mirror of
https://github.com/open-cluster-management-io/ocm.git
synced 2026-08-19 12:16:46 +00:00
374cc31e22
* feat: add NetworkPolicies for open-cluster-management-agent namespace Ship 4 NetworkPolicy manifests with the klusterlet operator to restrict ingress/egress in the agent namespace, meeting CIS Kube benchmark 5.3.2 requirements. Policies added: - default-deny-all: baseline deny for all ingress/egress - allow-dns-and-api: DNS egress (OpenShift/kube-dns) + ports-only API server egress (TCP 443/6443) - klusterlet: operator egress to intra-namespace, addon namespace, and kubernetes.default.svc - klusterlet-agent: agent egress to kubernetes.default.svc, hub webhooks, and intra-namespace Also adds: - RBAC: networking.k8s.io/networkpolicies permissions in klusterlet ClusterRole - Cleanup: *networkingv1.NetworkPolicy case in CleanUpStaticObject and GenerateRelatedResource Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Mihir Lele <mlele@redhat.com> * feat: add NetworkPolicies feature gate and fix ingress rules - Add NetworkPolicies feature gate (disabled by default) following the existing AboutAPIEnabled/ClusterProperty pattern - Filter operator-internal feature gates before ConvertToFeatureGateFlags to avoid invalid agent CLI flags and ValidFeatureGates condition issues - Conditionally apply NP manifests in both reconcile() and clean() based on the feature gate - Fix missing intra-namespace ingress rules in klusterlet and klusterlet-agent NetworkPolicies (CodeRabbit review feedback) - Revert test counts to pre-NP values and add TestSyncDeployWithNetworkPolicies for the feature-enabled path Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Mihir Lele <mlele@redhat.com> * fix: address CodeRabbit nitpicks - import grouping and defensive slice copy - Move featuregate import to correct alphabetical position in its group - Use defensive slice copy (append into new slice) instead of direct assignment from package-level var before appending Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Mihir Lele <mlele@redhat.com> * fix: update OLM CSV with NetworkPolicy RBAC permissions The ClusterServiceVersion file needs to include the networking.k8s.io networkpolicies RBAC rules added to the klusterlet ClusterRole. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Mihir Lele <mlele@redhat.com> * test: enable NetworkPolicies feature gate in integration and e2e tests Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Mihir Lele <mlele@redhat.com> * test: update relatedResources counts for NetworkPolicy resources Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Mihir Lele <mlele@redhat.com> * fix: update expected registration deployment args count for RegistrationConfiguration defaults RegistrationConfiguration triggers kubebuilder defaults (KubeAPIQPS=50, KubeAPIBurst=100), adding --kube-api-qps and --kube-api-burst args. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Mihir Lele <mlele@redhat.com> * fix: clarify relatedResources count comment arithmetic Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Mihir Lele <mlele@redhat.com> --------- Signed-off-by: Mihir Lele <mlele@redhat.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>