Skip to content

feat(rhdh): add in-cluster HTTP (port 80) egress NetworkPolicy #556

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
rm3l wants to merge 4 commits into from
Closed

feat(rhdh): add in-cluster HTTP (port 80) egress NetworkPolicy #556

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
031aaf7
feat(rhdh): add in-cluster HTTP (port 80) egress NetworkPolicy
rm3l Sep 24, 2026
6dde8fc
chore: bump chart version
rm3l Sep 24, 2026
b5ca5c6
docs(rhdh): document allow-http-egress NetworkPolicy in README
rm3l Sep 24, 2026
8df1ea9
docs(rhdh): clarify OKP port 80/8080 NPs are only created when OKP is…
rm3l Sep 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion charts/rhdh/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
apiVersion: v2
name: redhat-developer-hub
type: application
version: 3.4.0
version: 3.4.1
appVersion: 2.1.0
annotations:
artifacthub.io/category: integration-delivery
Expand Down
17 changes: 10 additions & 7 deletions charts/rhdh/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@

# RHDH Helm Chart for OpenShift and Kubernetes

![Version: 3.4.0](https://img.shields.io/badge/Version-3.4.0-informational?style=flat-square)
![Version: 3.4.1](https://img.shields.io/badge/Version-3.4.1-informational?style=flat-square)
![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)

A Helm chart for deploying Red Hat Developer Hub, which is a Red Hat supported version of Backstage.
Expand Down Expand Up @@ -36,7 +36,7 @@ For the **Generally Available** version of this chart, see:
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo add redhat-developer https://redhat-developer.github.io/rhdh-chart

helm install my-rhdh redhat-developer/redhat-developer-hub --version 3.4.0
helm install my-rhdh redhat-developer/redhat-developer-hub --version 3.4.1
```

## Introduction
Expand Down Expand Up @@ -570,10 +570,11 @@ The following traffic is allowed out of the box:
|-----------|------|----------------------|---------|
| Egress | 53, 5353 (UDP/TCP) | Any | DNS resolution |
| Egress | 443 (TCP) | Any | HTTPS (Git forges, auth providers, external APIs) |
| Egress | 80 (TCP) | In-cluster only (`namespaceSelector: {}`) | HTTP to in-cluster services (e.g., Keycloak without TLS termination) |
| Egress | 5432 (TCP) | Built-in PostgreSQL pods (scoped) or any (external DB) | Database access |
| Egress | 6379 (TCP) | Any | Redis (BYO — no pod/namespace selector) |
| Egress | 80 (TCP) | Any destination | LCORE access to an HTTP OKP Ingress |
| Egress | 8080 (TCP) | OKP pods | LCORE access to the internal OKP Service fallback |
| Egress | 80 (TCP) | Any destination | LCORE access to an HTTP OKP Ingress (NP created only when OKP is enabled; disabled by default) |
| Egress | 8080 (TCP) | OKP pods | LCORE access to the internal OKP Service fallback (NP created only when OKP is enabled; disabled by default) |
| Ingress | 7007 (TCP) | OpenShift router namespace or any namespace (non-OCP) | User traffic via Route / Ingress |
| Ingress | 8080 (TCP) | RHDH pods and the OpenShift router namespace or any namespace (non-OCP) | OKP queries and product-document citations via Route / Ingress |
| Ingress | 9464 (TCP) | `openshift-monitoring`, `openshift-user-workload-monitoring`, `gmp-system`, `gke-gmp-system`, `monitoring` | Prometheus metrics scraping |
Expand All @@ -588,15 +589,15 @@ RHDH already permits HTTPS egress on port 443. When OKP uses HTTP instead, the c

**Helm test NetworkPolicies** (`allow-test-connection` and `allow-test-connection-ingress`) are Helm test hooks: they are created just before `helm test` runs and cleaned up automatically on success.

**Adding your own NetworkPolicies.** Kubernetes evaluates NetworkPolicies additively — if any policy allows a connection, the connection is permitted. You **cannot** tighten an existing allow rule by adding another NetworkPolicy; you can only broaden access. To add extra allow rules (for example, allowing HTTP egress to an internal auth provider), use [`extraDeploy`](#extra-deployed-resources-extradeploy) or apply your own NetworkPolicy resources externally:
**Adding your own NetworkPolicies.** Kubernetes evaluates NetworkPolicies additively — if any policy allows a connection, the connection is permitted. You **cannot** tighten an existing allow rule by adding another NetworkPolicy; you can only broaden access. To add extra allow rules (for example, allowing LDAP egress to an internal directory server), use [`extraDeploy`](#extra-deployed-resources-extradeploy) or apply your own NetworkPolicy resources externally:

```yaml
extraDeploy:
- |
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: {{ include "rhdh.fullname" . }}-allow-http-egress
name: {{ include "rhdh.fullname" . }}-allow-ldap-egress
spec:
podSelector:
matchLabels:
Expand All @@ -605,7 +606,9 @@ extraDeploy:
- Egress
egress:
- ports:
- port: 80
- port: 389
protocol: TCP
- port: 636
protocol: TCP
```

Expand Down
13 changes: 8 additions & 5 deletions charts/rhdh/README.md.gotmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -398,10 +398,11 @@ The following traffic is allowed out of the box:
|-----------|------|----------------------|---------|
| Egress | 53, 5353 (UDP/TCP) | Any | DNS resolution |
| Egress | 443 (TCP) | Any | HTTPS (Git forges, auth providers, external APIs) |
| Egress | 80 (TCP) | In-cluster only (`namespaceSelector: {}`) | HTTP to in-cluster services (e.g., Keycloak without TLS termination) |
| Egress | 5432 (TCP) | Built-in PostgreSQL pods (scoped) or any (external DB) | Database access |
| Egress | 6379 (TCP) | Any | Redis (BYO — no pod/namespace selector) |
| Egress | 80 (TCP) | Any destination | LCORE access to an HTTP OKP Ingress |
| Egress | 8080 (TCP) | OKP pods | LCORE access to the internal OKP Service fallback |
| Egress | 80 (TCP) | Any destination | LCORE access to an HTTP OKP Ingress (NP created only when OKP is enabled; disabled by default) |
| Egress | 8080 (TCP) | OKP pods | LCORE access to the internal OKP Service fallback (NP created only when OKP is enabled; disabled by default) |
| Ingress | 7007 (TCP) | OpenShift router namespace or any namespace (non-OCP) | User traffic via Route / Ingress |
| Ingress | 8080 (TCP) | RHDH pods and the OpenShift router namespace or any namespace (non-OCP) | OKP queries and product-document citations via Route / Ingress |
| Ingress | 9464 (TCP) | `openshift-monitoring`, `openshift-user-workload-monitoring`, `gmp-system`, `gke-gmp-system`, `monitoring` | Prometheus metrics scraping |
Expand All @@ -416,15 +417,15 @@ RHDH already permits HTTPS egress on port 443. When OKP uses HTTP instead, the c

**Helm test NetworkPolicies** (`allow-test-connection` and `allow-test-connection-ingress`) are Helm test hooks: they are created just before `helm test` runs and cleaned up automatically on success.

**Adding your own NetworkPolicies.** Kubernetes evaluates NetworkPolicies additively — if any policy allows a connection, the connection is permitted. You **cannot** tighten an existing allow rule by adding another NetworkPolicy; you can only broaden access. To add extra allow rules (for example, allowing HTTP egress to an internal auth provider), use [`extraDeploy`](#extra-deployed-resources-extradeploy) or apply your own NetworkPolicy resources externally:
**Adding your own NetworkPolicies.** Kubernetes evaluates NetworkPolicies additively — if any policy allows a connection, the connection is permitted. You **cannot** tighten an existing allow rule by adding another NetworkPolicy; you can only broaden access. To add extra allow rules (for example, allowing LDAP egress to an internal directory server), use [`extraDeploy`](#extra-deployed-resources-extradeploy) or apply your own NetworkPolicy resources externally:

```yaml
extraDeploy:
- |
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: {{"{{" }} include "rhdh.fullname" . {{"}}"}}-allow-http-egress
name: {{"{{" }} include "rhdh.fullname" . {{"}}"}}-allow-ldap-egress
spec:
podSelector:
matchLabels:
Expand All @@ -433,7 +434,9 @@ extraDeploy:
- Egress
egress:
- ports:
- port: 80
- port: 389
protocol: TCP
- port: 636
protocol: TCP
```

Expand Down
27 changes: 27 additions & 0 deletions charts/rhdh/templates/network-policies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,33 @@ spec:
- port: 443
protocol: TCP

---
# Internal HTTP egress: plugins that talk to in-cluster services behind plain
# HTTP routes or services (e.g., Keycloak without TLS termination) need port 80.
# Restricted to cluster-internal destinations via namespaceSelector.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: {{ include "rhdh.fullname" . }}-allow-http-egress
labels:
{{- include "rhdh.labels" . | nindent 4 }}
{{- with .Values.commonAnnotations }}
annotations:
{{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }}
{{- end }}
spec:
podSelector:
matchLabels:
{{- include "rhdh.selectorLabels" . | nindent 6 }}
policyTypes:
- Egress
egress:
- to:
- namespaceSelector: {}
ports:
- port: 80
protocol: TCP

---
# Redis is part of the recommended checklist for production deployments
# (see https://docs.redhat.com/en/documentation/red_hat_developer_hub/1.10/html/setting_up_and_configuring_your_first_red_hat_developer_hub_instance/checklist-to-run-your-first-rhdh-instance-in-production_setting-up-and-configuring-your-first-red-hat-developer-hub-instance).
Expand Down
Loading