CNTRLPLANE-2663: Add network policies

[dusk125]

This PR adds network policies for the etcd-operator

Summary by CodeRabbit

• Chores
  • Added network security policies to enforce network access controls for cluster components.

[openshift-ci-robot]

@dusk125: This pull request references CNTRLPLANE-2663 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 6f088cd3-89d2-42b6-a356-88d6bb01034c

📥 Commits

Reviewing files that changed from the base of the PR and between 72a6e5f and e1e006f.

📒 Files selected for processing (1)

• manifests/0000_20_etcd-operator_11_networkpolicies.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• manifests/0000_20_etcd-operator_11_networkpolicies.yaml

---

Walkthrough

Adds six NetworkPolicy resources in the openshift-etcd-operator namespace: a default-deny baseline plus policies permitting egress to DNS, the API server, etcd, monitoring, and an ingress rule for metrics exposure.

Changes

Cohort / File(s)

Summary

Network Policies manifests/0000_20_etcd-operator_11_networkpolicies.yaml

Adds six networking.k8s.io/v1 NetworkPolicy manifests in openshift-etcd-operator: default-deny (podSelector: {}, policyTypes: Ingress,Egress), allow-to-dns (egress to openshift-dns DNS pods ports 53 & 5353 TCP/UDP), allow-to-apiserver (egress allowing API server access), allow-to-metrics (ingress from host-network policy-group to pods app=etcd-operator on port 8443), allow-to-etcd (egress from app=etcd-operator to etcd ports 2379, 9978–9980), and allow-to-monitoring (egress to openshift-monitoring port 9091).

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'CNTRLPLANE-2663: Add network policies' accurately and directly describes the main change in the pull request: adding network policies to the etcd-operator, which matches the addition of six Kubernetes NetworkPolicy resources to the manifests file.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Stable And Deterministic Test Names	✅ Passed	Custom check for stable test names is not applicable; PR only modifies Kubernetes NetworkPolicy manifests without changing any test code.
Test Structure And Quality	✅ Passed	PR adds only Kubernetes NetworkPolicy manifests without any test code; check is out of scope.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dusk125

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [dusk125]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[dusk125]

/retest-required

[openshift-ci-robot]

@dusk125: This pull request references CNTRLPLANE-2663 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

This PR adds network policies for the etcd-operator

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[dusk125]

/label tide/merge-method-squash

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@manifests/0000_20_etcd-operator_11_networkpolicies.yaml`:
- Around line 1-38: The NetworkPolicy named "allow-to-dns" currently sets
spec.policyTypes to only Egress so ingress default-deny is not enforced; either
add "Ingress" to spec.policyTypes and add an empty spec.ingress: [] to enable
default-deny ingress for the selected pods (keep podSelector: {} to apply to all
pods), or update the top comment to remove the claim that default-deny for
ingress is automatically enabled and clearly state that only egress is
restricted by this policy; modify either spec.policyTypes (and add spec.ingress)
or the comment accordingly to make the behavior and documentation consistent.

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@manifests/0000_20_etcd-operator_11_networkpolicies.yaml`:
- Around line 78-83: The allow-to-apiserver NetworkPolicy egress rule for port
6443 currently lacks a destination restriction; update the allow-to-apiserver
policy's egress entry (egress -> ports -> protocol: TCP port: 6443) to include a
corresponding "to" clause that limits destinations—either add an ipBlock with
the API server CIDR (ipBlock: cidr: <API_SERVER_CIDR>) or a `to` selector that
targets the API server workload (e.g., namespaceSelector matching the
openshift-kube-apiserver namespace and/or a podSelector matching the API server
pods/service), ensuring only the intended API server endpoint(s) can be reached.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# First, let's examine the specific NetworkPolicy file to understand the full context
echo "=== Full NetworkPolicy file context ===" 
cat -n manifests/0000_20_etcd-operator_11_networkpolicies.yaml

echo -e "\n=== Searching for other port 6443 usages in YAML files ==="
rg -l 'port:\s*6443' --type yaml 2>/dev/null || echo "No other files found with port 6443"

echo -e "\n=== Checking for NetworkPolicy files in the manifest ==="
fd -e yaml -e yml manifests | grep -i network | head -20

Repository: openshift/cluster-etcd-operator

Length of output: 7655

---

Egress to port 6443 lacks destination restrictions and applies to all pods.

The allow-to-apiserver policy applies to all pods (podSelector: {}), and its egress rule permits traffic to port 6443 without a to selector—allowing any destination. While API server access is necessary, other policies in this same file (allow-to-dns, allow-to-monitoring) successfully restrict egress destinations. Consider restricting this rule to the API server endpoint via ipBlock (for the API server CIDR) or a to selector targeting the openshift-kube-apiserver namespace. This reduces the attack surface for pods that may not actually need API access.

🤖 Prompt for AI Agents

In `@manifests/0000_20_etcd-operator_11_networkpolicies.yaml` around lines 78 -
83, The allow-to-apiserver NetworkPolicy egress rule for port 6443 currently
lacks a destination restriction; update the allow-to-apiserver policy's egress
entry (egress -> ports -> protocol: TCP port: 6443) to include a corresponding
"to" clause that limits destinations—either add an ipBlock with the API server
CIDR (ipBlock: cidr: <API_SERVER_CIDR>) or a `to` selector that targets the API
server workload (e.g., namespaceSelector matching the openshift-kube-apiserver
namespace and/or a podSelector matching the API server pods/service), ensuring
only the intended API server endpoint(s) can be reached.

[openshift-ci-robot]

@dusk125: This pull request references CNTRLPLANE-2663 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

This PR adds network policies for the etcd-operator

Summary by CodeRabbit

• Chores
• Added network security policies to enforce network access controls for cluster components.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@dusk125: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-agnostic-ovn-upgrade	e1e006f	link	true	/test e2e-agnostic-ovn-upgrade

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.