Allow group-prune job to access kube-api

component/group-prune.libsonnet

@@ -87,6 +87,31 @@ local jobTemplate = {
   },
 };
 
+local netpol = kube.NetworkPolicy('allow-group-prune-egress-kube-apiserver') + namespace {
+  spec+: {
+    podSelector: {
+      matchLabels: {
+        name: 'group-prune',
+      },
+    },
+    policyTypes: [ 'Egress' ],
+    egress: [
+      {
+        ports: [
+          {
+            port: '6443',
+            protocol: 'TCP',
+          },
+          {
+            port: '443',
+            protocol: 'TCP',
+          },
+        ],
+      },
+    ],
+  },
+};
+
 local cronJob = kube.CronJob('group-prune') + namespace {
   spec+: {
     schedule: params.groupPrune.schedule,
@@ -101,5 +126,6 @@ local cronJob = kube.CronJob('group-prune') + namespace {
   sa,
   rb,
   cm,
+  netpol,
   cronJob,
 ]

tests/golden/defaults/openshift4-authentication/openshift4-authentication/40_remove_kubeadmin_managedresource.yaml

@@ -43,6 +43,7 @@ apiVersion: espejote.io/v1alpha1
 kind: ManagedResource
 metadata:
   annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
     argocd.argoproj.io/sync-wave: '10'
   labels:
     app.kubernetes.io/component: openshift4-authentication

tests/golden/defaults/openshift4-authentication/openshift4-authentication/50_self_provisioning.yaml

@@ -60,6 +60,7 @@ apiVersion: espejote.io/v1alpha1
 kind: ManagedResource
 metadata:
   annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
     syn.tools/source: https://github.com/appuio/component-openshift4-authentication.git
   labels:
     app.kubernetes.io/component: openshift4-authentication

tests/golden/defaults/openshift4-authentication/openshift4-authentication/60_group_prune.yaml

@@ -143,6 +143,27 @@ metadata:
   name: group-prune
   namespace: openshift-config
 ---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  labels:
+    name: allow-group-prune-egress-kube-apiserver
+  name: allow-group-prune-egress-kube-apiserver
+  namespace: openshift-config
+spec:
+  egress:
+    - ports:
+        - port: '6443'
+          protocol: TCP
+        - port: '443'
+          protocol: TCP
+  ingress: []
+  podSelector:
+    matchLabels:
+      name: group-prune
+  policyTypes:
+    - Egress
+---
 apiVersion: batch/v1
 kind: CronJob
 metadata:

tests/golden/no-ldap/openshift4-authentication/openshift4-authentication/40_remove_kubeadmin_managedresource.yaml

@@ -43,6 +43,7 @@ apiVersion: espejote.io/v1alpha1
 kind: ManagedResource
 metadata:
   annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
     argocd.argoproj.io/sync-wave: '10'
   labels:
     app.kubernetes.io/component: openshift4-authentication

tests/golden/no-ldap/openshift4-authentication/openshift4-authentication/50_self_provisioning.yaml

@@ -60,6 +60,7 @@ apiVersion: espejote.io/v1alpha1
 kind: ManagedResource
 metadata:
   annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
     syn.tools/source: https://github.com/appuio/component-openshift4-authentication.git
   labels:
     app.kubernetes.io/component: openshift4-authentication