From 89429861b55211dec5b3842cf213ac56f8e5db1a Mon Sep 17 00:00:00 2001
From: grokspawn <jordan@nimblewidget.com>
Date: Thu, 9 Jul 2026 14:15:16 -0500
Subject: [PATCH 1/2] deploy/chart: add static NetworkPolicies for
 CatalogSource gRPC ingress and bundle unpack egress

The Helm chart's default-deny-all-traffic policy blocked two critical
traffic paths that are not covered by the existing static NetworkPolicies:

1. CatalogSource registry pods need to accept inbound gRPC connections on
   port 50051 from within the cluster. The catalog-operator reconciler
   already creates per-CatalogSource NetworkPolicies for this, but there
   is a bootstrapping gap between when default-deny-all-traffic is applied
   and when the controller first reconciles each CatalogSource.

2. Bundle-unpack Job pods need egress to reach the Kubernetes API server
   and container registries. The API server port is not statically
   specifiable because it varies across Kubernetes implementations, so a
   wildcard egress rule is used.

Adds two new NetworkPolicies to the chart:
- catalog-source-grpc-server: selects all pods carrying the
  olm.catalogSource label and allows ingress on the gRPC port.
- bundle-unpack-egress: selects all pods carrying both the
  olm.managed=true and operatorframework.io/bundle-unpack-ref labels and
  allows unrestricted egress.

Fixes: https://github.com/operator-framework/operator-lifecycle-manager/issues/3676

Signed-off-by: grokspawn <jordan@nimblewidget.com>
---
 .../0000_50_olm_01-networkpolicies.yaml       | 38 +++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/deploy/chart/templates/0000_50_olm_01-networkpolicies.yaml b/deploy/chart/templates/0000_50_olm_01-networkpolicies.yaml
index 6ee410a64a..380bf70460 100644
--- a/deploy/chart/templates/0000_50_olm_01-networkpolicies.yaml
+++ b/deploy/chart/templates/0000_50_olm_01-networkpolicies.yaml
@@ -85,3 +85,41 @@ spec:
     - { }
   egress:
     - { }
+---
+# Complements per-CatalogSource NPs from the controller; covers the bootstrapping window before reconciliation.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: catalog-source-grpc-server
+  namespace: {{ .Values.namespace }}
+spec:
+  podSelector:
+    matchExpressions:
+      - key: olm.catalogSource
+        operator: Exists
+  policyTypes:
+    - Ingress
+  ingress:
+    - ports:
+      - protocol: TCP
+        port: {{ .Values.catalogGrpcPodPort }}
+---
+# Wildcard egress; API server port omitted intentionally — it is implementation-defined and not statically knowable.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: bundle-unpack-egress
+  namespace: {{ .Values.namespace }}
+spec:
+  podSelector:
+    matchExpressions:
+      - key: operatorframework.io/bundle-unpack-ref
+        operator: Exists
+      - key: olm.managed
+        operator: In
+        values:
+          - "true"
+  policyTypes:
+    - Egress
+  egress:
+    - { }

From b4fea33f1f0b1427996c486d1b126512c058a629 Mon Sep 17 00:00:00 2001
From: grokspawn <jordan@nimblewidget.com>
Date: Thu, 9 Jul 2026 14:44:34 -0500
Subject: [PATCH 2/2] deploy/chart: use catalog_namespace for CatalogSource and
 bundle-unpack NPs

CatalogSource registry pods and bundle-unpack Jobs run in the namespace
determined by .Values.catalog_namespace, not .Values.namespace. When a
user overrides catalog_namespace to differ from namespace, the
NetworkPolicies must be created in catalog_namespace to actually apply
to those pods.

Fixes review feedback on #3863.

Signed-off-by: grokspawn <jordan@nimblewidget.com>
---
 deploy/chart/templates/0000_50_olm_01-networkpolicies.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/deploy/chart/templates/0000_50_olm_01-networkpolicies.yaml b/deploy/chart/templates/0000_50_olm_01-networkpolicies.yaml
index 380bf70460..ca020c87ca 100644
--- a/deploy/chart/templates/0000_50_olm_01-networkpolicies.yaml
+++ b/deploy/chart/templates/0000_50_olm_01-networkpolicies.yaml
@@ -91,7 +91,7 @@ apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: catalog-source-grpc-server
-  namespace: {{ .Values.namespace }}
+  namespace: {{ .Values.catalog_namespace }}
 spec:
   podSelector:
     matchExpressions:
@@ -109,7 +109,7 @@ apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: bundle-unpack-egress
-  namespace: {{ .Values.namespace }}
+  namespace: {{ .Values.catalog_namespace }}
 spec:
   podSelector:
     matchExpressions: