OCPBUGS-61088: create networkpolicy settings for in-cluster monitoring

assets/admission-webhook/networkpolicy.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  annotations:
+    include.release.openshift.io/hypershift: "true"
+    include.release.openshift.io/ibm-cloud-managed: "true"
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+  name: prometheus-operator-admission-webhook-access
+  namespace: openshift-monitoring
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: prometheus-operator-admission-webhook  # Label must match your prometheus-operator-admission-webhook pod
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  # Allow access to port 8443
+  - ports:
+    - port: 8443
+      protocol: TCP
+  egress:
+  # Allow curl 8443 and return result from any pod under any namespace
+  - {}

assets/alertmanager/networkpolicy.yaml

@@ -0,0 +1,32 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  annotations:
+    include.release.openshift.io/hypershift: "true"
+    include.release.openshift.io/ibm-cloud-managed: "true"
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+  name: alertmanager-access
+  namespace: openshift-monitoring
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: alertmanager  # Label must match your alertmanager pod
+  policyTypes:
+  - Ingress
+  - Egress
+  # Allow access to ports 9092(tenancy)/9094(service)/9095(web)/9097(metrics) from all pods in all namespaces for ingress and egress
+  ingress:
+  - ports:
+    - port: 9092
+      protocol: TCP
+    - port: 9094
+      protocol: TCP
+    - port: 9094
+      protocol: UDP
+    - port: 9095
+      protocol: TCP
+    - port: 9097
+      protocol: TCP
+  egress:
+  - {}

assets/cluster-monitoring-operator/cluster-monitoring-operator-networkpolicy.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  annotations:
+    include.release.openshift.io/hypershift: "true"
+    include.release.openshift.io/ibm-cloud-managed: "true"
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+  name: cluster-monitoring-operator-access
+  namespace: openshift-monitoring
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: cluster-monitoring-operator
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  # Allow access to port 8443
+  - ports:
+    - port: 8443
+      protocol: TCP
+  egress:
+  # Allow curl 8443 and return result from any pod under any namespace
+  - {}

assets/cluster-monitoring-operator/default-deny-networkpolicy.yaml

@@ -0,0 +1,15 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  annotations:
+    include.release.openshift.io/hypershift: "true"
+    include.release.openshift.io/ibm-cloud-managed: "true"
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+  name: default-deny
+  namespace: openshift-monitoring
+spec:
+  podSelector: {}
+  policyTypes:
+  - Ingress
+  - Egress

assets/kube-state-metrics/networkpolicy.yaml

@@ -0,0 +1,26 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  annotations:
+    include.release.openshift.io/hypershift: "true"
+    include.release.openshift.io/ibm-cloud-managed: "true"
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+  name: kube-state-metrics-access
+  namespace: openshift-monitoring
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: kube-state-metrics  # Label must match your kube-state-metrics pod
+  policyTypes:
+  - Ingress
+  - Egress
+  # Allow access to ports 8443(https-main)/9443(https-self)
+  ingress:
+  - ports:
+    - port: 8443
+      protocol: TCP
+    - port: 9443
+      protocol: TCP
+  egress:
+  - {}

assets/metrics-server/networkpolicy.yaml

@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  annotations:
+    include.release.openshift.io/hypershift: "true"
+    include.release.openshift.io/ibm-cloud-managed: "true"
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+  name: metrics-server-access
+  namespace: openshift-monitoring
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: metrics-server  # Label must match your metrics-server pod
+  policyTypes:
+  - Ingress
+  - Egress
+  # Allow access to ports 10250
+  ingress:
+  - ports:
+    - port: 10250
+      protocol: TCP
+  egress:
+  - {}

assets/monitoring-plugin/networkpolicy.yaml

@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  annotations:
+    include.release.openshift.io/hypershift: "true"
+    include.release.openshift.io/ibm-cloud-managed: "true"
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+  name: monitoring-plugin-access
+  namespace: openshift-monitoring
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: monitoring-plugin  # Label must match your monitoring-plugin pod
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  # Allow access to port 9443
+  - ports:
+    - port: 9443
+      protocol: TCP
+  egress:
+  - {}

assets/openshift-state-metrics/networkpolicy.yaml

@@ -0,0 +1,26 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  annotations:
+    include.release.openshift.io/hypershift: "true"
+    include.release.openshift.io/ibm-cloud-managed: "true"
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+  name: openshift-state-metrics-access
+  namespace: openshift-monitoring
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: openshift-state-metrics  # Label must match your openshift-state-metrics pod
+  policyTypes:
+  - Ingress
+  - Egress
+  # Allow access to ports 8443(https-main)/9443(https-self)
+  ingress:
+  - ports:
+    - port: 8443
+      protocol: TCP
+    - port: 9443
+      protocol: TCP
+  egress:
+  - {}

assets/prometheus-k8s/networkpolicy.yaml

@@ -0,0 +1,33 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  annotations:
+    include.release.openshift.io/hypershift: "true"
+    include.release.openshift.io/ibm-cloud-managed: "true"
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+  name: prometheus-access
+  namespace: openshift-monitoring
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: prometheus  # Label must match your Prometheus pod
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  # Allow access to ports 9091(svc port)/9092(metrics port)
+  - ports:
+    - port: 9091
+      protocol: TCP
+    - port: 9092
+      protocol: TCP
+ # grpc port 10901
+    - port: 10901
+      protocol: TCP
+ # thanos-proxy port 10903 for prometheus thanos-sidecar target
+    - port: 10903
+      protocol: TCP
+ # allow to access targert port to check target health and scrape from target
+  egress:
+  - {}

assets/prometheus-operator/networkpolicy.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  annotations:
+    include.release.openshift.io/hypershift: "true"
+    include.release.openshift.io/ibm-cloud-managed: "true"
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+  name: prometheus-operator-access
+  namespace: openshift-monitoring
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: prometheus-operator  # Label must match your prometheus-operator pod
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  # Allow access to port 8443
+  - ports:
+    - port: 8443
+      protocol: TCP
+  egress:
+  # Allow curl 8443 and return result from any pod under any namespace
+  - {}

assets/telemeter-client/networkpolicy.yaml

@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  annotations:
+    include.release.openshift.io/hypershift: "true"
+    include.release.openshift.io/ibm-cloud-managed: "true"
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+  name: telemeter-client-access
+  namespace: openshift-monitoring
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: telemeter-client  # Label must match your telemeter-client pod
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  # Allow access to port 8443
+  - ports:
+    - port: 8443
+      protocol: TCP
+  egress:
+  - {}

assets/thanos-querier/networkpolicy.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  annotations:
+    include.release.openshift.io/hypershift: "true"
+    include.release.openshift.io/ibm-cloud-managed: "true"
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+  name: thanos-querier-access
+  namespace: openshift-monitoring
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: thanos-query  # Label must match your thanos-query pod
+  policyTypes:
+  - Ingress
+  - Egress
+  # Allow access to ports 9091(svc)/9092(tenancy)/9093(tenancy-rules)/9094(metrics) from all pods in all namespaces  for ingress and egress
+  ingress:
+  - ports:
+    - port: 9091
+      endPort: 9094
+      protocol: TCP
+  egress:
+  - {}

jsonnet/components/admission-webhook.libsonnet

@@ -168,4 +168,42 @@ function(params)
         },
       ],
     },
+    networkPolicy: {
+      apiVersion: 'networking.k8s.io/v1',
+      kind: 'NetworkPolicy',
+      metadata: {
+        annotations: {
+          'include.release.openshift.io/hypershift': 'true',
+          'include.release.openshift.io/ibm-cloud-managed': 'true',
+          'include.release.openshift.io/self-managed-high-availability': 'true',
+          'include.release.openshift.io/single-node-developer': 'true',
+        },
+        name: 'prometheus-operator-access',
+        namespace: 'openshift-monitoring',
+      },
+      spec: {
+        podSelector: {
+          matchLabels: {
+            'app.kubernetes.io/name': 'prometheus-operator',
+          },
+        },
+        policyTypes: [
+          'Ingress',
+          'Egress',
+        ],
+        ingress: [
+          {
+            ports: [
+              {
+                port: '8443',
+                protocol: 'TCP',
+              },
+            ],
+          },
+        ],
+        egress: [
+          {},
+        ],
+      },
+    },
   }