Skip to content

Commit 971fb17

Browse files
author
Per Goncalves da Silva
committed
OPRUN-3903: Add package server manager network policy
Signed-off-by: Per Goncalves da Silva <[email protected]>
1 parent 9020d47 commit 971fb17

4 files changed

+127
-58
lines changed

‎manifests/0000_50_olm_06-psm-operator.networkpolicy.yaml

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: package-server-manager
5+
namespace: openshift-operator-lifecycle-manager
6+
annotations:
7+
include.release.openshift.io/ibm-cloud-managed: "true"
8+
include.release.openshift.io/self-managed-high-availability: "true"
9+
capability.openshift.io/name: "OperatorLifecycleManager"
10+
include.release.openshift.io/hypershift: "true"
11+
spec:
12+
podSelector:
13+
matchLabels:
14+
app: package-server-manager
15+
ingress:
16+
- ports:
17+
- port: 8443
18+
protocol: TCP
19+
egress:
20+
- ports:
21+
- port: 6443
22+
protocol: TCP
23+
- ports:
24+
- port: dns-tcp
25+
protocol: TCP
26+
- port: dns
27+
protocol: UDP
28+
to:
29+
- namespaceSelector:
30+
matchLabels:
31+
kubernetes.io/metadata.name: openshift-dns
32+
policyTypes:
33+
- Ingress
34+
- Egress

‎microshift-manifests/0000_50_olm_01-networkpolicies.yaml

Lines changed: 1 addition & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
---
12
apiVersion: networking.k8s.io/v1
23
kind: NetworkPolicy
34
metadata:
@@ -86,61 +87,3 @@ spec:
8687
policyTypes:
8788
- Ingress
8889
- Egress
89-
---
90-
apiVersion: networking.k8s.io/v1
91-
kind: NetworkPolicy
92-
metadata:
93-
name: packageserver
94-
namespace: openshift-operator-lifecycle-manager
95-
annotations:
96-
include.release.openshift.io/ibm-cloud-managed: "true"
97-
include.release.openshift.io/self-managed-high-availability: "true"
98-
capability.openshift.io/name: "OperatorLifecycleManager"
99-
include.release.openshift.io/hypershift: "true"
100-
spec:
101-
podSelector:
102-
matchLabels:
103-
app: packageserver
104-
ingress:
105-
- ports:
106-
- protocol: TCP
107-
port: 5443
108-
egress:
109-
- ports:
110-
- port: 6443
111-
protocol: TCP
112-
- ports:
113-
- port: dns-tcp
114-
protocol: TCP
115-
- port: dns
116-
protocol: UDP
117-
to:
118-
- namespaceSelector:
119-
matchLabels:
120-
kubernetes.io/metadata.name: openshift-dns
121-
- ports:
122-
- protocol: TCP
123-
port: 50051
124-
policyTypes:
125-
- Ingress
126-
- Egress
127-
---
128-
apiVersion: networking.k8s.io/v1
129-
kind: NetworkPolicy
130-
metadata:
131-
name: default-allow-all
132-
namespace: openshift-operators
133-
annotations:
134-
include.release.openshift.io/ibm-cloud-managed: "true"
135-
include.release.openshift.io/self-managed-high-availability: "true"
136-
capability.openshift.io/name: "OperatorLifecycleManager"
137-
include.release.openshift.io/hypershift: "true"
138-
spec:
139-
podSelector: {}
140-
policyTypes:
141-
- Ingress
142-
- Egress
143-
ingress:
144-
- {}
145-
egress:
146-
- {}

‎microshift-manifests/0000_50_olm_06-psm-operator.networkpolicy.yaml

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: package-server-manager
5+
namespace: openshift-operator-lifecycle-manager
6+
annotations:
7+
include.release.openshift.io/ibm-cloud-managed: "true"
8+
include.release.openshift.io/self-managed-high-availability: "true"
9+
capability.openshift.io/name: "OperatorLifecycleManager"
10+
include.release.openshift.io/hypershift: "true"
11+
spec:
12+
podSelector:
13+
matchLabels:
14+
app: package-server-manager
15+
ingress:
16+
- ports:
17+
- port: 8443
18+
protocol: TCP
19+
egress:
20+
- ports:
21+
- port: 6443
22+
protocol: TCP
23+
- ports:
24+
- port: dns-tcp
25+
protocol: TCP
26+
- port: dns
27+
protocol: UDP
28+
to:
29+
- namespaceSelector:
30+
matchLabels:
31+
kubernetes.io/metadata.name: openshift-dns
32+
policyTypes:
33+
- Ingress
34+
- Egress

‎scripts/generate_crds_manifests.sh

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,43 @@ spec:
116116
name: quay.io/openshift/origin-kube-rbac-proxy:latest
117117
EOF
118118

119+
cat << EOF > manifests/0000_50_olm_06-psm-operator.networkpolicy.yaml
120+
apiVersion: networking.k8s.io/v1
121+
kind: NetworkPolicy
122+
metadata:
123+
name: package-server-manager
124+
namespace: openshift-operator-lifecycle-manager
125+
annotations:
126+
include.release.openshift.io/ibm-cloud-managed: "true"
127+
include.release.openshift.io/self-managed-high-availability: "true"
128+
capability.openshift.io/name: "OperatorLifecycleManager"
129+
include.release.openshift.io/hypershift: "true"
130+
spec:
131+
podSelector:
132+
matchLabels:
133+
app: package-server-manager
134+
ingress:
135+
- ports:
136+
- port: 8443
137+
protocol: TCP
138+
egress:
139+
- ports:
140+
- port: 6443
141+
protocol: TCP
142+
- ports:
143+
- port: dns-tcp
144+
protocol: TCP
145+
- port: dns
146+
protocol: UDP
147+
to:
148+
- namespaceSelector:
149+
matchLabels:
150+
kubernetes.io/metadata.name: openshift-dns
151+
policyTypes:
152+
- Ingress
153+
- Egress
154+
EOF
155+
119156
cat << EOF > manifests/0000_50_olm_06-psm-operator.deployment.yaml
120157
apiVersion: apps/v1
121158
kind: Deployment
@@ -562,3 +599,24 @@ ${SED} -i '/- --writeStatusName/,+3d' ${ROOT_DIR}/microshift-manifests/0000_50_o
562599

563600
# Replace the namespace openshift, as it doesn't exist on microshift, in the rbac file
564601
${SED} -i 's/ namespace: openshift/ namespace: openshift-operator-lifecycle-manager/g' ${ROOT_DIR}/microshift-manifests/0000_50_olm_15-csv-viewer.rbac.yaml
602+
603+
# Remove packageserver network policy
604+
yaml_file="${ROOT_DIR}/microshift-manifests/0000_50_olm_01-networkpolicies.yaml"
605+
filtered_yaml="${ROOT_DIR}/microshift-manifests/0000_50_olm_01-networkpolicies.yaml.filtered"
606+
607+
# loop through each NetworkPolicy definition in the input multi-document yaml
608+
rm -f "${filtered_yaml}"
609+
doc_count=$(${YQ} r -l "$yaml_file")
610+
for (( i=0; i<doc_count; i++ )); do
611+
current_doc=$(${YQ} r -d "$i" "$yaml_file")
612+
resource_name="$(echo "$current_doc" | ${YQ} r - metadata.name)"
613+
resource_kind="$(echo "$current_doc" | ${YQ} r - kind)"
614+
# filter out the packageserver network policy
615+
if [[ "${resource_kind}" != "NetworkPolicy" || "${resource_name}" != "packageserver" ]]; then
616+
echo "---" >> "${filtered_yaml}"
617+
echo "${current_doc}" >> "${filtered_yaml}"
618+
fi
619+
done
620+
621+
# replace input with output
622+
mv "${filtered_yaml}" "${yaml_file}"

0 commit comments

Comments
 (0)