feat: add default NetworkPolicies for RHDH operator operands [RHIDP-16475] - #3394
Draft
rm3l wants to merge 9 commits into
Draft
Conversation
…6475] Ship default-deny with selective-allow NetworkPolicies for both backend and database pods. Backend policies (always-on) cover DNS egress, HTTPS egress, PostgreSQL egress, metrics ingress, and router ingress. Database policies (conditional on local DB) cover DNS egress and backend ingress. On OpenShift, the router ingress policy uses the policy-group.network.openshift.io/ingress namespace selector; on vanilla Kubernetes it allows from any namespace. Assisted-by: Claude
The networking.k8s.io/networkpolicies permission is now granted via the main manager-role ClusterRole (generated from the kubebuilder RBAC marker in backstage_controller.go). The separate grant in the sonataflow plugin RBAC is redundant. Assisted-by: Claude
Move the 4 namespace-wide orchestrator NetworkPolicies from
plugin-deps/sonataflow.yaml to the orchestrator flavour at
default-config/flavours/orchestrator/networkpolicy.yaml. This lets
them participate in the standard flavour merge mechanism.
Guard setMetaInfo so it only fills the rhdh.redhat.com/app podSelector
label when the placeholder key already exists; policies with
podSelector: {} (namespace-wide) keep their original scope.
Assisted-by: Claude
The orchestrator flavour NPs use podSelector: {} (namespace-wide),
which weakens per-component ingress isolation for RHDH backend and
DB pods in the same namespace. Add a TODO to review and scope them
to SonataFlow-specific labels.
Assisted-by: Claude
Member
Author
|
/build-images |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #3394 +/- ##
==========================================
+ Coverage 63.97% 65.18% +1.20%
==========================================
Files 38 40 +2
Lines 2365 2450 +85
==========================================
+ Hits 1513 1597 +84
- Misses 702 703 +1
Partials 150 150
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
Contributor
|
❌ Image build failed See workflow run for details: https://github.com/redhat-developer/rhdh-operator/actions/runs/32708255907 Triggered by @rm3l |
The backstage.io profile used in CI does not ship networkpolicy.yaml or db-networkpolicy.yaml manifests. Guard the NP count assertions behind os.Stat checks so the test passes for any profile. Assisted-by: Claude
The rhdh profile ships NP manifests, so the "create default rhdh" test should verify that backend and DB NetworkPolicies are created. Assisted-by: Claude
NetworkPolicy assertions are now in the rhdh-profile test, which always has the NP manifests available. The generic test runs under the backstage.io profile, which does not ship NP config. Assisted-by: Claude
…ent-base-networkpolicies-for-rhdh-operator-operands
Member
Author
|
/build-images |
|
Contributor
|
✅ PR images built successfully! Images are available for testing:
Also available with PR number tag:
Triggered by @rm3l |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Add default NetworkPolicies for all RHDH Operator operands (backend and PostgreSQL pods), enforcing least-privilege pod communication by default per the NetworkPolicies ADR.
Backend pods get 6 always-on policies:
openshift-monitoring)policy-group.network.openshift.io/ingresslabel on OpenShift, empty namespaceSelector on vanilla Kubernetes)PostgreSQL pods get 3 policies (only when local DB is enabled):
Orchestrator flavour adds 4 namespace-wide policies for SonataFlow components, moved from
plugin-deps/sonataflow.yamltoflavours/orchestrator/networkpolicy.yamlso they participate in the standard flavour merge mechanism. These usepodSelector: {}and are flagged with a TODO for future tightening to SonataFlow-specific labels.All policies are label-scoped to the specific RHDH instance (
rhdh.redhat.com/app: backstage-<cr-name>for backend,rhdh.redhat.com/app: backstage-psql-<cr-name>for PostgreSQL). Users can extend with additive NetworkPolicy resources in the same namespace.Which issue(s) does this PR fix or relate to
PR acceptance criteria
How to test changes / Special notes to the reviewer
enableLocalDb: false; verify no DB NetworkPolicies are created