fix(operator): add extract selectors to gateway in netobserv mode to fix

fine-grained AuthZ

Author: JoaoBraveCoding

operator/internal/manifests/gateway_tenants_test.go

@@ -944,6 +944,9 @@ func TestConfigureDeploymentForMode(t *testing.T) {
 							Containers: []corev1.Container{
 								{
 									Name: gatewayContainerName,
+									Args: []string{
+										"--logs.auth.extract-selectors=SrcK8S_Namespace,DstK8S_Namespace",
+									},
 								},
 								{
 									Name:  "opa",
@@ -1051,6 +1054,9 @@ func TestConfigureDeploymentForMode(t *testing.T) {
 							Containers: []corev1.Container{
 								{
 									Name: gatewayContainerName,
+									Args: []string{
+										"--logs.auth.extract-selectors=SrcK8S_Namespace,DstK8S_Namespace",
+									},
 								},
 								{
 									Name:  "opa",

operator/internal/manifests/openshift/configure.go

@@ -73,15 +73,23 @@ func ConfigureGatewayDeployment(
 		return kverrors.Wrap(err, "failed to merge sidecar container spec ")
 	}
 
-	if mode == lokiv1.OpenshiftLogging {
+	if mode == lokiv1.OpenshiftLogging || mode == lokiv1.OpenshiftNetwork {
 		// enable extraction of namespace selector
 		for i, c := range d.Spec.Template.Spec.Containers {
 			if c.Name != "gateway" {
 				continue
 			}
 
+			var authSelectors string
+			switch mode {
+			case lokiv1.OpenshiftLogging:
+				authSelectors = opaDefaultLabelMatchers
+			case lokiv1.OpenshiftNetwork:
+				authSelectors = opaNetworkLabelMatchers
+			}
+
 			d.Spec.Template.Spec.Containers[i].Args = append(d.Spec.Template.Spec.Containers[i].Args,
-				fmt.Sprintf("--logs.auth.extract-selectors=%s", opaDefaultLabelMatchers),
+				fmt.Sprintf("--logs.auth.extract-selectors=%s", authSelectors),
 			)
 		}
 	}