From afd1e7707e83f86cc8d3764cf44980da206e49fb Mon Sep 17 00:00:00 2001
From: Debakel Orakel <do@tegridy.io>
Date: Wed, 7 Oct 2026 13:54:04 +0200
Subject: [PATCH] Allow group-prune job to access kube-api

This PR deploys a NetworkPolicy, allowing the group-prune job to access the Kubernets API.
---
 component/group-prune.libsonnet               | 26 +++++++++++++++++++
 .../40_remove_kubeadmin_managedresource.yaml  |  1 +
 .../50_self_provisioning.yaml                 |  1 +
 .../60_group_prune.yaml                       | 21 +++++++++++++++
 .../40_remove_kubeadmin_managedresource.yaml  |  1 +
 .../50_self_provisioning.yaml                 |  1 +
 6 files changed, 51 insertions(+)

diff --git a/component/group-prune.libsonnet b/component/group-prune.libsonnet
index cd5618b..582edb6 100644
--- a/component/group-prune.libsonnet
+++ b/component/group-prune.libsonnet
@@ -87,6 +87,31 @@ local jobTemplate = {
   },
 };
 
+local netpol = kube.NetworkPolicy('allow-group-prune-egress-kube-apiserver') + namespace {
+  spec+: {
+    podSelector: {
+      matchLabels: {
+        name: 'group-prune',
+      },
+    },
+    policyTypes: [ 'Egress' ],
+    egress: [
+      {
+        ports: [
+          {
+            port: '6443',
+            protocol: 'TCP',
+          },
+          {
+            port: '443',
+            protocol: 'TCP',
+          },
+        ],
+      },
+    ],
+  },
+};
+
 local cronJob = kube.CronJob('group-prune') + namespace {
   spec+: {
     schedule: params.groupPrune.schedule,
@@ -101,5 +126,6 @@ local cronJob = kube.CronJob('group-prune') + namespace {
   sa,
   rb,
   cm,
+  netpol,
   cronJob,
 ]
diff --git a/tests/golden/defaults/openshift4-authentication/openshift4-authentication/40_remove_kubeadmin_managedresource.yaml b/tests/golden/defaults/openshift4-authentication/openshift4-authentication/40_remove_kubeadmin_managedresource.yaml
index c0142f9..1eddd4f 100644
--- a/tests/golden/defaults/openshift4-authentication/openshift4-authentication/40_remove_kubeadmin_managedresource.yaml
+++ b/tests/golden/defaults/openshift4-authentication/openshift4-authentication/40_remove_kubeadmin_managedresource.yaml
@@ -43,6 +43,7 @@ apiVersion: espejote.io/v1alpha1
 kind: ManagedResource
 metadata:
   annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
     argocd.argoproj.io/sync-wave: '10'
   labels:
     app.kubernetes.io/component: openshift4-authentication
diff --git a/tests/golden/defaults/openshift4-authentication/openshift4-authentication/50_self_provisioning.yaml b/tests/golden/defaults/openshift4-authentication/openshift4-authentication/50_self_provisioning.yaml
index ceb13b5..3c9f4d3 100644
--- a/tests/golden/defaults/openshift4-authentication/openshift4-authentication/50_self_provisioning.yaml
+++ b/tests/golden/defaults/openshift4-authentication/openshift4-authentication/50_self_provisioning.yaml
@@ -60,6 +60,7 @@ apiVersion: espejote.io/v1alpha1
 kind: ManagedResource
 metadata:
   annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
     syn.tools/source: https://github.com/appuio/component-openshift4-authentication.git
   labels:
     app.kubernetes.io/component: openshift4-authentication
diff --git a/tests/golden/defaults/openshift4-authentication/openshift4-authentication/60_group_prune.yaml b/tests/golden/defaults/openshift4-authentication/openshift4-authentication/60_group_prune.yaml
index 2b8d7c6..6738991 100644
--- a/tests/golden/defaults/openshift4-authentication/openshift4-authentication/60_group_prune.yaml
+++ b/tests/golden/defaults/openshift4-authentication/openshift4-authentication/60_group_prune.yaml
@@ -143,6 +143,27 @@ metadata:
   name: group-prune
   namespace: openshift-config
 ---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  labels:
+    name: allow-group-prune-egress-kube-apiserver
+  name: allow-group-prune-egress-kube-apiserver
+  namespace: openshift-config
+spec:
+  egress:
+    - ports:
+        - port: '6443'
+          protocol: TCP
+        - port: '443'
+          protocol: TCP
+  ingress: []
+  podSelector:
+    matchLabels:
+      name: group-prune
+  policyTypes:
+    - Egress
+---
 apiVersion: batch/v1
 kind: CronJob
 metadata:
diff --git a/tests/golden/no-ldap/openshift4-authentication/openshift4-authentication/40_remove_kubeadmin_managedresource.yaml b/tests/golden/no-ldap/openshift4-authentication/openshift4-authentication/40_remove_kubeadmin_managedresource.yaml
index c0142f9..1eddd4f 100644
--- a/tests/golden/no-ldap/openshift4-authentication/openshift4-authentication/40_remove_kubeadmin_managedresource.yaml
+++ b/tests/golden/no-ldap/openshift4-authentication/openshift4-authentication/40_remove_kubeadmin_managedresource.yaml
@@ -43,6 +43,7 @@ apiVersion: espejote.io/v1alpha1
 kind: ManagedResource
 metadata:
   annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
     argocd.argoproj.io/sync-wave: '10'
   labels:
     app.kubernetes.io/component: openshift4-authentication
diff --git a/tests/golden/no-ldap/openshift4-authentication/openshift4-authentication/50_self_provisioning.yaml b/tests/golden/no-ldap/openshift4-authentication/openshift4-authentication/50_self_provisioning.yaml
index da4d01a..8c4e3ea 100644
--- a/tests/golden/no-ldap/openshift4-authentication/openshift4-authentication/50_self_provisioning.yaml
+++ b/tests/golden/no-ldap/openshift4-authentication/openshift4-authentication/50_self_provisioning.yaml
@@ -60,6 +60,7 @@ apiVersion: espejote.io/v1alpha1
 kind: ManagedResource
 metadata:
   annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
     syn.tools/source: https://github.com/appuio/component-openshift4-authentication.git
   labels:
     app.kubernetes.io/component: openshift4-authentication