Add NetworkPolicy for operator and driver pods#544
Open
Rakshith-R wants to merge 2 commits into
Open
Conversation
Rakshith-R
force-pushed
the
network-policy
branch
from
9b4a0cf to
7de89ac
Compare
Replace the kubebuilder-scaffolded metrics NetworkPolicy with a policy for the ceph-csi-operator pod. The policy denies all ingress (no exposed ports needed -- metrics are disabled, health probes bypass NP) and allows open egress (required for API server access where the ClusterIP varies per cluster and CNI ipBlock behavior is inconsistent). The policy is disabled by default. Set NETWORK_POLICY=true to include it in the generated installer YAMLs: NETWORK_POLICY=true make build-installer Assisted-by: Claude <noreply@anthropic.com> Signed-off-by: Rakshith R <rar@redhat.com>
Create NetworkPolicies for controller-plugin and csi-addons node agent pods as part of the driver reconciliation loop. Controller-plugin NP: allows ingress from csi-addons controller-manager on the csi-addons gRPC port (9070 RBD / 9080 CephFS). For RBD drivers, also allows ingress on port 50051 for CSI snapshot-metadata gRPC from backup applications (Velero, etc.). All egress is open for API server and Ceph cluster access. Node agent NP: allows ingress from csi-addons controller-manager on port 9071 only. Mirrors the csi-addons daemonset lifecycle -- created when DeployCsiAddons is true, deleted when false. NP creation is gated by a startup check for the networking.k8s.io/v1 API group via the discovery client. Node-plugin DaemonSet is not covered as it runs with hostNetwork: true and is therefore exempt from NetworkPolicy. Assisted-by: Claude <noreply@anthropic.com> Signed-off-by: Rakshith R <rar@redhat.com>
Rakshith-R
force-pushed
the
network-policy
branch
from
7de89ac to
a056c2a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
and allows open egress (API server access). Disabled by default; enabled
with
NETWORK_POLICY=trueat build time.node agent pods as part of the driver reconciliation loop, gated by a
startup check for the
networking.k8s.io/v1API group.on the csi-addons gRPC port (9070 RBD / 9080 CephFS) and (RBD only)
port 50051 for CSI snapshot-metadata gRPC from backup applications.
9071, mirroring the csi-addons DaemonSet lifecycle.
hostNetwork: true).Why unrestricted egress (
- {})All policies use open egress instead of restricting to specific IPs because
the API server
ClusterIPis not portable:10.96.0.1(kubeadm),172.30.0.1(OpenShift), custom ranges on managed clouds.Unknown at manifest authoring time.
ipBlockbehavior is inconsistent — OVN-Kubernetes appliesNetworkPolicy before or after DNAT depending on traffic direction,
making
ipBlock-based rules unreliable for service IPs(OVN-K8s docs).
Cilium has similar quirks.
API server on non-6443 ports. Hardcoding port 6443 breaks these setups.
operator-marketplace PR #723
uses open egress for the same reasons.
monitor/OSD network, which varies per deployment.
References
docs/design/network-policy.mdTest plan
make buildpassesmake testpasses (existing tests)NETWORK_POLICY=true make build-installerincludes NP in outputDeployCsiAddons: false, verify node-agent NP deletedManually tested all 6 NPs on live OCP 4.23 cluster — PVC provision,
CSIAddonsNode registration, operator reconcile all pass.
🤖 Generated with Claude Code