Skip to content

Commit 8d8c933

Browse files
TomerNewmanTomerNewman
committed
adding network policies to kmm
Due to security concerns, we need to allow KMM operator only the nessecery traffic. This commits adds Network policies for each kmm pod. 1. controller 2. webhook 3. build and sign This commit also changes e2e tests to verify the network policies affect. This commit also affects KMM bundle to include the network policy mainfests.
1 parent 04655ff commit 8d8c933

35 files changed

+329
-57
lines changed

‎Makefile‎

Lines changed: 40 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -279,6 +279,22 @@ operator-sdk:
279279
chmod +x ${OPERATOR_SDK}; \
280280
fi
281281

282+
.PHONY: bundle-old
283+
bundle-old: operator-sdk manifests kustomize ## Generate bundle manifests and metadata, then validate generated files.
284+
rm -fr ./bundle
285+
${OPERATOR_SDK} generate kustomize manifests --apis-dir api
286+
cd config/manager && $(KUSTOMIZE) edit set image controller=$(IMG) worker=$(WORKER_IMG)
287+
cd config/manager-base && $(KUSTOMIZE) edit set image must-gather=$(GATHER_IMG) signer=$(SIGNER_IMG)
288+
cd config/webhook-server && $(KUSTOMIZE) edit set image webhook-server=$(WEBHOOK_IMG)
289+
290+
OPERATOR_SDK="${OPERATOR_SDK}" \
291+
BUNDLE_GEN_FLAGS="${BUNDLE_GEN_FLAGS} --extra-service-accounts kmm-operator-module-loader,kmm-operator-device-plugin" \
292+
PKG=kernel-module-management \
293+
SOURCE_DIR=$(dir $(realpath $(lastword $(MAKEFILE_LIST)))) \
294+
./hack/generate-bundle
295+
296+
${OPERATOR_SDK} bundle validate ./bundle
297+
282298
.PHONY: bundle
283299
bundle: operator-sdk manifests kustomize ## Generate bundle manifests and metadata, then validate generated files.
284300
rm -fr ./bundle
@@ -291,9 +307,31 @@ bundle: operator-sdk manifests kustomize ## Generate bundle manifests and metada
291307
BUNDLE_GEN_FLAGS="${BUNDLE_GEN_FLAGS} --extra-service-accounts kmm-operator-module-loader,kmm-operator-device-plugin" \
292308
PKG=kernel-module-management \
293309
SOURCE_DIR=$(dir $(realpath $(lastword $(MAKEFILE_LIST)))) \
310+
INCLUDE_NETWORK_POLICIES=true \
294311
./hack/generate-bundle
295312

296-
${OPERATOR_SDK} bundle validate ./bundle
313+
.PHONY: bundle-hub-old
314+
bundle-hub-old: operator-sdk manifests kustomize ## Generate bundle manifests and metadata, then validate generated files.
315+
rm -fr bundle-hub
316+
317+
${OPERATOR_SDK} generate kustomize manifests \
318+
--apis-dir api-hub \
319+
--output-dir config/manifests-hub \
320+
--package kernel-module-management-hub \
321+
--input-dir config/manifests-hub
322+
cd config/manager-hub && $(KUSTOMIZE) edit set image controller=$(HUB_IMG)
323+
cd config/manager-base && $(KUSTOMIZE) edit set image must-gather=$(GATHER_IMG) signer=$(SIGNER_IMG)
324+
cd config/webhook-server && $(KUSTOMIZE) edit set image webhook-server=$(WEBHOOK_IMG)
325+
326+
OPERATOR_SDK="${OPERATOR_SDK}" \
327+
BUNDLE_GEN_FLAGS="${BUNDLE_GEN_FLAGS}" \
328+
MANIFESTS_DIR=config/manifests-hub \
329+
PKG=kernel-module-management-hub \
330+
SOURCE_DIR=$(dir $(realpath $(lastword $(MAKEFILE_LIST)))) \
331+
SUFFIX="-hub" \
332+
./hack/generate-bundle
333+
334+
${OPERATOR_SDK} bundle validate ./bundle-hub
297335

298336
.PHONY: bundle-hub
299337
bundle-hub: operator-sdk manifests kustomize ## Generate bundle manifests and metadata, then validate generated files.
@@ -314,9 +352,9 @@ bundle-hub: operator-sdk manifests kustomize ## Generate bundle manifests and me
314352
PKG=kernel-module-management-hub \
315353
SOURCE_DIR=$(dir $(realpath $(lastword $(MAKEFILE_LIST)))) \
316354
SUFFIX="-hub" \
355+
INCLUDE_NETWORK_POLICIES=true \
317356
./hack/generate-bundle
318357

319-
${OPERATOR_SDK} bundle validate ./bundle-hub
320358

321359
.PHONY: bundle-build-hub
322360
bundle-build-hub: ## Build the bundle-hub image.

‎PROJECT‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
domain: sigs.x-k8s.io
22
layout:
3-
- go.kubebuilder.io/v3
3+
- go.kubebuilder.io/v4
44
plugins:
55
manifests.sdk.operatorframework.io/v2: {}
66
scorecard.sdk.operatorframework.io/v2: {}

‎bundle-hub/manifests/kernel-module-management-hub.clusterserviceversion.yaml‎

Lines changed: 1 addition & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ metadata:
3737
}
3838
]
3939
capabilities: Seamless Upgrades
40-
createdAt: "2025-07-15T14:14:25Z"
40+
createdAt: "2025-08-26T14:37:47Z"
4141
operatorframework.io/suggested-namespace: openshift-kmm-hub
4242
operators.operatorframework.io/builder: operator-sdk-v1.32.0
4343
operators.operatorframework.io/project_layout: go.kubebuilder.io/v3
@@ -227,19 +227,13 @@ spec:
227227
replicas: 1
228228
selector:
229229
matchLabels:
230-
app.kubernetes.io/component: kmm-hub
231-
app.kubernetes.io/name: kmm-hub
232-
app.kubernetes.io/part-of: kmm
233230
control-plane: controller
234231
strategy: {}
235232
template:
236233
metadata:
237234
annotations:
238235
kubectl.kubernetes.io/default-container: manager
239236
labels:
240-
app.kubernetes.io/component: kmm-hub
241-
app.kubernetes.io/name: kmm-hub
242-
app.kubernetes.io/part-of: kmm
243237
control-plane: controller
244238
spec:
245239
affinity:
@@ -324,19 +318,13 @@ spec:
324318
replicas: 1
325319
selector:
326320
matchLabels:
327-
app.kubernetes.io/component: kmm-hub
328-
app.kubernetes.io/name: kmm-hub
329-
app.kubernetes.io/part-of: kmm
330321
control-plane: webhook-server
331322
strategy: {}
332323
template:
333324
metadata:
334325
annotations:
335326
kubectl.kubernetes.io/default-container: webhook-server
336327
labels:
337-
app.kubernetes.io/component: kmm-hub
338-
app.kubernetes.io/name: kmm-hub
339-
app.kubernetes.io/part-of: kmm
340328
control-plane: webhook-server
341329
spec:
342330
affinity:

‎bundle-hub/manifests/kmm-operator-hub-build-and-sign_networking.k8s.io_v1_networkpolicy.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: build-and-sign
5+
namespace: system
6+
spec:
7+
podSelector:
8+
matchExpressions:
9+
- key: openshift.io/build.name
10+
operator: Exists
11+
policyTypes:
12+
- Egress
13+
egress:
14+
- {}

‎bundle-hub/manifests/kmm-operator-hub-controller-metrics-service_v1_service.yaml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,6 @@ spec:
1717
protocol: TCP
1818
targetPort: metrics
1919
selector:
20-
app.kubernetes.io/component: kmm-hub
21-
app.kubernetes.io/name: kmm-hub
22-
app.kubernetes.io/part-of: kmm
2320
control-plane: controller
2421
status:
2522
loadBalancer: {}

‎bundle-hub/manifests/kmm-operator-hub-controller_networking.k8s.io_v1_networkpolicy.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: controller
5+
namespace: system
6+
spec:
7+
podSelector:
8+
matchLabels:
9+
control-plane: controller
10+
policyTypes:
11+
- Egress
12+
- Ingress
13+
ingress:
14+
- ports:
15+
- protocol: TCP # metrics port
16+
port: 8443
17+
- protocol: TCP
18+
port: 8081 # Healthz
19+
egress:
20+
- to:
21+
- namespaceSelector: # DNS
22+
matchLabels:
23+
kubernetes.io/metadata.name: openshift-dns
24+
podSelector:
25+
matchLabels:
26+
dns.operator.openshift.io/daemonset-dns: default
27+
ports:
28+
- protocol: UDP # DNS
29+
port: 53
30+
- protocol: TCP # DNS
31+
port: 53
32+
- ports: # kube api server
33+
- protocol: TCP
34+
port: 6443
35+
- protocol: TCP
36+
port: 443

‎bundle-hub/manifests/kmm-operator-hub-default-deny_networking.k8s.io_v1_networkpolicy.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: default-deny
5+
namespace: system
6+
spec:
7+
podSelector: {}
8+
policyTypes:
9+
- Ingress
10+
- Egress

‎bundle-hub/manifests/kmm-operator-hub-webhook-service_v1_service.yaml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,6 @@ spec:
1616
protocol: TCP
1717
targetPort: 9443
1818
selector:
19-
app.kubernetes.io/component: kmm-hub
20-
app.kubernetes.io/name: kmm-hub
21-
app.kubernetes.io/part-of: kmm
2219
control-plane: webhook-server
2320
status:
2421
loadBalancer: {}

‎bundle-hub/manifests/kmm-operator-hub-webhook_networking.k8s.io_v1_networkpolicy.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: webhook
5+
namespace: system
6+
spec:
7+
podSelector:
8+
matchLabels:
9+
control-plane: webhook-server
10+
policyTypes:
11+
- Egress
12+
- Ingress
13+
ingress:
14+
- ports:
15+
- protocol: TCP
16+
port: 9443
17+
egress:
18+
- ports: # kube api server port
19+
- protocol: TCP
20+
port: 6443
21+
- protocol: TCP
22+
port: 443

‎bundle/manifests/kernel-module-management.clusterserviceversion.yaml‎

Lines changed: 1 addition & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ metadata:
4747
}
4848
]
4949
capabilities: Seamless Upgrades
50-
createdAt: "2025-07-15T13:32:13Z"
50+
createdAt: "2025-08-26T14:37:46Z"
5151
operatorframework.io/suggested-namespace: openshift-kmm
5252
operators.operatorframework.io/builder: operator-sdk-v1.32.0
5353
operators.operatorframework.io/project_layout: go.kubebuilder.io/v3
@@ -303,19 +303,13 @@ spec:
303303
replicas: 1
304304
selector:
305305
matchLabels:
306-
app.kubernetes.io/component: kmm
307-
app.kubernetes.io/name: kmm
308-
app.kubernetes.io/part-of: kmm
309306
control-plane: controller
310307
strategy: {}
311308
template:
312309
metadata:
313310
annotations:
314311
kubectl.kubernetes.io/default-container: manager
315312
labels:
316-
app.kubernetes.io/component: kmm
317-
app.kubernetes.io/name: kmm
318-
app.kubernetes.io/part-of: kmm
319313
control-plane: controller
320314
spec:
321315
affinity:
@@ -402,19 +396,13 @@ spec:
402396
replicas: 1
403397
selector:
404398
matchLabels:
405-
app.kubernetes.io/component: kmm
406-
app.kubernetes.io/name: kmm
407-
app.kubernetes.io/part-of: kmm
408399
control-plane: webhook-server
409400
strategy: {}
410401
template:
411402
metadata:
412403
annotations:
413404
kubectl.kubernetes.io/default-container: webhook-server
414405
labels:
415-
app.kubernetes.io/component: kmm
416-
app.kubernetes.io/name: kmm
417-
app.kubernetes.io/part-of: kmm
418406
control-plane: webhook-server
419407
spec:
420408
affinity:

0 commit comments

Comments
 (0)