From ad47675b6a72a7152695076f00900b434855d02d Mon Sep 17 00:00:00 2001 From: Jim Fitzpatrick Date: Wed, 2 Sep 2026 09:44:01 +0100 Subject: [PATCH] ADD: blocking network policy This adds the defualt blocking network policy to the operators namespace. Which in turns blocks all ingress to the pods within the namespace. Signed-off-by: Jim Fitzpatrick --- Makefile | 2 +- bundle.Dockerfile | 2 +- ...deny-all_networking.k8s.io_v1_networkpolicy.yaml | 10 ++++++++++ .../kuadrant-operator.clusterserviceversion.yaml | 4 ++-- bundle/metadata/annotations.yaml | 2 +- charts/kuadrant-operator/templates/manifests.yaml | 13 +++++++++++++ config/default/deny-all.yaml | 8 ++++++++ config/default/kustomization.yaml | 1 + 8 files changed, 37 insertions(+), 5 deletions(-) create mode 100644 bundle/manifests/kuadrant-operator-default-deny-all_networking.k8s.io_v1_networkpolicy.yaml create mode 100644 config/default/deny-all.yaml diff --git a/Makefile b/Makefile index 424e321e7..2ce666e0c 100644 --- a/Makefile +++ b/Makefile @@ -262,7 +262,7 @@ GOLANGCI_LINT ?= $(LOCALBIN)/golangci-lint RATCHET ?= $(LOCALBIN)/ratchet ## Tool Versions -OPERATOR_SDK_VERSION ?= v1.33.0 +OPERATOR_SDK_VERSION ?= v1.42.3 CONTROLLER_GEN_VERSION ?= v0.19.0 KUSTOMIZE_VERSION ?= v4.5.5 YQ_VERSION ?= v4.34.2 diff --git a/bundle.Dockerfile b/bundle.Dockerfile index b745dfc76..bcff548a5 100644 --- a/bundle.Dockerfile +++ b/bundle.Dockerfile @@ -7,7 +7,7 @@ LABEL operators.operatorframework.io.bundle.metadata.v1=metadata/ LABEL operators.operatorframework.io.bundle.package.v1=kuadrant-operator LABEL operators.operatorframework.io.bundle.channels.v1=alpha LABEL operators.operatorframework.io.bundle.channel.default.v1=alpha -LABEL operators.operatorframework.io.metrics.builder=operator-sdk-v1.33.0 +LABEL operators.operatorframework.io.metrics.builder=operator-sdk-v1.42.3 LABEL operators.operatorframework.io.metrics.mediatype.v1=metrics+v1 LABEL operators.operatorframework.io.metrics.project_layout=go.kubebuilder.io/v4 diff --git a/bundle/manifests/kuadrant-operator-default-deny-all_networking.k8s.io_v1_networkpolicy.yaml b/bundle/manifests/kuadrant-operator-default-deny-all_networking.k8s.io_v1_networkpolicy.yaml new file mode 100644 index 000000000..86e6378da --- /dev/null +++ b/bundle/manifests/kuadrant-operator-default-deny-all_networking.k8s.io_v1_networkpolicy.yaml @@ -0,0 +1,10 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app: kuadrant + name: kuadrant-operator-default-deny-all +spec: + podSelector: {} + policyTypes: + - Ingress diff --git a/bundle/manifests/kuadrant-operator.clusterserviceversion.yaml b/bundle/manifests/kuadrant-operator.clusterserviceversion.yaml index b838aee26..c67cfa4c4 100644 --- a/bundle/manifests/kuadrant-operator.clusterserviceversion.yaml +++ b/bundle/manifests/kuadrant-operator.clusterserviceversion.yaml @@ -225,9 +225,9 @@ metadata: categories: Integration & Delivery console.openshift.io/plugins: '["kuadrant-console-plugin"]' containerImage: quay.io/kuadrant/kuadrant-operator:latest - createdAt: "2026-08-27T13:56:33Z" + createdAt: "2026-09-02T14:39:30Z" description: A Kubernetes Operator to manage the lifecycle of the Kuadrant system - operators.operatorframework.io/builder: operator-sdk-v1.33.0 + operators.operatorframework.io/builder: operator-sdk-v1.42.3 operators.operatorframework.io/project_layout: go.kubebuilder.io/v4 repository: https://github.com/Kuadrant/kuadrant-operator support: kuadrant diff --git a/bundle/metadata/annotations.yaml b/bundle/metadata/annotations.yaml index 6acf54be3..4d6a70b87 100644 --- a/bundle/metadata/annotations.yaml +++ b/bundle/metadata/annotations.yaml @@ -6,7 +6,7 @@ annotations: operators.operatorframework.io.bundle.package.v1: kuadrant-operator operators.operatorframework.io.bundle.channels.v1: alpha operators.operatorframework.io.bundle.channel.default.v1: alpha - operators.operatorframework.io.metrics.builder: operator-sdk-v1.33.0 + operators.operatorframework.io.metrics.builder: operator-sdk-v1.42.3 operators.operatorframework.io.metrics.mediatype.v1: metrics+v1 operators.operatorframework.io.metrics.project_layout: go.kubebuilder.io/v4 # Annotations for testing. diff --git a/charts/kuadrant-operator/templates/manifests.yaml b/charts/kuadrant-operator/templates/manifests.yaml index 73d566fd6..41d72779e 100644 --- a/charts/kuadrant-operator/templates/manifests.yaml +++ b/charts/kuadrant-operator/templates/manifests.yaml @@ -15137,3 +15137,16 @@ spec: runAsNonRoot: true serviceAccountName: kuadrant-operator-controller-manager terminationGracePeriodSeconds: 10 +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app: kuadrant + app.kubernetes.io/managed-by: helm + name: kuadrant-operator-default-deny-all + namespace: '{{ .Release.Namespace }}' +spec: + podSelector: {} + policyTypes: + - Ingress diff --git a/config/default/deny-all.yaml b/config/default/deny-all.yaml new file mode 100644 index 000000000..3d537b3f0 --- /dev/null +++ b/config/default/deny-all.yaml @@ -0,0 +1,8 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: default-deny-all +spec: + podSelector: {} + policyTypes: + - Ingress diff --git a/config/default/kustomization.yaml b/config/default/kustomization.yaml index d6f4d36f2..16a639ff5 100644 --- a/config/default/kustomization.yaml +++ b/config/default/kustomization.yaml @@ -44,3 +44,4 @@ resources: - ../crd - ../rbac - ../manager +- deny-all.yaml