Skip to content

Commit 082d59a

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #1008 from perdasilva/networkpolicy
OPRUN-3923,OPRUN-3906,OPRUN-3903,OPRUN-3926: Add NetworkPolicy support to OLMv0 components
2 parents 1c88f59 + 03b8689 commit 082d59a

File tree

50 files changed

+2330
-156
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

50 files changed

+2330
-156
lines changed

‎manifests/0000_50_olm_01-networkpolicies.yaml

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: default-deny-all-traffic
5+
namespace: openshift-operator-lifecycle-manager
6+
annotations:
7+
include.release.openshift.io/ibm-cloud-managed: "true"
8+
include.release.openshift.io/self-managed-high-availability: "true"
9+
capability.openshift.io/name: "OperatorLifecycleManager"
10+
include.release.openshift.io/hypershift: "true"
11+
spec:
12+
podSelector: {}
13+
policyTypes:
14+
- Ingress
15+
- Egress
16+
---
17+
apiVersion: networking.k8s.io/v1
18+
kind: NetworkPolicy
19+
metadata:
20+
name: olm-operator
21+
namespace: openshift-operator-lifecycle-manager
22+
annotations:
23+
include.release.openshift.io/ibm-cloud-managed: "true"
24+
include.release.openshift.io/self-managed-high-availability: "true"
25+
capability.openshift.io/name: "OperatorLifecycleManager"
26+
include.release.openshift.io/hypershift: "true"
27+
spec:
28+
podSelector:
29+
matchLabels:
30+
app: olm-operator
31+
ingress:
32+
- ports:
33+
- port: metrics
34+
protocol: TCP
35+
egress:
36+
- ports:
37+
- port: 6443
38+
protocol: TCP
39+
- ports:
40+
- port: dns-tcp
41+
protocol: TCP
42+
- port: dns
43+
protocol: UDP
44+
to:
45+
- namespaceSelector:
46+
matchLabels:
47+
kubernetes.io/metadata.name: openshift-dns
48+
policyTypes:
49+
- Ingress
50+
- Egress
51+
---
52+
apiVersion: networking.k8s.io/v1
53+
kind: NetworkPolicy
54+
metadata:
55+
name: catalog-operator
56+
namespace: openshift-operator-lifecycle-manager
57+
annotations:
58+
include.release.openshift.io/ibm-cloud-managed: "true"
59+
include.release.openshift.io/self-managed-high-availability: "true"
60+
capability.openshift.io/name: "OperatorLifecycleManager"
61+
include.release.openshift.io/hypershift: "true"
62+
spec:
63+
podSelector:
64+
matchLabels:
65+
app: catalog-operator
66+
ingress:
67+
- ports:
68+
- port: metrics
69+
protocol: TCP
70+
egress:
71+
- ports:
72+
- port: 6443
73+
protocol: TCP
74+
- ports:
75+
- port: dns-tcp
76+
protocol: TCP
77+
- port: dns
78+
protocol: UDP
79+
to:
80+
- namespaceSelector:
81+
matchLabels:
82+
kubernetes.io/metadata.name: openshift-dns
83+
- ports: # This is another distinct rule in the egress list
84+
- protocol: TCP
85+
port: 50051
86+
policyTypes:
87+
- Ingress
88+
- Egress
89+
---
90+
apiVersion: networking.k8s.io/v1
91+
kind: NetworkPolicy
92+
metadata:
93+
name: packageserver
94+
namespace: openshift-operator-lifecycle-manager
95+
annotations:
96+
include.release.openshift.io/ibm-cloud-managed: "true"
97+
include.release.openshift.io/self-managed-high-availability: "true"
98+
capability.openshift.io/name: "OperatorLifecycleManager"
99+
include.release.openshift.io/hypershift: "true"
100+
spec:
101+
podSelector:
102+
matchLabels:
103+
app: packageserver
104+
ingress:
105+
- ports:
106+
- protocol: TCP
107+
port: 5443
108+
egress:
109+
- ports:
110+
- port: 6443
111+
protocol: TCP
112+
- ports:
113+
- port: dns-tcp
114+
protocol: TCP
115+
- port: dns
116+
protocol: UDP
117+
to:
118+
- namespaceSelector:
119+
matchLabels:
120+
kubernetes.io/metadata.name: openshift-dns
121+
- ports:
122+
- protocol: TCP
123+
port: 50051
124+
policyTypes:
125+
- Ingress
126+
- Egress
127+
---
128+
apiVersion: networking.k8s.io/v1
129+
kind: NetworkPolicy
130+
metadata:
131+
name: default-allow-all
132+
namespace: openshift-operators
133+
annotations:
134+
include.release.openshift.io/ibm-cloud-managed: "true"
135+
include.release.openshift.io/self-managed-high-availability: "true"
136+
capability.openshift.io/name: "OperatorLifecycleManager"
137+
include.release.openshift.io/hypershift: "true"
138+
spec:
139+
podSelector: {}
140+
policyTypes:
141+
- Ingress
142+
- Egress
143+
ingress:
144+
- {}
145+
egress:
146+
- {}

‎manifests/0000_50_olm_01-olm-operator.serviceaccount.yaml renamed to ‎manifests/0000_50_olm_02-olm-operator.serviceaccount.yaml

File renamed without changes.

‎manifests/0000_50_olm_02-olmconfig.yaml renamed to ‎manifests/0000_50_olm_03-olmconfig.yaml

File renamed without changes.

‎manifests/0000_50_olm_02-services.yaml renamed to ‎manifests/0000_50_olm_03-services.yaml

File renamed without changes.

‎manifests/0000_50_olm_06-psm-operator.networkpolicy.yaml

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: package-server-manager
5+
namespace: openshift-operator-lifecycle-manager
6+
annotations:
7+
include.release.openshift.io/ibm-cloud-managed: "true"
8+
include.release.openshift.io/self-managed-high-availability: "true"
9+
capability.openshift.io/name: "OperatorLifecycleManager"
10+
include.release.openshift.io/hypershift: "true"
11+
spec:
12+
podSelector:
13+
matchLabels:
14+
app: package-server-manager
15+
ingress:
16+
- ports:
17+
- port: 8443
18+
protocol: TCP
19+
egress:
20+
- ports:
21+
- port: 6443
22+
protocol: TCP
23+
- ports:
24+
- port: dns-tcp
25+
protocol: TCP
26+
- port: dns
27+
protocol: UDP
28+
to:
29+
- namespaceSelector:
30+
matchLabels:
31+
kubernetes.io/metadata.name: openshift-dns
32+
policyTypes:
33+
- Ingress
34+
- Egress

‎manifests/0000_50_olm_07-collect-profiles.cronjob.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ metadata:
77
include.release.openshift.io/self-managed-high-availability: "true"
88
capability.openshift.io/name: "OperatorLifecycleManager"
99
name: collect-profiles
10+
labels:
11+
app: olm-collect-profiles
1012
namespace: openshift-operator-lifecycle-manager
1113
spec:
1214
schedule: "*/15 * * * *"
@@ -18,6 +20,8 @@ spec:
1820
annotations:
1921
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
2022
openshift.io/required-scc: restricted-v2
23+
labels:
24+
app: olm-collect-profiles
2125
spec:
2226
securityContext:
2327
runAsNonRoot: true

‎manifests/0000_50_olm_07-collect-profiles.networkpolicy.yaml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: collect-profiles
5+
namespace: openshift-operator-lifecycle-manager
6+
annotations:
7+
include.release.openshift.io/ibm-cloud-managed: "true"
8+
include.release.openshift.io/self-managed-high-availability: "true"
9+
capability.openshift.io/name: "OperatorLifecycleManager"
10+
include.release.openshift.io/hypershift: "true"
11+
spec:
12+
podSelector:
13+
matchLabels:
14+
app: olm-collect-profiles
15+
egress:
16+
- ports:
17+
- port: 8443
18+
protocol: TCP
19+
to:
20+
- namespaceSelector:
21+
matchLabels:
22+
name: openshift-operator-lifecycle-manager
23+
- podSelector:
24+
matchLabels:
25+
app: olm-operator
26+
- podSelector:
27+
matchLabels:
28+
app: catalog-operator
29+
- ports:
30+
- port: 6443
31+
protocol: TCP
32+
- ports:
33+
- port: dns-tcp
34+
protocol: TCP
35+
- port: dns
36+
protocol: UDP
37+
to:
38+
- namespaceSelector:
39+
matchLabels:
40+
kubernetes.io/metadata.name: openshift-dns
41+
policyTypes:
42+
- Egress
43+
- Ingress

‎microshift-manifests/0000_50_olm_01-networkpolicies.yaml

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
---
2+
apiVersion: networking.k8s.io/v1
3+
kind: NetworkPolicy
4+
metadata:
5+
name: default-deny-all-traffic
6+
namespace: openshift-operator-lifecycle-manager
7+
annotations:
8+
include.release.openshift.io/ibm-cloud-managed: "true"
9+
include.release.openshift.io/self-managed-high-availability: "true"
10+
capability.openshift.io/name: "OperatorLifecycleManager"
11+
include.release.openshift.io/hypershift: "true"
12+
spec:
13+
podSelector: {}
14+
policyTypes:
15+
- Ingress
16+
- Egress
17+
---
18+
apiVersion: networking.k8s.io/v1
19+
kind: NetworkPolicy
20+
metadata:
21+
name: olm-operator
22+
namespace: openshift-operator-lifecycle-manager
23+
annotations:
24+
include.release.openshift.io/ibm-cloud-managed: "true"
25+
include.release.openshift.io/self-managed-high-availability: "true"
26+
capability.openshift.io/name: "OperatorLifecycleManager"
27+
include.release.openshift.io/hypershift: "true"
28+
spec:
29+
podSelector:
30+
matchLabels:
31+
app: olm-operator
32+
ingress:
33+
- ports:
34+
- port: metrics
35+
protocol: TCP
36+
egress:
37+
- ports:
38+
- port: 6443
39+
protocol: TCP
40+
- ports:
41+
- port: dns-tcp
42+
protocol: TCP
43+
- port: dns
44+
protocol: UDP
45+
to:
46+
- namespaceSelector:
47+
matchLabels:
48+
kubernetes.io/metadata.name: openshift-dns
49+
policyTypes:
50+
- Ingress
51+
- Egress
52+
---
53+
apiVersion: networking.k8s.io/v1
54+
kind: NetworkPolicy
55+
metadata:
56+
name: catalog-operator
57+
namespace: openshift-operator-lifecycle-manager
58+
annotations:
59+
include.release.openshift.io/ibm-cloud-managed: "true"
60+
include.release.openshift.io/self-managed-high-availability: "true"
61+
capability.openshift.io/name: "OperatorLifecycleManager"
62+
include.release.openshift.io/hypershift: "true"
63+
spec:
64+
podSelector:
65+
matchLabels:
66+
app: catalog-operator
67+
ingress:
68+
- ports:
69+
- port: metrics
70+
protocol: TCP
71+
egress:
72+
- ports:
73+
- port: 6443
74+
protocol: TCP
75+
- ports:
76+
- port: dns-tcp
77+
protocol: TCP
78+
- port: dns
79+
protocol: UDP
80+
to:
81+
- namespaceSelector:
82+
matchLabels:
83+
kubernetes.io/metadata.name: openshift-dns
84+
- ports: # This is another distinct rule in the egress list
85+
- protocol: TCP
86+
port: 50051
87+
policyTypes:
88+
- Ingress
89+
- Egress

‎microshift-manifests/0000_50_olm_01-olm-operator.serviceaccount.yaml renamed to ‎microshift-manifests/0000_50_olm_02-olm-operator.serviceaccount.yaml

File renamed without changes.

‎microshift-manifests/0000_50_olm_02-olmconfig.yaml renamed to ‎microshift-manifests/0000_50_olm_03-olmconfig.yaml

File renamed without changes.

‎microshift-manifests/0000_50_olm_02-services.yaml renamed to ‎microshift-manifests/0000_50_olm_03-services.yaml

File renamed without changes.

‎microshift-manifests/0000_50_olm_06-psm-operator.networkpolicy.yaml

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: package-server-manager
5+
namespace: openshift-operator-lifecycle-manager
6+
annotations:
7+
include.release.openshift.io/ibm-cloud-managed: "true"
8+
include.release.openshift.io/self-managed-high-availability: "true"
9+
capability.openshift.io/name: "OperatorLifecycleManager"
10+
include.release.openshift.io/hypershift: "true"
11+
spec:
12+
podSelector:
13+
matchLabels:
14+
app: package-server-manager
15+
ingress:
16+
- ports:
17+
- port: 8443
18+
protocol: TCP
19+
egress:
20+
- ports:
21+
- port: 6443
22+
protocol: TCP
23+
- ports:
24+
- port: dns-tcp
25+
protocol: TCP
26+
- port: dns
27+
protocol: UDP
28+
to:
29+
- namespaceSelector:
30+
matchLabels:
31+
kubernetes.io/metadata.name: openshift-dns
32+
policyTypes:
33+
- Ingress
34+
- Egress

‎microshift-manifests/0000_50_olm_07-collect-profiles.cronjob.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ metadata:
77
include.release.openshift.io/self-managed-high-availability: "true"
88
capability.openshift.io/name: "OperatorLifecycleManager"
99
name: collect-profiles
10+
labels:
11+
app: olm-collect-profiles
1012
namespace: openshift-operator-lifecycle-manager
1113
spec:
1214
schedule: "*/15 * * * *"
@@ -18,6 +20,8 @@ spec:
1820
annotations:
1921
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
2022
openshift.io/required-scc: restricted-v2
23+
labels:
24+
app: olm-collect-profiles
2125
spec:
2226
securityContext:
2327
runAsNonRoot: true

0 commit comments

Comments
 (0)