Skip to content

Commit cf0967f

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #74 from siddhibhor-56/network-policy-operand
ESO-223:Implementation of Network Policy for External Secrets Operand
2 parents 8b4826d + fca9509 commit cf0967f

23 files changed

+1929
-31
lines changed

‎api/v1alpha1/external_secrets_config_types.go‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package v1alpha1
22

33
import (
4+
networkingv1 "k8s.io/api/networking/v1"
45
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
56
)
67

@@ -120,6 +121,24 @@ type ControllerConfig struct {
120121
// +kubebuilder:validation:Maximum:=18000
121122
// +kubebuilder:validation:Optional
122123
PeriodicReconcileInterval uint32 `json:"periodicReconcileInterval,omitempty"`
124+
125+
// networkPolicies specifies the list of network policy configurations
126+
// to be applied to external-secrets pods.
127+
//
128+
// Each entry allows specifying a name for the generated NetworkPolicy object,
129+
// along with its full Kubernetes NetworkPolicy definition.
130+
//
131+
// If this field is not provided, external-secrets components will be isolated
132+
// with deny-all network policies, which will prevent proper operation.
133+
//
134+
// +kubebuilder:validation:XValidation:rule="oldSelf.all(op, self.exists(p, p.name == op.name && p.componentName == op.componentName))",message="name and componentName fields in networkPolicies are immutable"
135+
// +kubebuilder:validation:MinItems:=0
136+
// +kubebuilder:validation:MaxItems:=50
137+
// +kubebuilder:validation:Optional
138+
// +listType=map
139+
// +listMapKey=name
140+
// +listMapKey=componentName
141+
NetworkPolicies []NetworkPolicy `json:"networkPolicies,omitempty"`
123142
}
124143

125144
// BitwardenSecretManagerProvider is for enabling the bitwarden secrets manager provider and for setting up the additional service required for connecting with the bitwarden server.
@@ -201,3 +220,41 @@ type CertProvidersConfig struct {
201220
// +kubebuilder:validation:Optional
202221
CertManager *CertManagerConfig `json:"certManager,omitempty"`
203222
}
223+
224+
// ComponentName represents the different external-secrets components that can have network policies applied.
225+
type ComponentName string
226+
227+
const (
228+
// CoreController represents the external-secrets component
229+
CoreController ComponentName = "ExternalSecretsCoreController"
230+
231+
// BitwardenSDKServer represents the bitwarden-sdk-server component
232+
BitwardenSDKServer ComponentName = "BitwardenSDKServer"
233+
)
234+
235+
// NetworkPolicy represents a custom network policy configuration for operator-managed components.
236+
// It includes a name for identification and the network policy rules to be enforced.
237+
type NetworkPolicy struct {
238+
// name is a unique identifier for this network policy configuration.
239+
// This name will be used as part of the generated NetworkPolicy resource name.
240+
// +kubebuilder:validation:MinLength:=1
241+
// +kubebuilder:validation:MaxLength:=253
242+
// +kubebuilder:validation:Required
243+
Name string `json:"name"`
244+
245+
// componentName specifies which external-secrets component this network policy applies to.
246+
// +kubebuilder:validation:Enum:=ExternalSecretsCoreController;BitwardenSDKServer
247+
// +kubebuilder:validation:Required
248+
ComponentName ComponentName `json:"componentName"`
249+
250+
// egress is a list of egress rules to be applied to the selected pods. Outgoing traffic
251+
// is allowed if there are no NetworkPolicies selecting the pod (and cluster policy
252+
// otherwise allows the traffic), OR if the traffic matches at least one egress rule
253+
// across all the NetworkPolicy objects whose podSelector matches the pod. If
254+
// this field is empty then this NetworkPolicy limits all outgoing traffic (and serves
255+
// solely to ensure that the pods it selects are isolated by default).
256+
// The operator will automatically handle ingress rules based on the current running ports.
257+
// +kubebuilder:validation:Required
258+
//+listType=atomic
259+
Egress []networkingv1.NetworkPolicyEgressRule `json:"egress,omitempty" protobuf:"bytes,3,rep,name=egress"`
260+
}

‎api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 30 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎bindata/external-secrets/networkpolicy_allow-api-server-and-webhook-traffic.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: allow-api-server-egress-for-webhook
5+
namespace: external-secrets
6+
labels:
7+
app.kubernetes.io/name: external-secrets-webhook
8+
app.kubernetes.io/instance: external-secrets
9+
app.kubernetes.io/version: "v0.19.0"
10+
app.kubernetes.io/managed-by: external-secrets-operator
11+
external-secrets.io/component: webhook
12+
spec:
13+
podSelector:
14+
matchLabels:
15+
app.kubernetes.io/name: external-secrets-webhook
16+
policyTypes:
17+
- Egress
18+
- Ingress
19+
egress:
20+
- ports:
21+
- protocol: TCP
22+
port: 6443
23+
ingress:
24+
- ports:
25+
- protocol: TCP
26+
port: 10250
27+
# Allow Prometheus/monitoring to scrape metrics
28+
- from:
29+
- namespaceSelector:
30+
matchLabels:
31+
openshift.io/cluster-monitoring: "true"
32+
- namespaceSelector:
33+
matchLabels:
34+
name: openshift-monitoring
35+
ports:
36+
- protocol: TCP
37+
port: 8080

‎bindata/external-secrets/networkpolicy_allow-api-server-egress-for-bitwarden-sever.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: allow-api-server-egress-for-bitwarden-server
5+
namespace: external-secrets
6+
labels:
7+
app.kubernetes.io/name: bitwarden-sdk-server
8+
app.kubernetes.io/instance: external-secrets
9+
app.kubernetes.io/version: "v0.19.0"
10+
app.kubernetes.io/managed-by: external-secrets-operator
11+
spec:
12+
podSelector:
13+
matchLabels:
14+
app.kubernetes.io/name: bitwarden-sdk-server
15+
policyTypes:
16+
- Ingress
17+
- Egress
18+
ingress:
19+
# Allow External Secrets Controller to communicate with Bitwarden SDK Server
20+
- ports:
21+
- protocol: TCP
22+
port: 9998
23+
# Allow access to Kubernetes API server and bitwarden sdk external server
24+
egress:
25+
- ports:
26+
- protocol: TCP
27+
port: 6443
28+
- protocol: TCP
29+
port: 443

‎bindata/external-secrets/networkpolicy_allow-api-server-egress-for-cert-controller-traffic.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: allow-api-server-egress-for-cert-controller
5+
namespace: external-secrets
6+
labels:
7+
app.kubernetes.io/name: external-secrets-cert-controller
8+
app.kubernetes.io/instance: external-secrets
9+
app.kubernetes.io/version: "v0.19.0"
10+
app.kubernetes.io/managed-by: external-secrets-operator
11+
spec:
12+
podSelector:
13+
matchLabels:
14+
app.kubernetes.io/name: external-secrets-cert-controller
15+
policyTypes:
16+
- Egress
17+
- Ingress
18+
egress:
19+
- ports:
20+
- protocol: TCP
21+
port: 6443
22+
ingress:
23+
# Allow Prometheus/monitoring to scrape metrics
24+
- from:
25+
- namespaceSelector:
26+
matchLabels:
27+
openshift.io/cluster-monitoring: "true"
28+
- namespaceSelector:
29+
matchLabels:
30+
name: openshift-monitoring
31+
ports:
32+
- protocol: TCP
33+
port: 8080

‎bindata/external-secrets/networkpolicy_allow-api-server-egress-for-main-controller-traffic.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: allow-api-server-egress-for-main-controller
5+
namespace: external-secrets
6+
labels:
7+
app.kubernetes.io/name: external-secrets
8+
app.kubernetes.io/instance: external-secrets
9+
app.kubernetes.io/version: "v0.19.0"
10+
app.kubernetes.io/managed-by: external-secrets-operator
11+
spec:
12+
podSelector:
13+
matchLabels:
14+
app.kubernetes.io/name: external-secrets
15+
policyTypes:
16+
- Egress
17+
- Ingress
18+
egress:
19+
- ports:
20+
- protocol: TCP
21+
port: 6443
22+
ingress:
23+
# Allow Prometheus/monitoring to scrape metrics
24+
- from:
25+
- namespaceSelector:
26+
matchLabels:
27+
openshift.io/cluster-monitoring: "true"
28+
- namespaceSelector:
29+
matchLabels:
30+
name: openshift-monitoring
31+
ports:
32+
- protocol: TCP
33+
port: 8080

‎bindata/external-secrets/networkpolicy_allow-dns.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
labels:
5+
app.kubernetes.io/name: external-secrets
6+
app.kubernetes.io/instance: external-secrets
7+
app.kubernetes.io/version: "v0.19.0"
8+
app.kubernetes.io/managed-by: external-secrets-operator
9+
name: allow-to-dns
10+
spec:
11+
podSelector:
12+
matchExpressions:
13+
- key: app.kubernetes.io/name
14+
operator: In
15+
values:
16+
- external-secrets
17+
- bitwarden-sdk-server
18+
egress:
19+
- to:
20+
- namespaceSelector:
21+
matchLabels:
22+
kubernetes.io/metadata.name: openshift-dns
23+
podSelector:
24+
matchLabels:
25+
dns.operator.openshift.io/daemonset-dns: default
26+
ports:
27+
- protocol: TCP
28+
port: 5353
29+
- protocol: UDP
30+
port: 5353
31+
- protocol: TCP
32+
port: 53
33+
- protocol: UDP
34+
port: 53
35+
policyTypes:
36+
- Egress

‎bindata/external-secrets/networkpolicy_deny-all.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: deny-all-traffic
5+
namespace: external-secrets
6+
labels:
7+
app.kubernetes.io/name: external-secrets
8+
app.kubernetes.io/instance: external-secrets
9+
app.kubernetes.io/version: "v0.19.0"
10+
app.kubernetes.io/managed-by: external-secrets-operator
11+
spec:
12+
podSelector: {}
13+
policyTypes:
14+
- Ingress
15+
- Egress

‎bundle/manifests/external-secrets-operator.clusterserviceversion.yaml‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -220,7 +220,7 @@ metadata:
220220
categories: Security
221221
console.openshift.io/disable-operand-delete: "true"
222222
containerImage: openshift.io/external-secrets-operator:latest
223-
createdAt: "2025-10-07T03:20:14Z"
223+
createdAt: "2025-10-09T11:13:16Z"
224224
features.operators.openshift.io/cnf: "false"
225225
features.operators.openshift.io/cni: "false"
226226
features.operators.openshift.io/csi: "false"
@@ -578,6 +578,16 @@ spec:
578578
- patch
579579
- update
580580
- watch
581+
- apiGroups:
582+
- networking.k8s.io
583+
resources:
584+
- networkpolicies
585+
verbs:
586+
- create
587+
- get
588+
- list
589+
- update
590+
- watch
581591
- apiGroups:
582592
- operator.openshift.io
583593
resources:

0 commit comments

Comments
 (0)