OPRUN-3923,OPRUN-3906,OPRUN-3903,OPRUN-3926: Add NetworkPolicy support to OLMv0 components #1008

perdasilva · 2025-05-19T12:17:06Z

This PR adds NetworkPolicy resources to restrict OLMv0 component network communications:

resources:

default-deny-all added to openshift-operator-lifecycle-manager namespaces
olm-operator restricted to: egress: dns, kube-apiserver / ingress: metrics
catalog-operator restricted to: egress dns, kube-apiserver, 50051 (catalog services) / ingress: metrics
packageserver: egress dns, kube-apiserver, 50051 (catalog services) / ingress: 5443 (service port)
package-server-manager: egress dns, kube-apiserver / ingress: 8443 (metrics)
collect-profiles: egress dns, kube-apiserver, olm/catalog-operator metrics

code change:
network policies for catalogs need to be managed programmatically by stamping out NetworkPolicy resources for the catalog source pod. The definition of the policy depends on the type of catalog source (grpc or configmap). But they essentially restrict ingress to 50051 (catalog services). In the case of the configmap catalog source, egress to the kube-apiserver is also required (to read the configmap)

microshift:

packageserver, package-server-manger, and collect-profiles are not in microshift, therefore they are excluded (by the kustomization.yaml) from microshift. Because the packageserver network policy comes from upstream, it is removed from the network policy resources by the generate-crds_manifests.sh script.

openshift-ci-robot · 2025-05-19T12:39:36Z

@perdasilva: This pull request references OPRUN-3923 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

In response to this:

Makes the necessary changes to downstream and pulls in the necessary commits for adding NetworkPolicy resources to help constrain the network communication of OLM components

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2025-05-19T12:40:42Z

@perdasilva: This pull request references OPRUN-3923 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

This pull request references OPRUN-3906 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

In response to this:

Makes the necessary changes to downstream and pulls in the necessary commits for adding NetworkPolicy resources to help constrain the network communication of OLM components

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2025-05-19T12:57:09Z

@perdasilva: This pull request references OPRUN-3923 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

This pull request references OPRUN-3906 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

This pull request references OPRUN-3903 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

In response to this:

Makes the necessary changes to downstream and pulls in the necessary commits for adding NetworkPolicy resources to help constrain the network communication of OLM components

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2025-05-19T13:12:20Z

@perdasilva: An error was encountered searching for bug OPRUN-3926 on the Jira server at https://issues.redhat.com/. No known errors were detected, please see the full error message for details.

Full error message.


No response returned: Get "https://issues.redhat.com/rest/api/2/issue/OPRUN-3926": GET https://issues.redhat.com/rest/api/2/issue/OPRUN-3926 giving up after 5 attempt(s)

Please contact an administrator to resolve this issue, then request a bug refresh with /jira refresh.

In response to this:

Makes the necessary changes to downstream and pulls in the necessary commits for adding NetworkPolicy resources to help constrain the network communication of OLM components

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2025-05-19T13:12:22Z

@perdasilva: This pull request references OPRUN-3923 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

This pull request references OPRUN-3906 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

This pull request references OPRUN-3903 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

In response to this:

Makes the necessary changes to downstream and pulls in the necessary commits for adding NetworkPolicy resources to help constrain the network communication of OLM components

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

kuiwang02 · 2025-05-20T05:39:36Z

the issue mentioned in #1005 (comment) is fixed in this PR. I already update the bug ticket.

microshift-manifests/0000_50_olm_01-networkpolicies.yaml

microshift-manifests/0000_50_olm_06-psm-networkpolicy.networkpolicy.yaml

microshift-manifests/0000_50_olm_07-collect-profiles.networkpolicy.yaml

manifests/0000_50_olm_01-networkpolicies.yaml

manifests/0000_50_olm_07-collect-profiles.networkpolicy.yaml

perdasilva · 2025-05-20T07:41:42Z

@kuiwang02 thanks for the thorough review ^^ I'll fix those up!

openshift-ci-robot · 2025-05-20T08:57:21Z

@perdasilva: This pull request references OPRUN-3923 which is a valid jira issue.

This pull request references OPRUN-3906 which is a valid jira issue.

This pull request references OPRUN-3903 which is a valid jira issue.

This pull request references OPRUN-3926 which is a valid jira issue.

This pull request references Jira Issue OCPBUGS-56355, which is invalid:

expected the bug to be in one of the following states: NEW, ASSIGNED, POST, but it is Verified instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Makes the necessary changes to downstream and pulls in the necessary commits for adding NetworkPolicy resources to help constrain the network communication of OLM components

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2025-05-21T14:08:01Z

@perdasilva: This pull request references OPRUN-3923 which is a valid jira issue.

This pull request references OPRUN-3906 which is a valid jira issue.

This pull request references OPRUN-3903 which is a valid jira issue.

This pull request references OPRUN-3926 which is a valid jira issue.

In response to this:

This PR adds NetworkPolicy resources to restrict OLMv0 component network communications:

resources:

default-deny-all added to openshift-operator-lifecycle-manager namespaces

olm-operator restricted to: egress: dns, kube-apiserver / ingress: metrics

catalog-operator restricted to: egress dns, kube-apiserver, 50051 (catalog services) / ingress: metrics

packageserver: egress dns, kube-apiserver, 50051 (catalog services) / ingress: 5443 (service port)

package-server-manager: egress dns, kube-apiserver / ingress: 8443 (metrics)

collect-profiles: egress dns, kube-apiserver, olm/catalog-operator metrics

code change:
network policies for catalogs need to be managed programmatically by stamping out NetworkPolicy resources for the catalog source pod. The definition of the policy depends on the type of catalog source (grpc or configmap). But they essentially restrict ingress to 50051 (catalog services). In the case of the configmap catalog source, egress to the kube-apiserver is also required (to read the configmap)

microshift:

packageserver, package-server-manger, and collect-profiles are not in microshift, therefore they are excluded (by the kustomization.yaml) from microshift. Because the packageserver network policy comes from upstream, it is removed from the network policy resources by the generate-crds_manifests.sh script.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

…and olmconfig resource order when patching Signed-off-by: Per Goncalves da Silva <[email protected]>

…3568) * include network policy for all configmap and grpc catalogsources Signed-off-by: Joe Lanford <[email protected]> * add network policy for bundle unpack pods Signed-off-by: Joe Lanford <[email protected]> --------- Signed-off-by: Joe Lanford <[email protected]> Upstream-repository: operator-lifecycle-manager Upstream-commit: 8723097edf1d05d5c62e52224264c95be7f56861

* Introduce NetworkPolicy for core component workloads. [RFC](https://docs.google.com/document/d/10MZ4t2XgRydGa-NRs4uXFNVoTHH9SPKd7mV9IwT_i7M/edit?usp=sharing) Signed-off-by: Per G. da Silva <[email protected]> * specify namespace with selectors * Fix formatting Signed-off-by: Per G. da Silva <[email protected]> * template network policy Signed-off-by: Per G. da Silva <[email protected]> * restrict kube-apiserver and dns traffic Signed-off-by: Per G. da Silva <[email protected]> * Address reviewer comments Signed-off-by: Per G. da Silva <[email protected]> --------- Signed-off-by: Per G. da Silva <[email protected]> Co-authored-by: Per G. da Silva <[email protected]> Upstream-repository: operator-lifecycle-manager Upstream-commit: dcd8ad89c498ecdecd0f286d26e7aedfc1383084

Signed-off-by: Rashmi Gottipati <[email protected]> Upstream-repository: operator-lifecycle-manager Upstream-commit: d7aaeb11ab80f862fc9c70dfb7865158bb67e28c

Signed-off-by: Per Goncalves da Silva <[email protected]> Co-authored-by: Per Goncalves da Silva <[email protected]> Upstream-repository: operator-lifecycle-manager Upstream-commit: b4ec5bd5caa84725ec40de79b40f93fa08686563

…y (#3582) Signed-off-by: Per Goncalves da Silva <[email protected]> Co-authored-by: Per Goncalves da Silva <[email protected]> Upstream-repository: operator-lifecycle-manager Upstream-commit: 8c53b7f2598c0a2b88c22568712c18152cdfeee5

…penshift Signed-off-by: Per Goncalves da Silva <[email protected]>

Signed-off-by: Per Goncalves da Silva <[email protected]>

scripts/generate_crds_manifests.sh

Signed-off-by: Per Goncalves da Silva <[email protected]>

perdasilva · 2025-05-21T15:07:55Z

/retest

perdasilva · 2025-05-21T15:13:22Z

/retest

perdasilva · 2025-05-21T19:31:17Z

/retest

perdasilva · 2025-05-21T20:06:28Z

/retest

perdasilva · 2025-05-22T06:38:48Z

/retest

perdasilva · 2025-05-22T11:17:55Z

/retest

perdasilva · 2025-05-22T12:48:31Z

/retest

tmshort · 2025-05-22T14:45:13Z

GCP tests are in permafail

bentito · 2025-05-22T16:03:32Z

/approve
/lgtm

openshift-ci · 2025-05-22T16:03:55Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bentito, perdasilva

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~DOWNSTREAM_OWNERS~~ [perdasilva]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2025-05-22T16:04:01Z

@perdasilva: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-bot · 2025-05-22T19:35:48Z

[ART PR BUILD NOTIFIER]

Distgit: operator-registry
This PR has been included in build operator-registry-container-v4.20.0-202505221844.p0.g082d59a.assembly.stream.el9.
All builds following this will include this PR.

openshift-bot · 2025-05-22T19:35:49Z

[ART PR BUILD NOTIFIER]

Distgit: operator-lifecycle-manager
This PR has been included in build operator-lifecycle-manager-container-v4.20.0-202505221844.p0.g082d59a.assembly.stream.el9.
All builds following this will include this PR.

openshift-bot · 2025-05-22T19:38:47Z

[ART PR BUILD NOTIFIER]

Distgit: ose-operator-framework-tools
This PR has been included in build ose-operator-framework-tools-container-v4.20.0-202505221844.p0.g082d59a.assembly.stream.el9.
All builds following this will include this PR.

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 19, 2025

openshift-ci bot requested review from anik120 and grokspawn May 19, 2025 12:17

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 19, 2025

perdasilva force-pushed the networkpolicy branch from d4293f8 to 179ee2b Compare May 19, 2025 12:27

perdasilva mentioned this pull request May 19, 2025

NO-ISSUE: Synchronize From Upstream Repositories #1005

Open

perdasilva changed the title ~~WIP: Add NetworkPolicy support~~ OPRUN-3923: Add NetworkPolicy support May 19, 2025

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label May 19, 2025

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 19, 2025

perdasilva changed the title ~~OPRUN-3923: Add NetworkPolicy support~~ OPRUN-3923,OPRUN-3906: Add NetworkPolicy support May 19, 2025

perdasilva force-pushed the networkpolicy branch from 2b34299 to 417fcc1 Compare May 19, 2025 12:48

perdasilva changed the title ~~OPRUN-3923,OPRUN-3906: Add NetworkPolicy support~~ OPRUN-3923,OPRUN-3906,OPRUN-3903: Add NetworkPolicy support May 19, 2025

perdasilva changed the title ~~OPRUN-3923,OPRUN-3906,OPRUN-3903: Add NetworkPolicy support~~ OPRUN-3923,OPRUN-3906,OPRUN-3903,OPRUN-3926: Add NetworkPolicy support May 19, 2025

perdasilva force-pushed the networkpolicy branch 3 times, most recently from cae8c93 to 4b6b3ad Compare May 19, 2025 20:49

kuiwang02 reviewed May 20, 2025

View reviewed changes

perdasilva force-pushed the networkpolicy branch 2 times, most recently from eaca49b to 8045c80 Compare May 20, 2025 08:55

perdasilva changed the title ~~OPRUN-3923,OPRUN-3906,OPRUN-3903,OPRUN-3926: Add NetworkPolicy support~~ OPRUN-3923,OPRUN-3906,OPRUN-3903,OPRUN-3926,OCPBUGS-56355: Add NetworkPolicy support May 20, 2025

openshift-ci-robot added jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels May 20, 2025

Per Goncalves da Silva and others added 9 commits May 21, 2025 16:13

<carry>: update generate_crds_manifests script to care about service …

cc35d70

…and olmconfig resource order when patching Signed-off-by: Per Goncalves da Silva <[email protected]>

add NetworkPolicy as a supported kind (#3580)

4a6471e

Signed-off-by: Rashmi Gottipati <[email protected]> Upstream-repository: operator-lifecycle-manager Upstream-commit: d7aaeb11ab80f862fc9c70dfb7865158bb67e28c

<carry>: update network policy configuration for metrics and dns on o…

708a111

…penshift Signed-off-by: Per Goncalves da Silva <[email protected]>

OPRUN-3903: Add package server manager network policy

793060b

Signed-off-by: Per Goncalves da Silva <[email protected]>

OPRUN-3926: add static network policy for collect-profiles pod

05841d8

Signed-off-by: Per Goncalves da Silva <[email protected]>

bentito reviewed May 21, 2025

View reviewed changes

scripts/generate_crds_manifests.sh Show resolved Hide resolved

<carry>: add some information about the generate_crds_manifests scripts

03b8689

Signed-off-by: Per Goncalves da Silva <[email protected]>

perdasilva force-pushed the networkpolicy branch from 263fbc5 to 03b8689 Compare May 21, 2025 14:37

openshift-ci bot assigned bentito May 22, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label May 22, 2025

openshift-merge-bot bot merged commit 082d59a into openshift:main May 22, 2025
15 checks passed

OPRUN-3923,OPRUN-3906,OPRUN-3903,OPRUN-3926: Add NetworkPolicy support to OLMv0 components #1008

OPRUN-3923,OPRUN-3906,OPRUN-3903,OPRUN-3926: Add NetworkPolicy support to OLMv0 components #1008

Uh oh!

Conversation

perdasilva commented May 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented May 19, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented May 19, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented May 19, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented May 19, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented May 19, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kuiwang02 commented May 20, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

perdasilva commented May 20, 2025

Uh oh!

openshift-ci-robot commented May 20, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented May 21, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

perdasilva commented May 21, 2025

Uh oh!

perdasilva commented May 21, 2025

Uh oh!

perdasilva commented May 21, 2025

Uh oh!

perdasilva commented May 21, 2025

Uh oh!

perdasilva commented May 22, 2025

Uh oh!

perdasilva commented May 22, 2025

Uh oh!

perdasilva commented May 22, 2025

Uh oh!

tmshort commented May 22, 2025

Uh oh!

bentito commented May 22, 2025

Uh oh!

openshift-ci bot commented May 22, 2025

Uh oh!

openshift-ci bot commented May 22, 2025

Uh oh!

Uh oh!

openshift-bot commented May 22, 2025

Uh oh!

openshift-bot commented May 22, 2025

Uh oh!

openshift-bot commented May 22, 2025

Uh oh!

Uh oh!

perdasilva commented May 19, 2025 •

edited

Loading

openshift-ci-robot commented May 19, 2025 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented May 19, 2025 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented May 19, 2025 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented May 19, 2025 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented May 19, 2025 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented May 20, 2025 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented May 21, 2025 •

edited by openshift-ci bot

Loading