deploy/chart: add static NetworkPolicies for CatalogSource gRPC ingress and bundle unpack egress#3863
Conversation
…ss and bundle unpack egress The Helm chart's default-deny-all-traffic policy blocked two critical traffic paths that are not covered by the existing static NetworkPolicies: 1. CatalogSource registry pods need to accept inbound gRPC connections on port 50051 from within the cluster. The catalog-operator reconciler already creates per-CatalogSource NetworkPolicies for this, but there is a bootstrapping gap between when default-deny-all-traffic is applied and when the controller first reconciles each CatalogSource. 2. Bundle-unpack Job pods need egress to reach the Kubernetes API server and container registries. The API server port is not statically specifiable because it varies across Kubernetes implementations, so a wildcard egress rule is used. Adds two new NetworkPolicies to the chart: - catalog-source-grpc-server: selects all pods carrying the olm.catalogSource label and allows ingress on the gRPC port. - bundle-unpack-egress: selects all pods carrying both the olm.managed=true and operatorframework.io/bundle-unpack-ref labels and allows unrestricted egress. Fixes: operator-framework#3676 Signed-off-by: grokspawn <jordan@nimblewidget.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
There was a problem hiding this comment.
Pull request overview
This PR updates the OLM Helm chart’s static NetworkPolicy set to avoid connectivity failures caused by the chart’s default-deny-all-traffic policy during the bootstrapping window (before the catalog controller has reconciled per-CatalogSource policies). It specifically targets allowing gRPC ingress to CatalogSource registry pods and enabling bundle-unpack job egress.
Changes:
- Add
catalog-source-grpc-serverNetworkPolicyto allow ingress to pods labeledolm.catalogSourceon the configured gRPC port. - Add
bundle-unpack-egressNetworkPolicyto allow wildcard egress from bundle-unpack job pods (selected byolm.managed=trueandoperatorframework.io/bundle-unpack-ref).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…ck NPs CatalogSource registry pods and bundle-unpack Jobs run in the namespace determined by .Values.catalog_namespace, not .Values.namespace. When a user overrides catalog_namespace to differ from namespace, the NetworkPolicies must be created in catalog_namespace to actually apply to those pods. Fixes review feedback on operator-framework#3863. Signed-off-by: grokspawn <jordan@nimblewidget.com>
Summary
Fixes #3676.
The Helm chart's
default-deny-all-trafficNetworkPolicy blocked two traffic paths not covered by the existing static policies:default-deny-all-traffictakes effect immediately on install/upgrade, while the per-CatalogSource policies only exist after the controller reconciles each object.Two new NetworkPolicies are added to the chart:
catalog-source-grpc-serverolm.catalogSourcelabel (any value)catalogGrpcPodPort(50051)bundle-unpack-egressolm.managed=true+operatorframework.io/bundle-unpack-reflabelThe
catalog-source-grpc-serverpolicy only listsIngressinpolicyTypes, so it does not restrict egress of catalog pods (that remains under the per-CatalogSource policies from the controller). Thebundle-unpack-egresspolicy only listsEgress, so it does not affect ingress on those pods.Test plan
quay.io/operatorhubio/catalog:latest; verifylastObservedStatereachesREADYBundleLookupFailedcatalog-source-grpc-serverandbundle-unpack-egressNetworkPolicies are present in the OLM namespace afterhelm install🤖 Generated with Claude Code