Task
Split out of #26, where a guessed default would have been worse than none.
Add an optional NetworkPolicy (disabled by default) for the operator pod. It needs a considered egress rule set:
- egress to the Kubernetes API server (the address varies by cluster, so this likely needs a configurable CIDR or an
ipBlock value rather than a hardcoded rule)
- egress to DNS in kube-system
- ingress only for the metrics port, and only when
metrics.service.enabled is true
Add helm-unittest coverage and document the values. Verify against the kind cluster used by the e2e tests that the operator still reconciles with the policy applied, since a NetworkPolicy that silently blocks the API server would look like the operator simply doing nothing.
Task
Split out of #26, where a guessed default would have been worse than none.
Add an optional NetworkPolicy (disabled by default) for the operator pod. It needs a considered egress rule set:
ipBlockvalue rather than a hardcoded rule)metrics.service.enabledis trueAdd helm-unittest coverage and document the values. Verify against the kind cluster used by the e2e tests that the operator still reconciles with the policy applied, since a NetworkPolicy that silently blocks the API server would look like the operator simply doing nothing.