GeezerVison

What this PR does

A vm-instance with external: true, externalMethod: PortList and an empty externalPorts list renders a LoadBalancer Service with no port at all. The API server rejects it (Service "vm-instance-<name>" is invalid: spec.ports: Required value), so the HelmRelease fails on every retry. The previous Service stays in place meanwhile, which means the ports the user believes they removed are still open.

Emptying the list is a legitimate request: keep the VM's external IP (egress SNAT, ICMP) but expose no inbound port. This PR renders a single placeholder port in that case, 65535/SCTP, named no-ports. The protocol is the point: cozy-proxy's EnsurePortFilter only admits TCP and UDP ports into allowed_ports and skips anything else, while the pod still enters filtered_pods, so every inbound TCP and UDP packet is dropped. A TCP or UDP placeholder would open that port on the VM instead.

The WholeIP branch and the non-external branch keep their existing 65535 placeholder unchanged.

Tested on a lab cluster running cozy-proxy with node-local rules, against a running PortList VM exposing 22 and 80: with the placeholder Service, MetalLB kept the same IP, cozy-proxy logged Skipping unsupported protocol for port filter and kept the egress SNAT and ingress DNAT, TCP 22, 80 and 65535 timed out from outside, ICMP still answered (allowICMP: "true"), and the Cilium agents logged nothing about the Service. Restoring the port list reopened 22 and 80.

tests/service_ports_test.yaml covers the three external cases. Its first case fails on main (unknown path spec.ports[0]) and passes with the fix.

Screenshots

Not a UI change.

Downstream repositories

Walked the trigger map against the diff (templates/service.yaml and a new unit test in packages/apps/vm-instance): no package is added or renamed, no value, schema, default or annotation changes, and the service-proxy-name label and the wholeIP / allowICMP annotations cozy-proxy matches on are untouched. The fix does rely on cozy-proxy ignoring non-TCP/UDP ports in its port filter, which holds on cozy-proxy main today; if it ever learns SCTP, this placeholder would open 65535/SCTP and nothing else.

• No downstream repository is affected by this change
• cozystack/website - follow-up:
• cozystack/terraform-provider-cozystack - follow-up:
• cozystack/ansible-cozystack - follow-up:
• cozystack/ccp - follow-up:
• cozystack/talm - follow-up:
• cozystack/cozyhr - follow-up:
• cozystack/cozy-proxy - follow-up:
• cozystack/cozystack-telemetry-server - follow-up:
• cozystack/external-apps-example - follow-up:
• cozystack/examples - follow-up:
• cozystack/community - follow-up:

Release note

fix(vm-instance): an external PortList VM with an empty port list no longer fails to deploy; it keeps its external IP and blocks all inbound TCP and UDP traffic.

Summary by CodeRabbit

• Bug Fixes
  • External services without configured ports now include an SCTP placeholder on port 65535, except for WholeIP services, whose existing behavior is unchanged.
  • Services with configured ports continue to render those ports without the placeholder. This keeps the rendered service configuration consistent across these cases.