Skip to content

Commit b3004b4

Browse files
leandroberettaleandroberetta
authored
Merge branch 'main' into netobserv-584
2 parents d662dc2 + 6b872b1 commit b3004b4

File tree

11 files changed

+81
-20
lines changed

11 files changed

+81
-20
lines changed

‎api/flowcollector/v1beta2/flowcollector_types.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -86,16 +86,16 @@ type FlowCollectorSpec struct {
8686
// +k8s:conversion-gen=false
8787
Exporters []*FlowCollectorExporter `json:"exporters"`
8888

89-
// `networkPolicy` defines ingress network policy settings for NetObserv components isolation.
89+
// `networkPolicy` defines network policy settings for NetObserv components isolation.
9090
// +k8s:conversion-gen=false
9191
NetworkPolicy NetworkPolicy `json:"networkPolicy,omitempty"`
9292
}
9393

9494
type NetworkPolicy struct {
9595
// Set `enable` to `true` to deploy network policies on the namespaces used by NetObserv (main and privileged). It is disabled by default.
9696
// These network policies better isolate the NetObserv components to prevent undesired connections to them.
97-
// To increase the security of connections, enable this option or create your own network policy.
98-
// +optional
97+
// This option is enabled by default, disable it to manually manage network policies
98+
// +kubebuilder:default:=true
9999
Enable *bool `json:"enable,omitempty"`
100100

101101
// `additionalNamespaces` contains additional namespaces allowed to connect to the NetObserv namespace.

‎bundle/manifests/flows.netobserv.io_flowcollectors.yaml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4284,8 +4284,8 @@ spec:
42844284
and recreate the resource.
42854285
rule: self == oldSelf
42864286
networkPolicy:
4287-
description: '`networkPolicy` defines ingress network policy settings
4288-
for NetObserv components isolation.'
4287+
description: '`networkPolicy` defines network policy settings for
4288+
NetObserv components isolation.'
42894289
properties:
42904290
additionalNamespaces:
42914291
description: |-
@@ -4296,10 +4296,11 @@ spec:
42964296
type: string
42974297
type: array
42984298
enable:
4299+
default: true
42994300
description: |-
43004301
Set `enable` to `true` to deploy network policies on the namespaces used by NetObserv (main and privileged). It is disabled by default.
43014302
These network policies better isolate the NetObserv components to prevent undesired connections to them.
4302-
To increase the security of connections, enable this option or create your own network policy.
4303+
This option is enabled by default, disable it to manually manage network policies
43034304
type: boolean
43044305
type: object
43054306
processor:

‎bundle/manifests/netobserv-operator.clusterserviceversion.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -214,7 +214,7 @@ metadata:
214214
"namespace": "netobserv",
215215
"networkPolicy": {
216216
"additionalNamespaces": [],
217-
"enable": false
217+
"enable": true
218218
},
219219
"processor": {
220220
"imagePullPolicy": "IfNotPresent",
@@ -254,7 +254,7 @@ metadata:
254254
categories: Monitoring, Networking, Observability
255255
console.openshift.io/plugins: '["netobserv-plugin"]'
256256
containerImage: quay.io/netobserv/network-observability-operator:1.9.2-community
257-
createdAt: "2025-09-23T01:25:21Z"
257+
createdAt: "2025-09-18T08:50:21Z"
258258
description: Network flows collector and monitoring solution
259259
operatorframework.io/initialization-resource: '{"apiVersion":"flows.netobserv.io/v1beta2",
260260
"kind":"FlowCollector","metadata":{"name":"cluster"},"spec": {}}'

‎config/crd/bases/flows.netobserv.io_flowcollectors.yaml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3931,7 +3931,7 @@ spec:
39313931
- message: Namespace is immutable. If you need to change it, delete and recreate the resource.
39323932
rule: self == oldSelf
39333933
networkPolicy:
3934-
description: '`networkPolicy` defines ingress network policy settings for NetObserv components isolation.'
3934+
description: '`networkPolicy` defines network policy settings for NetObserv components isolation.'
39353935
properties:
39363936
additionalNamespaces:
39373937
description: |-
@@ -3942,10 +3942,11 @@ spec:
39423942
type: string
39433943
type: array
39443944
enable:
3945+
default: true
39453946
description: |-
39463947
Set `enable` to `true` to deploy network policies on the namespaces used by NetObserv (main and privileged). It is disabled by default.
39473948
These network policies better isolate the NetObserv components to prevent undesired connections to them.
3948-
To increase the security of connections, enable this option or create your own network policy.
3949+
This option is enabled by default, disable it to manually manage network policies
39493950
type: boolean
39503951
type: object
39513952
processor:

‎config/samples/flows_v1beta2_flowcollector.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ spec:
66
namespace: netobserv
77
deploymentModel: Direct
88
networkPolicy:
9-
enable: false
9+
enable: true
1010
additionalNamespaces: []
1111
agent:
1212
type: eBPF

‎docs/FlowCollector.md‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -154,7 +154,7 @@ Kafka can provide better scalability, resiliency, and high availability (for mor
154154
<td><b><a href="#flowcollectorspecnetworkpolicy">networkPolicy</a></b></td>
155155
<td>object</td>
156156
<td>
157-
`networkPolicy` defines ingress network policy settings for NetObserv components isolation.<br/>
157+
`networkPolicy` defines network policy settings for NetObserv components isolation.<br/>
158158
</td>
159159
<td>false</td>
160160
</tr><tr>
@@ -8406,7 +8406,7 @@ If the namespace is different, the config map or the secret is copied so that it
84068406

84078407

84088408

8409-
`networkPolicy` defines ingress network policy settings for NetObserv components isolation.
8409+
`networkPolicy` defines network policy settings for NetObserv components isolation.
84108410

84118411
<table>
84128412
<thead>
@@ -8432,7 +8432,9 @@ configuration, you can disable it and install your own instead.<br/>
84328432
<td>
84338433
Set `enable` to `true` to deploy network policies on the namespaces used by NetObserv (main and privileged). It is disabled by default.
84348434
These network policies better isolate the NetObserv components to prevent undesired connections to them.
8435-
To increase the security of connections, enable this option or create your own network policy.<br/>
8435+
This option is enabled by default, disable it to manually manage network policies<br/>
8436+
<br/>
8437+
<i>Default</i>: true<br/>
84368438
</td>
84378439
<td>false</td>
84388440
</tr></tbody>

‎helm/crds/flows.netobserv.io_flowcollectors.yaml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3935,7 +3935,7 @@ spec:
39353935
- message: Namespace is immutable. If you need to change it, delete and recreate the resource.
39363936
rule: self == oldSelf
39373937
networkPolicy:
3938-
description: '`networkPolicy` defines ingress network policy settings for NetObserv components isolation.'
3938+
description: '`networkPolicy` defines network policy settings for NetObserv components isolation.'
39393939
properties:
39403940
additionalNamespaces:
39413941
description: |-
@@ -3946,10 +3946,11 @@ spec:
39463946
type: string
39473947
type: array
39483948
enable:
3949+
default: true
39493950
description: |-
39503951
Set `enable` to `true` to deploy network policies on the namespaces used by NetObserv (main and privileged). It is disabled by default.
39513952
These network policies better isolate the NetObserv components to prevent undesired connections to them.
3952-
To increase the security of connections, enable this option or create your own network policy.
3953+
This option is enabled by default, disable it to manually manage network policies
39533954
type: boolean
39543955
type: object
39553956
processor:

‎internal/controller/flowcollector_controller_iso_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -218,7 +218,7 @@ func flowCollectorIsoSpecs() {
218218
},
219219
Exporters: []*flowslatest.FlowCollectorExporter{},
220220
NetworkPolicy: flowslatest.NetworkPolicy{
221-
Enable: nil,
221+
Enable: ptr.To(true),
222222
AdditionalNamespaces: []string{},
223223
},
224224
}

‎internal/controller/networkpolicy/np_objects.go‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ func buildMainNetworkPolicy(desired *flowslatest.FlowCollector, mgr *manager.Man
2727
ns := desired.Spec.GetNamespace()
2828

2929
name := types.NamespacedName{Name: netpolName, Namespace: ns}
30-
if desired.Spec.NetworkPolicy.Enable == nil || !*desired.Spec.NetworkPolicy.Enable {
30+
if !helper.DeployNetworkPolicy(&desired.Spec) {
3131
return name, nil
3232
}
3333

@@ -191,7 +191,7 @@ func buildPrivilegedNetworkPolicy(desired *flowslatest.FlowCollector, mgr *manag
191191
privNs := mainNs + constants.EBPFPrivilegedNSSuffix
192192

193193
name := types.NamespacedName{Name: netpolName, Namespace: privNs}
194-
if desired.Spec.NetworkPolicy.Enable == nil || !*desired.Spec.NetworkPolicy.Enable {
194+
if !helper.DeployNetworkPolicy(&desired.Spec) {
195195
return name, nil
196196
}
197197

@@ -245,5 +245,19 @@ func buildPrivilegedNetworkPolicy(desired *flowslatest.FlowCollector, mgr *manag
245245
}
246246
}
247247

248+
for _, aNs := range desired.Spec.NetworkPolicy.AdditionalNamespaces {
249+
np.Spec.Ingress = append(np.Spec.Ingress, networkingv1.NetworkPolicyIngressRule{
250+
From: []networkingv1.NetworkPolicyPeer{
251+
peerInNamespace(aNs),
252+
},
253+
})
254+
np.Spec.Egress = append(np.Spec.Egress, networkingv1.NetworkPolicyEgressRule{
255+
To: []networkingv1.NetworkPolicyPeer{
256+
peerInNamespace(aNs),
257+
},
258+
})
259+
260+
}
261+
248262
return name, &np
249263
}

‎internal/controller/networkpolicy/np_test.go‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -189,5 +189,19 @@ func TestNpBuilder(t *testing.T) {
189189
assert.NotNil(np)
190190
assert.Equal(np.ObjectMeta.Name, name.Name)
191191
assert.Equal(np.ObjectMeta.Namespace, name.Namespace)
192-
assert.Equal([]networkingv1.NetworkPolicyIngressRule{}, np.Spec.Ingress)
192+
assert.Equal([]networkingv1.NetworkPolicyIngressRule{
193+
{From: []networkingv1.NetworkPolicyPeer{
194+
{NamespaceSelector: &metav1.LabelSelector{
195+
MatchLabels: map[string]string{
196+
"kubernetes.io/metadata.name": "foo",
197+
},
198+
}},
199+
}},
200+
{From: []networkingv1.NetworkPolicyPeer{
201+
{NamespaceSelector: &metav1.LabelSelector{
202+
MatchLabels: map[string]string{
203+
"kubernetes.io/metadata.name": "bar",
204+
},
205+
}},
206+
}}}, np.Spec.Ingress)
193207
}

0 commit comments

Comments
 (0)