CMP-4496: Add NetworkPolicy RBAC for operands to operator Role and CSV - #1313
Merged
Conversation
Collaborator
|
@taimurhafeez: This pull request references CMP-4496 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
taimurhafeez
requested review from
Vincent056,
abushkin-redhat,
vickeybrown and
yuumasato
and removed request for
xiaojiey
July 29, 2026 12:12
taimurhafeez
marked this pull request as draft
July 29, 2026 12:18
taimurhafeez
marked this pull request as ready for review
July 30, 2026 09:49
Collaborator
Author
|
/retest-required |
3 tasks
Collaborator
Author
|
/retest-required |
taimurhafeez
force-pushed
the
CMP-4496-Add-NetworkPolicy-RBAC-for-operands-to-CSV-and-operator-role
branch
from
August 6, 2026 09:11
a852f8f to
529958f
Compare
|
🤖 To deploy this PR, run the following command: |
Member
|
/retest |
1 similar comment
Member
|
/retest |
Collaborator
Author
|
/retest |
1 similar comment
Collaborator
Author
|
/retest |
Collaborator
|
/lgtm |
taimurhafeez
force-pushed
the
CMP-4496-Add-NetworkPolicy-RBAC-for-operands-to-CSV-and-operator-role
branch
from
August 20, 2026 12:04
529958f to
82f7364
Compare
abushkin-redhat
added a commit
to abushkin-redhat/compliance-operator
that referenced
this pull request
Aug 20, 2026
The operator now creates and reconciles label-scoped NetworkPolicies for its operand pods (result server, scanners, aggregator, profileparser, rerunner) so operand traffic is governed at runtime rather than left unrestricted. - Add the compliance.openshift.io/netpol-managed marker to every operand pod template (pod template only for the result-server and profileparser Deployments, to avoid mutating their immutable selectors). - Create three named policies in the operator namespace via get-or-create/update (no list/watch, matching the RBAC granted for CMP-4496): default-deny (ingress+egress), allow-all-egress, and result-server ingress on 8443 from pod-network scanners and host-networked node scanners. - Reconcile the policies at the start of the scan launching phase, before any operand pods are created. - Read NetworkPolicy directly from the API server (manager client cache DisableFor) so a by-name Get does not start an informer list+watch, which the operand RBAC does not grant. Depends on ComplianceAsCode#1313 (CMP-4496) for the NetworkPolicy RBAC.
Collaborator
|
/retest-required |
taimurhafeez
force-pushed
the
CMP-4496-Add-NetworkPolicy-RBAC-for-operands-to-CSV-and-operator-role
branch
from
August 21, 2026 10:09
82f7364 to
5924a5c
Compare
|
🤖 To deploy this PR, run the following command: |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: taimurhafeez, yuumasato The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
networking.k8s.io/networkpoliciesRBAC rule (verbs:create,delete,get,update) to the operator Role (config/rbac/operator_role.yaml)config/manifests/bases/compliance-operator.clusterserviceversion.yaml) under thecompliance-operatorservice accountcompliancescan_controller.goto keep the three RBAC sources of truth in syncmake bundleWhy
The Conforma policy
olm.required_network_policy_rbac_for_operandsrequires the CSV to declare RBAC permissions fornetworking.k8s.io/networkpolicieswith verbscreate,delete, andupdate(orpatch).Test plan
Prerequisites
compliance-operator,compliance-operator-bundle, andcompliance-operator-catalog1. Build and push images
2. Deploy via OLM
3.Verify OLM installation is complete
4. Verify NetworkPolicy RBAC in the OLM-created Role
Check the OLM-created Role contains the networkpolicies rule
oc get roles -n openshift-compliance -o yaml | grep -B 2 -A 6 networkpoliciesExpected output:
5. Verify the CSV permissions section
Expected output should show
networkpolicieswith verbscreate,delete,get,updateunder thepermissions(namespace-scoped) section.6. Verify SA has the permissions