Skip to content

Commit 710acfa

Browse files
committed
let CVO manage the CMO networkpolicy
1 parent 9ce5af8 commit 710acfa

File tree

5 files changed

+14
-92
lines changed

5 files changed

+14
-92
lines changed

assets/cluster-monitoring-operator/network-policy-default-deny.yaml

Lines changed: 0 additions & 13 deletions
This file was deleted.

jsonnet/components/cluster-monitoring-operator.libsonnet

Lines changed: 0 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -571,56 +571,4 @@ function(params) {
571571
verbs: ['*'],
572572
}],
573573
},
574-
575-
// 2 networkpolicies, the first is default deny all pods traffic, the second is allow access to CMO port 8443
576-
networkPolicyDefaultDeny: {
577-
apiVersion: 'networking.k8s.io/v1',
578-
kind: 'NetworkPolicy',
579-
metadata: {
580-
name: 'default-deny',
581-
namespace: cfg.namespace,
582-
},
583-
spec: {
584-
podSelector: {
585-
},
586-
policyTypes: [
587-
'Ingress',
588-
'Egress',
589-
],
590-
},
591-
},
592-
networkPolicyDownstream: {
593-
apiVersion: 'networking.k8s.io/v1',
594-
kind: 'NetworkPolicy',
595-
metadata: {
596-
name: 'cluster-monitoring-operator',
597-
namespace: cfg.namespace,
598-
},
599-
spec: {
600-
podSelector: {
601-
matchLabels: {
602-
'app.kubernetes.io/name': 'cluster-monitoring-operator',
603-
},
604-
},
605-
policyTypes: [
606-
'Ingress',
607-
'Egress',
608-
],
609-
ingress: [
610-
{
611-
ports: [
612-
{
613-
// allow prometheus to scrape cluster-monitoring-operator endpoint,
614-
// 8443(port name: https) port
615-
port: 'https',
616-
protocol: 'TCP',
617-
},
618-
],
619-
},
620-
],
621-
egress: [
622-
{},
623-
],
624-
},
625-
},
626574
}

assets/cluster-monitoring-operator/network-policy-downstream.yaml renamed to manifests/0000_50_cluster-monitoring-operator_04-networkpolicy.yaml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,3 +19,17 @@ spec:
1919
policyTypes:
2020
- Ingress
2121
- Egress
22+
---
23+
apiVersion: networking.k8s.io/v1
24+
kind: NetworkPolicy
25+
metadata:
26+
labels:
27+
app.kubernetes.io/managed-by: cluster-monitoring-operator
28+
app.kubernetes.io/part-of: openshift-monitoring
29+
name: default-deny
30+
namespace: openshift-monitoring
31+
spec:
32+
podSelector: {}
33+
policyTypes:
34+
- Ingress
35+
- Egress

pkg/manifests/manifests.go

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -253,8 +253,6 @@ var (
253253
ClusterMonitoringMetricsServerClientCertsSecret = "cluster-monitoring-operator/metrics-server-client-certs.yaml"
254254
ClusterMonitoringFederateClientCertsSecret = "cluster-monitoring-operator/federate-client-certs.yaml"
255255
ClusterMonitoringMetricsClientCACM = "cluster-monitoring-operator/metrics-client-ca.yaml"
256-
ClusterMonitoringDenyAllTraffic = "cluster-monitoring-operator/network-policy-default-deny.yaml"
257-
ClusterMonitoringNetworkPolicy = "cluster-monitoring-operator/network-policy-downstream.yaml"
258256

259257
TelemeterClientClusterRole = "telemeter-client/cluster-role.yaml"
260258
TelemeterClientClusterRoleBinding = "telemeter-client/cluster-role-binding.yaml"
@@ -2520,14 +2518,6 @@ func (f *Factory) ClusterMonitoringOperatorPrometheusRule() (*monv1.PrometheusRu
25202518
return f.NewPrometheusRule(f.assets.MustNewAssetSlice(ClusterMonitoringOperatorPrometheusRule))
25212519
}
25222520

2523-
func (f *Factory) ClusterMonitoringDenyAllTraffic() (*networkingv1.NetworkPolicy, error) {
2524-
return f.NewNetworkPolicy(f.assets.MustNewAssetSlice(ClusterMonitoringDenyAllTraffic))
2525-
}
2526-
2527-
func (f *Factory) ClusterMonitoringNetworkPolicy() (*networkingv1.NetworkPolicy, error) {
2528-
return f.NewNetworkPolicy(f.assets.MustNewAssetSlice(ClusterMonitoringNetworkPolicy))
2529-
}
2530-
25312521
func (f *Factory) ControlPlanePrometheusRule() (*monv1.PrometheusRule, error) {
25322522
r, err := f.NewPrometheusRule(f.assets.MustNewAssetSlice(ControlPlanePrometheusRule))
25332523
if err != nil {

pkg/tasks/clustermonitoringoperator.go

Lines changed: 0 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -45,23 +45,6 @@ func NewClusterMonitoringOperatorTask(
4545
}
4646

4747
func (t *ClusterMonitoringOperatorTask) Run(ctx context.Context) error {
48-
netpol, err := t.factory.ClusterMonitoringNetworkPolicy()
49-
if err != nil {
50-
return fmt.Errorf("initializing Cluster Monitoring Operator NetworkPolicy failed: %w", err)
51-
}
52-
53-
err = t.client.CreateOrUpdateNetworkPolicy(ctx, netpol)
54-
if err != nil {
55-
return fmt.Errorf("reconciling Cluster Monitoring Operator NetworkPolicy failed: %w", err)
56-
}
57-
58-
// Deploy the denyNetpol first would block CMO, deploy it last.
59-
// TODO: maybe the NPs for CMO itself are better handled by CVO.
60-
denyNetpol, err := t.factory.ClusterMonitoringDenyAllTraffic()
61-
if err != nil {
62-
return fmt.Errorf("initializing deny all pods traffic NetworkPolicy failed: %w", err)
63-
}
64-
6548
err = t.client.CreateOrUpdateNetworkPolicy(ctx, denyNetpol)
6649
if err != nil {
6750
return fmt.Errorf("reconciling deny all pods traffic NetworkPolicy failed: %w", err)

0 commit comments

Comments
 (0)