From a3fd5a1d6b87a175eff6e5f25444cdfcda1ddceb Mon Sep 17 00:00:00 2001 From: Jeff Cantrill Date: Mon, 12 Oct 2026 11:19:57 -0400 Subject: [PATCH] Revert "LOG-7579: Deploy operator NetworkPolicy via OLM (#3511)" This reverts commit 91bac30b7eeb35dfffbda0de3f562daddc5e7aa5. --- ...cy_networking.k8s.io_v1_networkpolicy.yaml | 26 ---------- config/default/kustomization.yaml | 11 ++--- .../clo-permissive-network-policy.yaml | 12 ++--- config/network-policy/kustomization.yaml | 13 ++--- docs/features/network_policy.adoc | 48 +------------------ 5 files changed, 14 insertions(+), 96 deletions(-) delete mode 100644 bundle/manifests/clo-permissive-network-policy_networking.k8s.io_v1_networkpolicy.yaml diff --git a/bundle/manifests/clo-permissive-network-policy_networking.k8s.io_v1_networkpolicy.yaml b/bundle/manifests/clo-permissive-network-policy_networking.k8s.io_v1_networkpolicy.yaml deleted file mode 100644 index 1b709e1cec..0000000000 --- a/bundle/manifests/clo-permissive-network-policy_networking.k8s.io_v1_networkpolicy.yaml +++ /dev/null @@ -1,26 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - labels: - app.kubernetes.io/name: cluster-logging-operator - name: clo-permissive-network-policy -spec: - egress: - - ports: - - port: 53 - protocol: UDP - - port: 53 - protocol: TCP - - ports: - - port: 6443 - protocol: TCP - ingress: - - ports: - - port: 8443 - protocol: TCP - podSelector: - matchLabels: - name: cluster-logging-operator - policyTypes: - - Ingress - - Egress diff --git a/config/default/kustomization.yaml b/config/default/kustomization.yaml index 2473b8ab2f..dc4246b0a1 100644 --- a/config/default/kustomization.yaml +++ b/config/default/kustomization.yaml @@ -27,12 +27,11 @@ resources: # [METRICS] Expose the controller manager metrics service. #- metrics_service.yaml -# [NETWORK POLICY] Deploy the permissive NetworkPolicy for the operator manager pod so it -# keeps functioning (metrics, DNS, API server) under a restrictive AdminNetworkPolicy, but -# only for traffic that a matching AdminNetworkPolicy rule allows or delegates with a Pass -# action; an AdminNetworkPolicy Deny cannot be overridden here. -# See config/network-policy and docs/features/network_policy.adoc. -- ../network-policy +# [NETWORK POLICY] Protect the /metrics endpoint and Webhook Server with NetworkPolicy. +# Only Pod(s) running a namespace labeled with 'metrics: enabled' will be able to gather the metrics. +# Only CR(s) which requires webhooks and are applied on namespaces labeled with 'webhooks: enabled' will +# be able to communicate with the Webhook Server. +#- ../network-policy patches: # [METRICS] The following patch will enable the metrics endpoint using HTTPS and the port :8443. diff --git a/config/network-policy/clo-permissive-network-policy.yaml b/config/network-policy/clo-permissive-network-policy.yaml index 190f6bd104..60bdcf97be 100644 --- a/config/network-policy/clo-permissive-network-policy.yaml +++ b/config/network-policy/clo-permissive-network-policy.yaml @@ -1,8 +1,6 @@ # NetworkPolicy for cluster-logging-operator manager pod # This policy defines both ingress and egress rules required for the operator to function -# in a restrictive network environment. It only takes effect for traffic that a matching -# AdminNetworkPolicy rule allows or delegates with a Pass action; an AdminNetworkPolicy Deny -# takes precedence and cannot be overridden by this NetworkPolicy. +# in a restrictive network environment. apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: @@ -18,17 +16,15 @@ spec: - Ingress - Egress ingress: - # Allow metrics scraping (metrics-bind-address :8443) + # Allow metrics (Port 8443) - ports: - - port: 8443 + - port: https-metrics protocol: TCP egress: # Allow DNS resolution - ports: - - port: 53 + - port: dns protocol: UDP - - port: 53 - protocol: TCP # Allow communication with Kubernetes API server - ports: - port: 6443 diff --git a/config/network-policy/kustomization.yaml b/config/network-policy/kustomization.yaml index 1d4d86b4df..d88b4d8e1d 100644 --- a/config/network-policy/kustomization.yaml +++ b/config/network-policy/kustomization.yaml @@ -1,9 +1,4 @@ -resources: -# The permissive NetworkPolicy for the operator manager pod. It is deployed by OLM -# so the operator keeps functioning (metrics, DNS, API server) under a restrictive -# AdminNetworkPolicy, but only for traffic that a matching AdminNetworkPolicy rule allows -# or delegates with a Pass action; an AdminNetworkPolicy Deny cannot be overridden here. -# See docs/features/network_policy.adoc. -- clo-permissive-network-policy.yaml -# allow-metrics-traffic.yaml and allow-webhook-traffic.yaml are operator-sdk -# scaffolding and are intentionally not included. +# resources: +# - allow-metrics-traffic.yaml +# - allow-webhook-traffic.yaml +# - clo-permissive-network-policy.yaml \ No newline at end of file diff --git a/docs/features/network_policy.adoc b/docs/features/network_policy.adoc index 2eb217bcf2..1a76702413 100644 --- a/docs/features/network_policy.adoc +++ b/docs/features/network_policy.adoc @@ -2,7 +2,7 @@ The Cluster Logging Operator automatically creates and manages `NetworkPolicy` resources for its logging components to ensure they function in restrictive network environments, even if a cluster-wide `AdminNetworkPolicy` would otherwise block their traffic. -The operator's own manager pod is also protected by a permissive `NetworkPolicy` (`clo-permissive-network-policy`) that is deployed automatically by OLM as part of the operator bundle. This policy preserves the operator's metrics, DNS, and Kubernetes API server connectivity only for traffic that a matching `AdminNetworkPolicy` rule allows or delegates with `Pass`; an `AdminNetworkPolicy` `Deny` takes precedence and cannot be overridden by this `NetworkPolicy`. See <> for details. +In addition, you can use the `NetworkPolicy` defined in `config/network-policy/clo-permissive-network-policy.yaml` to configure the Cluster Logging Operator's network policy for restricted networks. == Overview @@ -14,52 +14,6 @@ When logging components are deployed, the operator can optionally create permiss The `NetworkPolicy` resources are automatically created, updated, and removed along with the component deployment lifecycle. -== Cluster Logging Operator NetworkPolicy - -The operator manager pod is protected by the `clo-permissive-network-policy` `NetworkPolicy`. This policy is included in the operator bundle and is created, updated, and removed by OLM together with the operator; no manual step is required. It is applied in the namespace where the operator is installed (for example, `openshift-logging`). - -The policy is intentionally permissive so the operator keeps working when a restrictive `AdminNetworkPolicy` is applied to the cluster: - -* **Ingress** is allowed on the metrics port so the operator can continue to be scraped for metrics. -* **Egress** is allowed to the cluster DNS (for name resolution) and to the Kubernetes API server (so the operator can reconcile resources and remain discoverable by OLM). - -IMPORTANT: A `NetworkPolicy` sits below `AdminNetworkPolicy` in the precedence hierarchy (see <>). This policy therefore only takes effect for traffic that a matching `AdminNetworkPolicy` rule allows or delegates with a `Pass` action. Traffic that an `AdminNetworkPolicy` explicitly denies cannot be re-allowed by this `NetworkPolicy`; in that case you must adjust the `AdminNetworkPolicy` to `Pass` or allow the relevant operator traffic (see <>). - -[source,yaml] ----- -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - labels: - app.kubernetes.io/name: cluster-logging-operator - name: clo-permissive-network-policy -spec: - podSelector: - matchLabels: - name: cluster-logging-operator - policyTypes: - - Ingress - - Egress - ingress: - # Allow metrics scraping (metrics-bind-address :8443) - - ports: - - port: 8443 - protocol: TCP - egress: - # Allow DNS resolution - - ports: - - port: 53 - protocol: UDP - - port: 53 - protocol: TCP - # Allow communication with the Kubernetes API server - - ports: - - port: 6443 - protocol: TCP ----- - -NOTE: When a cluster-wide proxy is enabled, the operator's egress traffic is directed to the proxy, which may listen on a port other than the ones allowed above. In that case, edit the `clo-permissive-network-policy` (or add a delegating `AdminNetworkPolicy`, see <>) to permit egress to the proxy endpoint. - == Collector NetworkPolicy When a `ClusterLogForwarder` is deployed and a network policy rule set is specified, the operator creates a `NetworkPolicy` for the collector pods. The policy behavior can be configured using the `networkPolicy.ruleSet` field in the collector specification. If `spec.collector.networkPolicy` is not specified, the operator will not create a `NetworkPolicy` for the collector.