Add option to reconcile network policies for operator #1248
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
frzifus
force-pushed
the
networking_operator
branch
from
30d7b70 to
041ee2c
Compare
frzifus
force-pushed
the
networking_operator
branch
from
041ee2c to
eb79693
Compare
frzifus
force-pushed
the
networking_operator
branch
2 times, most recently
from
ca64cb9 to
6d6ba02
Compare
frzifus
changed the title
frzifus
force-pushed
the
networking_operator
branch
from
6d6ba02 to
83b8487
Compare
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #1248 +/- ##
==========================================
+ Coverage 57.64% 58.35% +0.70%
==========================================
Files 121 123 +2
Lines 11277 11501 +224
==========================================
+ Hits 6501 6711 +210
- Misses 4418 4428 +10
- Partials 358 362 +4
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
frzifus
force-pushed
the
networking_operator
branch
from
83b8487 to
8fbc64b
Compare
rubenvp8510
approved these changes
Jul 24, 2025
frzifus
force-pushed
the
networking_operator
branch
from
8fbc64b to
82d73ed
Compare
frzifus
force-pushed
the
networking_operator
branch
from
82d73ed to
48c24fe
Compare
andreasgerstmayr
approved these changes
Jul 24, 2025
frzifus
force-pushed
the
networking_operator
branch
from
48c24fe to
5bf39e4
Compare
Signed-off-by: Benedikt Bongartz <bongartz@klimlive.de>
Signed-off-by: Benedikt Bongartz <bongartz@klimlive.de>
Signed-off-by: Benedikt Bongartz <bongartz@klimlive.de>
frzifus
force-pushed
the
networking_operator
branch
from
5bf39e4 to
d32a3c8
Compare
|
cc @IshwarKanse 😄 |
|
On OCP 4.20, the network policies are not being created by the Tempo Operator. The operator logs the following errors: Here are the steps to reproduce the issue: % oc version
Client Version: 4.19.0
Kustomize Version: v5.5.0
Server Version: 4.20.0-0.nightly-2025-07-20-021531
Kubernetes Version: v1.33.2
% oc create namespace openshift-tempo-operator
namespace/openshift-tempo-operator created
% oc label namespace openshift-tempo-operator openshift.io/cluster-monitoring="true"
namespace/openshift-tempo-operator labeled
% oc project openshift-tempo-operator
% operator-sdk run bundle --timeout=5m --security-context-config=restricted quay.io/rhn_support_ikanse/tempo-operator-bundle:v0.17.1
INFO[0015] Creating a File-Based Catalog of the bundle "quay.io/rhn_support_ikanse/tempo-operator-bundle:v0.17.1"
INFO[0018] Generated a valid File-Based Catalog
INFO[0025] Created registry pod: quay-io-rhn-support-ikanse-tempo-operator-bundle-v0-17-1
INFO[0026] Created CatalogSource: tempo-operator-catalog
INFO[0026] OperatorGroup "operator-sdk-og" created
INFO[0027] Created Subscription: tempo-operator-v0-17-1-sub
INFO[0037] Approved InstallPlan install-4w54d for the Subscription: tempo-operator-v0-17-1-sub
INFO[0037] Waiting for ClusterServiceVersion "openshift-tempo-operator/tempo-operator.v0.17.1" to reach 'Succeeded' phase
INFO[0038] Found ClusterServiceVersion "openshift-tempo-operator/tempo-operator.v0.17.1" phase: Pending
INFO[0040] Found ClusterServiceVersion "openshift-tempo-operator/tempo-operator.v0.17.1" phase: InstallReady
INFO[0041] Found ClusterServiceVersion "openshift-tempo-operator/tempo-operator.v0.17.1" phase: Installing
INFO[0053] Found ClusterServiceVersion "openshift-tempo-operator/tempo-operator.v0.17.1" phase: Succeeded
INFO[0054] OLM has successfully installed "tempo-operator.v0.17.1"
% oc get networkpolicies.networking.k8s.io
No resources found in openshift-tempo-operator namespace.
% oc logs tempo-operator-controller-7f9c475f6-x5zhs | grep -i error
{"level":"error","ts":"2025-07-25T05:00:20.212104549Z","logger":"operator-reconcile","msg":"failed to configure resource","object_name":"tempo-operator-deny-all","object_kind":"&TypeMeta{Kind:NetworkPolicy,APIVersion:networking.k8s.io/v1,}","error":"missing mutate implementation for resource type","stacktrace":"[github.com/grafana/tempo-operator/internal/controller/tempo.(*OperatorReconciler).Reconcile](https://github.com/grafana/tempo-operator/internal/controller/tempo.(*OperatorReconciler).Reconcile)\n\t/workspace/internal/controller/tempo/operator_controller.go:107\[ngithub.com/grafana/tempo-operator/cmd/start.addDependencies.func1](https://ngithub.com/grafana/tempo-operator/cmd/start.addDependencies.func1)\n\t/workspace/cmd/start/main.go:150\nsigs.k8s.io/controller-runtime/pkg/manager.RunnableFunc.Start\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/manager/manager.go:307\nsigs.k8s.io/controller-runtime/pkg/manager.(*runnableGroup).reconcile.func1\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/manager/runnable_group.go:226"}
{"level":"error","ts":"2025-07-25T05:00:20.212184257Z","logger":"operator-reconcile","msg":"failed to configure resource","object_name":"tempo-operator-ingress-to-metrics","object_kind":"&TypeMeta{Kind:NetworkPolicy,APIVersion:networking.k8s.io/v1,}","error":"missing mutate implementation for resource type","stacktrace":"[github.com/grafana/tempo-operator/internal/controller/tempo.(*OperatorReconciler).Reconcile](https://github.com/grafana/tempo-operator/internal/controller/tempo.(*OperatorReconciler).Reconcile)\n\t/workspace/internal/controller/tempo/operator_controller.go:107\[ngithub.com/grafana/tempo-operator/cmd/start.addDependencies.func1](https://ngithub.com/grafana/tempo-operator/cmd/start.addDependencies.func1)\n\t/workspace/cmd/start/main.go:150\nsigs.k8s.io/controller-runtime/pkg/manager.RunnableFunc.Start\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/manager/manager.go:307\nsigs.k8s.io/controller-runtime/pkg/manager.(*runnableGroup).reconcile.func1\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/manager/runnable_group.go:226"}
{"level":"error","ts":"2025-07-25T05:00:20.212221662Z","logger":"operator-reconcile","msg":"failed to configure resource","object_name":"tempo-operator-allow-dns","object_kind":"&TypeMeta{Kind:NetworkPolicy,APIVersion:networking.k8s.io/v1,}","error":"missing mutate implementation for resource type","stacktrace":"[github.com/grafana/tempo-operator/internal/controller/tempo.(*OperatorReconciler).Reconcile](https://github.com/grafana/tempo-operator/internal/controller/tempo.(*OperatorReconciler).Reconcile)\n\t/workspace/internal/controller/tempo/operator_controller.go:107\[ngithub.com/grafana/tempo-operator/cmd/start.addDependencies.func1](https://ngithub.com/grafana/tempo-operator/cmd/start.addDependencies.func1)\n\t/workspace/cmd/start/main.go:150\nsigs.k8s.io/controller-runtime/pkg/manager.RunnableFunc.Start\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/manager/manager.go:307\nsigs.k8s.io/controller-runtime/pkg/manager.(*runnableGroup).reconcile.func1\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/manager/runnable_group.go:226"}
{"level":"error","ts":"2025-07-25T05:00:20.212240731Z","logger":"operator-reconcile","msg":"failed to configure resource","object_name":"tempo-operator-egress-to-apiserver","object_kind":"&TypeMeta{Kind:NetworkPolicy,APIVersion:networking.k8s.io/v1,}","error":"missing mutate implementation for resource type","stacktrace":"[github.com/grafana/tempo-operator/internal/controller/tempo.(*OperatorReconciler).Reconcile](https://github.com/grafana/tempo-operator/internal/controller/tempo.(*OperatorReconciler).Reconcile)\n\t/workspace/internal/controller/tempo/operator_controller.go:107\[ngithub.com/grafana/tempo-operator/cmd/start.addDependencies.func1](https://ngithub.com/grafana/tempo-operator/cmd/start.addDependencies.func1)\n\t/workspace/cmd/start/main.go:150\nsigs.k8s.io/controller-runtime/pkg/manager.RunnableFunc.Start\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/manager/manager.go:307\nsigs.k8s.io/controller-runtime/pkg/manager.(*runnableGroup).reconcile.func1\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/manager/runnable_group.go:226"}
{"level":"error","ts":"2025-07-25T05:00:20.212259814Z","logger":"operator-reconcile","msg":"failed to configure resource","object_name":"tempo-operator-ingress-webhook","object_kind":"&TypeMeta{Kind:NetworkPolicy,APIVersion:networking.k8s.io/v1,}","error":"missing mutate implementation for resource type","stacktrace":"[github.com/grafana/tempo-operator/internal/controller/tempo.(*OperatorReconciler).Reconcile](https://github.com/grafana/tempo-operator/internal/controller/tempo.(*OperatorReconciler).Reconcile)\n\t/workspace/internal/controller/tempo/operator_controller.go:107\[ngithub.com/grafana/tempo-operator/cmd/start.addDependencies.func1](https://ngithub.com/grafana/tempo-operator/cmd/start.addDependencies.func1)\n\t/workspace/cmd/start/main.go:150\nsigs.k8s.io/controller-runtime/pkg/manager.RunnableFunc.Start\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/manager/manager.go:307\nsigs.k8s.io/controller-runtime/pkg/manager.(*runnableGroup).reconcile.func1\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/manager/runnable_group.go:226"}
{"level":"error","ts":"2025-07-25T05:00:20.231621265Z","logger":"operator-reconcile","msg":"cannot reconcile operator","error":"failed to create objects for operator: missing mutate implementation for resource type\nmissing mutate implementation for resource type\nmissing mutate implementation for resource type\nmissing mutate implementation for resource type\nmissing mutate implementation for resource type","stacktrace":"[github.com/grafana/tempo-operator/cmd/start.addDependencies.func1](https://github.com/grafana/tempo-operator/cmd/start.addDependencies.func1)\n\t/workspace/cmd/start/main.go:152\nsigs.k8s.io/controller-runtime/pkg/manager.RunnableFunc.Start\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/manager/manager.go:307\nsigs.k8s.io/controller-runtime/pkg/manager.(*runnableGroup).reconcile.func1\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/manager/runnable_group.go:226"} |
frzifus
force-pushed
the
networking_operator
branch
from
d32a3c8 to
dcd7f9d
Compare
|
Thanks @IshwarKanse . Should be fixed with: d093516 |
|
The controller pod is crashing after the latest changes. |
|
mh.. Just in idle? |
mh.. Seems there are only 3 ns on that cluster. |
Only limit the reconcilation on OpenShift Signed-off-by: Benedikt Bongartz <bongartz@klimlive.de>
Signed-off-by: Benedikt Bongartz <bongartz@klimlive.de>
Signed-off-by: Benedikt Bongartz <bongartz@klimlive.de>
Signed-off-by: Benedikt Bongartz <bongartz@klimlive.de>
frzifus
force-pushed
the
networking_operator
branch
from
dcd7f9d to
567e366
Compare
All tests passed, for the networking one, since I installed the operator in openshift-tempo-operator, the assert was failing but after fixing the namespace in the assert that test passed as well. You can modify the test to find the Tempo Operator namepace during runtime and use it for assert, for example: |
|
Awesome! I will do, thanks! |
Signed-off-by: Benedikt Bongartz <bongartz@klimlive.de>
frzifus
force-pushed
the
networking_operator
branch
from
dd3b76d to
a518750
Compare
pavolloffay
reviewed
Jul 29, 2025
| - namespaceSelector: {} | ||
| podSelector: {} | ||
| ports: | ||
| - port: metrics |
There was a problem hiding this comment.
I have realized that if port name is used instead of a number ingress access to all ports is allowed.
There was a problem hiding this comment.
Is this documented somewhere? 
There was a problem hiding this comment.
I couldn't find it, but I didn't find examples of using port names.
There was a problem hiding this comment.
I would report a bug if its not working:
// NetworkPolicyPort describes a port to allow traffic on
type NetworkPolicyPort struct {
...
// port represents the port on the given protocol. This can either be a numerical or named
// port on a pod. If this field is not provided, this matches all port names and
// numbers.
// If present, only traffic on the specified protocol AND port will be matched.
// +optional
Port *intstr.IntOrString `json:"port,omitempty" protobuf:"bytes,2,opt,name=port"`There was a problem hiding this comment.
@pavolloffay when I remove the webhook policy, allowing incoming traffic on port 9443 and maintain the %s-ingress-to-metrics policy using the port named metrics I am unable to access 9443.
$ oc version
Client Version: 4.17.1
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: 4.19.4
Kubernetes Version: v1.32.6
pavolloffay
reviewed
Jul 29, 2025
| isOpenShift := featureGates.OpenShift.ServingCertsService | ||
|
|
||
| if featureGates.NetworkPolicies && (!isOpenShift || discovered.AtLeast(minimum)) { | ||
| manifests = append(manifests, networking.GenerateOperatorPolicies(namespace)...) |
There was a problem hiding this comment.
are the NP created when no CR is in the cluster?
There was a problem hiding this comment.
They are created when featureGates.NetworkPolicies is set to true and its not OpenShift or the minimum k8s version requierement is met.
(While I think the version reuqierement was a misunderstanding and I will remove it in a followup pr)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.