Skip to content

Commit 8c53b7f

Browse files
perdasilvaPer Goncalves da Silva
perdasilva
and
Per Goncalves da Silva
authored
Adds kube-apiserver egress to config map catalog source network policy (#3582)
Signed-off-by: Per Goncalves da Silva <[email protected]> Co-authored-by: Per Goncalves da Silva <[email protected]>
1 parent b4ec5bd commit 8c53b7f

File tree

2 files changed

+116
-26
lines changed

2 files changed

+116
-26
lines changed

‎pkg/controller/operators/catalog/operator_test.go

Lines changed: 98 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -889,7 +889,6 @@ func TestSyncCatalogSourcesSecurityPolicy(t *testing.T) {
889889
ObjectMeta: metav1.ObjectMeta{
890890
Name: "cool-catalog",
891891
Namespace: "cool-namespace",
892-
UID: types.UID("catalog-uid"),
893892
},
894893
Spec: v1alpha1.CatalogSourceSpec{
895894
Image: "catalog-image",
@@ -908,7 +907,6 @@ func TestSyncCatalogSourcesSecurityPolicy(t *testing.T) {
908907
ObjectMeta: metav1.ObjectMeta{
909908
Name: "cool-catalog",
910909
Namespace: "cool-namespace",
911-
UID: types.UID("catalog-uid"),
912910
},
913911
Spec: v1alpha1.CatalogSourceSpec{
914912
Image: "catalog-image",
@@ -934,7 +932,6 @@ func TestSyncCatalogSourcesSecurityPolicy(t *testing.T) {
934932
ObjectMeta: metav1.ObjectMeta{
935933
Name: "cool-catalog",
936934
Namespace: "cool-namespace",
937-
UID: types.UID("catalog-uid"),
938935
},
939936
Spec: v1alpha1.CatalogSourceSpec{
940937
Image: "catalog-image",
@@ -953,7 +950,6 @@ func TestSyncCatalogSourcesSecurityPolicy(t *testing.T) {
953950
ObjectMeta: metav1.ObjectMeta{
954951
Name: "cool-catalog",
955952
Namespace: "cool-namespace",
956-
UID: types.UID("catalog-uid"),
957953
},
958954
Spec: v1alpha1.CatalogSourceSpec{
959955
Image: "catalog-image",
@@ -1006,23 +1002,32 @@ func TestSyncCatalogSources(t *testing.T) {
10061002
clockFake := utilclocktesting.NewFakeClock(time.Date(2018, time.January, 26, 20, 40, 0, 0, time.UTC))
10071003
now := metav1.NewTime(clockFake.Now())
10081004

1009-
configmapCatalog := &v1alpha1.CatalogSource{
1005+
internalCatalog := &v1alpha1.CatalogSource{
10101006
ObjectMeta: metav1.ObjectMeta{
10111007
Name: "cool-catalog",
10121008
Namespace: "cool-namespace",
1013-
UID: types.UID("catalog-uid"),
10141009
},
10151010
Spec: v1alpha1.CatalogSourceSpec{
10161011
ConfigMap: "cool-configmap",
10171012
SourceType: v1alpha1.SourceTypeInternal,
10181013
},
10191014
}
1015+
configMapCatalog := &v1alpha1.CatalogSource{
1016+
ObjectMeta: metav1.ObjectMeta{
1017+
Name: "cool-catalog",
1018+
Namespace: "cool-namespace",
1019+
},
1020+
Spec: v1alpha1.CatalogSourceSpec{
1021+
ConfigMap: "cool-configmap",
1022+
SourceType: v1alpha1.SourceTypeConfigmap,
1023+
},
1024+
}
10201025
grpcCatalog := &v1alpha1.CatalogSource{
10211026
ObjectMeta: metav1.ObjectMeta{
10221027
Name: "cool-catalog",
10231028
Namespace: "cool-namespace",
1024-
UID: types.UID("catalog-uid"),
1025-
Labels: map[string]string{"olm.catalogSource": "cool-catalog"},
1029+
1030+
Labels: map[string]string{"olm.catalogSource": "cool-catalog"},
10261031
},
10271032
Spec: v1alpha1.CatalogSourceSpec{
10281033
Image: "catalog-image",
@@ -1047,7 +1052,6 @@ func TestSyncCatalogSources(t *testing.T) {
10471052
ObjectMeta: metav1.ObjectMeta{
10481053
Name: "cool-catalog",
10491054
Namespace: "cool-namespace",
1050-
UID: types.UID("catalog-uid"),
10511055
},
10521056
Spec: v1alpha1.CatalogSourceSpec{
10531057
SourceType: "nope",
@@ -1061,13 +1065,12 @@ func TestSyncCatalogSources(t *testing.T) {
10611065
{
10621066
testName: "CatalogSourceWithBackingConfigMap",
10631067
namespace: "cool-namespace",
1064-
catalogSource: configmapCatalog,
1068+
catalogSource: internalCatalog,
10651069
k8sObjs: []runtime.Object{
10661070
&corev1.ConfigMap{
10671071
ObjectMeta: metav1.ObjectMeta{
10681072
Name: "cool-configmap",
10691073
Namespace: "cool-namespace",
1070-
UID: types.UID("configmap-uid"),
10711074
ResourceVersion: "resource-version",
10721075
},
10731076
Data: fakeConfigMapData(),
@@ -1077,7 +1080,6 @@ func TestSyncCatalogSources(t *testing.T) {
10771080
ConfigMapResource: &v1alpha1.ConfigMapResourceReference{
10781081
Name: "cool-configmap",
10791082
Namespace: "cool-namespace",
1080-
UID: types.UID("configmap-uid"),
10811083
ResourceVersion: "resource-version",
10821084
LastUpdateTime: now,
10831085
},
@@ -1092,7 +1094,6 @@ func TestSyncCatalogSources(t *testing.T) {
10921094
ObjectMeta: metav1.ObjectMeta{
10931095
Name: "cool-catalog",
10941096
Namespace: "cool-namespace",
1095-
UID: types.UID("catalog-uid"),
10961097
},
10971098
Spec: v1alpha1.CatalogSourceSpec{
10981099
ConfigMap: "cool-configmap",
@@ -1102,7 +1103,6 @@ func TestSyncCatalogSources(t *testing.T) {
11021103
ConfigMapResource: &v1alpha1.ConfigMapResourceReference{
11031104
Name: "cool-configmap",
11041105
Namespace: "cool-namespace",
1105-
UID: types.UID("configmap-uid"),
11061106
ResourceVersion: "resource-version",
11071107
LastUpdateTime: now,
11081108
},
@@ -1114,7 +1114,6 @@ func TestSyncCatalogSources(t *testing.T) {
11141114
ObjectMeta: metav1.ObjectMeta{
11151115
Name: "cool-configmap",
11161116
Namespace: "cool-namespace",
1117-
UID: types.UID("configmap-uid"),
11181117
ResourceVersion: "resource-version",
11191118
},
11201119
Data: fakeConfigMapData(),
@@ -1124,7 +1123,6 @@ func TestSyncCatalogSources(t *testing.T) {
11241123
ConfigMapResource: &v1alpha1.ConfigMapResourceReference{
11251124
Name: "cool-configmap",
11261125
Namespace: "cool-namespace",
1127-
UID: types.UID("configmap-uid"),
11281126
ResourceVersion: "resource-version",
11291127
LastUpdateTime: now,
11301128
},
@@ -1141,7 +1139,7 @@ func TestSyncCatalogSources(t *testing.T) {
11411139
{
11421140
testName: "CatalogSourceWithMissingConfigMap",
11431141
namespace: "cool-namespace",
1144-
catalogSource: configmapCatalog,
1142+
catalogSource: internalCatalog,
11451143
k8sObjs: []runtime.Object{
11461144
&corev1.ConfigMap{},
11471145
},
@@ -1175,8 +1173,8 @@ func TestSyncCatalogSources(t *testing.T) {
11751173
ObjectMeta: metav1.ObjectMeta{
11761174
Name: "cool-catalog",
11771175
Namespace: "cool-namespace",
1178-
UID: types.UID("catalog-uid"),
1179-
Labels: map[string]string{"olm.catalogSource": "cool-catalog"},
1176+
1177+
Labels: map[string]string{"olm.catalogSource": "cool-catalog"},
11801178
},
11811179
Spec: v1alpha1.CatalogSourceSpec{
11821180
Image: "old-image",
@@ -1198,15 +1196,28 @@ func TestSyncCatalogSources(t *testing.T) {
11981196
pod(t, *grpcCatalog),
11991197
},
12001198
},
1199+
{
1200+
testName: "CatalogSourceWithGrpcType/CreatesNetworkPolicyResources",
1201+
namespace: "cool-namespace",
1202+
catalogSource: grpcCatalog,
1203+
expectedObjs: []runtime.Object{
1204+
grpcServerNetworkPolicy(grpcCatalog, map[string]string{
1205+
reconciler.CatalogSourceLabelKey: grpcCatalog.GetName(),
1206+
install.OLMManagedLabelKey: install.OLMManagedLabelValue,
1207+
}),
1208+
unpackBundlesNetworkPolicy(grpcCatalog),
1209+
},
1210+
expectedError: nil,
1211+
},
12011212
{
12021213
testName: "CatalogSourceWithGrpcType/EnsuresImageOrAddressIsSet",
12031214
namespace: "cool-namespace",
12041215
catalogSource: &v1alpha1.CatalogSource{
12051216
ObjectMeta: metav1.ObjectMeta{
12061217
Name: "invalid-spec-catalog",
12071218
Namespace: "cool-namespace",
1208-
UID: types.UID("catalog-uid"),
1209-
Labels: map[string]string{"olm.catalogSource": "invalid-spec-catalog"},
1219+
1220+
Labels: map[string]string{"olm.catalogSource": "invalid-spec-catalog"},
12101221
},
12111222
Spec: v1alpha1.CatalogSourceSpec{
12121223
SourceType: v1alpha1.SourceTypeGrpc,
@@ -1225,8 +1236,8 @@ func TestSyncCatalogSources(t *testing.T) {
12251236
ObjectMeta: metav1.ObjectMeta{
12261237
Name: "invalid-spec-catalog",
12271238
Namespace: "cool-namespace",
1228-
UID: types.UID("catalog-uid"),
1229-
Labels: map[string]string{"olm.catalogSource": "invalid-spec-catalog"},
1239+
1240+
Labels: map[string]string{"olm.catalogSource": "invalid-spec-catalog"},
12301241
},
12311242
Spec: v1alpha1.CatalogSourceSpec{
12321243
SourceType: v1alpha1.SourceTypeInternal,
@@ -1238,15 +1249,46 @@ func TestSyncCatalogSources(t *testing.T) {
12381249
},
12391250
expectedError: nil,
12401251
},
1252+
{
1253+
testName: "CatalogSourceWithInternalType/CreatesNetworkPolicyResources",
1254+
namespace: "cool-namespace",
1255+
catalogSource: withStatus(*internalCatalog, v1alpha1.CatalogSourceStatus{
1256+
ConfigMapResource: &v1alpha1.ConfigMapResourceReference{
1257+
Name: "cool-configmap",
1258+
Namespace: "cool-namespace",
1259+
ResourceVersion: "resource-version",
1260+
LastUpdateTime: now,
1261+
},
1262+
RegistryServiceStatus: nil,
1263+
}),
1264+
k8sObjs: []runtime.Object{
1265+
&corev1.ConfigMap{
1266+
ObjectMeta: metav1.ObjectMeta{
1267+
Name: "cool-configmap",
1268+
Namespace: "cool-namespace",
1269+
ResourceVersion: "resource-version",
1270+
},
1271+
Data: fakeConfigMapData(),
1272+
},
1273+
},
1274+
expectedObjs: []runtime.Object{
1275+
grpcServerNetworkPolicy(internalCatalog, map[string]string{
1276+
reconciler.CatalogSourceLabelKey: internalCatalog.GetName(),
1277+
install.OLMManagedLabelKey: install.OLMManagedLabelValue,
1278+
}),
1279+
unpackBundlesNetworkPolicy(internalCatalog),
1280+
},
1281+
expectedError: nil,
1282+
},
12411283
{
12421284
testName: "CatalogSourceWithConfigMapType/EnsuresConfigMapIsSet",
12431285
namespace: "cool-namespace",
12441286
catalogSource: &v1alpha1.CatalogSource{
12451287
ObjectMeta: metav1.ObjectMeta{
12461288
Name: "invalid-spec-catalog",
12471289
Namespace: "cool-namespace",
1248-
UID: types.UID("catalog-uid"),
1249-
Labels: map[string]string{"olm.catalogSource": "invalid-spec-catalog"},
1290+
1291+
Labels: map[string]string{"olm.catalogSource": "invalid-spec-catalog"},
12501292
},
12511293
Spec: v1alpha1.CatalogSourceSpec{
12521294
SourceType: v1alpha1.SourceTypeConfigmap,
@@ -1258,6 +1300,37 @@ func TestSyncCatalogSources(t *testing.T) {
12581300
},
12591301
expectedError: nil,
12601302
},
1303+
{
1304+
testName: "CatalogSourceWithConfigMapType/CreatesNetworkPolicyResources",
1305+
namespace: "cool-namespace",
1306+
catalogSource: withStatus(*configMapCatalog, v1alpha1.CatalogSourceStatus{
1307+
ConfigMapResource: &v1alpha1.ConfigMapResourceReference{
1308+
Name: "cool-configmap",
1309+
Namespace: "cool-namespace",
1310+
ResourceVersion: "resource-version",
1311+
LastUpdateTime: now,
1312+
},
1313+
RegistryServiceStatus: nil,
1314+
}),
1315+
k8sObjs: []runtime.Object{
1316+
&corev1.ConfigMap{
1317+
ObjectMeta: metav1.ObjectMeta{
1318+
Name: "cool-configmap",
1319+
Namespace: "cool-namespace",
1320+
ResourceVersion: "resource-version",
1321+
},
1322+
Data: fakeConfigMapData(),
1323+
},
1324+
},
1325+
expectedObjs: []runtime.Object{
1326+
grpcServerNetworkPolicy(configMapCatalog, map[string]string{
1327+
reconciler.CatalogSourceLabelKey: configMapCatalog.GetName(),
1328+
install.OLMManagedLabelKey: install.OLMManagedLabelValue,
1329+
}),
1330+
unpackBundlesNetworkPolicy(configMapCatalog),
1331+
},
1332+
expectedError: nil,
1333+
},
12611334
{
12621335
testName: "GRPCConnectionStateAddressIsUpdated",
12631336
namespace: "cool-namespace",

‎pkg/controller/registry/reconciler/helpers.go

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ package reconciler
33
import (
44
"fmt"
55

6+
"github.com/operator-framework/api/pkg/operators/v1alpha1"
7+
68
corev1 "k8s.io/api/core/v1"
79
networkingv1 "k8s.io/api/networking/v1"
810
"k8s.io/apimachinery/pkg/api/equality"
@@ -16,7 +18,7 @@ import (
1618
"github.com/operator-framework/operator-lifecycle-manager/pkg/lib/ownerutil"
1719
)
1820

19-
func DesiredGRPCServerNetworkPolicy(catalogSource client.Object, matchLabels map[string]string) *networkingv1.NetworkPolicy {
21+
func DesiredGRPCServerNetworkPolicy(catalogSource *v1alpha1.CatalogSource, matchLabels map[string]string) *networkingv1.NetworkPolicy {
2022
np := &networkingv1.NetworkPolicy{
2123
ObjectMeta: metav1.ObjectMeta{
2224
Name: fmt.Sprintf("%s-grpc-server", catalogSource.GetName()),
@@ -43,6 +45,21 @@ func DesiredGRPCServerNetworkPolicy(catalogSource client.Object, matchLabels map
4345
},
4446
},
4547
}
48+
49+
// Allow egress to kube-apiserver from configmap backed catalog sources
50+
if catalogSource.Spec.SourceType == v1alpha1.SourceTypeConfigmap || catalogSource.Spec.SourceType == v1alpha1.SourceTypeInternal {
51+
np.Spec.Egress = []networkingv1.NetworkPolicyEgressRule{
52+
{
53+
Ports: []networkingv1.NetworkPolicyPort{
54+
{
55+
Protocol: ptr.To(corev1.ProtocolTCP),
56+
Port: ptr.To(intstr.FromInt32(6443)),
57+
},
58+
},
59+
},
60+
}
61+
}
62+
4663
ownerutil.AddOwner(np, catalogSource, false, false)
4764
return np
4865
}

0 commit comments

Comments
 (0)