Skip to content

Commit 727f38a

Browse files
TomerNewmanTomerNewman
committed
adding network policies for kmm's operator
Due to security concerns, we need to allow KMM operator only the nessecery traffic. This commits adds Network policies for each kmm oeprator pod. 1. controller 2. webhook This commit also changes e2e tests to verify the network policies affect. This commit also affects KMM bundle to include the network policy mainfests.
1 parent 6982405 commit 727f38a

28 files changed

+252
-54
lines changed

‎Makefile‎

Lines changed: 40 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -279,6 +279,22 @@ operator-sdk:
279279
chmod +x ${OPERATOR_SDK}; \
280280
fi
281281

282+
.PHONY: bundle-old
283+
bundle-old: operator-sdk manifests kustomize ## Generate bundle manifests and metadata, then validate generated files.
284+
rm -fr ./bundle
285+
${OPERATOR_SDK} generate kustomize manifests --apis-dir api
286+
cd config/manager && $(KUSTOMIZE) edit set image controller=$(IMG) worker=$(WORKER_IMG)
287+
cd config/manager-base && $(KUSTOMIZE) edit set image must-gather=$(GATHER_IMG) signer=$(SIGNER_IMG)
288+
cd config/webhook-server && $(KUSTOMIZE) edit set image webhook-server=$(WEBHOOK_IMG)
289+
290+
OPERATOR_SDK="${OPERATOR_SDK}" \
291+
BUNDLE_GEN_FLAGS="${BUNDLE_GEN_FLAGS} --extra-service-accounts kmm-operator-module-loader,kmm-operator-device-plugin" \
292+
PKG=kernel-module-management \
293+
SOURCE_DIR=$(dir $(realpath $(lastword $(MAKEFILE_LIST)))) \
294+
./hack/generate-bundle
295+
296+
${OPERATOR_SDK} bundle validate ./bundle
297+
282298
.PHONY: bundle
283299
bundle: operator-sdk manifests kustomize ## Generate bundle manifests and metadata, then validate generated files.
284300
rm -fr ./bundle
@@ -291,9 +307,31 @@ bundle: operator-sdk manifests kustomize ## Generate bundle manifests and metada
291307
BUNDLE_GEN_FLAGS="${BUNDLE_GEN_FLAGS} --extra-service-accounts kmm-operator-module-loader,kmm-operator-device-plugin" \
292308
PKG=kernel-module-management \
293309
SOURCE_DIR=$(dir $(realpath $(lastword $(MAKEFILE_LIST)))) \
310+
INCLUDE_NETWORK_POLICIES=true \
294311
./hack/generate-bundle
295312

296-
${OPERATOR_SDK} bundle validate ./bundle
313+
.PHONY: bundle-hub-old
314+
bundle-hub-old: operator-sdk manifests kustomize ## Generate bundle manifests and metadata, then validate generated files.
315+
rm -fr bundle-hub
316+
317+
${OPERATOR_SDK} generate kustomize manifests \
318+
--apis-dir api-hub \
319+
--output-dir config/manifests-hub \
320+
--package kernel-module-management-hub \
321+
--input-dir config/manifests-hub
322+
cd config/manager-hub && $(KUSTOMIZE) edit set image controller=$(HUB_IMG)
323+
cd config/manager-base && $(KUSTOMIZE) edit set image must-gather=$(GATHER_IMG) signer=$(SIGNER_IMG)
324+
cd config/webhook-server && $(KUSTOMIZE) edit set image webhook-server=$(WEBHOOK_IMG)
325+
326+
OPERATOR_SDK="${OPERATOR_SDK}" \
327+
BUNDLE_GEN_FLAGS="${BUNDLE_GEN_FLAGS}" \
328+
MANIFESTS_DIR=config/manifests-hub \
329+
PKG=kernel-module-management-hub \
330+
SOURCE_DIR=$(dir $(realpath $(lastword $(MAKEFILE_LIST)))) \
331+
SUFFIX="-hub" \
332+
./hack/generate-bundle
333+
334+
${OPERATOR_SDK} bundle validate ./bundle-hub
297335

298336
.PHONY: bundle-hub
299337
bundle-hub: operator-sdk manifests kustomize ## Generate bundle manifests and metadata, then validate generated files.
@@ -314,9 +352,9 @@ bundle-hub: operator-sdk manifests kustomize ## Generate bundle manifests and me
314352
PKG=kernel-module-management-hub \
315353
SOURCE_DIR=$(dir $(realpath $(lastword $(MAKEFILE_LIST)))) \
316354
SUFFIX="-hub" \
355+
INCLUDE_NETWORK_POLICIES=true \
317356
./hack/generate-bundle
318357

319-
${OPERATOR_SDK} bundle validate ./bundle-hub
320358

321359
.PHONY: bundle-build-hub
322360
bundle-build-hub: ## Build the bundle-hub image.

‎bundle-hub/manifests/kernel-module-management-hub.clusterserviceversion.yaml‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -245,19 +245,13 @@ spec:
245245
replicas: 1
246246
selector:
247247
matchLabels:
248-
app.kubernetes.io/component: kmm-hub
249-
app.kubernetes.io/name: kmm-hub
250-
app.kubernetes.io/part-of: kmm
251248
control-plane: controller
252249
strategy: {}
253250
template:
254251
metadata:
255252
annotations:
256253
kubectl.kubernetes.io/default-container: manager
257254
labels:
258-
app.kubernetes.io/component: kmm-hub
259-
app.kubernetes.io/name: kmm-hub
260-
app.kubernetes.io/part-of: kmm
261255
control-plane: controller
262256
spec:
263257
affinity:
@@ -342,19 +336,13 @@ spec:
342336
replicas: 1
343337
selector:
344338
matchLabels:
345-
app.kubernetes.io/component: kmm-hub
346-
app.kubernetes.io/name: kmm-hub
347-
app.kubernetes.io/part-of: kmm
348339
control-plane: webhook-server
349340
strategy: {}
350341
template:
351342
metadata:
352343
annotations:
353344
kubectl.kubernetes.io/default-container: webhook-server
354345
labels:
355-
app.kubernetes.io/component: kmm-hub
356-
app.kubernetes.io/name: kmm-hub
357-
app.kubernetes.io/part-of: kmm
358346
control-plane: webhook-server
359347
spec:
360348
affinity:

‎bundle-hub/manifests/kmm-operator-hub-controller-metrics-service_v1_service.yaml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,6 @@ spec:
1717
protocol: TCP
1818
targetPort: metrics
1919
selector:
20-
app.kubernetes.io/component: kmm-hub
21-
app.kubernetes.io/name: kmm-hub
22-
app.kubernetes.io/part-of: kmm
2320
control-plane: controller
2421
status:
2522
loadBalancer: {}

‎bundle-hub/manifests/kmm-operator-hub-controller_networking.k8s.io_v1_networkpolicy.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: controller
5+
namespace: system
6+
spec:
7+
podSelector:
8+
matchLabels:
9+
control-plane: controller
10+
policyTypes:
11+
- Egress
12+
- Ingress
13+
ingress:
14+
- ports:
15+
- protocol: TCP # metrics port
16+
port: 8443
17+
- protocol: TCP
18+
port: 8081 # Healthz
19+
egress:
20+
- to:
21+
- namespaceSelector: # DNS
22+
matchLabels:
23+
kubernetes.io/metadata.name: openshift-dns
24+
podSelector:
25+
matchLabels:
26+
dns.operator.openshift.io/daemonset-dns: default
27+
ports:
28+
- protocol: UDP # DNS
29+
port: 53
30+
- protocol: TCP # DNS
31+
port: 53
32+
- ports: # kube api server
33+
- protocol: TCP
34+
port: 6443
35+
- protocol: TCP
36+
port: 443

‎bundle-hub/manifests/kmm-operator-hub-webhook-service_v1_service.yaml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,6 @@ spec:
1616
protocol: TCP
1717
targetPort: 9443
1818
selector:
19-
app.kubernetes.io/component: kmm-hub
20-
app.kubernetes.io/name: kmm-hub
21-
app.kubernetes.io/part-of: kmm
2219
control-plane: webhook-server
2320
status:
2421
loadBalancer: {}

‎bundle-hub/manifests/kmm-operator-hub-webhook_networking.k8s.io_v1_networkpolicy.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: webhook
5+
namespace: system
6+
spec:
7+
podSelector:
8+
matchLabels:
9+
control-plane: webhook-server
10+
policyTypes:
11+
- Egress
12+
- Ingress
13+
ingress:
14+
- ports:
15+
- protocol: TCP
16+
port: 9443
17+
egress:
18+
- ports: # kube api server port
19+
- protocol: TCP
20+
port: 6443
21+
- protocol: TCP
22+
port: 443

‎bundle/manifests/kernel-module-management.clusterserviceversion.yaml‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -352,19 +352,13 @@ spec:
352352
replicas: 1
353353
selector:
354354
matchLabels:
355-
app.kubernetes.io/component: kmm
356-
app.kubernetes.io/name: kmm
357-
app.kubernetes.io/part-of: kmm
358355
control-plane: controller
359356
strategy: {}
360357
template:
361358
metadata:
362359
annotations:
363360
kubectl.kubernetes.io/default-container: manager
364361
labels:
365-
app.kubernetes.io/component: kmm
366-
app.kubernetes.io/name: kmm
367-
app.kubernetes.io/part-of: kmm
368362
control-plane: controller
369363
spec:
370364
affinity:
@@ -451,19 +445,13 @@ spec:
451445
replicas: 1
452446
selector:
453447
matchLabels:
454-
app.kubernetes.io/component: kmm
455-
app.kubernetes.io/name: kmm
456-
app.kubernetes.io/part-of: kmm
457448
control-plane: webhook-server
458449
strategy: {}
459450
template:
460451
metadata:
461452
annotations:
462453
kubectl.kubernetes.io/default-container: webhook-server
463454
labels:
464-
app.kubernetes.io/component: kmm
465-
app.kubernetes.io/name: kmm
466-
app.kubernetes.io/part-of: kmm
467455
control-plane: webhook-server
468456
spec:
469457
affinity:

‎bundle/manifests/kmm-operator-controller-metrics-service_v1_service.yaml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,6 @@ spec:
1717
protocol: TCP
1818
targetPort: metrics
1919
selector:
20-
app.kubernetes.io/component: kmm
21-
app.kubernetes.io/name: kmm
22-
app.kubernetes.io/part-of: kmm
2320
control-plane: controller
2421
status:
2522
loadBalancer: {}

‎bundle/manifests/kmm-operator-controller_networking.k8s.io_v1_networkpolicy.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: controller
5+
namespace: system
6+
spec:
7+
podSelector:
8+
matchLabels:
9+
control-plane: controller
10+
policyTypes:
11+
- Egress
12+
- Ingress
13+
ingress:
14+
- ports:
15+
- protocol: TCP # metrics port
16+
port: 8443
17+
- protocol: TCP
18+
port: 8081 # Healthz
19+
egress:
20+
- to:
21+
- namespaceSelector: # DNS
22+
matchLabels:
23+
kubernetes.io/metadata.name: openshift-dns
24+
podSelector:
25+
matchLabels:
26+
dns.operator.openshift.io/daemonset-dns: default
27+
ports:
28+
- protocol: UDP # DNS
29+
port: 53
30+
- protocol: TCP # DNS
31+
port: 53
32+
- ports: # kube api server
33+
- protocol: TCP
34+
port: 6443
35+
- protocol: TCP
36+
port: 443

‎bundle/manifests/kmm-operator-webhook-service_v1_service.yaml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,6 @@ spec:
1616
protocol: TCP
1717
targetPort: 9443
1818
selector:
19-
app.kubernetes.io/component: kmm
20-
app.kubernetes.io/name: kmm
21-
app.kubernetes.io/part-of: kmm
2219
control-plane: webhook-server
2320
status:
2421
loadBalancer: {}

0 commit comments

Comments
 (0)