* feat: add NetworkPolicies for open-cluster-management-agent namespace
Ship 4 NetworkPolicy manifests with the klusterlet operator to restrict
ingress/egress in the agent namespace, meeting CIS Kube benchmark 5.3.2
requirements.
Policies added:
- default-deny-all: baseline deny for all ingress/egress
- allow-dns-and-api: DNS egress (OpenShift/kube-dns) + ports-only API
server egress (TCP 443/6443)
- klusterlet: operator egress to intra-namespace, addon namespace, and
kubernetes.default.svc
- klusterlet-agent: agent egress to kubernetes.default.svc, hub webhooks,
and intra-namespace
Also adds:
- RBAC: networking.k8s.io/networkpolicies permissions in klusterlet
ClusterRole
- Cleanup: *networkingv1.NetworkPolicy case in CleanUpStaticObject and
GenerateRelatedResource
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Mihir Lele <mlele@redhat.com>
* feat: add NetworkPolicies feature gate and fix ingress rules
- Add NetworkPolicies feature gate (disabled by default) following the
existing AboutAPIEnabled/ClusterProperty pattern
- Filter operator-internal feature gates before ConvertToFeatureGateFlags
to avoid invalid agent CLI flags and ValidFeatureGates condition issues
- Conditionally apply NP manifests in both reconcile() and clean() based
on the feature gate
- Fix missing intra-namespace ingress rules in klusterlet and
klusterlet-agent NetworkPolicies (CodeRabbit review feedback)
- Revert test counts to pre-NP values and add
TestSyncDeployWithNetworkPolicies for the feature-enabled path
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Mihir Lele <mlele@redhat.com>
* fix: address CodeRabbit nitpicks - import grouping and defensive slice copy
- Move featuregate import to correct alphabetical position in its group
- Use defensive slice copy (append into new slice) instead of direct
assignment from package-level var before appending
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Mihir Lele <mlele@redhat.com>
* fix: update OLM CSV with NetworkPolicy RBAC permissions
The ClusterServiceVersion file needs to include the networking.k8s.io
networkpolicies RBAC rules added to the klusterlet ClusterRole.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Mihir Lele <mlele@redhat.com>
* test: enable NetworkPolicies feature gate in integration and e2e tests
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Mihir Lele <mlele@redhat.com>
* test: update relatedResources counts for NetworkPolicy resources
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Mihir Lele <mlele@redhat.com>
* fix: update expected registration deployment args count for RegistrationConfiguration defaults
RegistrationConfiguration triggers kubebuilder defaults (KubeAPIQPS=50,
KubeAPIBurst=100), adding --kube-api-qps and --kube-api-burst args.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Mihir Lele <mlele@redhat.com>
* fix: clarify relatedResources count comment arithmetic
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Mihir Lele <mlele@redhat.com>
---------
Signed-off-by: Mihir Lele <mlele@redhat.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Move addon api to beta in registration
Signed-off-by: Jian Qiu <jqiu@redhat.com>
* Update conversion e2e tests
Signed-off-by: Jian Qiu <jqiu@redhat.com>
* Add addon v1beta1 to supported type in grpc
Signed-off-by: Jian Qiu <jqiu@redhat.com>
* Fix flaky e2e in addon conversion
Signed-off-by: Jian Qiu <jqiu@redhat.com>
* Set subject for registration configuration when it is not set
Signed-off-by: Jian Qiu <jqiu@redhat.com>
---------
Signed-off-by: Jian Qiu <jqiu@redhat.com>
The addon namespace should always be default on.
The operator will not create addon ns based
on klusterlet install namespace.
Signed-off-by: Jian Qiu <jqiu@redhat.com>
mihirleleandClaude Opus 4.6
Jian Qiu
jaswalkiranavtar