Skip to content

Add KME NetworkPolicies - #516

Merged
openshift-merge-bot[bot] merged 1 commit into
openshift-virtualization:mainfrom
tiraboschi:kme_np
Nov 2, 2026
Merged

openshift-merge-bot[bot] merged 1 commit into
openshift-virtualization:mainfrom
tiraboschi:kme_np

Conversation

@tiraboschi

Copy link
Copy Markdown
Member

Summary

  • sync the default-deny, API server, and metrics NetworkPolicies from kubevirt-metrics-exporter#37
  • preserve the OpenShift mTLS metrics port (8443) transform
  • generate correct NetworkPolicy RBAC and cover its pluralization

Validation

  • make verify-kme-assets
  • make verify-rbac
  • make shellcheck
  • go test ./pkg/rbac/... ./pkg/assets/... ./pkg/engine/...

Depends on openshift-virtualization/kubevirt-metrics-exporter#37

Sync the default-deny, API server,
and metrics ingress policies introduced by kubevirt-metrics-exporter#37.
Preserve the OpenShift mTLS metrics-port overlay
and grant the operator NetworkPolicy access.

Signed-off-by: Simone Tiraboschi <stirabos@redhat.com>

@nunnatsa nunnatsa left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added one comment. Thanks!

@@ -0,0 +1,12 @@
# KME owns its dedicated namespace, so isolate all pods by default and add only

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure we need this one. The user should decide if they want to block networking or not. We only need to allow what we need to make our pods to work properly.

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nevermind

@nunnatsa

nunnatsa commented Nov 2, 2026

Copy link
Copy Markdown
Collaborator

/lgtm

@nunnatsa

nunnatsa commented Nov 2, 2026

Copy link
Copy Markdown
Collaborator

/approve

@openshift-ci

openshift-ci Bot commented Nov 2, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: nunnatsa

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved label Nov 2, 2026
@openshift-merge-bot
openshift-merge-bot Bot merged commit 6c312c8 into openshift-virtualization:main Nov 2, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants