CM-576: Implementation of Network Policy for Cert Manager Operator #283

PillaiManish · 2025-06-03T13:57:52Z

This PR adds the NetworkPolicy for the operator:

Deny all over podSelector
Allow-egress-to-api-server
Allow-ingress-to-metrics

Steps followed:

Update the library-go to latest version so that it contains the commit for the NetworkPolicy support
- update the dependency libraries.
adds parameter in the function call for the updated version code
run the command make generate
add the required NetworkPolicy files and a static controller to watch/reconcile on these resources

openshift-ci-robot · 2025-06-03T13:58:31Z

@PillaiManish: This pull request references CM-576 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2025-06-11T11:08:48Z

@PillaiManish: This pull request references CM-576 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

In response to this:

This PR adds the NetworkPolicy for the operator:

Deny all over podSelector

Allow-egress-to-api-server

Allow-ingress-to-metrics

Steps followed:

Update the library-go to latest version so that it contains the commit for the NetworkPolicy support

update the dependency libraries.

adds parameter in the function call for the updated version code

run the command make generate

add the required NetworkPolicy files and a static controller to watch/reconcile on these resources

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

swghosh

E0610 17:30:08.850137       1 reflector.go:166] "Unhandled Error" err="k8s.io/client-go/informers/factory.go:160: Failed to watch *v1.NetworkPolicy: failed to list *v1.NetworkPolicy: networkpolicies.networking.k8s.io is forbidden: User \"system:serviceaccount:cert-manager-operator:cert-manager-operator-controller-manager\" cannot list resource \"networkpolicies\" in API group \"networking.k8s.io\" in the namespace \"cert-manager-operator\""
W0610 17:30:58.441258       1 reflector.go:569] k8s.io/client-go/informers/factory.go:160: failed to list *v1.NetworkPolicy: networkpolicies.networking.k8s.io is forbidden: User "system:serviceaccount:cert-manager-operator:cert-manager-operator-controller-manager" cannot list resource "networkpolicies" in API group "networking.k8s.io" in the namespace "cert-manager-operator"
E0610 17:30:58.441294       1 reflector.go:166] "Unhandled Error" err="k8s.io/client-go/informers/factory.go:160: Failed to watch *v1.NetworkPolicy: failed to list *v1.NetworkPolicy: networkpolicies.networking.k8s.io is forbidden: User \"system:serviceaccount:cert-manager-operator:cert-manager-operator-controller-manager\" cannot list resource \"networkpolicies\" in API group \"networking.k8s.io\" in the namespace \"cert-manager-operator\""

from the e2e operator pod logs it seems that the NetworkPolicy we intend to apply are not getting added at all. One way for the e2e to observe this as a failure is to add a status condition check for the new static-resource-controller being added, refer #279 for details. However, for this to work would need to check if your controller can effectively apply a NetworkPolicy object via library-go first, and resolve that RBAC issue too.

bindata/cert-manager-deployment/network-policy/operator-allow-egress-to-api-server.yaml

bindata/cert-manager-deployment/network-policy/operator-allow-ingress-to-metrics.yaml

bindata/cert-manager-deployment/network-policy/operator-deny-all-pod-selector.yaml

swghosh · 2025-06-19T06:26:56Z

bindata/cert-manager-deployment/network-policy/operator-allow-egress-to-api-server.yaml

+  egress:
+    - ports:
+        - protocol: TCP
+          port: 6443


This allows (operator pod to) egress ALL to any 6443 port to any pod on the cluster? Is my understanding correct?

Yes, in the docs they have mentioned this way. They might tighten it later.

pkg/controller/deployment/cert_manager_operator_static_resource.go

swghosh · 2025-06-19T06:34:32Z

pkg/controller/istiocsr/deployments.go

@@ -433,7 +433,7 @@ func validateTolerationsConfig(tolerations []corev1.Toleration, fldPath *field.P
 func validateResourceRequirements(requirements corev1.ResourceRequirements, fldPath *field.Path) error {
 	// convert corev1.ResourceRequirements to core.ResourceRequirements, required for validation.
 	convRequirements := *(*core.ResourceRequirements)(unsafe.Pointer(&requirements))
-	return corevalidation.ValidateResourceRequirements(&convRequirements, nil, fldPath.Child("resources"), corevalidation.PodValidationOptions{}).ToAggregate()
+	return corevalidation.ValidateContainerResourceRequirements(&convRequirements, nil, fldPath.Child("resources"), corevalidation.PodValidationOptions{}).ToAggregate()


coming in from upstream bump?

Yes, in the upstream, that corevalidation

func validatePodResourceRequirements(requirements *core.ResourceRequirements, podClaimNames sets.Set[string], fldPath *field.Path, opts PodValidationOptions) field.ErrorList { return validateResourceRequirements(requirements, validatePodResourceName, podClaimNames, fldPath, opts) } func ValidateContainerResourceRequirements(requirements *core.ResourceRequirements, podClaimNames sets.Set[string], fldPath *field.Path, opts PodValidationOptions) field.ErrorList { return validateResourceRequirements(requirements, validateContainerResourceName, podClaimNames, fldPath, opts) } // Validates resource requirement spec. func validateResourceRequirements(requirements *core.ResourceRequirements, resourceNameFn func(core.ResourceName, *field.Path) field.ErrorList, podClaimNames sets.Set[string], fldPath *field.Path, opts PodValidationOptions) field.ErrorList {

Two function have been added validatePodResourceRequirements, ValidateContainerResourceRequirements.

swghosh · 2025-06-19T06:37:27Z

pkg/operator/clientset/versioned/clientset.go

-	"fmt"
-	"net/http"
+	fmt "fmt"
+	http "net/http"


I'm not sure what is changing the generated client-gen code.
Auto-generation update?

Not sure, maybe the bump? I will once take a look on it.

swghosh · 2025-06-19T06:45:11Z

pkg/operator/starter.go

@@ -71,10 +71,13 @@ func RunOperator(ctx context.Context, cc *controllercmd.ControllerContext) error
 	versionRecorder := status.NewVersionGetter()
 	versionRecorder.SetVersion("operator", status.VersionForOperatorFromEnv())

+	operatorclient.OperatorNamespace = cc.OperatorNamespace
+
 	kubeInformersForNamespaces := v1helpers.NewKubeInformersForNamespaces(kubeClient,


Let's check library-go implementation for the Static Resources Controller (especially informers),
my guess is that there is no informer/client for NetworkPolicy yet.

openshift-ci · 2025-06-19T06:53:02Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: PillaiManish
Once this PR has been reviewed and has the lgtm label, please assign trilokgeer for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

swghosh · 2025-06-19T07:00:13Z

go.mod

-	k8s.io/client-go v0.31.7
-	k8s.io/code-generator v0.31.1
-	k8s.io/component-base v0.31.7
+	golang.org/x/tools v0.26.0


these bumps to kube 32, can go in as a separate PR (ideally with the upstream bump, but not a must)

Do you mean with the PR ?

pkg/controller/deployment/cert_manager_operator_static_resource.go

swghosh · 2025-06-19T10:24:20Z

E0610 17:30:08.850137       1 reflector.go:166] "Unhandled Error" err="k8s.io/client-go/informers/factory.go:160: Failed to watch *v1.NetworkPolicy: failed to list *v1.NetworkPolicy: networkpolicies.networking.k8s.io is forbidden: User \"system:serviceaccount:cert-manager-operator:cert-manager-operator-controller-manager\" cannot list resource \"networkpolicies\" in API group \"networking.k8s.io\" in the namespace \"cert-manager-operator\""
W0610 17:30:58.441258       1 reflector.go:569] k8s.io/client-go/informers/factory.go:160: failed to list *v1.NetworkPolicy: networkpolicies.networking.k8s.io is forbidden: User "system:serviceaccount:cert-manager-operator:cert-manager-operator-controller-manager" cannot list resource "networkpolicies" in API group "networking.k8s.io" in the namespace "cert-manager-operator"
E0610 17:30:58.441294       1 reflector.go:166] "Unhandled Error" err="k8s.io/client-go/informers/factory.go:160: Failed to watch *v1.NetworkPolicy: failed to list *v1.NetworkPolicy: networkpolicies.networking.k8s.io is forbidden: User \"system:serviceaccount:cert-manager-operator:cert-manager-operator-controller-manager\" cannot list resource \"networkpolicies\" in API group \"networking.k8s.io\" in the namespace \"cert-manager-operator\""

from the e2e operator pod logs it seems that the NetworkPolicy we intend to apply are not getting added at all. One way for the e2e to observe this as a failure is to add a status condition check for the new static-resource-controller being added, refer #279 for details. However, for this to work would need to check if your controller can effectively apply a NetworkPolicy object via library-go first, and resolve that RBAC issue too.

looks like apply-ing NetworkPolicy via Static Resource Controller was already added in openshift/library-go#1961: which suffices, so fixing the RBAC should fix your issue.

So additionally, we would need e2e to check that Status.Conditions is: - {status: "False", type: cert-manager-operator-static-resources-Degraded } (context of why we need it is in OCPBUGS-56758 FYR).

PillaiManish · 2025-06-30T13:56:30Z

/retest

PillaiManish · 2025-06-30T17:31:06Z

/retest

TrilokGeer · 2025-07-02T05:13:28Z

/hold
Hold for design review.

openshift-ci · 2025-07-29T06:03:11Z

@PillaiManish: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-operator	`bd6195f`	link	true	`/test e2e-operator`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-merge-robot · 2025-07-29T06:03:17Z

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jun 3, 2025

openshift-ci bot requested review from bharath-b-rh and TrilokGeer June 3, 2025 14:01

PillaiManish force-pushed the cm-576-network-policy-operator branch 6 times, most recently from 6628d66 to efb2f8d Compare June 10, 2025 11:47

PillaiManish added 3 commits June 10, 2025 20:24

updates go mod and vendor

3a7a860

changes for latest versions

dc6f1e1

adds files for make generate command

f03287e

PillaiManish force-pushed the cm-576-network-policy-operator branch 2 times, most recently from dcaa292 to 9864f42 Compare June 10, 2025 15:19

swghosh suggested changes Jun 19, 2025

View reviewed changes

swghosh reviewed Jun 19, 2025

View reviewed changes

PillaiManish force-pushed the cm-576-network-policy-operator branch from 9864f42 to 42d6de6 Compare June 30, 2025 07:55

adds network policy for operator

99ae963

PillaiManish force-pushed the cm-576-network-policy-operator branch from 42d6de6 to 6cbef25 Compare June 30, 2025 09:17

updates csv for networkPolicy clusterPermission

bd6195f

PillaiManish force-pushed the cm-576-network-policy-operator branch from 6cbef25 to bd6195f Compare June 30, 2025 09:47

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 2, 2025

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 29, 2025

CM-576: Implementation of Network Policy for Cert Manager Operator #283

Are you sure you want to change the base?

CM-576: Implementation of Network Policy for Cert Manager Operator #283

Uh oh!

Conversation

PillaiManish commented Jun 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Jun 3, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Jun 11, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

swghosh left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Jun 19, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

swghosh commented Jun 19, 2025

Uh oh!

PillaiManish commented Jun 30, 2025

Uh oh!

PillaiManish commented Jun 30, 2025

Uh oh!

TrilokGeer commented Jul 2, 2025

Uh oh!

openshift-ci bot commented Jul 29, 2025

Uh oh!

openshift-merge-robot commented Jul 29, 2025

Uh oh!

Uh oh!

PillaiManish commented Jun 3, 2025 •

edited

Loading

openshift-ci-robot commented Jun 3, 2025 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented Jun 11, 2025 •

edited by openshift-ci bot

Loading

swghosh left a comment •

edited

Loading