Skip to content

🐛 OPRUN-4139: Use control-plane selectors in network-policies and tests for now #2218

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 12, 2025
Merged

🐛 OPRUN-4139: Use control-plane selectors in network-policies and tests for now #2218

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .../olmv1/templates/networkpolicy/networkpolicy-olmv1-system-catalogd-controller-manager.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ spec:
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: catalogd
control-plane: catalogd-controller-manager
policyTypes:
- Ingress
- Egress
Expand Down
2 changes: 1 addition & 1 deletion ...lates/networkpolicy/networkpolicy-olmv1-system-operator-controller-controller-manager.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ spec:
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: operator-controller
control-plane: operator-controller-controller-manager
policyTypes:
- Ingress
- Egress
Expand Down
4 changes: 2 additions & 2 deletions manifests/experimental-e2e.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ spec:
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: catalogd
control-plane: catalogd-controller-manager
policyTypes:
- Ingress
- Egress
Expand Down Expand Up @@ -82,7 +82,7 @@ spec:
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: operator-controller
control-plane: operator-controller-controller-manager
policyTypes:
- Ingress
- Egress
Expand Down
4 changes: 2 additions & 2 deletions manifests/experimental.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ spec:
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: catalogd
control-plane: catalogd-controller-manager
policyTypes:
- Ingress
- Egress
Expand Down Expand Up @@ -82,7 +82,7 @@ spec:
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: operator-controller
control-plane: operator-controller-controller-manager
policyTypes:
- Ingress
- Egress
Expand Down
4 changes: 2 additions & 2 deletions manifests/standard-e2e.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ spec:
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: catalogd
control-plane: catalogd-controller-manager
policyTypes:
- Ingress
- Egress
Expand Down Expand Up @@ -82,7 +82,7 @@ spec:
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: operator-controller
control-plane: operator-controller-controller-manager
policyTypes:
- Ingress
- Egress
Expand Down
4 changes: 2 additions & 2 deletions manifests/standard.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ spec:
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: catalogd
control-plane: catalogd-controller-manager
policyTypes:
- Ingress
- Egress
Expand Down Expand Up @@ -82,7 +82,7 @@ spec:
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: operator-controller
control-plane: operator-controller-controller-manager
policyTypes:
- Ingress
- Egress
Expand Down
26 changes: 11 additions & 15 deletions test/e2e/metrics_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ import (
func TestOperatorControllerMetricsExportedEndpoint(t *testing.T) {
client := utils.FindK8sClient(t)
curlNamespace := createRandomNamespace(t, client)
componentNamespace := getComponentNamespace(t, client, operatorManagerSelector)
componentNamespace := getComponentNamespace(t, client, "control-plane=operator-controller-controller-manager")
metricsURL := fmt.Sprintf("https://operator-controller-service.%s.svc.cluster.local:8443/metrics", componentNamespace)

config := NewMetricsTestConfig(
Expand All @@ -52,7 +52,7 @@ func TestOperatorControllerMetricsExportedEndpoint(t *testing.T) {
func TestCatalogdMetricsExportedEndpoint(t *testing.T) {
client := utils.FindK8sClient(t)
curlNamespace := createRandomNamespace(t, client)
componentNamespace := getComponentNamespace(t, client, catalogdManagerSelector)
componentNamespace := getComponentNamespace(t, client, "control-plane=catalogd-controller-manager")
metricsURL := fmt.Sprintf("https://catalogd-service.%s.svc.cluster.local:7443/metrics", componentNamespace)

config := NewMetricsTestConfig(
Expand Down Expand Up @@ -231,20 +231,16 @@ func createRandomNamespace(t *testing.T, client string) string {
}

// getComponentNamespace returns the namespace where operator-controller or catalogd is running
func getComponentNamespace(t *testing.T, client string, selectors []string) string {
for _, selector := range selectors {
cmd := exec.Command(client, "get", "pods", "--all-namespaces", "--selector="+selector, "--output=jsonpath={.items[0].metadata.namespace}")
output, err := cmd.CombinedOutput()
if err != nil {
continue
}
namespace := string(bytes.TrimSpace(output))
if namespace != "" {
return namespace
}
func getComponentNamespace(t *testing.T, client, selector string) string {
cmd := exec.Command(client, "get", "pods", "--all-namespaces", "--selector="+selector, "--output=jsonpath={.items[0].metadata.namespace}")
output, err := cmd.CombinedOutput()
require.NoError(t, err, "Error determining namespace: %s", string(output))

namespace := string(bytes.TrimSpace(output))
if namespace == "" {
t.Fatal("No namespace found for selector " + selector)
}
t.Fatalf("No namespace found for selectors: %v", selectors)
return ""
return namespace
}

func stdoutAndCombined(cmd *exec.Cmd) ([]byte, []byte, error) {
Expand Down
11 changes: 4 additions & 7 deletions test/e2e/network_policy_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,17 +20,14 @@ import (

const (
minJustificationLength = 40
catalogdManagerSelector = "control-plane=catalogd-controller-manager"
operatorManagerSelector = "control-plane=operator-controller-controller-manager"
catalogdMetricsPort = 7443
catalogdWebhookPort = 9443
catalogServerPort = 8443
operatorControllerMetricsPort = 8443
)

var (
catalogdManagerSelector = []string{"app.kubernetes.io/name=catalogd", "control-plane=catalogd-controller-manager"}
operatorManagerSelector = []string{"app.kubernetes.io/name=operator-controller", "control-plane=operator-controller-controller-manager"}
)

type portWithJustification struct {
port []networkingv1.NetworkPolicyPort
justification string
Expand Down Expand Up @@ -91,7 +88,7 @@ var prometheuSpec = allowedPolicyDefinition{
// Ref: https://docs.google.com/document/d/1bHEEWzA65u-kjJFQRUY1iBuMIIM1HbPy4MeDLX4NI3o/edit?usp=sharing
var allowedNetworkPolicies = map[string]allowedPolicyDefinition{
"catalogd-controller-manager": {
selector: metav1.LabelSelector{MatchLabels: map[string]string{"app.kubernetes.io/name": "catalogd"}},
selector: metav1.LabelSelector{MatchLabels: map[string]string{"control-plane": "catalogd-controller-manager"}},
policyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress, networkingv1.PolicyTypeEgress},
ingressRule: ingressRule{
ports: []portWithJustification{
Expand Down Expand Up @@ -119,7 +116,7 @@ var allowedNetworkPolicies = map[string]allowedPolicyDefinition{
},
},
"operator-controller-controller-manager": {
selector: metav1.LabelSelector{MatchLabels: map[string]string{"app.kubernetes.io/name": "operator-controller"}},
selector: metav1.LabelSelector{MatchLabels: map[string]string{"control-plane": "operator-controller-controller-manager"}},
policyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress, networkingv1.PolicyTypeEgress},
ingressRule: ingressRule{
ports: []portWithJustification{
Expand Down