Skip to content

Commit eaca49b

Browse files
author
Per Goncalves da Silva
committed
OPRUN-3926: add static network policy for collect-profiles pod
Signed-off-by: Per Goncalves da Silva <[email protected]>
1 parent 5e4ae50 commit eaca49b

9 files changed

+162
-32
lines changed

‎manifests/0000_50_olm_01-networkpolicies.yaml

Lines changed: 4 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -29,12 +29,8 @@ spec:
2929
matchLabels:
3030
app: olm-operator
3131
ingress:
32-
- from:
33-
- namespaceSelector:
34-
matchLabels:
35-
name: openshift-monitoring
36-
ports:
37-
- port: 8443
32+
- ports:
33+
- port: metrics
3834
protocol: TCP
3935
egress:
4036
- ports:
@@ -71,12 +67,8 @@ spec:
7167
matchLabels:
7268
app: catalog-operator
7369
ingress:
74-
- from:
75-
- namespaceSelector:
76-
matchLabels:
77-
name: openshift-monitoring
78-
ports:
79-
- port: 8443
70+
- ports:
71+
- port: metrics
8072
protocol: TCP
8173
egress:
8274
- ports:

‎manifests/0000_50_olm_07-collect-profiles.cronjob.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ metadata:
77
include.release.openshift.io/self-managed-high-availability: "true"
88
capability.openshift.io/name: "OperatorLifecycleManager"
99
name: collect-profiles
10+
labels:
11+
app: olm-collect-profiles
1012
namespace: openshift-operator-lifecycle-manager
1113
spec:
1214
schedule: "*/15 * * * *"
@@ -18,6 +20,8 @@ spec:
1820
annotations:
1921
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
2022
openshift.io/required-scc: restricted-v2
23+
labels:
24+
app: olm-collect-profiles
2125
spec:
2226
securityContext:
2327
runAsNonRoot: true

‎manifests/0000_50_olm_07-collect-profiles.networkpolicy.yaml

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: collect-profiles
5+
namespace: openshift-operator-lifecycle-manager
6+
annotations:
7+
include.release.openshift.io/ibm-cloud-managed: "true"
8+
include.release.openshift.io/self-managed-high-availability: "true"
9+
capability.openshift.io/name: "OperatorLifecycleManager"
10+
include.release.openshift.io/hypershift: "true"
11+
spec:
12+
podSelector:
13+
matchLabels:
14+
app: olm-collect-profiles
15+
egress:
16+
- ports:
17+
- port: 8443
18+
protocol: TCP
19+
from:
20+
- namespaceSelector:
21+
matchLabels:
22+
name: openshift-operator-lifecycle-manager
23+
- podSelector:
24+
matchLabels:
25+
app: olm-operator
26+
- podSelector:
27+
matchLabels:
28+
app: catalog-operator
29+
- ports:
30+
- port: 6443
31+
protocol: TCP
32+
- ports:
33+
- port: dns-tcp
34+
protocol: TCP
35+
- port: dns
36+
protocol: UDP
37+
to:
38+
- namespaceSelector:
39+
matchLabels:
40+
kubernetes.io/metadata.name: openshift-dns
41+
- podSelector:
42+
matchLabels:
43+
dns.operator.openshift.io/daemonset-dns: default
44+
policyTypes:
45+
- Egress
46+
- Ingress

‎microshift-manifests/0000_50_olm_01-networkpolicies.yaml

Lines changed: 4 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,8 @@ spec:
3030
matchLabels:
3131
app: olm-operator
3232
ingress:
33-
- from:
34-
- namespaceSelector:
35-
matchLabels:
36-
name: openshift-monitoring
37-
ports:
38-
- port: 8443
33+
- ports:
34+
- port: metrics
3935
protocol: TCP
4036
egress:
4137
- ports:
@@ -72,12 +68,8 @@ spec:
7268
matchLabels:
7369
app: catalog-operator
7470
ingress:
75-
- from:
76-
- namespaceSelector:
77-
matchLabels:
78-
name: openshift-monitoring
79-
ports:
80-
- port: 8443
71+
- ports:
72+
- port: metrics
8173
protocol: TCP
8274
egress:
8375
- ports:

‎microshift-manifests/0000_50_olm_07-collect-profiles.cronjob.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ metadata:
77
include.release.openshift.io/self-managed-high-availability: "true"
88
capability.openshift.io/name: "OperatorLifecycleManager"
99
name: collect-profiles
10+
labels:
11+
app: olm-collect-profiles
1012
namespace: openshift-operator-lifecycle-manager
1113
spec:
1214
schedule: "*/15 * * * *"
@@ -18,6 +20,8 @@ spec:
1820
annotations:
1921
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
2022
openshift.io/required-scc: restricted-v2
23+
labels:
24+
app: olm-collect-profiles
2125
spec:
2226
securityContext:
2327
runAsNonRoot: true

‎microshift-manifests/0000_50_olm_07-collect-profiles.networkpolicy.yaml

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: collect-profiles
5+
namespace: openshift-operator-lifecycle-manager
6+
annotations:
7+
include.release.openshift.io/ibm-cloud-managed: "true"
8+
include.release.openshift.io/self-managed-high-availability: "true"
9+
capability.openshift.io/name: "OperatorLifecycleManager"
10+
include.release.openshift.io/hypershift: "true"
11+
spec:
12+
podSelector:
13+
matchLabels:
14+
app: olm-collect-profiles
15+
egress:
16+
- ports:
17+
- port: 8443
18+
protocol: TCP
19+
from:
20+
- namespaceSelector:
21+
matchLabels:
22+
name: openshift-operator-lifecycle-manager
23+
- podSelector:
24+
matchLabels:
25+
app: olm-operator
26+
- podSelector:
27+
matchLabels:
28+
app: catalog-operator
29+
- ports:
30+
- port: 6443
31+
protocol: TCP
32+
- ports:
33+
- port: dns-tcp
34+
protocol: TCP
35+
- port: dns
36+
protocol: UDP
37+
to:
38+
- namespaceSelector:
39+
matchLabels:
40+
kubernetes.io/metadata.name: openshift-dns
41+
- podSelector:
42+
matchLabels:
43+
dns.operator.openshift.io/daemonset-dns: default
44+
policyTypes:
45+
- Egress
46+
- Ingress

‎scripts/generate_crds_manifests.sh

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -407,6 +407,55 @@ data:
407407
tls.key: ""
408408
EOF
409409

410+
cat << EOF > manifests/0000_50_olm_07-collect-profiles.networkpolicy.yaml
411+
apiVersion: networking.k8s.io/v1
412+
kind: NetworkPolicy
413+
metadata:
414+
name: collect-profiles
415+
namespace: openshift-operator-lifecycle-manager
416+
annotations:
417+
include.release.openshift.io/ibm-cloud-managed: "true"
418+
include.release.openshift.io/self-managed-high-availability: "true"
419+
capability.openshift.io/name: "OperatorLifecycleManager"
420+
include.release.openshift.io/hypershift: "true"
421+
spec:
422+
podSelector:
423+
matchLabels:
424+
app: olm-collect-profiles
425+
egress:
426+
- ports:
427+
- port: 8443
428+
protocol: TCP
429+
from:
430+
- namespaceSelector:
431+
matchLabels:
432+
name: openshift-operator-lifecycle-manager
433+
- podSelector:
434+
matchLabels:
435+
app: olm-operator
436+
- podSelector:
437+
matchLabels:
438+
app: catalog-operator
439+
- ports:
440+
- port: 6443
441+
protocol: TCP
442+
- ports:
443+
- port: dns-tcp
444+
protocol: TCP
445+
- port: dns
446+
protocol: UDP
447+
to:
448+
- namespaceSelector:
449+
matchLabels:
450+
kubernetes.io/metadata.name: openshift-dns
451+
- podSelector:
452+
matchLabels:
453+
dns.operator.openshift.io/daemonset-dns: default
454+
policyTypes:
455+
- Egress
456+
- Ingress
457+
EOF
458+
410459
cat << EOF > manifests/0000_50_olm_07-collect-profiles.cronjob.yaml
411460
apiVersion: batch/v1
412461
kind: CronJob
@@ -416,6 +465,8 @@ metadata:
416465
include.release.openshift.io/hypershift: "true"
417466
include.release.openshift.io/self-managed-high-availability: "true"
418467
name: collect-profiles
468+
labels:
469+
app: olm-collect-profiles
419470
namespace: openshift-operator-lifecycle-manager
420471
spec:
421472
schedule: "*/15 * * * *"
@@ -427,6 +478,8 @@ spec:
427478
annotations:
428479
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
429480
openshift.io/required-scc: restricted-v2
481+
labels:
482+
app: olm-collect-profiles
430483
spec:
431484
securityContext:
432485
runAsNonRoot: true

‎staging/operator-lifecycle-manager/test/e2e/util.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1069,6 +1069,7 @@ func SetupGeneratedTestNamespaceWithOperatorGroup(name string, og operatorsv1.Op
10691069
ns := corev1.Namespace{
10701070
ObjectMeta: metav1.ObjectMeta{
10711071
Name: name,
1072+
Labels: map[string]string{},
10721073
},
10731074
}
10741075
Eventually(func() error {

‎values.yaml

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -119,11 +119,3 @@ networkPolicy:
119119
- podSelector:
120120
matchLabels:
121121
dns.operator.openshift.io/daemonset-dns: default
122-
metrics:
123-
ports:
124-
- port: 8443
125-
protocol: TCP
126-
from:
127-
- namespaceSelector:
128-
matchLabels:
129-
name: openshift-monitoring

0 commit comments

Comments
 (0)