Skip to content

Commit f6c3239

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #1396 from huali9/networkpolicy-v2
OCPCLOUD-2980: add ingress/egress network policy v2
2 parents 257c594 + faec93a commit f6c3239

6 files changed

+162
-0
lines changed

‎install/0000_90_machine-api-operator_05_networkpolicy-allow-all-egress.yaml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Allow all egress from apps in openshift-machine-api
2+
apiVersion: networking.k8s.io/v1
3+
kind: NetworkPolicy
4+
metadata:
5+
name: allow-all-egress
6+
namespace: openshift-machine-api
7+
annotations:
8+
capability.openshift.io/name: MachineAPI
9+
exclude.release.openshift.io/internal-openshift-hosted: "true"
10+
include.release.openshift.io/self-managed-high-availability: "true"
11+
include.release.openshift.io/single-node-developer: "true"
12+
spec:
13+
egress:
14+
# Allow all egress traffic - operators need broad access
15+
- {} # Empty rule allows all egress
16+
podSelector: {} # Empty selector means allow all pods
17+
policyTypes:
18+
- Egress

‎install/0000_90_machine-api-operator_05_networkpolicy-allow-ingress-cluster.yaml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Allow ingress to the openshift-machine-api namespace pods for internal cluster request
2+
apiVersion: networking.k8s.io/v1
3+
kind: NetworkPolicy
4+
metadata:
5+
name: allow-ingress-cluster
6+
namespace: openshift-machine-api
7+
annotations:
8+
capability.openshift.io/name: MachineAPI
9+
exclude.release.openshift.io/internal-openshift-hosted: "true"
10+
include.release.openshift.io/self-managed-high-availability: "true"
11+
include.release.openshift.io/single-node-developer: "true"
12+
spec:
13+
ingress:
14+
- ports:
15+
- protocol: TCP
16+
port: 9440
17+
endPort: 9442
18+
podSelector:
19+
matchExpressions:
20+
- key: k8s-app
21+
operator: In
22+
values:
23+
- cluster-autoscaler
24+
- cluster-autoscaler-operator
25+
- cluster-baremetal-operator
26+
- control-plane-machine-set-operator
27+
- controller
28+
- machine-api-operator
29+
policyTypes:
30+
- Ingress

‎install/0000_90_machine-api-operator_05_networkpolicy-allow-ingress-kubeapi.yaml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Allow ingress to the openshift-machine-api namespace pods for kubeapi requests
2+
apiVersion: networking.k8s.io/v1
3+
kind: NetworkPolicy
4+
metadata:
5+
name: allow-ingress-kubeapi
6+
namespace: openshift-machine-api
7+
annotations:
8+
capability.openshift.io/name: MachineAPI
9+
exclude.release.openshift.io/internal-openshift-hosted: "true"
10+
include.release.openshift.io/self-managed-high-availability: "true"
11+
include.release.openshift.io/single-node-developer: "true"
12+
spec:
13+
ingress:
14+
- ports:
15+
- protocol: TCP
16+
port: 9443
17+
podSelector:
18+
matchExpressions:
19+
- key: k8s-app
20+
operator: In
21+
values:
22+
- cluster-autoscaler
23+
- cluster-autoscaler-operator
24+
- cluster-baremetal-operator
25+
- control-plane-machine-set-operator
26+
- controller
27+
- machine-api-operator
28+
policyTypes:
29+
- Ingress

‎install/0000_90_machine-api-operator_05_networkpolicy-allow-ingress-metal.yaml

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# Add ports for metal
2+
# As metal behavior can be quite different from other deployment because of the added services and network complexity
3+
apiVersion: networking.k8s.io/v1
4+
kind: NetworkPolicy
5+
metadata:
6+
name: allow-ingress-metal
7+
namespace: openshift-machine-api
8+
annotations:
9+
capability.openshift.io/name: MachineAPI
10+
exclude.release.openshift.io/internal-openshift-hosted: "true"
11+
include.release.openshift.io/self-managed-high-availability: "true"
12+
include.release.openshift.io/single-node-developer: "true"
13+
spec:
14+
ingress:
15+
- ports:
16+
- protocol: TCP
17+
port: 80 # httpd service
18+
- protocol: TCP
19+
port: 443 # secure httpd service
20+
- protocol: TCP
21+
port: 6180 # ironic httpd port
22+
- protocol: TCP
23+
port: 6183 # secure ironic httpd port
24+
- protocol: TCP
25+
port: 6385 # ironic API
26+
- protocol: TCP
27+
port: 6388 # ironic API proxy
28+
- protocol: TCP
29+
port: 8084 # image customization service
30+
- protocol: TCP
31+
port: 9447 # bare metal webhook service
32+
podSelector: {}
33+
policyTypes:
34+
- Ingress

‎install/0000_90_machine-api-operator_05_networkpolicy-allow-ingress-metrics.yaml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# Allow ingress to the openshift-machine-api namespace pods for metrics request
2+
apiVersion: networking.k8s.io/v1
3+
kind: NetworkPolicy
4+
metadata:
5+
name: allow-ingress-metrics
6+
namespace: openshift-machine-api
7+
annotations:
8+
capability.openshift.io/name: MachineAPI
9+
exclude.release.openshift.io/internal-openshift-hosted: "true"
10+
include.release.openshift.io/self-managed-high-availability: "true"
11+
include.release.openshift.io/single-node-developer: "true"
12+
spec:
13+
ingress:
14+
- ports:
15+
- protocol: TCP
16+
port: 8085
17+
- protocol: TCP
18+
port: 8440
19+
endPort: 8444
20+
- protocol: TCP
21+
port: 9191
22+
endPort: 9192
23+
podSelector:
24+
matchExpressions:
25+
- key: k8s-app
26+
operator: In
27+
values:
28+
- cluster-autoscaler
29+
- cluster-autoscaler-operator
30+
- cluster-baremetal-operator
31+
- control-plane-machine-set-operator
32+
- controller
33+
- machine-api-operator
34+
policyTypes:
35+
- Ingress

‎install/0000_90_machine-api-operator_05_networkpolicy-default-deny.yaml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# Default deny all ingress and egress
2+
apiVersion: networking.k8s.io/v1
3+
kind: NetworkPolicy
4+
metadata:
5+
name: default-deny
6+
namespace: openshift-machine-api
7+
annotations:
8+
capability.openshift.io/name: MachineAPI
9+
exclude.release.openshift.io/internal-openshift-hosted: "true"
10+
include.release.openshift.io/self-managed-high-availability: "true"
11+
include.release.openshift.io/single-node-developer: "true"
12+
spec:
13+
podSelector: {}
14+
policyTypes:
15+
- Ingress
16+
- Egress

0 commit comments

Comments
 (0)