Skip to content

deploy/chart: add static NetworkPolicies for CatalogSource gRPC ingress and bundle unpack egress#3863

Open
grokspawn wants to merge 2 commits into
operator-framework:masterfrom
grokspawn:fix/networkpolicy-gaps-3676
Open

deploy/chart: add static NetworkPolicies for CatalogSource gRPC ingress and bundle unpack egress#3863
grokspawn wants to merge 2 commits into
operator-framework:masterfrom
grokspawn:fix/networkpolicy-gaps-3676

Conversation

@grokspawn

Copy link
Copy Markdown
Contributor

Summary

Fixes #3676.

The Helm chart's default-deny-all-traffic NetworkPolicy blocked two traffic paths not covered by the existing static policies:

  • CatalogSource gRPC ingress (port 50051): Registry pods spawned per CatalogSource could not receive inbound gRPC connections. The catalog-operator reconciler does create per-CatalogSource NetworkPolicies for this dynamically, but there is a bootstrapping gap — default-deny-all-traffic takes effect immediately on install/upgrade, while the per-CatalogSource policies only exist after the controller reconciles each object.
  • Bundle-unpack job egress: Job pods created for bundle unpacking could not reach the Kubernetes API server or container registries. The API server port cannot be statically specified (it is implementation-defined), so a wildcard egress rule is used instead.

Two new NetworkPolicies are added to the chart:

Policy Selector Effect
catalog-source-grpc-server pods with olm.catalogSource label (any value) allow ingress on catalogGrpcPodPort (50051)
bundle-unpack-egress pods with olm.managed=true + operatorframework.io/bundle-unpack-ref label allow all egress

The catalog-source-grpc-server policy only lists Ingress in policyTypes, so it does not restrict egress of catalog pods (that remains under the per-CatalogSource policies from the controller). The bundle-unpack-egress policy only lists Egress, so it does not affect ingress on those pods.

Test plan

  • Deploy OLM via the Helm chart into a cluster with a default-deny NetworkPolicy enforcement (e.g., K3s / Rancher Desktop)
  • Create a CatalogSource pointing to quay.io/operatorhubio/catalog:latest; verify lastObservedState reaches READY
  • Create a Subscription; verify the InstallPlan completes without BundleLookupFailed
  • Verify catalog-source-grpc-server and bundle-unpack-egress NetworkPolicies are present in the OLM namespace after helm install

🤖 Generated with Claude Code

…ss and bundle unpack egress

The Helm chart's default-deny-all-traffic policy blocked two critical
traffic paths that are not covered by the existing static NetworkPolicies:

1. CatalogSource registry pods need to accept inbound gRPC connections on
   port 50051 from within the cluster. The catalog-operator reconciler
   already creates per-CatalogSource NetworkPolicies for this, but there
   is a bootstrapping gap between when default-deny-all-traffic is applied
   and when the controller first reconciles each CatalogSource.

2. Bundle-unpack Job pods need egress to reach the Kubernetes API server
   and container registries. The API server port is not statically
   specifiable because it varies across Kubernetes implementations, so a
   wildcard egress rule is used.

Adds two new NetworkPolicies to the chart:
- catalog-source-grpc-server: selects all pods carrying the
  olm.catalogSource label and allows ingress on the gRPC port.
- bundle-unpack-egress: selects all pods carrying both the
  olm.managed=true and operatorframework.io/bundle-unpack-ref labels and
  allows unrestricted egress.

Fixes: operator-framework#3676

Signed-off-by: grokspawn <jordan@nimblewidget.com>
Copilot AI review requested due to automatic review settings July 9, 2026 19:15
@openshift-ci openshift-ci Bot requested review from ankitathomas and fgiudici July 9, 2026 19:15
@openshift-ci

openshift-ci Bot commented Jul 9, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign tmshort for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the OLM Helm chart’s static NetworkPolicy set to avoid connectivity failures caused by the chart’s default-deny-all-traffic policy during the bootstrapping window (before the catalog controller has reconciled per-CatalogSource policies). It specifically targets allowing gRPC ingress to CatalogSource registry pods and enabling bundle-unpack job egress.

Changes:

  • Add catalog-source-grpc-server NetworkPolicy to allow ingress to pods labeled olm.catalogSource on the configured gRPC port.
  • Add bundle-unpack-egress NetworkPolicy to allow wildcard egress from bundle-unpack job pods (selected by olm.managed=true and operatorframework.io/bundle-unpack-ref).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread deploy/chart/templates/0000_50_olm_01-networkpolicies.yaml
Comment thread deploy/chart/templates/0000_50_olm_01-networkpolicies.yaml
…ck NPs

CatalogSource registry pods and bundle-unpack Jobs run in the namespace
determined by .Values.catalog_namespace, not .Values.namespace. When a
user overrides catalog_namespace to differ from namespace, the
NetworkPolicies must be created in catalog_namespace to actually apply
to those pods.

Fixes review feedback on operator-framework#3863.

Signed-off-by: grokspawn <jordan@nimblewidget.com>
Copilot AI review requested due to automatic review settings July 9, 2026 19:44

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

NetworkPolicy blocks OLM catalog connectivity and bundle unpacking jobs

2 participants