Skip to content

Commit 263fbc5

Browse files
author
Per Goncalves da Silva
committed
OPRUN-3926: add static network policy for collect-profiles pod
Signed-off-by: Per Goncalves da Silva <[email protected]>
1 parent 971fb17 commit 263fbc5

6 files changed

+145
-0
lines changed

‎manifests/0000_50_olm_07-collect-profiles.cronjob.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ metadata:
77
include.release.openshift.io/self-managed-high-availability: "true"
88
capability.openshift.io/name: "OperatorLifecycleManager"
99
name: collect-profiles
10+
labels:
11+
app: olm-collect-profiles
1012
namespace: openshift-operator-lifecycle-manager
1113
spec:
1214
schedule: "*/15 * * * *"
@@ -18,6 +20,8 @@ spec:
1820
annotations:
1921
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
2022
openshift.io/required-scc: restricted-v2
23+
labels:
24+
app: olm-collect-profiles
2125
spec:
2226
securityContext:
2327
runAsNonRoot: true

‎manifests/0000_50_olm_07-collect-profiles.networkpolicy.yaml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: collect-profiles
5+
namespace: openshift-operator-lifecycle-manager
6+
annotations:
7+
include.release.openshift.io/ibm-cloud-managed: "true"
8+
include.release.openshift.io/self-managed-high-availability: "true"
9+
capability.openshift.io/name: "OperatorLifecycleManager"
10+
include.release.openshift.io/hypershift: "true"
11+
spec:
12+
podSelector:
13+
matchLabels:
14+
app: olm-collect-profiles
15+
egress:
16+
- ports:
17+
- port: 8443
18+
protocol: TCP
19+
to:
20+
- namespaceSelector:
21+
matchLabels:
22+
name: openshift-operator-lifecycle-manager
23+
- podSelector:
24+
matchLabels:
25+
app: olm-operator
26+
- podSelector:
27+
matchLabels:
28+
app: catalog-operator
29+
- ports:
30+
- port: 6443
31+
protocol: TCP
32+
- ports:
33+
- port: dns-tcp
34+
protocol: TCP
35+
- port: dns
36+
protocol: UDP
37+
to:
38+
- namespaceSelector:
39+
matchLabels:
40+
kubernetes.io/metadata.name: openshift-dns
41+
policyTypes:
42+
- Egress
43+
- Ingress

‎microshift-manifests/0000_50_olm_07-collect-profiles.cronjob.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ metadata:
77
include.release.openshift.io/self-managed-high-availability: "true"
88
capability.openshift.io/name: "OperatorLifecycleManager"
99
name: collect-profiles
10+
labels:
11+
app: olm-collect-profiles
1012
namespace: openshift-operator-lifecycle-manager
1113
spec:
1214
schedule: "*/15 * * * *"
@@ -18,6 +20,8 @@ spec:
1820
annotations:
1921
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
2022
openshift.io/required-scc: restricted-v2
23+
labels:
24+
app: olm-collect-profiles
2125
spec:
2226
securityContext:
2327
runAsNonRoot: true

‎microshift-manifests/0000_50_olm_07-collect-profiles.networkpolicy.yaml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: collect-profiles
5+
namespace: openshift-operator-lifecycle-manager
6+
annotations:
7+
include.release.openshift.io/ibm-cloud-managed: "true"
8+
include.release.openshift.io/self-managed-high-availability: "true"
9+
capability.openshift.io/name: "OperatorLifecycleManager"
10+
include.release.openshift.io/hypershift: "true"
11+
spec:
12+
podSelector:
13+
matchLabels:
14+
app: olm-collect-profiles
15+
egress:
16+
- ports:
17+
- port: 8443
18+
protocol: TCP
19+
to:
20+
- namespaceSelector:
21+
matchLabels:
22+
name: openshift-operator-lifecycle-manager
23+
- podSelector:
24+
matchLabels:
25+
app: olm-operator
26+
- podSelector:
27+
matchLabels:
28+
app: catalog-operator
29+
- ports:
30+
- port: 6443
31+
protocol: TCP
32+
- ports:
33+
- port: dns-tcp
34+
protocol: TCP
35+
- port: dns
36+
protocol: UDP
37+
to:
38+
- namespaceSelector:
39+
matchLabels:
40+
kubernetes.io/metadata.name: openshift-dns
41+
policyTypes:
42+
- Egress
43+
- Ingress

‎scripts/generate_crds_manifests.sh

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -400,6 +400,52 @@ data:
400400
tls.key: ""
401401
EOF
402402

403+
cat << EOF > manifests/0000_50_olm_07-collect-profiles.networkpolicy.yaml
404+
apiVersion: networking.k8s.io/v1
405+
kind: NetworkPolicy
406+
metadata:
407+
name: collect-profiles
408+
namespace: openshift-operator-lifecycle-manager
409+
annotations:
410+
include.release.openshift.io/ibm-cloud-managed: "true"
411+
include.release.openshift.io/self-managed-high-availability: "true"
412+
capability.openshift.io/name: "OperatorLifecycleManager"
413+
include.release.openshift.io/hypershift: "true"
414+
spec:
415+
podSelector:
416+
matchLabels:
417+
app: olm-collect-profiles
418+
egress:
419+
- ports:
420+
- port: 8443
421+
protocol: TCP
422+
to:
423+
- namespaceSelector:
424+
matchLabels:
425+
name: openshift-operator-lifecycle-manager
426+
- podSelector:
427+
matchLabels:
428+
app: olm-operator
429+
- podSelector:
430+
matchLabels:
431+
app: catalog-operator
432+
- ports:
433+
- port: 6443
434+
protocol: TCP
435+
- ports:
436+
- port: dns-tcp
437+
protocol: TCP
438+
- port: dns
439+
protocol: UDP
440+
to:
441+
- namespaceSelector:
442+
matchLabels:
443+
kubernetes.io/metadata.name: openshift-dns
444+
policyTypes:
445+
- Egress
446+
- Ingress
447+
EOF
448+
403449
cat << EOF > manifests/0000_50_olm_07-collect-profiles.cronjob.yaml
404450
apiVersion: batch/v1
405451
kind: CronJob
@@ -409,6 +455,8 @@ metadata:
409455
include.release.openshift.io/hypershift: "true"
410456
include.release.openshift.io/self-managed-high-availability: "true"
411457
name: collect-profiles
458+
labels:
459+
app: olm-collect-profiles
412460
namespace: openshift-operator-lifecycle-manager
413461
spec:
414462
schedule: "*/15 * * * *"
@@ -420,6 +468,8 @@ spec:
420468
annotations:
421469
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
422470
openshift.io/required-scc: restricted-v2
471+
labels:
472+
app: olm-collect-profiles
423473
spec:
424474
securityContext:
425475
runAsNonRoot: true

‎staging/operator-lifecycle-manager/test/e2e/util.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1069,6 +1069,7 @@ func SetupGeneratedTestNamespaceWithOperatorGroup(name string, og operatorsv1.Op
10691069
ns := corev1.Namespace{
10701070
ObjectMeta: metav1.ObjectMeta{
10711071
Name: name,
1072+
Labels: map[string]string{},
10721073
},
10731074
}
10741075
Eventually(func() error {

0 commit comments

Comments
 (0)