NO-JIRA: Fix NetworkPolicy for openshift-capi-operator namespace #454
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@miyadav: This pull request explicitly references no jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci
bot
added
the
do-not-merge/hold
📝 WalkthroughWalkthroughAdds three Kubernetes NetworkPolicy manifests: an egress-allow for capi-operator, ingress rules permitting metrics on ports 8443 (and 8442 for migration) for operator/controller pods, and default-deny policies applied separately to openshift-cluster-api-operator and openshift-cluster-api namespaces. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Comment |
|
/test e2e-aws-capi-techpreview |
|
@miyadav: This pull request explicitly references no jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
bot
removed
the
do-not-merge/hold
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Added annotations to the NetworkPolicy metadata for OpenShift.
|
/test e2e-aws-capi-techpreview |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@manifests/0000_30_cluster-api_14_allow-egress-capi-operators.yaml`:
- Around line 1-27: The YAML manifest for the NetworkPolicy is malformed due to
incorrect indentation under the metadata and spec blocks; move annotations, name
and namespace to be direct children of metadata (annotations: and
name:/namespace: as siblings), and normalize the spec block indentation so spec:
contains podSelector (with matchLabels: k8s-app: capi-operator), policyTypes: -
Egress, and egress: - {} as children at the same indentation level; ensure all
mapping keys (metadata, annotations, name, namespace, spec, podSelector,
matchLabels, policyTypes, egress) are properly aligned so the parser can read
the NetworkPolicy resource named allow-egress-capi-operator in namespace
openshift-cluster-api-operator.
| apiVersion: networking.k8s.io/v1 | ||
| kind: NetworkPolicy | ||
| metadata: | ||
| annotations: | ||
| exclude.release.openshift.io/internal-openshift-hosted: "true" | ||
| include.release.openshift.io/self-managed-high-availability: "true" | ||
| include.release.openshift.io/single-node-developer: "true" | ||
| release.openshift.io/feature-set: CustomNoUpgrade,TechPreviewNoUpgrade | ||
| name: allow-egress-capi-operator | ||
| namespace: openshift-cluster-api-operator | ||
| spec: | ||
| # Select pods with the label k8s-app=capi-operator | ||
| # This policy will apply only to pods matching these labels | ||
| podSelector: | ||
| matchLabels: | ||
| k8s-app: capi-operator | ||
|
|
||
| # Define that this policy controls egress (outbound) traffic | ||
| # Without this, the policy would also deny all egress by default | ||
| policyTypes: | ||
| - Egress | ||
|
|
||
| # Egress rules - define what outbound traffic is allowed | ||
| egress: | ||
| - {} # Empty rule allows ALL egress traffic to any destination | ||
| # This permits the capi-operator pods to make outbound connections | ||
| # to any IP address on any port and protocol |
There was a problem hiding this comment.
Critical: YAML syntax error due to incorrect indentation.
The manifest has malformed YAML structure that will fail to parse:
annotations:(line 4) must be indented undermetadata:name:andnamespace:(lines 9-10) must be siblings ofannotations:undermetadata:, not children of annotations- The
spec:contents also have inconsistent indentation
The static analyzer confirms: "mapping values are not allowed here" at line 9.
🐛 Proposed fix for YAML indentation
- apiVersion: networking.k8s.io/v1
- kind: NetworkPolicy
- metadata:
- annotations:
- exclude.release.openshift.io/internal-openshift-hosted: "true"
- include.release.openshift.io/self-managed-high-availability: "true"
- include.release.openshift.io/single-node-developer: "true"
- release.openshift.io/feature-set: CustomNoUpgrade,TechPreviewNoUpgrade
- name: allow-egress-capi-operator
- namespace: openshift-cluster-api-operator
- spec:
- # Select pods with the label k8s-app=capi-operator
- # This policy will apply only to pods matching these labels
- podSelector:
- matchLabels:
- k8s-app: capi-operator
-
- # Define that this policy controls egress (outbound) traffic
- # Without this, the policy would also deny all egress by default
- policyTypes:
- - Egress
-
- # Egress rules - define what outbound traffic is allowed
- egress:
- - {} # Empty rule allows ALL egress traffic to any destination
- # This permits the capi-operator pods to make outbound connections
- # to any IP address on any port and protocol
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+ annotations:
+ exclude.release.openshift.io/internal-openshift-hosted: "true"
+ include.release.openshift.io/self-managed-high-availability: "true"
+ include.release.openshift.io/single-node-developer: "true"
+ release.openshift.io/feature-set: CustomNoUpgrade,TechPreviewNoUpgrade
+ name: allow-egress-capi-operator
+ namespace: openshift-cluster-api-operator
+spec:
+ # Select pods with the label k8s-app=capi-operator
+ # This policy will apply only to pods matching these labels
+ podSelector:
+ matchLabels:
+ k8s-app: capi-operator
+ # Define that this policy controls egress (outbound) traffic
+ # Without this, the policy would also deny all egress by default
+ policyTypes:
+ - Egress
+ # Egress rules - define what outbound traffic is allowed
+ egress:
+ - {} # Empty rule allows ALL egress traffic to any destination
+ # This permits the capi-operator pods to make outbound connections
+ # to any IP address on any port and protocol🧰 Tools
🪛 YAMLlint (1.38.0)
[error] 9-9: syntax error: mapping values are not allowed here
(syntax)
🤖 Prompt for AI Agents
In `@manifests/0000_30_cluster-api_14_allow-egress-capi-operators.yaml` around
lines 1 - 27, The YAML manifest for the NetworkPolicy is malformed due to
incorrect indentation under the metadata and spec blocks; move annotations, name
and namespace to be direct children of metadata (annotations: and
name:/namespace: as siblings), and normalize the spec block indentation so spec:
contains podSelector (with matchLabels: k8s-app: capi-operator), policyTypes: -
Egress, and egress: - {} as children at the same indentation level; ensure all
mapping keys (metadata, annotations, name, namespace, spec, podSelector,
matchLabels, policyTypes, egress) are properly aligned so the parser can read
the NetworkPolicy resource named allow-egress-capi-operator in namespace
openshift-cluster-api-operator.
|
/close since already been worked on ( duplicate ) |
2 participants
/hold
Summary by CodeRabbit