Add NetworkPolicies for operator

Sriov Network Operator pod needs egress traffic to the API server.
No other traffic is supposed to go in/out the pod.

Signed-off-by: Andrea Panattoni <[email protected]>

Author: zeeke

config/default/kustomization.yaml

@@ -16,6 +16,7 @@ bases:
 - ../crd
 - ../rbac
 - ../manager
+- ../networkpolicies
 # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
 # crd/kustomization.yaml
 #- ../webhook

config/networkpolicies/allow_egress_api_server.yaml

@@ -0,0 +1,14 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+ name: operator-allow-egress-to-api-server
+spec:
+ podSelector:
+   matchLabels:
+    name: sriov-network-operator
+ egress:
+ - ports:
+   - protocol: TCP
+     port: 6443
+ policyTypes:
+ - Egress

config/networkpolicies/kustomization.yaml

@@ -0,0 +1,2 @@
+resources:
+- allow_egress_api_server.yaml