Add NetworkPolicy for operator pod

Replace the kubebuilder-scaffolded metrics NetworkPolicy with a policy
for the ceph-csi-operator pod. The policy denies all ingress (no
exposed ports needed -- metrics are disabled, health probes bypass NP)
and allows open egress (required for API server access where the
ClusterIP varies per cluster and CNI ipBlock behavior is inconsistent).

The policy is disabled by default. Set NETWORK_POLICY=true to include
it in the generated installer YAMLs:

  NETWORK_POLICY=true make build-installer

Assisted-by: Claude <noreply@anthropic.com>
Signed-off-by: Rakshith R <rar@redhat.com>

Author: Rakshith-R

Makefile

@@ -12,6 +12,10 @@ WATCH_NAMESPACE ?= ""
 
 IMG ?= $(IMAGE_REGISTRY)/$(REGISTRY_NAMESPACE)/$(IMAGE_NAME):$(IMAGE_TAG)
 
+# NETWORK_POLICY controls whether NetworkPolicy manifests are included
+# in the generated installer YAMLs. Set to true to enable.
+NETWORK_POLICY ?= false
+
 # ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
 ENVTEST_K8S_VERSION = 1.29.0
 
@@ -74,6 +78,15 @@ resources:
 endef
 export BUILD_CSI_RBAC_OVERLAY
 
+# Helpers to toggle the network-policy kustomize resource.
+# Called from build targets when NETWORK_POLICY=true.
+define enable-network-policy
+$(if $(filter true,$(NETWORK_POLICY)),cd config/default && sed -i 's|#- ../network-policy|- ../network-policy|' kustomization.yaml)
+endef
+define disable-network-policy
+$(if $(filter true,$(NETWORK_POLICY)),cd config/default && sed -i 's|^- ../network-policy|#- ../network-policy|' kustomization.yaml)
+endef
+
 .PHONY: all
 all: build
 
@@ -192,19 +205,23 @@ docker-buildx: ## Build and push docker image for the manager for cross-platform
 
 .PHONY: build-installer
 build-installer: manifests generate kustomize ## Generate a consolidated YAML with CRDs and deployment.
+	$(call enable-network-policy)
 	mkdir -p build deploy/all-in-one
 	cd build && echo "$$BUILD_INSTALLER_OVERLAY" > kustomization.yaml
 	cd build && $(KUSTOMIZE) edit add resource ../config/default/
 	$(KUSTOMIZE) build build > deploy/all-in-one/install.yaml
 	rm -rf build
+	$(call disable-network-policy)
 
 .PHONY: build-openshift-installer
 build-openshift-installer: manifests generate kustomize ## Generate a consolidated YAML with CRDs, deployment, and OpenShift SCC.
+	$(call enable-network-policy)
 	mkdir -p build deploy/all-in-one
 	cd build && echo "$$BUILD_INSTALLER_OVERLAY" > kustomization.yaml
 	cd build && $(KUSTOMIZE) edit add resource ../config/openshift/
 	$(KUSTOMIZE) build build > deploy/all-in-one/install-openshift.yaml
 	rm -rf build
+	$(call disable-network-policy)
 
 .PHONY: build-helm-installer
 build-helm-installer: manifests generate kustomize helmify ## Generate helm charts for the operator.

config/default/kustomization.yaml

@@ -18,10 +18,8 @@ resources:
 #- ../prometheus
 # [METRICS] Expose the controller manager metrics service.
 # - metrics_service.yaml
-# [NETWORK POLICY] Protect the /metrics endpoint and Webhook Server with NetworkPolicy.
-# Only Pod(s) running a namespace labeled with 'metrics: enabled' will be able to gather the metrics.
-# Only CR(s) which requires webhooks and are applied on namespaces labeled with 'webhooks: enabled' will
-# be able to communicate with the Webhook Server.
+# [NETWORK POLICY] Protect the operator pod with NetworkPolicy.
+# Denies all ingress and allows open egress for API server access.
 #- ../network-policy
 
 #patches:

config/network-policy/allow-metrics-traffic.yaml

@@ -1,2 +1,2 @@
 resources:
-- allow-metrics-traffic.yaml
+- operator-network-policy.yaml

config/network-policy/kustomization.yaml

@@ -0,0 +1,14 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: ceph-csi-controller-manager
+spec:
+  podSelector:
+    matchLabels:
+      control-plane: ceph-csi-op-controller-manager
+  # Ingress is not specified — deny all inbound traffic.
+  egress:
+  - {}
+  policyTypes:
+  - Ingress
+  - Egress