Skip to content

Commit 708a111

Browse files
author
Per Goncalves da Silva
committed
<carry>: update network policy configuration for metrics and dns on openshift
Signed-off-by: Per Goncalves da Silva <[email protected]>
1 parent 8970d0f commit 708a111

9 files changed

+520
-0
lines changed

‎manifests/0000_50_olm_01-networkpolicies.yaml

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: default-deny-all-traffic
5+
namespace: openshift-operator-lifecycle-manager
6+
annotations:
7+
include.release.openshift.io/ibm-cloud-managed: "true"
8+
include.release.openshift.io/self-managed-high-availability: "true"
9+
capability.openshift.io/name: "OperatorLifecycleManager"
10+
include.release.openshift.io/hypershift: "true"
11+
spec:
12+
podSelector: {}
13+
policyTypes:
14+
- Ingress
15+
- Egress
16+
---
17+
apiVersion: networking.k8s.io/v1
18+
kind: NetworkPolicy
19+
metadata:
20+
name: olm-operator
21+
namespace: openshift-operator-lifecycle-manager
22+
annotations:
23+
include.release.openshift.io/ibm-cloud-managed: "true"
24+
include.release.openshift.io/self-managed-high-availability: "true"
25+
capability.openshift.io/name: "OperatorLifecycleManager"
26+
include.release.openshift.io/hypershift: "true"
27+
spec:
28+
podSelector:
29+
matchLabels:
30+
app: olm-operator
31+
ingress:
32+
- ports:
33+
- port: metrics
34+
protocol: TCP
35+
egress:
36+
- ports:
37+
- port: 6443
38+
protocol: TCP
39+
- ports:
40+
- port: dns-tcp
41+
protocol: TCP
42+
- port: dns
43+
protocol: UDP
44+
to:
45+
- namespaceSelector:
46+
matchLabels:
47+
kubernetes.io/metadata.name: openshift-dns
48+
policyTypes:
49+
- Ingress
50+
- Egress
51+
---
52+
apiVersion: networking.k8s.io/v1
53+
kind: NetworkPolicy
54+
metadata:
55+
name: catalog-operator
56+
namespace: openshift-operator-lifecycle-manager
57+
annotations:
58+
include.release.openshift.io/ibm-cloud-managed: "true"
59+
include.release.openshift.io/self-managed-high-availability: "true"
60+
capability.openshift.io/name: "OperatorLifecycleManager"
61+
include.release.openshift.io/hypershift: "true"
62+
spec:
63+
podSelector:
64+
matchLabels:
65+
app: catalog-operator
66+
ingress:
67+
- ports:
68+
- port: metrics
69+
protocol: TCP
70+
egress:
71+
- ports:
72+
- port: 6443
73+
protocol: TCP
74+
- ports:
75+
- port: dns-tcp
76+
protocol: TCP
77+
- port: dns
78+
protocol: UDP
79+
to:
80+
- namespaceSelector:
81+
matchLabels:
82+
kubernetes.io/metadata.name: openshift-dns
83+
- ports: # This is another distinct rule in the egress list
84+
- protocol: TCP
85+
port: 50051
86+
policyTypes:
87+
- Ingress
88+
- Egress
89+
---
90+
apiVersion: networking.k8s.io/v1
91+
kind: NetworkPolicy
92+
metadata:
93+
name: packageserver
94+
namespace: openshift-operator-lifecycle-manager
95+
annotations:
96+
include.release.openshift.io/ibm-cloud-managed: "true"
97+
include.release.openshift.io/self-managed-high-availability: "true"
98+
capability.openshift.io/name: "OperatorLifecycleManager"
99+
include.release.openshift.io/hypershift: "true"
100+
spec:
101+
podSelector:
102+
matchLabels:
103+
app: packageserver
104+
ingress:
105+
- ports:
106+
- protocol: TCP
107+
port: 5443
108+
egress:
109+
- ports:
110+
- port: 6443
111+
protocol: TCP
112+
- ports:
113+
- port: dns-tcp
114+
protocol: TCP
115+
- port: dns
116+
protocol: UDP
117+
to:
118+
- namespaceSelector:
119+
matchLabels:
120+
kubernetes.io/metadata.name: openshift-dns
121+
- ports:
122+
- protocol: TCP
123+
port: 50051
124+
policyTypes:
125+
- Ingress
126+
- Egress
127+
---
128+
apiVersion: networking.k8s.io/v1
129+
kind: NetworkPolicy
130+
metadata:
131+
name: default-allow-all
132+
namespace: openshift-operators
133+
annotations:
134+
include.release.openshift.io/ibm-cloud-managed: "true"
135+
include.release.openshift.io/self-managed-high-availability: "true"
136+
capability.openshift.io/name: "OperatorLifecycleManager"
137+
include.release.openshift.io/hypershift: "true"
138+
spec:
139+
podSelector: {}
140+
policyTypes:
141+
- Ingress
142+
- Egress
143+
ingress:
144+
- {}
145+
egress:
146+
- {}

‎manifests/0000_50_olm_02-olm-operator.serviceaccount.yaml

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
kind: ServiceAccount
2+
apiVersion: v1
3+
metadata:
4+
name: olm-operator-serviceaccount
5+
namespace: openshift-operator-lifecycle-manager
6+
annotations:
7+
include.release.openshift.io/ibm-cloud-managed: "true"
8+
include.release.openshift.io/self-managed-high-availability: "true"
9+
capability.openshift.io/name: "OperatorLifecycleManager"
10+
include.release.openshift.io/hypershift: "true"
11+
---
12+
apiVersion: rbac.authorization.k8s.io/v1
13+
kind: ClusterRole
14+
metadata:
15+
name: system:controller:operator-lifecycle-manager
16+
annotations:
17+
include.release.openshift.io/ibm-cloud-managed: "true"
18+
include.release.openshift.io/self-managed-high-availability: "true"
19+
capability.openshift.io/name: "OperatorLifecycleManager"
20+
include.release.openshift.io/hypershift: "true"
21+
rules:
22+
- apiGroups: ["*"]
23+
resources: ["*"]
24+
verbs: ["watch", "list", "get", "create", "update", "patch", "delete", "deletecollection", "escalate", "bind"]
25+
- nonResourceURLs: ["*"]
26+
verbs: ["*"]
27+
- apiGroups:
28+
- security.openshift.io
29+
resources:
30+
- securitycontextconstraints
31+
resourceNames:
32+
- restricted-v2
33+
- anyuid
34+
verbs:
35+
- use
36+
---
37+
apiVersion: rbac.authorization.k8s.io/v1
38+
kind: ClusterRoleBinding
39+
metadata:
40+
name: olm-operator-binding-openshift-operator-lifecycle-manager
41+
annotations:
42+
include.release.openshift.io/ibm-cloud-managed: "true"
43+
include.release.openshift.io/self-managed-high-availability: "true"
44+
capability.openshift.io/name: "OperatorLifecycleManager"
45+
include.release.openshift.io/hypershift: "true"
46+
roleRef:
47+
apiGroup: rbac.authorization.k8s.io
48+
kind: ClusterRole
49+
name: system:controller:operator-lifecycle-manager
50+
subjects:
51+
- kind: ServiceAccount
52+
name: olm-operator-serviceaccount
53+
namespace: openshift-operator-lifecycle-manager

‎manifests/0000_50_olm_03-olmconfig.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
apiVersion: operators.coreos.com/v1
2+
kind: OLMConfig
3+
metadata:
4+
name: cluster
5+
annotations:
6+
release.openshift.io/create-only: "true"
7+
include.release.openshift.io/ibm-cloud-managed: "true"
8+
include.release.openshift.io/self-managed-high-availability: "true"
9+
capability.openshift.io/name: "OperatorLifecycleManager"
10+
include.release.openshift.io/hypershift: "true"

‎manifests/0000_50_olm_03-services.yaml

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: olm-operator-metrics
5+
namespace: openshift-operator-lifecycle-manager
6+
annotations:
7+
service.alpha.openshift.io/serving-cert-secret-name: olm-operator-serving-cert
8+
include.release.openshift.io/ibm-cloud-managed: "true"
9+
include.release.openshift.io/self-managed-high-availability: "true"
10+
capability.openshift.io/name: "OperatorLifecycleManager"
11+
include.release.openshift.io/hypershift: "true"
12+
labels:
13+
app: olm-operator
14+
spec:
15+
type: ClusterIP
16+
ports:
17+
- name: https-metrics
18+
port: 8443
19+
protocol: TCP
20+
targetPort: 8443
21+
selector:
22+
app: olm-operator
23+
---
24+
apiVersion: v1
25+
kind: Service
26+
metadata:
27+
name: catalog-operator-metrics
28+
namespace: openshift-operator-lifecycle-manager
29+
annotations:
30+
service.alpha.openshift.io/serving-cert-secret-name: catalog-operator-serving-cert
31+
include.release.openshift.io/ibm-cloud-managed: "true"
32+
include.release.openshift.io/self-managed-high-availability: "true"
33+
capability.openshift.io/name: "OperatorLifecycleManager"
34+
include.release.openshift.io/hypershift: "true"
35+
labels:
36+
app: catalog-operator
37+
spec:
38+
type: ClusterIP
39+
ports:
40+
- name: https-metrics
41+
port: 8443
42+
protocol: TCP
43+
targetPort: 8443
44+
selector:
45+
app: catalog-operator

0 commit comments

Comments
 (0)