Add NetworkPolicy reconcilers for driver operand pods

Create NetworkPolicies for controller-plugin and csi-addons node agent
pods as part of the driver reconciliation loop.

Controller-plugin NP: allows ingress from csi-addons controller-manager
on the csi-addons gRPC port (9070 RBD / 9080 CephFS). For RBD drivers,
also allows ingress on port 50051 for CSI snapshot-metadata gRPC from
backup applications (Velero, etc.). All egress is open for API server
and Ceph cluster access.

Node agent NP: allows ingress from csi-addons controller-manager on
port 9071 only. Mirrors the csi-addons daemonset lifecycle -- created
when DeployCsiAddons is true, deleted when false.

NP creation is gated by a startup check for the networking.k8s.io/v1
API group via the discovery client.

Node-plugin DaemonSet is not covered as it runs with hostNetwork: true
and is therefore exempt from NetworkPolicy.

Assisted-by: Claude <noreply@anthropic.com>
Signed-off-by: Rakshith R <rar@redhat.com>

Author: Rakshith-R

Makefile

@@ -292,11 +292,13 @@ uninstall: manifests kustomize ## Uninstall CRDs from the K8s cluster specified
 
 .PHONY: deploy
 deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
+	$(call enable-network-policy)
 	mkdir -p build
 	cd build && echo "$$BUILD_INSTALLER_OVERLAY" > kustomization.yaml
 	cd build && $(KUSTOMIZE) edit add resource ../config/default/
 	$(KUSTOMIZE) build build | $(KUBECTL) apply -f -
 	rm -rf build
+	$(call disable-network-policy)
 
 .PHONY: undeploy
 undeploy: kustomize ## Undeploy controller from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.

PendingReleaseNotes.md

@@ -8,4 +8,5 @@
 - Fencing can now be enabled in the ceph-csi-drivers Helm chart either globally for all drivers or on a per-driver basis.
 - Added `enabled` field to log rotation configuration in the ceph-csi-drivers Helm chart. Users can now disable log rotation by setting `log.rotation.enabled: false` either globally in `operatorConfig.driverSpecDefaults` or per-driver in `drivers.<driver-type>`. This resolves Helm warnings when disabling file logging from parent charts.
 - Added support to set the priorityClass in the operator helm chart.
+- Added NetworkPolicies for the operator pod and CSI driver pods (controller-plugin, csi-addons node agent). Disabled by default; enabled with `NETWORK_POLICY=true` at build time. Driver NPs are created by the operator when `networking.k8s.io/v1` is available on the cluster. Node-plugin pods are exempt (`hostNetwork: true`).
 ## NOTE

config/rbac/role.yaml

@@ -87,6 +87,18 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - networkpolicies
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - storage.k8s.io
   resources:

deploy/all-in-one/install-openshift.yaml

@@ -15802,6 +15802,18 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - networkpolicies
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - storage.k8s.io
   resources:

deploy/all-in-one/install.yaml

@@ -15788,6 +15788,18 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - networkpolicies
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - storage.k8s.io
   resources:

deploy/charts/ceph-csi-operator/templates/manager-rbac.yaml

@@ -88,6 +88,18 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - networkpolicies
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - storage.k8s.io
   resources:

deploy/multifile/operator.yaml

@@ -345,6 +345,18 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - networkpolicies
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - storage.k8s.io
   resources:

docs/design/network-policy.md

@@ -0,0 +1,86 @@
+# NetworkPolicy for Ceph-CSI Operator and Driver Pods
+
+This document describes the NetworkPolicy implementation for the
+ceph-csi-operator and the CSI driver pods it manages.
+
+## Component Inventory
+
+| Component | Pod Labels | hostNetwork | NP Coverage |
+|---|---|---|---|
+| Operator pod | `control-plane: ceph-csi-op-controller-manager` | No | Static manifest |
+| Controller-plugin (per driver) | `app: {driver}-ctrlplugin` | Configurable | Code-generated |
+| csi-addons node agent (per driver) | `app: {driver}-nodeplugin-csi-addons` | No | Code-generated |
+| Node-plugin DaemonSet | `app: {driver}-nodeplugin` | Yes (hardcoded) | Exempt |
+
+## Policies
+
+### Operator Pod
+
+- **Ingress:** Deny all. No exposed ports (metrics disabled by default,
+  kubelet health probes bypass NetworkPolicy).
+- **Egress:** Open (`- {}`). Required for API server access. The API server
+  ClusterIP varies per cluster (10.96.0.1 on kubeadm, 172.30.0.1 on OpenShift)
+  and CNI ipBlock behavior is inconsistent across implementations, so
+  restricting egress to a specific IP is not portable.
+
+### Controller-Plugin
+
+- **Ingress:** Two rules:
+  1. csi-addons controller-manager → csi-addons gRPC port (9070 for RBD,
+     9080 for CephFS). Source restricted to pods with labels
+     `app.kubernetes.io/name: csi-addons` + `control-plane: controller-manager`
+     in any namespace.
+  2. (RBD only) Any pod → snapshot-metadata gRPC port 50051. Open source
+     because backup applications (Velero, etc.) can run in any namespace
+     with any labels. See [CSI snapshot-metadata](https://kubernetes-csi.github.io/docs/external-snapshot-metadata.html).
+- **Egress:** Open. Required for API server and Ceph cluster access.
+
+### csi-addons Node Agent
+
+- **Ingress:** csi-addons controller-manager → port 9071 only.
+- **Egress:** Open.
+- **Lifecycle:** Mirrors the csi-addons DaemonSet — created when
+  `DeployCsiAddons` is true, deleted when false. Not created for NFS drivers.
+
+### Node-Plugin DaemonSet
+
+No NetworkPolicy. Runs with `hostNetwork: true`, which makes it exempt
+from NetworkPolicy enforcement.
+
+## Gating
+
+### Static Manifest (Operator Pod)
+
+The operator pod NP is in `config/network-policy/` and referenced from
+`config/default/kustomization.yaml` as a commented resource. It is
+**disabled by default**. Set `NETWORK_POLICY=true` when building to include it:
+
+```console
+NETWORK_POLICY=true make build-installer
+```
+
+### Code-Generated NPs (Driver Pods)
+
+Driver pod NPs are created by the operator at runtime. The operator checks
+for the `networking.k8s.io/v1` API group at startup via the discovery client.
+If the API is not available, no NPs are created and a log message is emitted.
+
+## API Server Egress Rationale
+
+Open egress (`- {}`) is used instead of restricting to a specific API server
+IP because:
+
+1. The API server ClusterIP varies per cluster and is unknown at manifest
+   authoring time.
+2. CNI implementations handle `ipBlock` inconsistently with DNAT (OVN-K8s
+   timing, Cilium quirks).
+3. HyperShift clusters may use non-standard API server ports.
+
+This follows the precedent set by
+[operator-marketplace PR #723](https://github.com/operator-framework/operator-marketplace/pull/723).
+
+## References
+
+- [CSI snapshot-metadata sidecar](https://kubernetes-csi.github.io/docs/external-snapshot-metadata.html)
+- [kubernetes-csi/external-snapshot-metadata](https://github.com/kubernetes-csi/external-snapshot-metadata)
+- [operator-marketplace NP precedent](https://github.com/operator-framework/operator-marketplace/pull/723)

docs/kubernetes-installation.md

@@ -495,3 +495,33 @@ Expected output:
 ```text
 No resources found in ceph-csi-operator-system namespace.
 ```
+
+## 6. Optional: Enable NetworkPolicies
+
+NetworkPolicies for the operator pod and CSI driver pods are included but
+**disabled by default**. To include them in the generated manifests, pass
+`NETWORK_POLICY=true` to the build target:
+
+```bash
+NETWORK_POLICY=true make build-installer
+# or for OpenShift:
+NETWORK_POLICY=true make build-openshift-installer
+```
+
+When enabled:
+
+- The **operator pod** gets a policy that denies all ingress and allows open
+  egress (required for API server access).
+- Each **controller-plugin** pod gets a policy allowing ingress only from the
+  csi-addons controller-manager on the csi-addons gRPC port, and (for RBD)
+  from any pod on port 50051 for snapshot-metadata gRPC.
+- Each **csi-addons node agent** pod (when `deployCsiAddons: true`) gets a
+  policy allowing ingress only from the csi-addons controller-manager on
+  port 9071.
+- The **node-plugin** DaemonSet runs with `hostNetwork: true` and is exempt
+  from NetworkPolicies.
+
+Driver pod NetworkPolicies are created by the operator when the cluster
+supports the `networking.k8s.io/v1` API group (checked at startup).
+
+For design details, see [docs/design/network-policy.md](design/network-policy.md).