Add NetworkPolicy reconciler for Authorino and Limitador operands

api/v1beta1/topology.go

@@ -7,6 +7,7 @@ import (
 	"github.com/kuadrant/policy-machinery/machinery"
 	"github.com/samber/lo"
 	appsv1 "k8s.io/api/apps/v1"
+	networkingv1 "k8s.io/api/networking/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	gatewayapiv1 "sigs.k8s.io/gateway-api/apis/v1"
@@ -25,6 +26,9 @@ var (
 
 	DeploymentGroupKind = appsv1.SchemeGroupVersion.WithKind("Deployment").GroupKind()
 	DeploymentsResource = appsv1.SchemeGroupVersion.WithResource("deployments")
+
+	NetworkPolicyGroupKind = schema.GroupKind{Group: networkingv1.SchemeGroupVersion.Group, Kind: "NetworkPolicy"}
+	NetworkPolicyResource  = networkingv1.SchemeGroupVersion.WithResource("networkpolicies")
 )
 
 func LinkKuadrantToGatewayClasses(objs controller.Store) machinery.LinkFunc {
@@ -71,6 +75,21 @@ func LinkKuadrantToAuthorino(objs controller.Store) machinery.LinkFunc {
 	}
 }
 
+func LinkAuthorinoToDeployment(objs controller.Store) machinery.LinkFunc {
+	authorinos := utils.Map(objs.FilterByGroupKind(AuthorinoGroupKind), ControllerObjectToMachineryObject)
+
+	return machinery.LinkFunc{
+		From: AuthorinoGroupKind,
+		To:   DeploymentGroupKind,
+		Func: func(deployment machinery.Object) []machinery.Object {
+			return lo.Filter(authorinos, func(authorino machinery.Object, _ int) bool {
+				// the name of the deployment is hardcoded. This deployment is owned by the authorino operator.
+				return authorino.GetNamespace() == deployment.GetNamespace() && deployment.GetName() == "authorino"
+			})
+		},
+	}
+}
+
 func LinkLimitadorToDeployment(objs controller.Store) machinery.LinkFunc {
 	limitadors := utils.Map(objs.FilterByGroupKind(LimitadorGroupKind), ControllerObjectToMachineryObject)
 
@@ -126,6 +145,34 @@ func LinkKuadrantToPodMonitor(objs controller.Store) machinery.LinkFunc {
 	}
 }
 
+func LinkAuthorinoToNetworkPolicy(objs controller.Store) machinery.LinkFunc {
+	authorinos := utils.Map(objs.FilterByGroupKind(AuthorinoGroupKind), ControllerObjectToMachineryObject)
+
+	return machinery.LinkFunc{
+		From: AuthorinoGroupKind,
+		To:   NetworkPolicyGroupKind,
+		Func: func(networkPolicy machinery.Object) []machinery.Object {
+			return lo.Filter(authorinos, func(authorino machinery.Object, _ int) bool {
+				return authorino.GetNamespace() == networkPolicy.GetNamespace() && networkPolicy.GetName() == "kuadrant-authorino"
+			})
+		},
+	}
+}
+
+func LinkLimitadorToNetworkPolicy(objs controller.Store) machinery.LinkFunc {
+	limitadors := utils.Map(objs.FilterByGroupKind(LimitadorGroupKind), ControllerObjectToMachineryObject)
+
+	return machinery.LinkFunc{
+		From: LimitadorGroupKind,
+		To:   NetworkPolicyGroupKind,
+		Func: func(networkPolicy machinery.Object) []machinery.Object {
+			return lo.Filter(limitadors, func(limitador machinery.Object, _ int) bool {
+				return limitador.GetNamespace() == networkPolicy.GetNamespace() && networkPolicy.GetName() == "kuadrant-limitador"
+			})
+		},
+	}
+}
+
 func ControllerObjectToMachineryObject(cObj controller.Object) machinery.Object {
 	if mObj, ok := cObj.(machinery.Object); ok {
 		return mObj

bundle/manifests/kuadrant-operator.clusterserviceversion.yaml

@@ -225,7 +225,7 @@ metadata:
     categories: Integration & Delivery
     console.openshift.io/plugins: '["kuadrant-console-plugin"]'
     containerImage: quay.io/kuadrant/kuadrant-operator:latest
-    createdAt: "2026-08-27T13:56:33Z"
+    createdAt: "2026-09-01T08:36:51Z"
     description: A Kubernetes Operator to manage the lifecycle of the Kuadrant system
     operators.operatorframework.io/builder: operator-sdk-v1.33.0
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v4
@@ -744,6 +744,18 @@ spec:
           - patch
           - update
           - watch
+        - apiGroups:
+          - networking.k8s.io
+          resources:
+          - networkpolicies
+          verbs:
+          - create
+          - delete
+          - get
+          - list
+          - patch
+          - update
+          - watch
         - apiGroups:
           - operator.authorino.kuadrant.io
           resources:

charts/kuadrant-operator/templates/manifests.yaml

@@ -14816,6 +14816,18 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - networkpolicies
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - operator.authorino.kuadrant.io
   resources:

cmd/main.go

@@ -43,6 +43,7 @@ import (
 	istiosecurity "istio.io/client-go/pkg/apis/security/v1"
 
 	corev1 "k8s.io/api/core/v1"
+	networkingv1 "k8s.io/api/networking/v1"
 	apiextv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	k8sruntime "k8s.io/apimachinery/pkg/runtime"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
@@ -100,6 +101,7 @@ func init() {
 	utilruntime.Must(consolev1.AddToScheme(scheme))
 	utilruntime.Must(monitoringv1.AddToScheme(scheme))
 	utilruntime.Must(istiosecurity.AddToScheme(scheme))
+	utilruntime.Must(networkingv1.AddToScheme(scheme))
 	//+kubebuilder:scaffold:scheme
 
 	sync = zapcore.Lock(zapcore.AddSync(os.Stdout))

config/rbac/role.yaml

@@ -351,6 +351,18 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - networkpolicies
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - operator.authorino.kuadrant.io
   resources: