Skip to content

Commit 10f7c82

Browse files
mpatlasovmpatlasov
committed
OCPBUGS-61175: Create NetworkPolicy for Manila CSI driver
Manila csi driver controller pods reside in a custome namespace (`openshift-manila-csi-driver`). Hence, Manila csi driver operator must create NetworkPolicy for them expicitly.
1 parent 845e3ff commit 10f7c82

15 files changed

+348
-1
lines changed

‎assets/overlays/openstack-manila/base/network-policy-allow-all-egress.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: allow-all-egress
5+
namespace: ${NAMESPACE}
6+
annotations:
7+
include.release.openshift.io/hypershift: "true"
8+
include.release.openshift.io/ibm-cloud-managed: "true"
9+
include.release.openshift.io/self-managed-high-availability: "true"
10+
include.release.openshift.io/single-node-developer: "true"
11+
capability.openshift.io/name: Storage
12+
spec:
13+
podSelector:
14+
matchLabels:
15+
openshift.storage.network-policy.all-egress: allow
16+
egress:
17+
- ports:
18+
- protocol: TCP
19+
port: 1
20+
endPort: 65535
21+
policyTypes:
22+
- Egress

‎assets/overlays/openstack-manila/base/network-policy-allow-egress-to-api-server.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: allow-egress-to-api-server
5+
namespace: ${NAMESPACE}
6+
annotations:
7+
include.release.openshift.io/hypershift: "true"
8+
include.release.openshift.io/ibm-cloud-managed: "true"
9+
include.release.openshift.io/self-managed-high-availability: "true"
10+
include.release.openshift.io/single-node-developer: "true"
11+
capability.openshift.io/name: Storage
12+
spec:
13+
podSelector:
14+
matchLabels:
15+
openshift.storage.network-policy.api-server: allow
16+
egress:
17+
- ports:
18+
- protocol: TCP
19+
port: 6443
20+
policyTypes:
21+
- Egress

‎assets/overlays/openstack-manila/base/network-policy-allow-ingress-to-metrics.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: allow-ingress-to-metrics-range
5+
namespace: ${NAMESPACE}
6+
annotations:
7+
include.release.openshift.io/hypershift: "true"
8+
include.release.openshift.io/ibm-cloud-managed: "true"
9+
include.release.openshift.io/self-managed-high-availability: "true"
10+
include.release.openshift.io/single-node-developer: "true"
11+
capability.openshift.io/name: Storage
12+
spec:
13+
podSelector:
14+
matchLabels:
15+
openshift.storage.network-policy.metrics-range: allow
16+
ingress:
17+
- ports:
18+
- protocol: TCP
19+
port: 9201
20+
endPort: 9223
21+
policyTypes:
22+
- Ingress

‎assets/overlays/openstack-manila/base/network-policy-allow-to-dns.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: allow-to-dns
5+
namespace: ${NAMESPACE}
6+
annotations:
7+
include.release.openshift.io/hypershift: "true"
8+
include.release.openshift.io/ibm-cloud-managed: "true"
9+
include.release.openshift.io/self-managed-high-availability: "true"
10+
include.release.openshift.io/single-node-developer: "true"
11+
capability.openshift.io/name: Storage
12+
spec:
13+
podSelector:
14+
matchLabels:
15+
openshift.storage.network-policy.dns: allow
16+
egress:
17+
- to:
18+
- namespaceSelector:
19+
matchLabels:
20+
kubernetes.io/metadata.name: openshift-dns
21+
podSelector:
22+
matchLabels:
23+
dns.operator.openshift.io/daemonset-dns: default
24+
ports:
25+
- protocol: TCP
26+
port: dns-tcp
27+
- protocol: UDP
28+
port: dns
29+
policyTypes:
30+
- Egress

‎assets/overlays/openstack-manila/generated/hypershift/manifests.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,10 @@ controllerStaticAssetNames:
33
- controller.yaml
44
- controller_pdb.yaml
55
- controller_sa.yaml
6+
- network-policy-allow-all-egress.yaml
7+
- network-policy-allow-egress-to-api-server.yaml
8+
- network-policy-allow-ingress-to-metrics.yaml
9+
- network-policy-allow-to-dns.yaml
610
- service.yaml
711
guestStaticAssetNames:
812
- csidriver.yaml

‎assets/overlays/openstack-manila/generated/hypershift/network-policy-allow-all-egress.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Generated file. Do not edit. Update using "make update".
2+
#
3+
# Loaded from overlays/openstack-manila/base/network-policy-allow-all-egress.yaml
4+
#
5+
#
6+
7+
apiVersion: networking.k8s.io/v1
8+
kind: NetworkPolicy
9+
metadata:
10+
annotations:
11+
capability.openshift.io/name: Storage
12+
include.release.openshift.io/hypershift: "true"
13+
include.release.openshift.io/ibm-cloud-managed: "true"
14+
include.release.openshift.io/self-managed-high-availability: "true"
15+
include.release.openshift.io/single-node-developer: "true"
16+
name: allow-all-egress
17+
namespace: ${NAMESPACE}
18+
spec:
19+
egress:
20+
- ports:
21+
- endPort: 65535
22+
port: 1
23+
protocol: TCP
24+
podSelector:
25+
matchLabels:
26+
openshift.storage.network-policy.all-egress: allow
27+
policyTypes:
28+
- Egress

‎assets/overlays/openstack-manila/generated/hypershift/network-policy-allow-egress-to-api-server.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Generated file. Do not edit. Update using "make update".
2+
#
3+
# Loaded from overlays/openstack-manila/base/network-policy-allow-egress-to-api-server.yaml
4+
#
5+
#
6+
7+
apiVersion: networking.k8s.io/v1
8+
kind: NetworkPolicy
9+
metadata:
10+
annotations:
11+
capability.openshift.io/name: Storage
12+
include.release.openshift.io/hypershift: "true"
13+
include.release.openshift.io/ibm-cloud-managed: "true"
14+
include.release.openshift.io/self-managed-high-availability: "true"
15+
include.release.openshift.io/single-node-developer: "true"
16+
name: allow-egress-to-api-server
17+
namespace: ${NAMESPACE}
18+
spec:
19+
egress:
20+
- ports:
21+
- port: 6443
22+
protocol: TCP
23+
podSelector:
24+
matchLabels:
25+
openshift.storage.network-policy.api-server: allow
26+
policyTypes:
27+
- Egress

‎assets/overlays/openstack-manila/generated/hypershift/network-policy-allow-ingress-to-metrics.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Generated file. Do not edit. Update using "make update".
2+
#
3+
# Loaded from overlays/openstack-manila/base/network-policy-allow-ingress-to-metrics.yaml
4+
#
5+
#
6+
7+
apiVersion: networking.k8s.io/v1
8+
kind: NetworkPolicy
9+
metadata:
10+
annotations:
11+
capability.openshift.io/name: Storage
12+
include.release.openshift.io/hypershift: "true"
13+
include.release.openshift.io/ibm-cloud-managed: "true"
14+
include.release.openshift.io/self-managed-high-availability: "true"
15+
include.release.openshift.io/single-node-developer: "true"
16+
name: allow-ingress-to-metrics-range
17+
namespace: ${NAMESPACE}
18+
spec:
19+
ingress:
20+
- ports:
21+
- endPort: 9223
22+
port: 9201
23+
protocol: TCP
24+
podSelector:
25+
matchLabels:
26+
openshift.storage.network-policy.metrics-range: allow
27+
policyTypes:
28+
- Ingress

‎assets/overlays/openstack-manila/generated/hypershift/network-policy-allow-to-dns.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# Generated file. Do not edit. Update using "make update".
2+
#
3+
# Loaded from overlays/openstack-manila/base/network-policy-allow-to-dns.yaml
4+
#
5+
#
6+
7+
apiVersion: networking.k8s.io/v1
8+
kind: NetworkPolicy
9+
metadata:
10+
annotations:
11+
capability.openshift.io/name: Storage
12+
include.release.openshift.io/hypershift: "true"
13+
include.release.openshift.io/ibm-cloud-managed: "true"
14+
include.release.openshift.io/self-managed-high-availability: "true"
15+
include.release.openshift.io/single-node-developer: "true"
16+
name: allow-to-dns
17+
namespace: ${NAMESPACE}
18+
spec:
19+
egress:
20+
- ports:
21+
- port: dns-tcp
22+
protocol: TCP
23+
- port: dns
24+
protocol: UDP
25+
to:
26+
- namespaceSelector:
27+
matchLabels:
28+
kubernetes.io/metadata.name: openshift-dns
29+
podSelector:
30+
matchLabels:
31+
dns.operator.openshift.io/daemonset-dns: default
32+
podSelector:
33+
matchLabels:
34+
openshift.storage.network-policy.dns: allow
35+
policyTypes:
36+
- Egress

‎assets/overlays/openstack-manila/generated/standalone/manifests.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@ controllerStaticAssetNames:
55
- controller_sa.yaml
66
- kube_rbac_proxy_binding.yaml
77
- kube_rbac_proxy_role.yaml
8+
- network-policy-allow-all-egress.yaml
9+
- network-policy-allow-egress-to-api-server.yaml
10+
- network-policy-allow-ingress-to-metrics.yaml
11+
- network-policy-allow-to-dns.yaml
812
- prometheus_binding.yaml
913
- prometheus_role.yaml
1014
- service.yaml

0 commit comments

Comments
 (0)