diff --git a/charts/rhdh/Chart.yaml b/charts/rhdh/Chart.yaml index caa39caf3..64d24a20a 100644 --- a/charts/rhdh/Chart.yaml +++ b/charts/rhdh/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 name: redhat-developer-hub type: application -version: 3.5.11 +version: 3.5.12 appVersion: 2.2.0 annotations: artifacthub.io/category: integration-delivery diff --git a/charts/rhdh/README.md b/charts/rhdh/README.md index 29cd63b72..ed71692f8 100644 --- a/charts/rhdh/README.md +++ b/charts/rhdh/README.md @@ -1,7 +1,7 @@ # RHDH Helm Chart for OpenShift and Kubernetes -![Version: 3.5.11](https://img.shields.io/badge/Version-3.5.11-informational?style=flat-square) +![Version: 3.5.12](https://img.shields.io/badge/Version-3.5.12-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) A Helm chart for deploying Red Hat Developer Hub, which is a Red Hat supported version of Backstage. @@ -36,7 +36,7 @@ For the **Generally Available** version of this chart, see: helm repo add bitnami https://charts.bitnami.com/bitnami helm repo add redhat-developer https://redhat-developer.github.io/rhdh-chart -helm install my-rhdh redhat-developer/redhat-developer-hub --version 3.5.11 +helm install my-rhdh redhat-developer/redhat-developer-hub --version 3.5.12 ``` ## Introduction @@ -567,6 +567,8 @@ extraDeploy: This chart deploys a **default-deny** NetworkPolicy for the RHDH backend pod, blocking all ingress and egress traffic that is not explicitly allowed. When the built-in PostgreSQL is enabled (`postgresql.enabled=true`), the database pods also get their own default-deny policy with selective allow rules. When OKP is active, its pods receive a separate default-deny ingress and egress policy with rules allowing only the required HTTP ingress. +When `orchestrator.enabled=true`, the chart also creates NetworkPolicies for SonataFlow Data Index and Jobs Service pods (default-deny, then selective allow) and for other pods labeled `app.kubernetes.io/managed-by: sonataflow-operator`. These include RHDH ↔ SonataFlow access, scoped SonataFlow egress (DNS, HTTPS, Kubernetes API, PostgreSQL, and RHDH on port 7007), and (when built-in PostgreSQL is enabled) PostgreSQL ingress from SonataFlow-managed pods. The Orchestrator create-db Job uses `rhdh.selectorLabels`, so it is covered by the existing RHDH → PostgreSQL allow. These policies are label-scoped and do not use namespace-wide `podSelector: {}`. + The following traffic is allowed out of the box: | Direction | Port | Destination / Source | Purpose | @@ -581,11 +583,25 @@ The following traffic is allowed out of the box: | Ingress | 7007 (TCP) | OpenShift router namespace or any namespace (non-OCP) | User traffic via Route / Ingress | | Ingress | 8080 (TCP) | RHDH pods and the OpenShift router namespace or any namespace (non-OCP) | OKP queries and product-document citations via Route / Ingress | | Ingress | 9464 (TCP) | `openshift-monitoring`, `openshift-user-workload-monitoring`, `gmp-system`, `gke-gmp-system`, `monitoring` | Prometheus metrics scraping | +| Ingress | any | OpenShift router namespace → SonataFlow pods | Orchestrator / SonataFlow Routes (NP created only when `orchestrator.enabled=true`) | +| Ingress | any | RHDH pods → SonataFlow pods | Orchestrator backend to Data Index / workflows (NP created only when `orchestrator.enabled=true`) | +| Ingress | any | SonataFlow pods → SonataFlow pods (same or other namespaces) | SonataFlow inter-pod ingress and egress (NP created only when `orchestrator.enabled=true`) | +| Ingress | any | `knative-eventing`, `knative-serving`, `openshift-serverless-logic` → SonataFlow pods | Orchestrator infra namespaces (NP created only when `orchestrator.enabled=true`) | +| Ingress | 8080 (TCP) | `openshift-monitoring`, `openshift-user-workload-monitoring`, `gmp-system`, `gke-gmp-system`, `monitoring` → SonataFlow pods | SonataFlow metrics scrape (NP created only when `orchestrator.enabled=true` and `orchestrator.sonataflowPlatform.monitoring.enabled=true`) | +| Ingress | 7007 (TCP) | SonataFlow pods → RHDH pods | Workflows calling RHDH APIs (NP created only when `orchestrator.enabled=true`) | +| Egress | any | RHDH pods → SonataFlow pods | Orchestrator backend to SonataFlow / Data Index (NP created only when `orchestrator.enabled=true`) | +| Egress | 53, 5353 (UDP/TCP) | SonataFlow pods → any | SonataFlow DNS (NP created only when `orchestrator.enabled=true`) | +| Egress | 443, 6443 (TCP) | SonataFlow pods → any | SonataFlow HTTPS and Kubernetes API (NP created only when `orchestrator.enabled=true`) | +| Egress | 5432 (TCP) | SonataFlow pods → built-in PostgreSQL (scoped) or any (external DB) | SonataFlow database access (NP created only when `orchestrator.enabled=true`) | +| Egress | 7007 (TCP) | SonataFlow pods → RHDH pods | Workflows calling RHDH APIs (NP created only when `orchestrator.enabled=true`) | +| Ingress | 5432 (TCP) | SonataFlow pods (same or other namespaces) → built-in PostgreSQL primary | Orchestrator / SonataFlow database access (NP created only when `orchestrator.enabled=true` and `postgresql.enabled=true`) | OKP initiates no outbound connections: its HTTP server and Solr process run in the same pod and serve the documentation embedded in the image. Its default-deny policy therefore blocks all new egress connections. NetworkPolicy is stateful, so response traffic for allowed ingress connections remains permitted. RHDH already permits HTTPS egress on port 443. When OKP uses HTTP instead, the chart permits RHDH egress on port 80 for a Kubernetes Ingress or restricts port 8080 egress to OKP pods for the internal Service fallback. No additional RHDH egress policy is created when `OKP_SERVICE_URL` uses HTTPS. +When Orchestrator is enabled (`orchestrator.enabled=true`), the chart first creates default-deny NetworkPolicies for the SonataFlow Data Index and Jobs Service pods, then selective allow policies for pods labeled `app.kubernetes.io/managed-by: sonataflow-operator`. These allow ingress from the Knative Eventing/Serving and OpenShift Serverless Logic namespaces, from the OpenShift router (any port), from other SonataFlow pods in the same or other namespaces (ingress and egress), from RHDH (any port), and (when `orchestrator.sonataflowPlatform.monitoring.enabled=true`) from known monitoring namespaces on port 8080. SonataFlow egress is scoped to DNS, HTTPS (443), the Kubernetes API (6443), PostgreSQL (5432), and RHDH on port 7007; additional destinations must be allowed explicitly. Separately, the RHDH backend pod (selected via `rhdh.selectorLabels`) is allowed to reach SonataFlow pods (any port), and SonataFlow pods are allowed to reach RHDH on port 7007. When the built-in PostgreSQL is enabled (`postgresql.enabled=true`), Postgres admits TCP/5432 from SonataFlow-managed pods in the same or other namespaces; the Orchestrator create-db Job uses `rhdh.selectorLabels` and is covered by the existing RHDH backend PostgreSQL allow. + **Redis egress is intentionally unscoped.** RHDH does not deploy Redis; users bring their own instance, which may live in the same namespace, a different namespace, or an external managed service. The rule therefore allows egress on port 6379 to any destination. **Bitnami subchart NetworkPolicies are disabled** (`postgresql.primary.networkPolicy.enabled=false`, `postgresql.readReplicas.networkPolicy.enabled=false`) because this chart provides its own tighter policies for the built-in database pods. @@ -676,6 +692,7 @@ helm install redhat-developer/redhat-developer-hub-orchestrator-i ``` helm install redhat-developer/redhat-developer-hub --set orchestrator.enabled=true ``` +Enabling Orchestrator also creates label-scoped NetworkPolicies for SonataFlow-managed pods (default-deny for Data Index and Jobs Service, then selective allows), for RHDH ↔ SonataFlow access, and (when built-in PostgreSQL is enabled) for SonataFlow access to Postgres on TCP/5432; they are not namespace-wide. See [NetworkPolicies](#networkpolicies) for details. Note that serverlessLogicOperator, and serverlessOperator are enabled by default. They can be disabled together or seperately by passing the following flags: `--set orchestrator.serverlessLogicOperator.enabled=false --set orchestrator.serverlessOperator.enabled=false` diff --git a/charts/rhdh/README.md.gotmpl b/charts/rhdh/README.md.gotmpl index b656a7797..9aba7cfc3 100644 --- a/charts/rhdh/README.md.gotmpl +++ b/charts/rhdh/README.md.gotmpl @@ -392,6 +392,8 @@ extraDeploy: This chart deploys a **default-deny** NetworkPolicy for the RHDH backend pod, blocking all ingress and egress traffic that is not explicitly allowed. When the built-in PostgreSQL is enabled (`postgresql.enabled=true`), the database pods also get their own default-deny policy with selective allow rules. When OKP is active, its pods receive a separate default-deny ingress and egress policy with rules allowing only the required HTTP ingress. +When `orchestrator.enabled=true`, the chart also creates NetworkPolicies for SonataFlow Data Index and Jobs Service pods (default-deny, then selective allow) and for other pods labeled `app.kubernetes.io/managed-by: sonataflow-operator`. These include RHDH ↔ SonataFlow access, scoped SonataFlow egress (DNS, HTTPS, Kubernetes API, PostgreSQL, and RHDH on port 7007), and (when built-in PostgreSQL is enabled) PostgreSQL ingress from SonataFlow-managed pods. The Orchestrator create-db Job uses `rhdh.selectorLabels`, so it is covered by the existing RHDH → PostgreSQL allow. These policies are label-scoped and do not use namespace-wide `podSelector: {}`. + The following traffic is allowed out of the box: | Direction | Port | Destination / Source | Purpose | @@ -406,11 +408,25 @@ The following traffic is allowed out of the box: | Ingress | 7007 (TCP) | OpenShift router namespace or any namespace (non-OCP) | User traffic via Route / Ingress | | Ingress | 8080 (TCP) | RHDH pods and the OpenShift router namespace or any namespace (non-OCP) | OKP queries and product-document citations via Route / Ingress | | Ingress | 9464 (TCP) | `openshift-monitoring`, `openshift-user-workload-monitoring`, `gmp-system`, `gke-gmp-system`, `monitoring` | Prometheus metrics scraping | +| Ingress | any | OpenShift router namespace → SonataFlow pods | Orchestrator / SonataFlow Routes (NP created only when `orchestrator.enabled=true`) | +| Ingress | any | RHDH pods → SonataFlow pods | Orchestrator backend to Data Index / workflows (NP created only when `orchestrator.enabled=true`) | +| Ingress | any | SonataFlow pods → SonataFlow pods (same or other namespaces) | SonataFlow inter-pod ingress and egress (NP created only when `orchestrator.enabled=true`) | +| Ingress | any | `knative-eventing`, `knative-serving`, `openshift-serverless-logic` → SonataFlow pods | Orchestrator infra namespaces (NP created only when `orchestrator.enabled=true`) | +| Ingress | 8080 (TCP) | `openshift-monitoring`, `openshift-user-workload-monitoring`, `gmp-system`, `gke-gmp-system`, `monitoring` → SonataFlow pods | SonataFlow metrics scrape (NP created only when `orchestrator.enabled=true` and `orchestrator.sonataflowPlatform.monitoring.enabled=true`) | +| Ingress | 7007 (TCP) | SonataFlow pods → RHDH pods | Workflows calling RHDH APIs (NP created only when `orchestrator.enabled=true`) | +| Egress | any | RHDH pods → SonataFlow pods | Orchestrator backend to SonataFlow / Data Index (NP created only when `orchestrator.enabled=true`) | +| Egress | 53, 5353 (UDP/TCP) | SonataFlow pods → any | SonataFlow DNS (NP created only when `orchestrator.enabled=true`) | +| Egress | 443, 6443 (TCP) | SonataFlow pods → any | SonataFlow HTTPS and Kubernetes API (NP created only when `orchestrator.enabled=true`) | +| Egress | 5432 (TCP) | SonataFlow pods → built-in PostgreSQL (scoped) or any (external DB) | SonataFlow database access (NP created only when `orchestrator.enabled=true`) | +| Egress | 7007 (TCP) | SonataFlow pods → RHDH pods | Workflows calling RHDH APIs (NP created only when `orchestrator.enabled=true`) | +| Ingress | 5432 (TCP) | SonataFlow pods (same or other namespaces) → built-in PostgreSQL primary | Orchestrator / SonataFlow database access (NP created only when `orchestrator.enabled=true` and `postgresql.enabled=true`) | OKP initiates no outbound connections: its HTTP server and Solr process run in the same pod and serve the documentation embedded in the image. Its default-deny policy therefore blocks all new egress connections. NetworkPolicy is stateful, so response traffic for allowed ingress connections remains permitted. RHDH already permits HTTPS egress on port 443. When OKP uses HTTP instead, the chart permits RHDH egress on port 80 for a Kubernetes Ingress or restricts port 8080 egress to OKP pods for the internal Service fallback. No additional RHDH egress policy is created when `OKP_SERVICE_URL` uses HTTPS. +When Orchestrator is enabled (`orchestrator.enabled=true`), the chart first creates default-deny NetworkPolicies for the SonataFlow Data Index and Jobs Service pods, then selective allow policies for pods labeled `app.kubernetes.io/managed-by: sonataflow-operator`. These allow ingress from the Knative Eventing/Serving and OpenShift Serverless Logic namespaces, from the OpenShift router (any port), from other SonataFlow pods in the same or other namespaces (ingress and egress), from RHDH (any port), and (when `orchestrator.sonataflowPlatform.monitoring.enabled=true`) from known monitoring namespaces on port 8080. SonataFlow egress is scoped to DNS, HTTPS (443), the Kubernetes API (6443), PostgreSQL (5432), and RHDH on port 7007; additional destinations must be allowed explicitly. Separately, the RHDH backend pod (selected via `rhdh.selectorLabels`) is allowed to reach SonataFlow pods (any port), and SonataFlow pods are allowed to reach RHDH on port 7007. When the built-in PostgreSQL is enabled (`postgresql.enabled=true`), Postgres admits TCP/5432 from SonataFlow-managed pods in the same or other namespaces; the Orchestrator create-db Job uses `rhdh.selectorLabels` and is covered by the existing RHDH backend PostgreSQL allow. + **Redis egress is intentionally unscoped.** RHDH does not deploy Redis; users bring their own instance, which may live in the same namespace, a different namespace, or an external managed service. The rule therefore allows egress on port 6379 to any destination. **Bitnami subchart NetworkPolicies are disabled** (`postgresql.primary.networkPolicy.enabled=false`, `postgresql.readReplicas.networkPolicy.enabled=false`) because this chart provides its own tighter policies for the built-in database pods. @@ -501,6 +517,7 @@ helm install redhat-developer/redhat-developer-hub-orchestrator-i ``` helm install redhat-developer/redhat-developer-hub --set orchestrator.enabled=true ``` +Enabling Orchestrator also creates label-scoped NetworkPolicies for SonataFlow-managed pods (default-deny for Data Index and Jobs Service, then selective allows), for RHDH ↔ SonataFlow access, and (when built-in PostgreSQL is enabled) for SonataFlow access to Postgres on TCP/5432; they are not namespace-wide. See [NetworkPolicies](#networkpolicies) for details. Note that serverlessLogicOperator, and serverlessOperator are enabled by default. They can be disabled together or seperately by passing the following flags: `--set orchestrator.serverlessLogicOperator.enabled=false --set orchestrator.serverlessOperator.enabled=false` diff --git a/charts/rhdh/templates/network-policies.yaml b/charts/rhdh/templates/network-policies.yaml index 135a2a69e..835deaedf 100644 --- a/charts/rhdh/templates/network-policies.yaml +++ b/charts/rhdh/templates/network-policies.yaml @@ -367,6 +367,40 @@ spec: ports: - port: 5432 protocol: TCP +{{- if .Values.orchestrator.enabled }} +--- +# Allow SonataFlow-managed pods to reach the built-in PostgreSQL. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "rhdh.fullname" . }}-db-allow-sonataflow-ingress + labels: + {{- include "rhdh.labels" . | nindent 4 }} + {{- with .Values.commonAnnotations }} + annotations: + {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: + app.kubernetes.io/name: postgresql + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/component: primary + policyTypes: + - Ingress + ingress: + - from: + - podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator + - namespaceSelector: {} + podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator + ports: + - port: 5432 + protocol: TCP +{{- end }} {{- if $isReplication }} diff --git a/charts/rhdh/templates/orchestrator/network-policies.yaml b/charts/rhdh/templates/orchestrator/network-policies.yaml index d20e38579..05dab892b 100644 --- a/charts/rhdh/templates/orchestrator/network-policies.yaml +++ b/charts/rhdh/templates/orchestrator/network-policies.yaml @@ -1,15 +1,9 @@ -# TODO: these Orchestrator policies use podSelector: {} (namespace-wide) and conflict with -# the ADR's "default deny with selective allow" and "label-scoped policies" principles. -# They weaken per-component ingress isolation for RHDH backend and DB pods in the same namespace. -# Even though only one Orchestrator-flavoured RHDH instance is supported per namespace (the -# SonataFlow Operator enforces one SonataFlowPlatform per namespace), a non-Orchestrator RHDH -# instance could coexist in the same namespace; these namespace-wide policies would affect it too. -# Review and make stricter by scoping to SonataFlow-specific labels where possible. {{- if .Values.orchestrator.enabled }} +# Default-deny for SonataFlow Data Index pods created by the operator. apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: - name: {{ include "rhdh.fullname" . }}-allow-infra-ns-to-workflow-ns + name: {{ include "rhdh.fullname" . }}-sonataflow-data-index-default-deny labels: {{- include "rhdh.labels" . | nindent 4 }} {{- with .Values.commonAnnotations }} @@ -17,26 +11,69 @@ metadata: {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} {{- end }} spec: - podSelector: {} + podSelector: + matchLabels: + app.kubernetes.io/name: data-index-service + app.kubernetes.io/managed-by: sonataflow-operator + policyTypes: + - Ingress + - Egress +--- +# Default-deny for SonataFlow Jobs Service pods created by the operator. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "rhdh.fullname" . }}-sonataflow-jobs-service-default-deny + labels: + {{- include "rhdh.labels" . | nindent 4 }} + {{- with .Values.commonAnnotations }} + annotations: + {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: + app.kubernetes.io/name: jobs-service + app.kubernetes.io/managed-by: sonataflow-operator + policyTypes: + - Ingress + - Egress +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "rhdh.fullname" . }}-allow-infra-ns-to-sonataflow + labels: + {{- include "rhdh.labels" . | nindent 4 }} + {{- with .Values.commonAnnotations }} + annotations: + {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator + policyTypes: + - Ingress ingress: - from: - - namespaceSelector: - matchLabels: - # Allow knative events to be delivered to workflows. - kubernetes.io/metadata.name: knative-eventing - - namespaceSelector: - matchLabels: - # Allow auxiliary knative function for workflow (such as m2k-save-transformation) - kubernetes.io/metadata.name: knative-serving - - namespaceSelector: - matchLabels: - # Allow openshift serverless logic operator controller pod to access all pods in sonataflow - kubernetes.io/metadata.name: openshift-serverless-logic + - namespaceSelector: + matchLabels: + # Allow knative events to be delivered to workflows. + kubernetes.io/metadata.name: knative-eventing + - namespaceSelector: + matchLabels: + # Allow auxiliary knative function for workflow (such as m2k-save-transformation) + kubernetes.io/metadata.name: knative-serving + - namespaceSelector: + matchLabels: + # Allow openshift serverless logic operator controller pod to access SonataFlow pods + kubernetes.io/metadata.name: openshift-serverless-logic --- apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: - name: {{ include "rhdh.fullname" . }}-allow-external-communication + name: {{ include "rhdh.fullname" . }}-allow-router-ingress-to-sonataflow labels: {{- include "rhdh.labels" . | nindent 4 }} {{- with .Values.commonAnnotations }} @@ -44,20 +81,22 @@ metadata: {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} {{- end }} spec: - podSelector: {} + podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator policyTypes: - Ingress ingress: - from: - - namespaceSelector: - matchLabels: - # Allow knative events to be delivered to workflows. - policy-group.network.openshift.io/ingress: "" + - namespaceSelector: + matchLabels: + # Allow OpenShift Router / ingress controller to reach SonataFlow pods. + policy-group.network.openshift.io/ingress: "" --- apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: - name: {{ include "rhdh.fullname" . }}-allow-intra-network + name: {{ include "rhdh.fullname" . }}-allow-backstage-to-sonataflow labels: {{- include "rhdh.labels" . | nindent 4 }} {{- with .Values.commonAnnotations }} @@ -65,22 +104,21 @@ metadata: {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} {{- end }} spec: - podSelector: {} + podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator policyTypes: - Ingress ingress: - from: - - podSelector: {} -{{- end }} -{{- if .Values.orchestrator.enabled }} -# Allow all egress from all pods in the namespace. -# The Orchestrator backend plugin needs HTTP egress to reach SonataFlow and Data Index services; -# SonataFlow workflows may also need arbitrary outbound access. + - podSelector: + matchLabels: + {{- include "rhdh.selectorLabels" . | nindent 14 }} --- apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: - name: {{ include "rhdh.fullname" . }}-allow-all-egress + name: {{ include "rhdh.fullname" . }}-allow-sonataflow-intra labels: {{- include "rhdh.labels" . | nindent 4 }} {{- with .Values.commonAnnotations }} @@ -88,18 +126,202 @@ metadata: {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} {{- end }} spec: - podSelector: {} + podSelector: + matchLabels: + # Allow SonataFlow pods to communicate with each other + app.kubernetes.io/managed-by: sonataflow-operator policyTypes: + - Ingress - Egress + ingress: + - from: + - podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator + - namespaceSelector: {} + podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator egress: - - {} -{{- end }} + - to: + - podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator + - namespaceSelector: {} + podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator +--- +# Allow DNS egress from SonataFlow-managed pods. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "rhdh.fullname" . }}-allow-sonataflow-dns-egress + labels: + {{- include "rhdh.labels" . | nindent 4 }} + {{- with .Values.commonAnnotations }} + annotations: + {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator + policyTypes: + - Egress + egress: + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + - port: 5353 + protocol: UDP + - port: 5353 + protocol: TCP +--- +# Allow HTTPS and Kubernetes API egress from SonataFlow-managed pods. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "rhdh.fullname" . }}-allow-sonataflow-https-egress + labels: + {{- include "rhdh.labels" . | nindent 4 }} + {{- with .Values.commonAnnotations }} + annotations: + {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator + policyTypes: + - Egress + egress: + - ports: + - port: 443 + protocol: TCP + - port: 6443 + protocol: TCP +--- +# Allow SonataFlow-managed pods to reach PostgreSQL. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "rhdh.fullname" . }}-allow-sonataflow-postgresql-egress + labels: + {{- include "rhdh.labels" . | nindent 4 }} + {{- with .Values.commonAnnotations }} + annotations: + {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator + policyTypes: + - Egress + egress: + - {{- if .Values.postgresql.enabled }} + to: + - podSelector: + matchLabels: + app.kubernetes.io/name: postgresql + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/component: primary + {{- if eq (default "standalone" .Values.postgresql.architecture) "replication" }} + - podSelector: + matchLabels: + app.kubernetes.io/name: postgresql + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/component: read + {{- end }} + {{- end }} + ports: + - port: {{ if .Values.postgresql.enabled }}5432{{ else }}{{ .Values.orchestrator.sonataflowPlatform.externalDB.port | default 5432 }}{{ end }} + protocol: TCP +--- +# Allow SonataFlow-managed pods to call RHDH APIs on port 7007. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "rhdh.fullname" . }}-allow-sonataflow-to-backstage-egress + labels: + {{- include "rhdh.labels" . | nindent 4 }} + {{- with .Values.commonAnnotations }} + annotations: + {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator + policyTypes: + - Egress + egress: + - to: + - podSelector: + matchLabels: + {{- include "rhdh.selectorLabels" . | nindent 14 }} + ports: + - port: 7007 + protocol: TCP --- +# Allow SonataFlow-managed pods to reach the RHDH backend on port 7007 (matching ingress). +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "rhdh.fullname" . }}-allow-sonataflow-to-backstage-ingress + labels: + {{- include "rhdh.labels" . | nindent 4 }} + {{- with .Values.commonAnnotations }} + annotations: + {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: + {{- include "rhdh.selectorLabels" . | nindent 6 }} + policyTypes: + - Ingress + ingress: + - from: + - podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator + ports: + - port: 7007 + protocol: TCP +--- +# Allow the Orchestrator backend plugin to reach SonataFlow / Data Index services. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "rhdh.fullname" . }}-allow-backstage-to-sonataflow-egress + labels: + {{- include "rhdh.labels" . | nindent 4 }} + {{- with .Values.commonAnnotations }} + annotations: + {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: + {{- include "rhdh.selectorLabels" . | nindent 6 }} + policyTypes: + - Egress + egress: + - to: + - podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator +{{- end }} {{- if and .Values.orchestrator.enabled .Values.orchestrator.sonataflowPlatform.monitoring.enabled }} +--- apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: - name: {{ include "rhdh.fullname" . }}-allow-monitoring-to-sonataflow-and-workflows + name: {{ include "rhdh.fullname" . }}-allow-monitoring-to-sonataflow labels: {{- include "rhdh.labels" . | nindent 4 }} {{- with .Values.commonAnnotations }} @@ -107,13 +329,29 @@ metadata: {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} {{- end }} spec: - podSelector: {} + podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator policyTypes: - Ingress ingress: - from: - - namespaceSelector: - matchLabels: - # Allow openshift-user-workload-monitoring pods to access the workflow. - kubernetes.io/metadata.name: openshift-user-workload-monitoring + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: openshift-monitoring + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: openshift-user-workload-monitoring + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: gmp-system + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: gke-gmp-system + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: monitoring + ports: + - port: 8080 + protocol: TCP {{- end }} diff --git a/charts/rhdh/templates/orchestrator/sonataflows.yaml b/charts/rhdh/templates/orchestrator/sonataflows.yaml index de951f350..4881a0749 100644 --- a/charts/rhdh/templates/orchestrator/sonataflows.yaml +++ b/charts/rhdh/templates/orchestrator/sonataflows.yaml @@ -103,6 +103,9 @@ spec: {{- end }} activeDeadlineSeconds: {{ .Values.orchestrator.sonataflowPlatform.dbCreationJob.activeDeadlineSeconds }} template: + metadata: + labels: + {{- include "rhdh.selectorLabels" . | nindent 8 }} spec: initContainers: - name: wait-for-db