CORENET-6816: Add NetworkPolicies for CNO and its operands

bindata/kube-proxy/000-ns.yaml

@@ -13,3 +13,16 @@ metadata:
     openshift.io/node-selector: "" #override default node selector
     openshift.io/description: "kubernetes service proxy"
     workload.openshift.io/allowed: "management"
+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: default-deny
+  namespace: openshift-kube-proxy
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress: []
+  egress: []

bindata/network-diagnostics/000-ns.yaml

@@ -7,3 +7,17 @@ metadata:
   annotations:
     openshift.io/node-selector: "" #override default node selector
     workload.openshift.io/allowed: "management"
+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: default-deny
+  namespace: openshift-network-diagnostics
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress: []
+  egress: []
+

bindata/network-diagnostics/networkpolicy.yaml

@@ -0,0 +1,41 @@
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: network-check-source
+  namespace: openshift-network-diagnostics
+spec:
+  podSelector:
+    matchLabels:
+      app: network-check-source
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    # Allow ingress to metrics
+    - ports:
+        - port: 17698
+  egress:
+    # Allow egress to network-check-target pods.
+    - to:
+        - podSelector:
+            matchLabels:
+              app: network-check-target
+    # Allow egress to apiserver
+    - {}
+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: network-check-target
+  namespace: openshift-network-diagnostics
+spec:
+  podSelector:
+    matchLabels:
+      app: network-check-target
+  policyTypes:
+    # network-check-target does no egress
+    - Ingress
+  ingress:
+    # Allow to the check-target port. For debuggability we don't restrict the source.
+    - ports:
+        - port: 8080

bindata/network/frr-k8s/000-ns.yaml

@@ -11,3 +11,16 @@ metadata:
     openshift.io/node-selector: ""
     openshift.io/description: "FRR-K8s components"
     workload.openshift.io/allowed: "management"
+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: default-deny
+  namespace: openshift-frr-k8s
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress: []
+  egress: []

bindata/network/iptables-alerter/004-networkpolicy.yaml

@@ -0,0 +1,14 @@
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: iptables-alerter
+  namespace: openshift-network-operator
+spec:
+  podSelector:
+    matchLabels:
+      app: iptables-alerter
+  policyTypes:
+    - Egress
+  egress:
+    # Allow to apiserver
+    - {}

bindata/network/multus-admission-controller/004-networkpolicy.yaml

@@ -0,0 +1,22 @@
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: multus-admission-controller
+  namespace: openshift-multus
+spec:
+  podSelector:
+    matchLabels:
+      app: multus-admission-controller
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    # Allow from apiserver to webhook port
+    - ports:
+        - port: 6443
+    # Allow all to metrics port
+    - ports:
+        - port: 8443
+  egress:
+    # Allow to apiserver; currently requires allow all
+    - {}

bindata/network/multus/000-ns.yaml

@@ -13,3 +13,16 @@ metadata:
     openshift.io/node-selector: "" #override default node selector
     openshift.io/description: "Multus network plugin components"
     workload.openshift.io/allowed: "management"
+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: default-deny
+  namespace: openshift-multus
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress: []
+  egress: []

bindata/network/network-metrics/003-networkpolicy.yaml

@@ -0,0 +1,19 @@
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: network-metrics
+  namespace: openshift-multus
+spec:
+  podSelector:
+    matchLabels:
+      app: network-metrics-daemon
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    # Allow ingress to metrics
+    - ports:
+      - port: 8443
+  egress:
+    # Allow egress to apiserver
+    - {}

bindata/network/node-identity/common/001-node-identity-namespace.yaml

@@ -14,3 +14,16 @@ metadata:
     openshift.io/node-selector: ""
     openshift.io/description: "OpenShift network node identity namespace - a controller used to manage node identity components"
     workload.openshift.io/allowed: "management"
+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: default-deny
+  namespace: openshift-network-node-identity
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress: []
+  egress: []

bindata/network/ovn-kubernetes/common/000-ns.yaml

@@ -13,3 +13,16 @@ metadata:
     openshift.io/node-selector: ""
     openshift.io/description: "OVN Kubernetes components"
     workload.openshift.io/allowed: "management"
+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: default-deny
+  namespace: openshift-ovn-kubernetes
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress: []
+  egress: []

bindata/network/ovn-kubernetes/common/openshift-host-network-ns.yaml

@@ -8,4 +8,16 @@ metadata:
   annotations:
     openshift.io/description: "Namespace for enabling network policy specification for host network traffic. Can be used to allow access to or from host network components"
     workload.openshift.io/allowed: "management"
-
+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: default-deny
+  namespace: openshift-host-network
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress: []
+  egress: []

bindata/networking-console-plugin/000-namespace.yaml

@@ -7,3 +7,16 @@ metadata:
   annotations:
     openshift.io/description: "Namespace for running the networking-console-plugin pods that enables the Networking console section"
     workload.openshift.io/allowed: "management"
+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: default-deny
+  namespace: openshift-network-console
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress: []
+  egress: []

bindata/networking-console-plugin/005-networkpolicy.yaml

@@ -0,0 +1,19 @@
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: networking-console-plugin
+  namespace: openshift-network-console
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: networking-console-plugin
+  policyTypes:
+    - Ingress
+  ingress:
+    # Allow from console
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: openshift-console
+      ports:
+      - port: 9443

manifests/0000_70_cluster-network-operator_00_namespace.yaml

@@ -14,4 +14,17 @@ metadata:
     pod-security.kubernetes.io/enforce: privileged
     pod-security.kubernetes.io/audit: privileged
     pod-security.kubernetes.io/warn: privileged
-    openshift.io/cluster-monitoring: "true"
+    openshift.io/cluster-monitoring: "true"
+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: default-deny
+  namespace: openshift-network-operator
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress: []
+  egress: []

pkg/network/kube_proxy_test.go

@@ -403,7 +403,7 @@ func TestRenderKubeProxy(t *testing.T) {
 	objs, err := renderStandaloneKubeProxy(c, &FakeKubeProxyBootstrapResult, manifestDir)
 	g.Expect(err).NotTo(HaveOccurred())
 
-	g.Expect(objs).To(HaveLen(10))
+	g.Expect(objs).To(HaveLen(11))
 
 	// Make sure the arguments to kube-proxy are reasonable
 	found := false

pkg/network/multus_admission_controller_test.go

@@ -74,12 +74,13 @@ func TestRenderMultusAdmissionController(t *testing.T) {
 	g.Expect(objs).To(ContainElement(HaveKubernetesID("Deployment", "openshift-multus", "multus-admission-controller")))
 
 	// Check rendered object
-	g.Expect(len(objs)).To(Equal(10))
+	g.Expect(len(objs)).To(Equal(11))
 	g.Expect(objs).To(ContainElement(HaveKubernetesID("Service", "openshift-multus", "multus-admission-controller")))
 	g.Expect(objs).To(ContainElement(HaveKubernetesID("ClusterRole", "", "multus-admission-controller-webhook")))
 	g.Expect(objs).To(ContainElement(HaveKubernetesID("ClusterRoleBinding", "", "multus-admission-controller-webhook")))
 	g.Expect(objs).To(ContainElement(HaveKubernetesID("ValidatingWebhookConfiguration", "", names.MULTUS_VALIDATING_WEBHOOK)))
 	g.Expect(objs).To(ContainElement(HaveKubernetesID("Deployment", "openshift-multus", "multus-admission-controller")))
+	g.Expect(objs).To(ContainElement(HaveKubernetesID("NetworkPolicy", "openshift-multus", "multus-admission-controller")))
 }
 
 // TestRenderMultusAdmissionController has some simple rendering tests

pkg/network/multus_test.go

@@ -46,12 +46,13 @@ func TestRenderMultus(t *testing.T) {
 	g.Expect(objs).To(ContainElement(HaveKubernetesID("DaemonSet", "openshift-multus", "multus")))
 
 	// It's important that the namespace is first
-	g.Expect(len(objs)).To(Equal(32), "Expected 32 multus related objects")
+	g.Expect(len(objs)).To(Equal(34), "Expected 34 multus related objects")
 	g.Expect(objs[0]).To(HaveKubernetesID("CustomResourceDefinition", "", "network-attachment-definitions.k8s.cni.cncf.io"))
 	g.Expect(objs).To(ContainElement(HaveKubernetesID("Namespace", "", "openshift-multus")))
 	g.Expect(objs).To(ContainElement(HaveKubernetesID("ServiceAccount", "openshift-multus", "multus-ancillary-tools")))
 	g.Expect(objs).To(ContainElement(HaveKubernetesID("ClusterRole", "", "multus-ancillary-tools")))
 	g.Expect(objs).To(ContainElement(HaveKubernetesID("ClusterRoleBinding", "", "multus-ancillary-tools")))
 	g.Expect(objs).To(ContainElement(HaveKubernetesID("ClusterRole", "", "multus")))
 	g.Expect(objs).To(ContainElement(HaveKubernetesID("DaemonSet", "openshift-multus", "multus")))
+	g.Expect(objs).To(ContainElement(HaveKubernetesID("NetworkPolicy", "openshift-multus", "default-deny")))
 }

pkg/network/network_metrics_test.go

@@ -46,7 +46,7 @@ func TestRenderNetworkMetricsDaemon(t *testing.T) {
 
 	// Check rendered object
 
-	g.Expect(len(objs)).To(Equal(32), "Expected 32 multus related objects")
+	g.Expect(len(objs)).To(Equal(34), "Expected 34 multus related objects")
 	g.Expect(objs).To(ContainElement(HaveKubernetesID("DaemonSet", "openshift-multus", "network-metrics-daemon")))
 	g.Expect(objs).To(ContainElement(HaveKubernetesID("Service", "openshift-multus", "network-metrics-service")))
 	g.Expect(objs).To(ContainElement(HaveKubernetesID("ClusterRole", "", "metrics-daemon-role")))

pkg/network/ovn_kubernetes_test.go

@@ -4221,7 +4221,7 @@ func Test_renderOVNKubernetes(t *testing.T) {
 				client:          cnofake.NewFakeClient(),
 				featureGates:    noFeatureGates,
 			},
-			expectNumObjs: 50,
+			expectNumObjs: 52,
 		},
 		{
 			name: "render routeadvertisements",
@@ -4236,7 +4236,7 @@ func Test_renderOVNKubernetes(t *testing.T) {
 				client:          cnofake.NewFakeClient(),
 				featureGates:    noFeatureGates,
 			},
-			expectNumObjs: 51,
+			expectNumObjs: 53,
 		},
 		{
 			name: "render with UDN",
@@ -4247,7 +4247,7 @@ func Test_renderOVNKubernetes(t *testing.T) {
 				client:          cnofake.NewFakeClient(),
 				featureGates:    udnFeatureGate,
 			},
-			expectNumObjs: 50,
+			expectNumObjs: 52,
 		},
 		{
 			name: "render with PreconfiguredUDNAddresses, UDN, persistent-IP, and RA",
@@ -4261,7 +4261,7 @@ func Test_renderOVNKubernetes(t *testing.T) {
 				client:       cnofake.NewFakeClient(),
 				featureGates: preDefUDNFeatureGates,
 			},
-			expectNumObjs: 51,
+			expectNumObjs: 53,
 		},
 	}
 	for _, tt := range tests {

pkg/network/render_test.go

@@ -524,7 +524,7 @@ func Test_renderNetworkDiagnostics(t *testing.T) {
 				operConf:    &operv1.NetworkSpec{DisableNetworkDiagnostics: true},
 				clusterConf: &configv1.NetworkSpec{NetworkDiagnostics: configv1.NetworkDiagnostics{Mode: configv1.NetworkDiagnosticsAll}},
 			},
-			want:        15,
+			want:        18,
 			expectedErr: nil,
 		},
 	}
@@ -568,7 +568,7 @@ func Test_renderAdditionalRoutingCapabilities(t *testing.T) {
 					},
 				},
 			},
-			want:        19,
+			want:        20,
 			expectedErr: nil,
 		},
 	}