CNTRLPLANE-2905: add network policies

bindata/assets/openshift-controller-manager/networkpolicy-allow.yaml

@@ -0,0 +1,27 @@
+# Network policy for the openshift-controller-manager pods.
+#
+# Egress:
+# - Allow all egress to support communication with the Kubernetes API server,
+#   whose IP address and port are not known at manifest time. This implicitly
+#   covers DNS resolution as well.
+#
+# Ingress:
+# - Allow ingress on port 8443 (metrics) for metrics scraping.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-controller-manager
+  namespace: openshift-controller-manager
+spec:
+  podSelector:
+    matchLabels:
+      controller-manager: "true"
+  ingress:
+  - ports:
+    - protocol: TCP
+      port: 8443
+  egress:
+  - {}                                          # Allow all egress for API server access
+  policyTypes:
+  - Ingress
+  - Egress

bindata/assets/openshift-controller-manager/networkpolicy-default-deny.yaml

@@ -0,0 +1,22 @@
+# Default-deny network policy for the openshift-controller-manager namespace.
+# This policy selects all pods in the namespace and enables default-deny for both
+# ingress and egress by specifying policyTypes without any allow rules.
+#
+# NetworkPolicies are additive (use OR logic):
+# - This policy enables default-deny for all pods
+# - Subsequent policies add specific allow rules
+# - If any policy allows traffic, that traffic is permitted
+# - Policies cannot override or block traffic allowed by other policies
+#
+# Without this policy, all pods would have unrestricted network access (allow-all).
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny
+  namespace: openshift-controller-manager
+spec:
+  podSelector: {}                               # Selects all pods in the namespace
+  policyTypes:
+  - Ingress
+  - Egress
+  # No ingress or egress rules - denies all traffic by default

bindata/assets/openshift-controller-manager/route-controller-manager-networkpolicy-allow.yaml

@@ -0,0 +1,27 @@
+# Network policy for the route-controller-manager pods.
+#
+# Egress:
+# - Allow all egress to support communication with the Kubernetes API server,
+#   whose IP address and port are not known at manifest time. This implicitly
+#   covers DNS resolution as well.
+#
+# Ingress:
+# - Allow ingress on port 8443 (metrics) for metrics scraping.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-route-controller-manager
+  namespace: openshift-route-controller-manager
+spec:
+  podSelector:
+    matchLabels:
+      route-controller-manager: "true"
+  ingress:
+  - ports:
+    - protocol: TCP
+      port: 8443
+  egress:
+  - {}                                          # Allow all egress for API server access
+  policyTypes:
+  - Ingress
+  - Egress

bindata/assets/openshift-controller-manager/route-controller-manager-networkpolicy-default-deny.yaml

@@ -0,0 +1,22 @@
+# Default-deny network policy for the openshift-route-controller-manager namespace.
+# This policy selects all pods in the namespace and enables default-deny for both
+# ingress and egress by specifying policyTypes without any allow rules.
+#
+# NetworkPolicies are additive (use OR logic):
+# - This policy enables default-deny for all pods
+# - Subsequent policies add specific allow rules
+# - If any policy allows traffic, that traffic is permitted
+# - Policies cannot override or block traffic allowed by other policies
+#
+# Without this policy, all pods would have unrestricted network access (allow-all).
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny
+  namespace: openshift-route-controller-manager
+spec:
+  podSelector: {}                               # Selects all pods in the namespace
+  policyTypes:
+  - Ingress
+  - Egress
+  # No ingress or egress rules - denies all traffic by default

manifests/0000_25_openshift-controller-manager-operator_00_network-policy-operator.yaml

@@ -0,0 +1,30 @@
+# Network policy for the openshift-controller-manager-operator pod.
+#
+# Egress:
+# - Allow all egress to support communication with the Kubernetes API server,
+#   whose IP address and port are not known at manifest time. This implicitly
+#   covers DNS resolution as well.
+#
+# Ingress:
+# - Allow ingress on port 8443 (metrics) for metrics scraping.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-operator
+  namespace: openshift-controller-manager-operator
+  annotations:
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+spec:
+  podSelector:
+    matchLabels:
+      app: openshift-controller-manager-operator
+  ingress:
+  - ports:
+    - protocol: TCP
+      port: 8443
+  egress:
+  - {}                                          # Allow all egress for API server access
+  policyTypes:
+  - Ingress
+  - Egress

manifests/0000_26_openshift-controller-manager-operator_00_network-policy-default-deny.yaml

@@ -0,0 +1,25 @@
+# Default-deny network policy for the openshift-controller-manager-operator namespace.
+# This policy selects all pods in the namespace and enables default-deny for both
+# ingress and egress by specifying policyTypes without any allow rules.
+#
+# NetworkPolicies are additive (use OR logic):
+# - This policy enables default-deny for all pods
+# - Subsequent policies add specific allow rules
+# - If any policy allows traffic, that traffic is permitted
+# - Policies cannot override or block traffic allowed by other policies
+#
+# Without this policy, all pods would have unrestricted network access (allow-all).
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny
+  namespace: openshift-controller-manager-operator
+  annotations:
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+spec:
+  podSelector: {}                               # Selects all pods in the namespace
+  policyTypes:
+  - Ingress
+  - Egress
+  # No ingress or egress rules - denies all traffic by default

pkg/operator/starter.go

@@ -237,6 +237,13 @@ func RunOperator(ctx context.Context, controllerConfig *controllercmd.Controller
 			"assets/openshift-controller-manager/deployer-clusterrolebinding.yaml",
 			"assets/openshift-controller-manager/image-trigger-controller-clusterrole.yaml",
 			"assets/openshift-controller-manager/image-trigger-controller-clusterrolebinding.yaml",
+			// Network policies
+			// Apply allow rules before default-deny so that traffic is never
+			// blocked during the window between sequential resource applies.
+			"assets/openshift-controller-manager/networkpolicy-allow.yaml",
+			"assets/openshift-controller-manager/networkpolicy-default-deny.yaml",
+			"assets/openshift-controller-manager/route-controller-manager-networkpolicy-allow.yaml",
+			"assets/openshift-controller-manager/route-controller-manager-networkpolicy-default-deny.yaml",
 		},
 		resourceapply.NewKubeClientHolder(kubeClient),
 		opClient,