CM-576: Implementation of Network Policy for Cert Manager Operator #283
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| apiVersion: networking.k8s.io/v1 | ||
| kind: NetworkPolicy | ||
| metadata: | ||
| name: operator-allow-egress-to-api-server | ||
| spec: | ||
| podSelector: | ||
| matchLabels: | ||
| name: cert-manager-operator | ||
| policyTypes: | ||
| - Egress | ||
| egress: | ||
| - ports: | ||
| - protocol: TCP | ||
| port: 6443 | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| apiVersion: networking.k8s.io/v1 | ||
| kind: NetworkPolicy | ||
| metadata: | ||
| name: operator-allow-ingress-to-metrics | ||
| spec: | ||
| podSelector: | ||
| matchLabels: | ||
| name: cert-manager-operator | ||
| policyTypes: | ||
| - Ingress | ||
| ingress: | ||
| - ports: | ||
| - protocol: TCP | ||
| port: 8443 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| apiVersion: networking.k8s.io/v1 | ||
| kind: NetworkPolicy | ||
| metadata: | ||
| name: operator-deny-all-traffic | ||
| spec: | ||
| podSelector: | ||
| matchLabels: | ||
| name: cert-manager-operator | ||
| policyTypes: | ||
| - Ingress | ||
| - Egress |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -504,6 +504,7 @@ spec: | |
| resources: | ||
| - ingresses | ||
| - ingresses/finalizers | ||
| - networkpolicies | ||
| verbs: | ||
| - create | ||
| - delete | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -194,6 +194,7 @@ rules: | |
| resources: | ||
| - ingresses | ||
| - ingresses/finalizers | ||
| - networkpolicies | ||
| verbs: | ||
| - create | ||
| - delete | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -9,40 +9,41 @@ require ( | |
| github.com/go-bindata/go-bindata v3.1.2+incompatible | ||
| github.com/go-logr/logr v1.4.2 | ||
| github.com/golangci/golangci-lint v1.50.1 | ||
| github.com/google/go-cmp v0.7.0 | ||
| github.com/google/go-jsonnet v0.17.0 | ||
| github.com/maxbrunsfeld/counterfeiter/v6 v6.8.1 | ||
| github.com/mogensen/kubernetes-split-yaml v0.3.0 | ||
| github.com/onsi/ginkgo/v2 v2.21.0 | ||
| github.com/onsi/gomega v1.35.1 | ||
| github.com/openshift/api v0.0.0-20250320170726-75d64d71980b | ||
| github.com/openshift/build-machinery-go v0.0.0-20250102153059-e85a1a7ecb5c | ||
| github.com/openshift/client-go v0.0.0-20250125113824-8e1f0b8fa9a7 | ||
| github.com/openshift/library-go v0.0.0-20250609093359-ccdcf648dd95 | ||
| github.com/operator-framework/operator-lib v0.11.0 | ||
| github.com/spf13/cobra v1.8.1 | ||
| github.com/spf13/pflag v1.0.5 | ||
| github.com/stretchr/testify v1.10.0 | ||
| golang.org/x/tools v0.26.0 | ||
|
There was a problem hiding this comment. these bumps to kube 32, can go in as a separate PR (ideally with the upstream bump, but not a must) There was a problem hiding this comment. Do you mean with the PR ? |
||
| k8s.io/api v0.32.5 | ||
| k8s.io/apiextensions-apiserver v0.32.1 | ||
| k8s.io/apimachinery v0.32.5 | ||
| k8s.io/client-go v0.32.5 | ||
| k8s.io/code-generator v0.32.1 | ||
| k8s.io/component-base v0.32.5 | ||
| k8s.io/klog/v2 v2.130.1 | ||
| k8s.io/kubernetes v1.32.5 | ||
| k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 | ||
| sigs.k8s.io/controller-runtime v0.19.0 | ||
| sigs.k8s.io/controller-runtime/tools/setup-envtest v0.0.0-20230912183013-811757733433 | ||
| sigs.k8s.io/controller-tools v0.15.0 | ||
| sigs.k8s.io/kustomize/kustomize/v5 v5.5.0 | ||
| sigs.k8s.io/structured-merge-diff/v4 v4.6.0 | ||
| sigs.k8s.io/yaml v1.4.0 | ||
| ) | ||
|
|
||
| require ( | ||
| 4d63.com/gochecknoglobals v0.1.0 // indirect | ||
| cel.dev/expr v0.19.1 // indirect | ||
| github.com/Abirdcfly/dupword v0.0.7 // indirect | ||
| github.com/Antonboom/errname v0.1.7 // indirect | ||
| github.com/Antonboom/nilnil v0.1.1 // indirect | ||
|
|
@@ -77,11 +78,10 @@ require ( | |
| github.com/daixiang0/gci v0.8.1 // indirect | ||
| github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect | ||
| github.com/denis-tingaikin/go-header v0.4.3 // indirect | ||
| github.com/distribution/reference v0.6.0 // indirect | ||
| github.com/emicklei/go-restful/v3 v3.12.1 // indirect | ||
| github.com/esimonov/ifshort v1.0.4 // indirect | ||
| github.com/ettle/strcase v0.1.1 // indirect | ||
| github.com/evanphx/json-patch/v5 v5.9.0 // indirect | ||
| github.com/fatih/color v1.17.0 // indirect | ||
| github.com/fatih/structtag v1.2.0 // indirect | ||
|
|
@@ -111,7 +111,6 @@ require ( | |
| github.com/gobwas/glob v0.2.3 // indirect | ||
| github.com/gofrs/flock v0.8.1 // indirect | ||
| github.com/gogo/protobuf v1.3.2 // indirect | ||
| github.com/golang/protobuf v1.5.4 // indirect | ||
| github.com/golangci/check v0.0.0-20180506172741-cfe4005ccda2 // indirect | ||
| github.com/golangci/dupl v0.0.0-20180902072040-3e9179ac440a // indirect | ||
|
|
@@ -122,10 +121,11 @@ require ( | |
| github.com/golangci/misspell v0.3.5 // indirect | ||
| github.com/golangci/revgrep v0.0.0-20220804021717-745bb2f7c2e6 // indirect | ||
| github.com/golangci/unconvert v0.0.0-20180507085042-28b1c447d1f4 // indirect | ||
| github.com/google/btree v1.1.3 // indirect | ||
| github.com/google/cel-go v0.22.0 // indirect | ||
| github.com/google/gnostic-models v0.6.9 // indirect | ||
| github.com/google/gofuzz v1.2.0 // indirect | ||
| github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db // indirect | ||
| github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect | ||
| github.com/google/uuid v1.6.0 // indirect | ||
| github.com/gordonklaus/ineffassign v0.0.0-20210914165742-4cc7213b9bc8 // indirect | ||
|
|
@@ -134,13 +134,12 @@ require ( | |
| github.com/gostaticanalysis/forcetypeassert v0.1.0 // indirect | ||
| github.com/gostaticanalysis/nilerr v0.1.1 // indirect | ||
| github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect | ||
| github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0 // indirect | ||
| github.com/hashicorp/errwrap v1.1.0 // indirect | ||
| github.com/hashicorp/go-multierror v1.1.1 // indirect | ||
| github.com/hashicorp/go-version v1.6.0 // indirect | ||
| github.com/hashicorp/hcl v1.0.1-vault-5 // indirect | ||
| github.com/hexops/gotextdiff v1.0.3 // indirect | ||
| github.com/inconshreveable/mousetrap v1.1.0 // indirect | ||
| github.com/jgautheron/goconst v1.5.1 // indirect | ||
| github.com/jingyugao/rowserrcheck v1.1.1 // indirect | ||
|
|
@@ -151,7 +150,6 @@ require ( | |
| github.com/kisielk/errcheck v1.6.2 // indirect | ||
| github.com/kisielk/gotool v1.0.0 // indirect | ||
| github.com/kkHAIKE/contextcheck v1.1.3 // indirect | ||
| github.com/kulti/thelper v0.6.3 // indirect | ||
| github.com/kunwardeep/paralleltest v1.0.6 // indirect | ||
| github.com/kylelemons/godebug v1.1.0 // indirect | ||
|
|
@@ -190,9 +188,9 @@ require ( | |
| github.com/pkg/profile v1.7.0 // indirect | ||
| github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect | ||
| github.com/polyfloyd/go-errorlint v1.0.5 // indirect | ||
| github.com/prometheus/client_golang v1.22.0 // indirect | ||
| github.com/prometheus/client_model v0.6.1 // indirect | ||
| github.com/prometheus/common v0.62.0 // indirect | ||
| github.com/prometheus/procfs v0.15.1 // indirect | ||
| github.com/quasilyte/go-ruleguard v0.3.18 // indirect | ||
| github.com/quasilyte/gogrep v0.0.0-20220828223005-86e4605de09f // indirect | ||
|
|
@@ -207,6 +205,7 @@ require ( | |
| github.com/sashamelentyev/interfacebloat v1.1.0 // indirect | ||
| github.com/sashamelentyev/usestdlibvars v1.20.0 // indirect | ||
| github.com/securego/gosec/v2 v2.13.1 // indirect | ||
| github.com/sergi/go-diff v1.2.0 // indirect | ||
| github.com/shazow/go-diff v0.0.0-20160112020656-b6b7b6733b8c // indirect | ||
| github.com/sirupsen/logrus v1.9.3 // indirect | ||
| github.com/sivchari/containedctx v1.0.2 // indirect | ||
|
|
@@ -238,64 +237,65 @@ require ( | |
| github.com/yagipy/maintidx v1.0.0 // indirect | ||
| github.com/yeya24/promlinter v0.2.0 // indirect | ||
| gitlab.com/bosi/decorder v0.2.3 // indirect | ||
| go.etcd.io/etcd/api/v3 v3.5.21 // indirect | ||
| go.etcd.io/etcd/client/pkg/v3 v3.5.21 // indirect | ||
| go.etcd.io/etcd/client/v3 v3.5.21 // indirect | ||
| go.opentelemetry.io/auto/sdk v1.1.0 // indirect | ||
| go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.58.0 // indirect | ||
| go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect | ||
| go.opentelemetry.io/otel v1.33.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.33.0 // indirect | ||
| go.opentelemetry.io/otel/sdk v1.33.0 // indirect | ||
| go.opentelemetry.io/otel/trace v1.33.0 // indirect | ||
| go.opentelemetry.io/proto/otlp v1.4.0 // indirect | ||
| go.uber.org/multierr v1.11.0 // indirect | ||
| go.uber.org/zap v1.27.0 // indirect | ||
| golang.org/x/crypto v0.36.0 // indirect | ||
| golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect | ||
| golang.org/x/exp/typeparams v0.0.0-20220827204233-334a2380cb91 // indirect | ||
| golang.org/x/mod v0.21.0 // indirect | ||
| golang.org/x/net v0.38.0 // indirect | ||
| golang.org/x/oauth2 v0.27.0 // indirect | ||
| golang.org/x/sync v0.12.0 // indirect | ||
| golang.org/x/sys v0.31.0 // indirect | ||
| golang.org/x/term v0.30.0 // indirect | ||
| golang.org/x/text v0.23.0 // indirect | ||
| golang.org/x/time v0.9.0 // indirect | ||
| gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect | ||
| google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 // indirect | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 // indirect | ||
| google.golang.org/grpc v1.68.1 // indirect | ||
| google.golang.org/protobuf v1.36.5 // indirect | ||
| gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect | ||
| gopkg.in/inf.v0 v0.9.1 // indirect | ||
| gopkg.in/ini.v1 v1.67.0 // indirect | ||
| gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect | ||
| gopkg.in/yaml.v2 v2.4.0 // indirect | ||
| gopkg.in/yaml.v3 v3.0.1 // indirect | ||
| honnef.co/go/tools v0.3.3 // indirect | ||
| k8s.io/apiserver v0.32.5 // indirect | ||
| k8s.io/cloud-provider v0.30.1 // indirect | ||
| k8s.io/component-helpers v0.32.1 // indirect | ||
| k8s.io/controller-manager v0.32.5 // indirect | ||
| k8s.io/gengo/v2 v2.0.0-20240911193312-2b36238f13e9 // indirect | ||
| k8s.io/kms v0.32.5 // indirect | ||
| k8s.io/kube-aggregator v0.32.1 // indirect | ||
| k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect | ||
| k8s.io/kubelet v0.30.1 // indirect | ||
| mvdan.cc/gofumpt v0.4.0 // indirect | ||
| mvdan.cc/interfacer v0.0.0-20180901003855-c20040233aed // indirect | ||
| mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b // indirect | ||
| mvdan.cc/unparam v0.0.0-20220706161116-678bad134442 // indirect | ||
| sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 // indirect | ||
| sigs.k8s.io/gateway-api v1.1.0 // indirect | ||
| sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect | ||
| sigs.k8s.io/kube-storage-version-migrator v0.0.6-0.20230721195810-5c8923c5ff96 // indirect | ||
| sigs.k8s.io/kustomize/api v0.18.0 // indirect | ||
| sigs.k8s.io/kustomize/cmd/config v0.15.0 // indirect | ||
| sigs.k8s.io/kustomize/kyaml v0.18.1 // indirect | ||
| sigs.k8s.io/randfill v1.0.0 // indirect | ||
| ) | ||
|
|
||
| replace github.com/cert-manager/cert-manager => github.com/openshift/jetstack-cert-manager v1.16.4 | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This allows (operator pod to) egress ALL to any 6443 port to any pod on the cluster? Is my understanding correct?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, in the docs they have mentioned this way. They might tighten it later.