"
+version = "0.2.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "705440e08b42d3e4b36de7d66c944be628d579796b8090bfa3471478a2260051"
+checksum = "2cc6181fd9a7492eef6fef1f33961e3695e4579b9872a6f7c83aee556666d4fe"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -7823,28 +7812,28 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.97"
+version = "0.2.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98c9ae5a76e46f4deecd0f0255cc223cfa18dc9b261213b8aa0c7b36f61b3f1d"
+checksum = "30d7a95b763d3c45903ed6c81f156801839e5ee968bb07e534c44df0fcd330c2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.97"
+version = "0.2.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ee99da9c5ba11bd675621338ef6fa52296b76b83305e9b6e5c77d4c286d6d49"
+checksum = "943aab3fdaaa029a6e0271b35ea10b72b943135afe9bffca82384098ad0e06a6"
 
 [[package]]
 name = "web-sys"
-version = "0.3.74"
+version = "0.3.76"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a98bc3c33f0fe7e59ad7cd041b89034fa82a7c2d4365ca538dda6cdaf513863c"
+checksum = "04dd7223427d52553d3702c004d3b2fe07c148165faa56313cb00211e31c12bc"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -7889,12 +7878,12 @@ dependencies = [
 
 [[package]]
 name = "which"
-version = "7.0.0"
+version = "7.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9cad3279ade7346b96e38731a641d7343dd6a53d55083dd54eadfa5a1b38c6b"
+checksum = "fb4a9e33648339dc1642b0e36e21b3385e6148e289226f657c809dee59df5028"
 dependencies = [
  "either",
- "home",
+ "env_home",
  "rustix",
  "winsafe",
 ]
@@ -8159,16 +8148,6 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
-[[package]]
-name = "winreg"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a277a57398d4bfa075df44f501a17cfdf8542d224f0d36095a2adc7aee4ef0a5"
-dependencies = [
- "cfg-if",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "winsafe"
 version = "0.0.19"
@@ -8177,18 +8156,17 @@ checksum = "d135d17ab770252ad95e9a872d365cf3090e3be864a34ab46f48555993efc904"
 
 [[package]]
 name = "wintun-bindings"
-version = "0.7.19"
+version = "0.7.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50da04a12b4acd77944c4e3501a61e754dc798dadcab063c9bf1d7c40081ec41"
+checksum = "8e35d3911efde5ee25586385204127ff6a3f251477dcdd3b222775aaa4d95977"
 dependencies = [
  "blocking",
  "c2rust-bitfields",
  "futures",
  "libloading",
  "log",
- "thiserror 2.0.4",
+ "thiserror 2.0.9",
  "windows-sys 0.59.0",
- "winreg 0.52.0",
 ]
 
 [[package]]
@@ -8359,7 +8337,7 @@ checksum = "2380878cad4ac9aac1e2435f3eb4020e8374b5f13c296cb75b4620ff8e229154"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
  "synstructure 0.13.1",
 ]
 
@@ -8381,7 +8359,7 @@ checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -8401,7 +8379,7 @@ checksum = "595eed982f7d355beb85837f651fa22e90b3c044842dc7f2c2842c086f295808"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
  "synstructure 0.13.1",
 ]
 
@@ -8422,7 +8400,7 @@ checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
@@ -8444,7 +8422,7 @@ checksum = "6eafa6dfb17584ea3e2bd6e76e0cc15ad7af12b09abdd1ca55961bed9b1063c6"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.90",
+ "syn 2.0.93",
 ]
 
 [[package]]
diff --git a/mirrord/operator/src/crd/policy.rs b/mirrord/operator/src/crd/policy.rs
index eaf894d4739..ad92524e623 100644
--- a/mirrord/operator/src/crd/policy.rs
+++ b/mirrord/operator/src/crd/policy.rs
@@ -54,16 +54,9 @@ pub struct MirrordPolicySpec {
     /// List of features and operations blocked by this policy.
     pub block: Vec<BlockedFeature>,
 
-    /// List of environment variables that should be excluded when using mirrord.
-    ///
-    /// These environment variables won't be retrieved from the target even if the user
-    /// specifies them in their `feature.env.include` mirrord config.
-    ///
-    /// Variable names can be matched using `*` and `?` where `?` matches exactly one occurrence of
-    /// any character and `*` matches arbitrary many (including zero) occurrences of any character,
-    /// e.g. `DATABASE_*` will match `DATABASE_URL` and `DATABASE_PORT`.
+    /// Allows the mirrord-operator to control which environment variables can affected by mirrord.
     #[serde(default)]
-    pub env_vars_exclude: HashSet<String>,
+    pub env: EnvPolicy,
 }
 
 /// Custom cluster-wide resource for policies that limit what mirrord features users can use.
@@ -92,6 +85,15 @@ pub struct MirrordClusterPolicySpec {
     /// List of features and operations blocked by this policy.
     pub block: Vec<BlockedFeature>,
 
+    /// Allows the mirrord-operator to control which environment variables can affected by mirrord.
+    #[serde(default)]
+    pub env: EnvPolicy,
+}
+
+/// Policy for controlling environment variables access from mirrord instances.
+#[derive(Clone, Default, Debug, Deserialize, Eq, PartialEq, Serialize, JsonSchema)]
+#[serde(rename_all = "kebab-case")]
+pub struct EnvPolicy {
     /// List of environment variables that should be excluded when using mirrord.
     ///
     /// These environment variables won't be retrieved from the target even if the user
@@ -100,8 +102,7 @@ pub struct MirrordClusterPolicySpec {
     /// Variable names can be matched using `*` and `?` where `?` matches exactly one occurrence of
     /// any character and `*` matches arbitrary many (including zero) occurrences of any character,
     /// e.g. `DATABASE_*` will match `DATABASE_URL` and `DATABASE_PORT`.
-    #[serde(default)]
-    pub env_vars_exclude: HashSet<String>,
+    exclude: HashSet<String>,
 }
 
 #[test]

From 5d13e17af3ed746a76de1340e2192a6ade16b24c Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Tue, 31 Dec 2024 12:00:10 -0300
Subject: [PATCH 11/33] make it pub

---
 mirrord/operator/src/crd/policy.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mirrord/operator/src/crd/policy.rs b/mirrord/operator/src/crd/policy.rs
index ad92524e623..6baf742b406 100644
--- a/mirrord/operator/src/crd/policy.rs
+++ b/mirrord/operator/src/crd/policy.rs
@@ -102,7 +102,7 @@ pub struct EnvPolicy {
     /// Variable names can be matched using `*` and `?` where `?` matches exactly one occurrence of
     /// any character and `*` matches arbitrary many (including zero) occurrences of any character,
     /// e.g. `DATABASE_*` will match `DATABASE_URL` and `DATABASE_PORT`.
-    exclude: HashSet<String>,
+    pub exclude: HashSet<String>,
 }
 
 #[test]

From 568302760f6d4a718b67f806ce54c241c158426e Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Tue, 31 Dec 2024 12:03:12 -0300
Subject: [PATCH 12/33] fix test

---
 tests/src/operator/policies.rs | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/tests/src/operator/policies.rs b/tests/src/operator/policies.rs
index 605f14f3653..61a17d90af5 100644
--- a/tests/src/operator/policies.rs
+++ b/tests/src/operator/policies.rs
@@ -127,7 +127,7 @@ fn block_steal_without_qualifiers() -> PolicyTestCase {
                 target_path: None,
                 selector: None,
                 block: vec![BlockedFeature::Steal],
-                env_vars_exclude: Default::default(),
+                env: Default::default(),
             },
         ),
         service_b_can_steal: No,
@@ -146,7 +146,7 @@ fn block_steal_with_path_pattern() -> PolicyTestCase {
                 target_path: Some("*-service-a*".into()),
                 selector: None,
                 block: vec![BlockedFeature::Steal],
-                env_vars_exclude: Default::default(),
+                env: Default::default(),
             },
         ),
         service_b_can_steal: EvenWithoutFilter,
@@ -165,7 +165,7 @@ fn block_unfiltered_steal_with_path_pattern() -> PolicyTestCase {
                 target_path: Some("*-service-a*".into()),
                 selector: None,
                 block: vec![BlockedFeature::StealWithoutFilter],
-                env_vars_exclude: Default::default(),
+                env: Default::default(),
             },
         ),
         service_b_can_steal: EvenWithoutFilter,
@@ -184,7 +184,7 @@ fn block_unfiltered_steal_with_deployment_path_pattern() -> PolicyTestCase {
                 target_path: Some("deploy/*service-a*".into()),
                 selector: None,
                 block: vec![BlockedFeature::StealWithoutFilter],
-                env_vars_exclude: Default::default(),
+                env: Default::default(),
             },
         ),
         service_a_can_steal: OnlyWithFilter,
@@ -209,7 +209,7 @@ fn block_steal_with_label_selector() -> PolicyTestCase {
                     )])),
                 }),
                 block: vec![BlockedFeature::Steal],
-                env_vars_exclude: Default::default(),
+                env: Default::default(),
             },
         ),
         service_b_can_steal: EvenWithoutFilter,
@@ -235,7 +235,7 @@ fn block_steal_with_unmatching_policy() -> PolicyTestCase {
                     )])),
                 }),
                 block: vec![BlockedFeature::Steal],
-                env_vars_exclude: Default::default(),
+                env: Default::default(),
             },
         ),
         service_b_can_steal: EvenWithoutFilter,
@@ -376,7 +376,7 @@ pub async fn create_cluster_policy_and_try_to_mirror(
                 target_path: Some("*-service-a*".into()),
                 selector: None,
                 block: vec![BlockedFeature::Mirror],
-                env_vars_exclude: Default::default(),
+                env: Default::default(),
             },
         ),
     )

From c3b4035ab0ac1514735b813cc60d6584f88542b3 Mon Sep 17 00:00:00 2001
From: meowjesty <43983236+meowjesty@users.noreply.github.com>
Date: Tue, 31 Dec 2024 12:36:59 -0300
Subject: [PATCH 13/33] better docs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Michał Smolarek <34063647+Razz4780@users.noreply.github.com>
---
 mirrord/operator/src/crd/policy.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mirrord/operator/src/crd/policy.rs b/mirrord/operator/src/crd/policy.rs
index 6baf742b406..a12476c15dc 100644
--- a/mirrord/operator/src/crd/policy.rs
+++ b/mirrord/operator/src/crd/policy.rs
@@ -85,7 +85,7 @@ pub struct MirrordClusterPolicySpec {
     /// List of features and operations blocked by this policy.
     pub block: Vec<BlockedFeature>,
 
-    /// Allows the mirrord-operator to control which environment variables can affected by mirrord.
+    /// Controls how mirrord-operator handles user requests to fetch environment variables from the target.
     #[serde(default)]
     pub env: EnvPolicy,
 }

From cb9669926d9c2da2a9818e7b007d4f1003a3c2ad Mon Sep 17 00:00:00 2001
From: meowjesty <43983236+meowjesty@users.noreply.github.com>
Date: Tue, 31 Dec 2024 12:37:16 -0300
Subject: [PATCH 14/33] better docs due
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Michał Smolarek <34063647+Razz4780@users.noreply.github.com>
---
 mirrord/operator/src/crd/policy.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mirrord/operator/src/crd/policy.rs b/mirrord/operator/src/crd/policy.rs
index a12476c15dc..b0b452c4a98 100644
--- a/mirrord/operator/src/crd/policy.rs
+++ b/mirrord/operator/src/crd/policy.rs
@@ -54,7 +54,7 @@ pub struct MirrordPolicySpec {
     /// List of features and operations blocked by this policy.
     pub block: Vec<BlockedFeature>,
 
-    /// Allows the mirrord-operator to control which environment variables can affected by mirrord.
+    /// Controls how mirrord-operator handles user requests to fetch environment variables from the target.
     #[serde(default)]
     pub env: EnvPolicy,
 }

From 5a13f57349a4efd68d999e12a1754d82170ebe5e Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Tue, 31 Dec 2024 12:51:31 -0300
Subject: [PATCH 15/33] rustfmt

---
 mirrord/operator/src/crd/policy.rs | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/mirrord/operator/src/crd/policy.rs b/mirrord/operator/src/crd/policy.rs
index b0b452c4a98..1ad9447d1e8 100644
--- a/mirrord/operator/src/crd/policy.rs
+++ b/mirrord/operator/src/crd/policy.rs
@@ -54,7 +54,8 @@ pub struct MirrordPolicySpec {
     /// List of features and operations blocked by this policy.
     pub block: Vec<BlockedFeature>,
 
-    /// Controls how mirrord-operator handles user requests to fetch environment variables from the target.
+    /// Controls how mirrord-operator handles user requests to fetch environment variables from the
+    /// target.
     #[serde(default)]
     pub env: EnvPolicy,
 }
@@ -85,7 +86,8 @@ pub struct MirrordClusterPolicySpec {
     /// List of features and operations blocked by this policy.
     pub block: Vec<BlockedFeature>,
 
-    /// Controls how mirrord-operator handles user requests to fetch environment variables from the target.
+    /// Controls how mirrord-operator handles user requests to fetch environment variables from the
+    /// target.
     #[serde(default)]
     pub env: EnvPolicy,
 }

From a6799874e56c10bb9c521f0e40204ab3ff470c29 Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Tue, 31 Dec 2024 19:04:58 -0300
Subject: [PATCH 16/33] Add policy for file ops.

---
 mirrord/operator/src/crd/policy.rs | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/mirrord/operator/src/crd/policy.rs b/mirrord/operator/src/crd/policy.rs
index 1ad9447d1e8..30defa1a151 100644
--- a/mirrord/operator/src/crd/policy.rs
+++ b/mirrord/operator/src/crd/policy.rs
@@ -58,6 +58,9 @@ pub struct MirrordPolicySpec {
     /// target.
     #[serde(default)]
     pub env: EnvPolicy,
+
+    #[serde(default)]
+    pub fs: FsPolicy,
 }
 
 /// Custom cluster-wide resource for policies that limit what mirrord features users can use.
@@ -90,6 +93,9 @@ pub struct MirrordClusterPolicySpec {
     /// target.
     #[serde(default)]
     pub env: EnvPolicy,
+
+    #[serde(default)]
+    pub fs: FsPolicy,
 }
 
 /// Policy for controlling environment variables access from mirrord instances.
@@ -104,9 +110,26 @@ pub struct EnvPolicy {
     /// Variable names can be matched using `*` and `?` where `?` matches exactly one occurrence of
     /// any character and `*` matches arbitrary many (including zero) occurrences of any character,
     /// e.g. `DATABASE_*` will match `DATABASE_URL` and `DATABASE_PORT`.
+    #[serde(default)]
     pub exclude: HashSet<String>,
 }
 
+#[derive(Clone, Default, Debug, Deserialize, Eq, PartialEq, Serialize, JsonSchema)]
+#[serde(rename_all = "kebab-case")]
+pub struct FsPolicy {
+    #[serde(default)]
+    pub read_only: HashSet<String>,
+
+    #[serde(default)]
+    pub read_write: HashSet<String>,
+
+    #[serde(default)]
+    pub local: HashSet<String>,
+
+    #[serde(default)]
+    pub not_found: HashSet<String>,
+}
+
 #[test]
 fn check_one_api_group() {
     use kube::Resource;

From 6ee04ba9e563749902d6993516cad677855df7d0 Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Mon, 6 Jan 2025 17:26:09 -0300
Subject: [PATCH 17/33] no exclude

---
 mirrord/operator/src/crd/policy.rs | 1 -
 1 file changed, 1 deletion(-)

diff --git a/mirrord/operator/src/crd/policy.rs b/mirrord/operator/src/crd/policy.rs
index 66e587973f7..30defa1a151 100644
--- a/mirrord/operator/src/crd/policy.rs
+++ b/mirrord/operator/src/crd/policy.rs
@@ -128,7 +128,6 @@ pub struct FsPolicy {
 
     #[serde(default)]
     pub not_found: HashSet<String>,
-    pub exclude: HashSet<String>,
 }
 
 #[test]

From bd9d11dfb376a987980a35ed9e581324dfa01ae5 Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Mon, 6 Jan 2025 18:24:12 -0300
Subject: [PATCH 18/33] update protocol with open_local_version

---
 mirrord/protocol/src/file.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mirrord/protocol/src/file.rs b/mirrord/protocol/src/file.rs
index 184e0e8a40a..e6abba8a356 100644
--- a/mirrord/protocol/src/file.rs
+++ b/mirrord/protocol/src/file.rs
@@ -26,7 +26,7 @@ pub static MKDIR_VERSION: LazyLock<VersionReq> =
     LazyLock::new(|| ">=1.13.0".parse().expect("Bad Identifier"));
 
 pub static OPEN_LOCAL_VERSION: LazyLock<VersionReq> =
-    LazyLock::new(|| ">=1.13.0".parse().expect("Bad Identifier"));
+    LazyLock::new(|| ">=1.13.1".parse().expect("Bad Identifier"));
 
 /// Internal version of Metadata across operating system (macOS, Linux)
 /// Only mutual attributes

From d2dd6d8dbfe196ba0b9bc2d34a8499eedaed4e8f Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Mon, 6 Jan 2025 18:58:16 -0300
Subject: [PATCH 19/33] bump protocol

---
 Cargo.lock                   | 2 +-
 mirrord/protocol/Cargo.toml  | 2 +-
 mirrord/protocol/src/file.rs | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 2cfeea353a5..2fe98475fc5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4453,7 +4453,7 @@ dependencies = [
 
 [[package]]
 name = "mirrord-protocol"
-version = "1.13.1"
+version = "1.14.0"
 dependencies = [
  "actix-codec",
  "bincode",
diff --git a/mirrord/protocol/Cargo.toml b/mirrord/protocol/Cargo.toml
index 70f33186ba1..f675fe3625c 100644
--- a/mirrord/protocol/Cargo.toml
+++ b/mirrord/protocol/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "mirrord-protocol"
-version = "1.13.1"
+version = "1.14.0"
 authors.workspace = true
 description.workspace = true
 documentation.workspace = true
diff --git a/mirrord/protocol/src/file.rs b/mirrord/protocol/src/file.rs
index e6abba8a356..eeb021e3266 100644
--- a/mirrord/protocol/src/file.rs
+++ b/mirrord/protocol/src/file.rs
@@ -26,7 +26,7 @@ pub static MKDIR_VERSION: LazyLock<VersionReq> =
     LazyLock::new(|| ">=1.13.0".parse().expect("Bad Identifier"));
 
 pub static OPEN_LOCAL_VERSION: LazyLock<VersionReq> =
-    LazyLock::new(|| ">=1.13.1".parse().expect("Bad Identifier"));
+    LazyLock::new(|| ">=1.14.0".parse().expect("Bad Identifier"));
 
 /// Internal version of Metadata across operating system (macOS, Linux)
 /// Only mutual attributes

From a4d212c2c05c9c626aa191c8922d6439bcc89747 Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Tue, 7 Jan 2025 17:28:52 -0300
Subject: [PATCH 20/33] lint test

---
 tests/src/operator/policies.rs | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/tests/src/operator/policies.rs b/tests/src/operator/policies.rs
index 61a17d90af5..dff53a66939 100644
--- a/tests/src/operator/policies.rs
+++ b/tests/src/operator/policies.rs
@@ -127,7 +127,7 @@ fn block_steal_without_qualifiers() -> PolicyTestCase {
                 target_path: None,
                 selector: None,
                 block: vec![BlockedFeature::Steal],
-                env: Default::default(),
+                ..Default::default()
             },
         ),
         service_b_can_steal: No,
@@ -146,7 +146,7 @@ fn block_steal_with_path_pattern() -> PolicyTestCase {
                 target_path: Some("*-service-a*".into()),
                 selector: None,
                 block: vec![BlockedFeature::Steal],
-                env: Default::default(),
+                ..Default::default()
             },
         ),
         service_b_can_steal: EvenWithoutFilter,
@@ -165,7 +165,7 @@ fn block_unfiltered_steal_with_path_pattern() -> PolicyTestCase {
                 target_path: Some("*-service-a*".into()),
                 selector: None,
                 block: vec![BlockedFeature::StealWithoutFilter],
-                env: Default::default(),
+                ..Default::default()
             },
         ),
         service_b_can_steal: EvenWithoutFilter,
@@ -184,7 +184,7 @@ fn block_unfiltered_steal_with_deployment_path_pattern() -> PolicyTestCase {
                 target_path: Some("deploy/*service-a*".into()),
                 selector: None,
                 block: vec![BlockedFeature::StealWithoutFilter],
-                env: Default::default(),
+                ..Default::default()
             },
         ),
         service_a_can_steal: OnlyWithFilter,
@@ -209,7 +209,7 @@ fn block_steal_with_label_selector() -> PolicyTestCase {
                     )])),
                 }),
                 block: vec![BlockedFeature::Steal],
-                env: Default::default(),
+                ..Default::default()
             },
         ),
         service_b_can_steal: EvenWithoutFilter,
@@ -235,7 +235,7 @@ fn block_steal_with_unmatching_policy() -> PolicyTestCase {
                     )])),
                 }),
                 block: vec![BlockedFeature::Steal],
-                env: Default::default(),
+                ..Default::default()
             },
         ),
         service_b_can_steal: EvenWithoutFilter,
@@ -376,7 +376,7 @@ pub async fn create_cluster_policy_and_try_to_mirror(
                 target_path: Some("*-service-a*".into()),
                 selector: None,
                 block: vec![BlockedFeature::Mirror],
-                env: Default::default(),
+                ..Default::default()
             },
         ),
     )

From 749017ef7049451eb11e9ff3667d84dc55919242 Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Tue, 7 Jan 2025 17:48:53 -0300
Subject: [PATCH 21/33] docs

---
 mirrord/layer/src/detour.rs        |  2 ++
 mirrord/layer/src/file/ops.rs      |  1 +
 mirrord/operator/src/crd/policy.rs | 15 +++++++++++++++
 3 files changed, 18 insertions(+)

diff --git a/mirrord/layer/src/detour.rs b/mirrord/layer/src/detour.rs
index 67ef5138282..92a014d20dd 100644
--- a/mirrord/layer/src/detour.rs
+++ b/mirrord/layer/src/detour.rs
@@ -216,6 +216,8 @@ pub(crate) enum Bypass {
     /// doesn't support them.
     NotImplemented,
 
+    /// File `open` (any `open`-ish operation) was forced to be local, instead of remote, most
+    /// likely due to an operator fs policy.
     OpenLocal,
 }
 
diff --git a/mirrord/layer/src/file/ops.rs b/mirrord/layer/src/file/ops.rs
index d971dfc5486..ca9dd10f951 100644
--- a/mirrord/layer/src/file/ops.rs
+++ b/mirrord/layer/src/file/ops.rs
@@ -208,6 +208,7 @@ pub(crate) fn open(path: Detour<PathBuf>, open_options: OpenOptionsInternal) ->
 
     let OpenFileResponse { fd: remote_fd } = RemoteFile::remote_open(path.clone(), open_options)
         .or_else(|fail| match fail {
+            // The operator has a policy that matches this `path` as local-only.
             HookError::ResponseError(ResponseError::OpenLocal) => Detour::Bypass(Bypass::OpenLocal),
             other => Detour::Error(other),
         })?;
diff --git a/mirrord/operator/src/crd/policy.rs b/mirrord/operator/src/crd/policy.rs
index 30defa1a151..d18ecd793bf 100644
--- a/mirrord/operator/src/crd/policy.rs
+++ b/mirrord/operator/src/crd/policy.rs
@@ -59,6 +59,8 @@ pub struct MirrordPolicySpec {
     #[serde(default)]
     pub env: EnvPolicy,
 
+    /// Overrides fs ops behaviour, granting control over them to the operator policy, instead of
+    /// the user config.
     #[serde(default)]
     pub fs: FsPolicy,
 }
@@ -94,6 +96,8 @@ pub struct MirrordClusterPolicySpec {
     #[serde(default)]
     pub env: EnvPolicy,
 
+    /// Overrides fs ops behaviour, granting control over them to the operator policy, instead of
+    /// the user config.
     #[serde(default)]
     pub fs: FsPolicy,
 }
@@ -114,18 +118,29 @@ pub struct EnvPolicy {
     pub exclude: HashSet<String>,
 }
 
+/// File operations policy that mimics the mirrord fs config.
+///
+/// Allows the operator control over remote file ops behaviour, overriding what the user has set in
+/// their mirrord config file, if it matches something in one of the lists (regex sets) of this
+/// struct.
 #[derive(Clone, Default, Debug, Deserialize, Eq, PartialEq, Serialize, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
 pub struct FsPolicy {
+    /// The file can only be opened in read-only mode, otherwise the operator returns an IO error.
     #[serde(default)]
     pub read_only: HashSet<String>,
 
+    /// The file may be opened in read-write mode.
     #[serde(default)]
     pub read_write: HashSet<String>,
 
+    /// The file cannot be opened in the remote target.
+    ///
+    /// `open` calls that match this are forced to be opened in the local user's machine.
     #[serde(default)]
     pub local: HashSet<String>,
 
+    /// Any file that matches this returns a file not found error from the operator.
     #[serde(default)]
     pub not_found: HashSet<String>,
 }

From 79e307ad95f3e1080e5ff450a2c03bece412c0c2 Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Tue, 7 Jan 2025 18:14:19 -0300
Subject: [PATCH 22/33] fix test

---
 tests/src/operator/policies.rs | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/tests/src/operator/policies.rs b/tests/src/operator/policies.rs
index dff53a66939..7ff69d8e78f 100644
--- a/tests/src/operator/policies.rs
+++ b/tests/src/operator/policies.rs
@@ -127,7 +127,8 @@ fn block_steal_without_qualifiers() -> PolicyTestCase {
                 target_path: None,
                 selector: None,
                 block: vec![BlockedFeature::Steal],
-                ..Default::default()
+                env: Default::default(),
+                fs: Default::default(),
             },
         ),
         service_b_can_steal: No,
@@ -146,7 +147,8 @@ fn block_steal_with_path_pattern() -> PolicyTestCase {
                 target_path: Some("*-service-a*".into()),
                 selector: None,
                 block: vec![BlockedFeature::Steal],
-                ..Default::default()
+                env: Default::default(),
+                fs: Default::default(),
             },
         ),
         service_b_can_steal: EvenWithoutFilter,
@@ -165,7 +167,8 @@ fn block_unfiltered_steal_with_path_pattern() -> PolicyTestCase {
                 target_path: Some("*-service-a*".into()),
                 selector: None,
                 block: vec![BlockedFeature::StealWithoutFilter],
-                ..Default::default()
+                env: Default::default(),
+                fs: Default::default(),
             },
         ),
         service_b_can_steal: EvenWithoutFilter,
@@ -184,7 +187,8 @@ fn block_unfiltered_steal_with_deployment_path_pattern() -> PolicyTestCase {
                 target_path: Some("deploy/*service-a*".into()),
                 selector: None,
                 block: vec![BlockedFeature::StealWithoutFilter],
-                ..Default::default()
+                env: Default::default(),
+                fs: Default::default(),
             },
         ),
         service_a_can_steal: OnlyWithFilter,
@@ -209,7 +213,8 @@ fn block_steal_with_label_selector() -> PolicyTestCase {
                     )])),
                 }),
                 block: vec![BlockedFeature::Steal],
-                ..Default::default()
+                env: Default::default(),
+                fs: Default::default(),
             },
         ),
         service_b_can_steal: EvenWithoutFilter,
@@ -235,7 +240,8 @@ fn block_steal_with_unmatching_policy() -> PolicyTestCase {
                     )])),
                 }),
                 block: vec![BlockedFeature::Steal],
-                ..Default::default()
+                env: Default::default(),
+                fs: Default::default(),
             },
         ),
         service_b_can_steal: EvenWithoutFilter,
@@ -376,7 +382,8 @@ pub async fn create_cluster_policy_and_try_to_mirror(
                 target_path: Some("*-service-a*".into()),
                 selector: None,
                 block: vec![BlockedFeature::Mirror],
-                ..Default::default()
+                env: Default::default(),
+                fs: Default::default(),
             },
         ),
     )

From 916737315d0cc23841ed9bc3c6c1c00e4d0591e9 Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Tue, 7 Jan 2025 18:15:04 -0300
Subject: [PATCH 23/33] change min protocol version

---
 mirrord/protocol/src/file.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mirrord/protocol/src/file.rs b/mirrord/protocol/src/file.rs
index eeb021e3266..c0b4cfe2f18 100644
--- a/mirrord/protocol/src/file.rs
+++ b/mirrord/protocol/src/file.rs
@@ -26,7 +26,7 @@ pub static MKDIR_VERSION: LazyLock<VersionReq> =
     LazyLock::new(|| ">=1.13.0".parse().expect("Bad Identifier"));
 
 pub static OPEN_LOCAL_VERSION: LazyLock<VersionReq> =
-    LazyLock::new(|| ">=1.14.0".parse().expect("Bad Identifier"));
+    LazyLock::new(|| ">=1.13.3".parse().expect("Bad Identifier"));
 
 /// Internal version of Metadata across operating system (macOS, Linux)
 /// Only mutual attributes

From b11eaeaee191780176c13e3d3277336d3d53a2e4 Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Wed, 8 Jan 2025 17:38:20 -0300
Subject: [PATCH 24/33] e2e test for fspolicy

---
 .../fspolicy/test_operator_fs_policy.mjs      | 54 +++++++++++
 tests/src/operator/policies.rs                |  2 +
 tests/src/operator/policies/fs.rs             | 93 +++++++++++++++++++
 tests/src/utils.rs                            |  8 ++
 4 files changed, 157 insertions(+)
 create mode 100644 tests/node-e2e/fspolicy/test_operator_fs_policy.mjs
 create mode 100644 tests/src/operator/policies/fs.rs

diff --git a/tests/node-e2e/fspolicy/test_operator_fs_policy.mjs b/tests/node-e2e/fspolicy/test_operator_fs_policy.mjs
new file mode 100644
index 00000000000..8e58bf52cec
--- /dev/null
+++ b/tests/node-e2e/fspolicy/test_operator_fs_policy.mjs
@@ -0,0 +1,54 @@
+import fs from 'fs';
+
+fs.open("/app/file.local", (fail, fd) => {
+  console.log(`open file.local ${fd}`);
+  if (fd) {
+    console.log(`SUCCESS /app/file.local ${fd}`);
+  }
+
+  if (fail) {
+    console.error(`FAIL /app/file.local ${fail}`);
+  }
+});
+
+fs.open("/app/file.not-found", (fail, fd) => {
+  console.log(`open file.not-found ${fd}`);
+  if (fd) {
+    console.log(`SUCCESS /app/file.not-found ${fd}`);
+  }
+
+  if (fail) {
+    console.error(`FAIL /app/file.not-found ${fail}`);
+  }
+});
+
+fs.open("/app/file.read-only", (fail, fd) => {
+  if (fd) {
+    console.log(`SUCCESS /app/file.read-only ${fd}`);
+  }
+
+  if (fail) {
+    console.error(`FAIL /app/file.read-only ${fail}`);
+  }
+});
+
+fs.open("/app/file.read-only", "r+", (fail, fd) => {
+  if (fd) {
+    console.log(`SUCCESS r+ /app/file.read-only ${fd}`);
+  }
+
+  if (fail) {
+    console.error(`FAIL r+ /app/file.read-only ${fail}`);
+  }
+});
+
+fs.open("/app/file.read-write", "r+", (fail, fd) => {
+  if (fd) {
+    console.log(`SUCCESS /app/file.read-write ${fd}`);
+  }
+
+  if (fail) {
+    console.error(`FAIL /app/file.read-write ${fail}`);
+  }
+});
+
diff --git a/tests/src/operator/policies.rs b/tests/src/operator/policies.rs
index 7ff69d8e78f..114d42968e6 100644
--- a/tests/src/operator/policies.rs
+++ b/tests/src/operator/policies.rs
@@ -18,6 +18,8 @@ use crate::utils::{
     config_dir, kube_client, service, Application, KubeService, ResourceGuard, TestProcess,
 };
 
+mod fs;
+
 /// Guard that deletes a mirrord policy when dropped.
 struct PolicyGuard {
     _inner: ResourceGuard,
diff --git a/tests/src/operator/policies/fs.rs b/tests/src/operator/policies/fs.rs
new file mode 100644
index 00000000000..bdcbbce45c8
--- /dev/null
+++ b/tests/src/operator/policies/fs.rs
@@ -0,0 +1,93 @@
+use std::{collections::HashSet, time::Duration};
+
+use mirrord_operator::crd::policy::{FsPolicy, MirrordClusterPolicy, MirrordClusterPolicySpec};
+use rstest::{fixture, rstest};
+
+use crate::{
+    operator::policies::PolicyGuard,
+    utils::{kube_client, service, Application, KubeService},
+};
+
+#[fixture]
+async fn fs_service(#[future] kube_client: kube::Client) -> KubeService {
+    let namespace = format!("e2e-tests-fs-policies-{}", crate::utils::random_string());
+
+    service(
+        &namespace,
+        "NodePort",
+        "ghcr.io/metalbear-co/mirrord-pytest:latest",
+        "fs-policy-e2e-test-service",
+        false,
+        kube_client,
+    )
+    .await
+}
+
+#[rstest]
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[timeout(Duration::from_secs(60))]
+pub async fn create_cluster_fs_policy_and_try_file_operations(
+    #[future] service: KubeService,
+    #[future] kube_client: kube::Client,
+) {
+    let kube_client = kube_client.await;
+    let service = service.await;
+
+    // Create policy, delete it when test exits.
+    let _policy_guard = PolicyGuard::clusterwide(
+        kube_client,
+        &MirrordClusterPolicy::new(
+            "e2e-test-block-mirror-with-path-pattern",
+            MirrordClusterPolicySpec {
+                target_path: Some("fs_policy_e2e-test-*".into()),
+                selector: None,
+                block: Default::default(),
+                env: Default::default(),
+                fs: FsPolicy {
+                    read_only: HashSet::from_iter(vec!["file.read-only".to_string()]),
+                    read_write: HashSet::from_iter(vec!["file.read-write".to_string()]),
+                    local: HashSet::from_iter(vec!["file.local".to_string()]),
+                    not_found: HashSet::from_iter(vec!["file.not-found".to_string()]),
+                },
+            },
+        ),
+    )
+    .await;
+
+    let application = Application::NodeFsPolicy;
+    println!("Running mirrord {application:?} against {}", &service.name);
+
+    let mut test_process = application
+        .run(
+            &service.target,
+            Some(&service.namespace),
+            Some(vec!["--fs-mode=write"]),
+            None,
+        )
+        .await;
+
+    test_process
+        .wait_for_line(Duration::from_secs(40), "daemon subscribed")
+        .await;
+
+    test_process.wait_assert_success().await;
+
+    test_process
+        .assert_stderr_contains("FAIL /app/file.local")
+        .await;
+    test_process
+        .assert_stderr_contains("FAIL /app/file.not-found")
+        .await;
+    test_process
+        .assert_stderr_contains("FAIL r+ /app/file.read-only")
+        .await;
+
+    test_process
+        .assert_stdout_contains("SUCCESS /app/file.read-only")
+        .await;
+    test_process
+        .assert_stdout_contains("SUCCESS /app/file.read-write")
+        .await;
+
+    test_process.child.kill().await.unwrap()
+}
diff --git a/tests/src/utils.rs b/tests/src/utils.rs
index bf807337a09..538a4d753e6 100644
--- a/tests/src/utils.rs
+++ b/tests/src/utils.rs
@@ -100,6 +100,11 @@ pub enum Application {
     PythonCloseSocketKeepConnection,
     RustWebsockets,
     RustSqs,
+    /// Tries to open files in the remote target, but these operations should succeed or fail based
+    /// on mirrord `FsPolicy`.
+    ///
+    /// - `node-e2e/fspolicy/test_operator_fs_policy.mjs`
+    NodeFsPolicy,
 }
 
 #[derive(Debug)]
@@ -408,6 +413,9 @@ impl Application {
             Application::NodeHTTP2 => {
                 vec!["node", "node-e2e/http2/test_http2_traffic_steal.mjs"]
             }
+            Application::NodeFsPolicy => {
+                vec!["node", "node-e2e/fspolicy/test_operator_fs_policy.mjs"]
+            }
             Application::Go21HTTP => vec!["go-e2e/21.go_test_app"],
             Application::Go22HTTP => vec!["go-e2e/22.go_test_app"],
             Application::Go23HTTP => vec!["go-e2e/23.go_test_app"],

From 53112c44176e7b5589c82142e7909a6af3f745ca Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Wed, 8 Jan 2025 18:53:47 -0300
Subject: [PATCH 25/33] Ignore fs policy test/

---
 tests/src/operator/policies.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/src/operator/policies.rs b/tests/src/operator/policies.rs
index 114d42968e6..a37258cfa40 100644
--- a/tests/src/operator/policies.rs
+++ b/tests/src/operator/policies.rs
@@ -18,7 +18,7 @@ use crate::utils::{
     config_dir, kube_client, service, Application, KubeService, ResourceGuard, TestProcess,
 };
 
-mod fs;
+// mod fs;
 
 /// Guard that deletes a mirrord policy when dropped.
 struct PolicyGuard {

From 1f8fc85f4ddd8b0f71c6a36f3aca96a103983038 Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Wed, 8 Jan 2025 19:09:25 -0300
Subject: [PATCH 26/33] namespaced test

---
 tests/src/operator/policies.rs    |  4 ++--
 tests/src/operator/policies/fs.rs | 10 ++++++----
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/tests/src/operator/policies.rs b/tests/src/operator/policies.rs
index a37258cfa40..2ed6b93e1fd 100644
--- a/tests/src/operator/policies.rs
+++ b/tests/src/operator/policies.rs
@@ -1,5 +1,5 @@
 #![cfg(test)]
-#![cfg(feature = "operator")]
+// #![cfg(feature = "operator")]
 //! Test that mirrordpolicies work and features are blocked.
 
 use std::{collections::BTreeMap, time::Duration};
@@ -18,7 +18,7 @@ use crate::utils::{
     config_dir, kube_client, service, Application, KubeService, ResourceGuard, TestProcess,
 };
 
-// mod fs;
+mod fs;
 
 /// Guard that deletes a mirrord policy when dropped.
 struct PolicyGuard {
diff --git a/tests/src/operator/policies/fs.rs b/tests/src/operator/policies/fs.rs
index bdcbbce45c8..9d1212bb89c 100644
--- a/tests/src/operator/policies/fs.rs
+++ b/tests/src/operator/policies/fs.rs
@@ -1,6 +1,6 @@
 use std::{collections::HashSet, time::Duration};
 
-use mirrord_operator::crd::policy::{FsPolicy, MirrordClusterPolicy, MirrordClusterPolicySpec};
+use mirrord_operator::crd::policy::{FsPolicy, MirrordPolicy, MirrordPolicySpec};
 use rstest::{fixture, rstest};
 
 use crate::{
@@ -34,11 +34,12 @@ pub async fn create_cluster_fs_policy_and_try_file_operations(
     let service = service.await;
 
     // Create policy, delete it when test exits.
-    let _policy_guard = PolicyGuard::clusterwide(
+    // TODO(alex) [high]: Should probably be namespaced, to avoid it infecting other tests?
+    let _policy_guard = PolicyGuard::namespaced(
         kube_client,
-        &MirrordClusterPolicy::new(
+        &MirrordPolicy::new(
             "e2e-test-block-mirror-with-path-pattern",
-            MirrordClusterPolicySpec {
+            MirrordPolicySpec {
                 target_path: Some("fs_policy_e2e-test-*".into()),
                 selector: None,
                 block: Default::default(),
@@ -51,6 +52,7 @@ pub async fn create_cluster_fs_policy_and_try_file_operations(
                 },
             },
         ),
+        &service.namespace,
     )
     .await;
 

From dfa2edd8fcf10ec7597ba8be07d4264c69b5b344 Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Thu, 9 Jan 2025 11:19:20 -0300
Subject: [PATCH 27/33] hopefully fixed policy test

---
 tests/src/operator/policies.rs    | 2 +-
 tests/src/operator/policies/fs.rs | 5 -----
 2 files changed, 1 insertion(+), 6 deletions(-)

diff --git a/tests/src/operator/policies.rs b/tests/src/operator/policies.rs
index 2ed6b93e1fd..114d42968e6 100644
--- a/tests/src/operator/policies.rs
+++ b/tests/src/operator/policies.rs
@@ -1,5 +1,5 @@
 #![cfg(test)]
-// #![cfg(feature = "operator")]
+#![cfg(feature = "operator")]
 //! Test that mirrordpolicies work and features are blocked.
 
 use std::{collections::BTreeMap, time::Duration};
diff --git a/tests/src/operator/policies/fs.rs b/tests/src/operator/policies/fs.rs
index 9d1212bb89c..7130a006f42 100644
--- a/tests/src/operator/policies/fs.rs
+++ b/tests/src/operator/policies/fs.rs
@@ -34,7 +34,6 @@ pub async fn create_cluster_fs_policy_and_try_file_operations(
     let service = service.await;
 
     // Create policy, delete it when test exits.
-    // TODO(alex) [high]: Should probably be namespaced, to avoid it infecting other tests?
     let _policy_guard = PolicyGuard::namespaced(
         kube_client,
         &MirrordPolicy::new(
@@ -68,10 +67,6 @@ pub async fn create_cluster_fs_policy_and_try_file_operations(
         )
         .await;
 
-    test_process
-        .wait_for_line(Duration::from_secs(40), "daemon subscribed")
-        .await;
-
     test_process.wait_assert_success().await;
 
     test_process

From 9f5b738bd731b46bb0d92fab47f2ac1b269e4b46 Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Thu, 9 Jan 2025 11:19:55 -0300
Subject: [PATCH 28/33] the children get to live

---
 tests/src/operator/policies/fs.rs | 2 --
 1 file changed, 2 deletions(-)

diff --git a/tests/src/operator/policies/fs.rs b/tests/src/operator/policies/fs.rs
index 7130a006f42..c3df837a4fb 100644
--- a/tests/src/operator/policies/fs.rs
+++ b/tests/src/operator/policies/fs.rs
@@ -85,6 +85,4 @@ pub async fn create_cluster_fs_policy_and_try_file_operations(
     test_process
         .assert_stdout_contains("SUCCESS /app/file.read-write")
         .await;
-
-    test_process.child.kill().await.unwrap()
 }

From 3f4a0a62f8db4e93a47684860723a73e1f05c3c6 Mon Sep 17 00:00:00 2001
From: meowjesty <43983236+meowjesty@users.noreply.github.com>
Date: Thu, 9 Jan 2025 11:21:23 -0300
Subject: [PATCH 29/33] fix test policy name

Co-authored-by: t4lz <t4lz.git@gmail.com>
---
 tests/src/operator/policies/fs.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/src/operator/policies/fs.rs b/tests/src/operator/policies/fs.rs
index c3df837a4fb..2d9a8e08829 100644
--- a/tests/src/operator/policies/fs.rs
+++ b/tests/src/operator/policies/fs.rs
@@ -37,7 +37,7 @@ pub async fn create_cluster_fs_policy_and_try_file_operations(
     let _policy_guard = PolicyGuard::namespaced(
         kube_client,
         &MirrordPolicy::new(
-            "e2e-test-block-mirror-with-path-pattern",
+            "e2e-test-fs-policy-with-path-pattern",
             MirrordPolicySpec {
                 target_path: Some("fs_policy_e2e-test-*".into()),
                 selector: None,

From bf1073a6b114acd94816618b3321ef142b801874 Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Thu, 9 Jan 2025 11:49:12 -0300
Subject: [PATCH 30/33] fix go fs test

---
 tests/go-e2e-dir/main.go | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/tests/go-e2e-dir/main.go b/tests/go-e2e-dir/main.go
index b608f01b53b..80006ce58c5 100644
--- a/tests/go-e2e-dir/main.go
+++ b/tests/go-e2e-dir/main.go
@@ -15,13 +15,20 @@ func main() {
 		os.Exit(-1)
 	}
 	fmt.Printf("DirEntries: %s\n", dir)
+
 	// `os.ReadDir` does not include `.` and `..`.
-	if len(dir) != 2 {
+	if len(dir) < 2 {
 		os.Exit(-1)
 	}
-	// `os.ReadDir` sorts the result by file name.
-	if dir[0].Name() != "app.py" || dir[1].Name() != "test.txt" {
-		os.Exit(-1)
+
+	// Iterate over the files in this dir, exiting if it's not an expected file name.
+	for i := 0; i < len(dir); i++ {
+		dirName := dir[i].Name()
+
+		if dirName != "app.py" && dirName != "test.txt" && dirName != "file.local" && dirName != "file.not-found" && dirName != "file.read-only" && dirName != "file.read-write" {
+			os.Exit(-1)
+		}
+
 	}
 
 	err = os.Mkdir("/app/test_mkdir", 0755)

From 2ef52e6b5a16abd61fdb2be84158309dd09f6f94 Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Thu, 9 Jan 2025 13:55:55 -0300
Subject: [PATCH 31/33] remove read_write

---
 mirrord/operator/src/crd/policy.rs | 4 ----
 tests/src/operator/policies/fs.rs  | 1 -
 2 files changed, 5 deletions(-)

diff --git a/mirrord/operator/src/crd/policy.rs b/mirrord/operator/src/crd/policy.rs
index d18ecd793bf..e236164da98 100644
--- a/mirrord/operator/src/crd/policy.rs
+++ b/mirrord/operator/src/crd/policy.rs
@@ -130,10 +130,6 @@ pub struct FsPolicy {
     #[serde(default)]
     pub read_only: HashSet<String>,
 
-    /// The file may be opened in read-write mode.
-    #[serde(default)]
-    pub read_write: HashSet<String>,
-
     /// The file cannot be opened in the remote target.
     ///
     /// `open` calls that match this are forced to be opened in the local user's machine.
diff --git a/tests/src/operator/policies/fs.rs b/tests/src/operator/policies/fs.rs
index 2d9a8e08829..d54ed7bb98d 100644
--- a/tests/src/operator/policies/fs.rs
+++ b/tests/src/operator/policies/fs.rs
@@ -45,7 +45,6 @@ pub async fn create_cluster_fs_policy_and_try_file_operations(
                 env: Default::default(),
                 fs: FsPolicy {
                     read_only: HashSet::from_iter(vec!["file.read-only".to_string()]),
-                    read_write: HashSet::from_iter(vec!["file.read-write".to_string()]),
                     local: HashSet::from_iter(vec!["file.local".to_string()]),
                     not_found: HashSet::from_iter(vec!["file.not-found".to_string()]),
                 },

From e942a0b60718580d8cec87245552e0cdbbf9c50c Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Thu, 9 Jan 2025 14:05:30 -0300
Subject: [PATCH 32/33] add newline to python test

---
 tests/python-e2e/files_ro.py | 4 ++--
 tests/python-e2e/ops.py      | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/tests/python-e2e/files_ro.py b/tests/python-e2e/files_ro.py
index ed99eab5d7f..c6e4e8d5631 100644
--- a/tests/python-e2e/files_ro.py
+++ b/tests/python-e2e/files_ro.py
@@ -3,7 +3,7 @@
 import uuid
 import unittest
 
-TEXT = "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum."
+TEXT = "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.\n"
 
 
 class FileOpsTest(unittest.TestCase):
@@ -22,4 +22,4 @@ def test_read_only(self):
 
 
 if __name__ == "__main__":
-    unittest.main()
\ No newline at end of file
+    unittest.main()
diff --git a/tests/python-e2e/ops.py b/tests/python-e2e/ops.py
index 8e83271628f..9f94425921e 100644
--- a/tests/python-e2e/ops.py
+++ b/tests/python-e2e/ops.py
@@ -2,7 +2,7 @@
 import uuid
 import unittest
 
-TEXT = "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum."
+TEXT = "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.\n"
 
 
 class FileOpsTest(unittest.TestCase):

From ed913557b64d009cff627d1e9cb71283dfea707d Mon Sep 17 00:00:00 2001
From: meowjesty <meowjesty_nyan@outlook.com>
Date: Thu, 9 Jan 2025 14:33:20 -0300
Subject: [PATCH 33/33] changelog

---
 changelog.d/+104-policy-fs.added.md | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 changelog.d/+104-policy-fs.added.md

diff --git a/changelog.d/+104-policy-fs.added.md b/changelog.d/+104-policy-fs.added.md
new file mode 100644
index 00000000000..1ad43a13736
--- /dev/null
+++ b/changelog.d/+104-policy-fs.added.md
@@ -0,0 +1 @@
+Add policy to control file ops.