From e595e74ade05a5e089233aae554cdc42a221d42f Mon Sep 17 00:00:00 2001 From: Leanne Ahern Date: Tue, 6 Oct 2026 00:26:26 +0100 Subject: [PATCH 01/10] Updating networkpolicies accordingly Signed-off-by: Leanne Ahern --- .../orchestrator/network-policies.yaml | 146 ++++++++++++------ 1 file changed, 103 insertions(+), 43 deletions(-) diff --git a/charts/rhdh/templates/orchestrator/network-policies.yaml b/charts/rhdh/templates/orchestrator/network-policies.yaml index d20e38579..6aaebdab3 100644 --- a/charts/rhdh/templates/orchestrator/network-policies.yaml +++ b/charts/rhdh/templates/orchestrator/network-policies.yaml @@ -1,15 +1,8 @@ -# TODO: these Orchestrator policies use podSelector: {} (namespace-wide) and conflict with -# the ADR's "default deny with selective allow" and "label-scoped policies" principles. -# They weaken per-component ingress isolation for RHDH backend and DB pods in the same namespace. -# Even though only one Orchestrator-flavoured RHDH instance is supported per namespace (the -# SonataFlow Operator enforces one SonataFlowPlatform per namespace), a non-Orchestrator RHDH -# instance could coexist in the same namespace; these namespace-wide policies would affect it too. -# Review and make stricter by scoping to SonataFlow-specific labels where possible. {{- if .Values.orchestrator.enabled }} apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: - name: {{ include "rhdh.fullname" . }}-allow-infra-ns-to-workflow-ns + name: {{ include "rhdh.fullname" . }}-allow-infra-ns-to-sonataflow labels: {{- include "rhdh.labels" . | nindent 4 }} {{- with .Values.commonAnnotations }} @@ -17,26 +10,28 @@ metadata: {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} {{- end }} spec: - podSelector: {} + podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator ingress: - from: - - namespaceSelector: - matchLabels: - # Allow knative events to be delivered to workflows. - kubernetes.io/metadata.name: knative-eventing - - namespaceSelector: - matchLabels: - # Allow auxiliary knative function for workflow (such as m2k-save-transformation) - kubernetes.io/metadata.name: knative-serving - - namespaceSelector: - matchLabels: - # Allow openshift serverless logic operator controller pod to access all pods in sonataflow - kubernetes.io/metadata.name: openshift-serverless-logic + - namespaceSelector: + matchLabels: + # Allow knative events to be delivered to workflows. + kubernetes.io/metadata.name: knative-eventing + - namespaceSelector: + matchLabels: + # Allow auxiliary knative function for workflow (such as m2k-save-transformation) + kubernetes.io/metadata.name: knative-serving + - namespaceSelector: + matchLabels: + # Allow openshift serverless logic operator controller pod to access SonataFlow pods + kubernetes.io/metadata.name: openshift-serverless-logic --- apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: - name: {{ include "rhdh.fullname" . }}-allow-external-communication + name: {{ include "rhdh.fullname" . }}-allow-router-ingress-to-sonataflow labels: {{- include "rhdh.labels" . | nindent 4 }} {{- with .Values.commonAnnotations }} @@ -44,20 +39,25 @@ metadata: {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} {{- end }} spec: - podSelector: {} + podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator policyTypes: - Ingress ingress: - from: - - namespaceSelector: - matchLabels: - # Allow knative events to be delivered to workflows. - policy-group.network.openshift.io/ingress: "" + - namespaceSelector: + matchLabels: + # Allow OpenShift Router / ingress controller to reach SonataFlow pods. + policy-group.network.openshift.io/ingress: "" + ports: + - port: 80 + protocol: TCP --- apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: - name: {{ include "rhdh.fullname" . }}-allow-intra-network + name: {{ include "rhdh.fullname" . }}-allow-backstage-to-sonataflow labels: {{- include "rhdh.labels" . | nindent 4 }} {{- with .Values.commonAnnotations }} @@ -65,22 +65,24 @@ metadata: {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} {{- end }} spec: - podSelector: {} + podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator policyTypes: - Ingress ingress: - from: - - podSelector: {} -{{- end }} -{{- if .Values.orchestrator.enabled }} -# Allow all egress from all pods in the namespace. -# The Orchestrator backend plugin needs HTTP egress to reach SonataFlow and Data Index services; -# SonataFlow workflows may also need arbitrary outbound access. + - podSelector: + matchLabels: + {{- include "rhdh.selectorLabels" . | nindent 14 }} + ports: + - port: 80 + protocol: TCP --- apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: - name: {{ include "rhdh.fullname" . }}-allow-all-egress + name: {{ include "rhdh.fullname" . }}-allow-sonataflow-intra labels: {{- include "rhdh.labels" . | nindent 4 }} {{- with .Values.commonAnnotations }} @@ -88,18 +90,74 @@ metadata: {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} {{- end }} spec: - podSelector: {} + podSelector: + matchLabels: + # Allow SonataFlow pods to communicate with each other + app.kubernetes.io/managed-by: sonataflow-operator + policyTypes: + - Ingress + ingress: + - from: + - podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator + ports: + - port: 80 + protocol: TCP +--- +# Allow all egress from SonataFlow-managed pods. +# SonataFlow workflows may need arbitrary outbound access. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "rhdh.fullname" . }}-allow-sonataflow-all-egress + labels: + {{- include "rhdh.labels" . | nindent 4 }} + {{- with .Values.commonAnnotations }} + annotations: + {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator policyTypes: - Egress egress: - {} +--- +# Allow the Orchestrator backend plugin to reach SonataFlow / Data Index services. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "rhdh.fullname" . }}-allow-backstage-to-sonataflow-egress + labels: + {{- include "rhdh.labels" . | nindent 4 }} + {{- with .Values.commonAnnotations }} + annotations: + {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: + {{- include "rhdh.selectorLabels" . | nindent 6 }} + policyTypes: + - Egress + egress: + - to: + - podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator + ports: + - port: 80 + protocol: TCP {{- end }} --- {{- if and .Values.orchestrator.enabled .Values.orchestrator.sonataflowPlatform.monitoring.enabled }} apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: - name: {{ include "rhdh.fullname" . }}-allow-monitoring-to-sonataflow-and-workflows + name: {{ include "rhdh.fullname" . }}-allow-monitoring-to-sonataflow labels: {{- include "rhdh.labels" . | nindent 4 }} {{- with .Values.commonAnnotations }} @@ -107,13 +165,15 @@ metadata: {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} {{- end }} spec: - podSelector: {} + podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator policyTypes: - Ingress ingress: - from: - - namespaceSelector: - matchLabels: - # Allow openshift-user-workload-monitoring pods to access the workflow. - kubernetes.io/metadata.name: openshift-user-workload-monitoring + - namespaceSelector: + matchLabels: + # Allow openshift-user-workload-monitoring pods to access SonataFlow pods + kubernetes.io/metadata.name: openshift-user-workload-monitoring {{- end }} From abdd6f3e4b2979808fa07feb0934da59125d58df Mon Sep 17 00:00:00 2001 From: Leanne Ahern Date: Tue, 6 Oct 2026 00:41:25 +0100 Subject: [PATCH 02/10] Updating ReadMe based on changes made to networkpolicies Signed-off-by: Leanne Ahern --- charts/rhdh/README.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/charts/rhdh/README.md b/charts/rhdh/README.md index ac9091db0..1e4840daa 100644 --- a/charts/rhdh/README.md +++ b/charts/rhdh/README.md @@ -564,6 +564,8 @@ extraDeploy: This chart deploys a **default-deny** NetworkPolicy for the RHDH backend pod, blocking all ingress and egress traffic that is not explicitly allowed. When the built-in PostgreSQL is enabled (`postgresql.enabled=true`), the database pods also get their own default-deny policy with selective allow rules. When OKP is active, its pods receive a separate default-deny ingress and egress policy with rules allowing only the required HTTP ingress. +When `orchestrator.enabled=true`, the chart also creates NetworkPolicies for SonataFlow-managed pods (`app.kubernetes.io/managed-by: sonataflow-operator`) and for RHDH-to-SonataFlow access on port 80; these policies are label-scoped and do not use namespace-wide `podSelector: {}`. + The following traffic is allowed out of the box: | Direction | Port | Destination / Source | Purpose | @@ -577,11 +579,20 @@ The following traffic is allowed out of the box: | Ingress | 7007 (TCP) | OpenShift router namespace or any namespace (non-OCP) | User traffic via Route / Ingress | | Ingress | 8080 (TCP) | RHDH pods and the OpenShift router namespace or any namespace (non-OCP) | OKP queries and product-document citations via Route / Ingress | | Ingress | 9464 (TCP) | `openshift-monitoring`, `openshift-user-workload-monitoring`, `gmp-system`, `gke-gmp-system`, `monitoring` | Prometheus metrics scraping | +| Ingress | 80 (TCP) | OpenShift router namespace → SonataFlow pods | Orchestrator / SonataFlow Routes (NP created only when `orchestrator.enabled=true`) | +| Ingress | 80 (TCP) | RHDH pods → SonataFlow pods | Orchestrator backend to Data Index / workflows (NP created only when `orchestrator.enabled=true`) | +| Ingress | 80 (TCP) | SonataFlow pods → SonataFlow pods | SonataFlow inter-pod traffic (NP created only when `orchestrator.enabled=true`) | +| Ingress | any | `knative-eventing`, `knative-serving`, `openshift-serverless-logic` → SonataFlow pods | Orchestrator infra namespaces (NP created only when `orchestrator.enabled=true`) | +| Ingress | any | `openshift-user-workload-monitoring` → SonataFlow pods | SonataFlow metrics scrape (NP created only when `orchestrator.enabled=true` and `orchestrator.sonataflowPlatform.monitoring.enabled=true`) | +| Egress | 80 (TCP) | RHDH pods → SonataFlow pods | Orchestrator backend HTTP to SonataFlow / Data Index (NP created only when `orchestrator.enabled=true`) | +| Egress | any | SonataFlow pods → any | SonataFlow / workflow outbound access (NP created only when `orchestrator.enabled=true`) | OKP initiates no outbound connections: its HTTP server and Solr process run in the same pod and serve the documentation embedded in the image. Its default-deny policy therefore blocks all new egress connections. NetworkPolicy is stateful, so response traffic for allowed ingress connections remains permitted. RHDH already permits HTTPS egress on port 443. When OKP uses HTTP instead, the chart permits RHDH egress on port 80 for a Kubernetes Ingress or restricts port 8080 egress to OKP pods for the internal Service fallback. No additional RHDH egress policy is created when `OKP_SERVICE_URL` uses HTTPS. +When Orchestrator is enabled (`orchestrator.enabled=true`), the chart creates additional NetworkPolicies scoped to pods labeled `app.kubernetes.io/managed-by: sonataflow-operator` (Data Index, Jobs Service, and workflow pods managed by the SonataFlow Operator). These allow ingress from the Knative Eventing/Serving and OpenShift Serverless Logic namespaces, from the OpenShift router on port 80, from other SonataFlow pods on port 80, and (when `orchestrator.sonataflowPlatform.monitoring.enabled=true`) from `openshift-user-workload-monitoring`. SonataFlow pods also receive unrestricted egress. Separately, the RHDH backend pod (selected via `rhdh.selectorLabels`) is allowed to reach SonataFlow pods on port 80 (RHDH egress and matching SonataFlow ingress) so the Orchestrator plugins can reach Data Index and workflow services. + **Redis egress is intentionally unscoped.** RHDH does not deploy Redis; users bring their own instance, which may live in the same namespace, a different namespace, or an external managed service. The rule therefore allows egress on port 6379 to any destination. **Bitnami subchart NetworkPolicies are disabled** (`postgresql.primary.networkPolicy.enabled=false`, `postgresql.readReplicas.networkPolicy.enabled=false`) because this chart provides its own tighter policies for the built-in database pods. @@ -672,6 +683,7 @@ helm install redhat-developer/redhat-developer-hub-orchestrator-i ``` helm install redhat-developer/redhat-developer-hub --set orchestrator.enabled=true ``` +Enabling Orchestrator also creates label-scoped NetworkPolicies for SonataFlow-managed pods and for RHDH access to SonataFlow on port 80; they are not namespace-wide. See [NetworkPolicies](#networkpolicies) for details. Note that serverlessLogicOperator, and serverlessOperator are enabled by default. They can be disabled together or seperately by passing the following flags: `--set orchestrator.serverlessLogicOperator.enabled=false --set orchestrator.serverlessOperator.enabled=false` From 7b0d789b9700e32e6fca01ccc339ead04542a372 Mon Sep 17 00:00:00 2001 From: Leanne Ahern Date: Tue, 6 Oct 2026 00:43:07 +0100 Subject: [PATCH 03/10] Bumping chart version - patch Signed-off-by: Leanne Ahern --- charts/rhdh/Chart.yaml | 2 +- charts/rhdh/README.md | 16 ++-------------- 2 files changed, 3 insertions(+), 15 deletions(-) diff --git a/charts/rhdh/Chart.yaml b/charts/rhdh/Chart.yaml index 52a62af15..30e422c43 100644 --- a/charts/rhdh/Chart.yaml +++ b/charts/rhdh/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 name: redhat-developer-hub type: application -version: 3.5.3 +version: 3.5.4 appVersion: 2.2.0 annotations: artifacthub.io/category: integration-delivery diff --git a/charts/rhdh/README.md b/charts/rhdh/README.md index 1e4840daa..6b8943b67 100644 --- a/charts/rhdh/README.md +++ b/charts/rhdh/README.md @@ -1,7 +1,7 @@ # RHDH Helm Chart for OpenShift and Kubernetes -![Version: 3.5.3](https://img.shields.io/badge/Version-3.5.3-informational?style=flat-square) +![Version: 3.5.4](https://img.shields.io/badge/Version-3.5.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) A Helm chart for deploying Red Hat Developer Hub, which is a Red Hat supported version of Backstage. @@ -36,7 +36,7 @@ For the **Generally Available** version of this chart, see: helm repo add bitnami https://charts.bitnami.com/bitnami helm repo add redhat-developer https://redhat-developer.github.io/rhdh-chart -helm install my-rhdh redhat-developer/redhat-developer-hub --version 3.5.3 +helm install my-rhdh redhat-developer/redhat-developer-hub --version 3.5.4 ``` ## Introduction @@ -564,8 +564,6 @@ extraDeploy: This chart deploys a **default-deny** NetworkPolicy for the RHDH backend pod, blocking all ingress and egress traffic that is not explicitly allowed. When the built-in PostgreSQL is enabled (`postgresql.enabled=true`), the database pods also get their own default-deny policy with selective allow rules. When OKP is active, its pods receive a separate default-deny ingress and egress policy with rules allowing only the required HTTP ingress. -When `orchestrator.enabled=true`, the chart also creates NetworkPolicies for SonataFlow-managed pods (`app.kubernetes.io/managed-by: sonataflow-operator`) and for RHDH-to-SonataFlow access on port 80; these policies are label-scoped and do not use namespace-wide `podSelector: {}`. - The following traffic is allowed out of the box: | Direction | Port | Destination / Source | Purpose | @@ -579,20 +577,11 @@ The following traffic is allowed out of the box: | Ingress | 7007 (TCP) | OpenShift router namespace or any namespace (non-OCP) | User traffic via Route / Ingress | | Ingress | 8080 (TCP) | RHDH pods and the OpenShift router namespace or any namespace (non-OCP) | OKP queries and product-document citations via Route / Ingress | | Ingress | 9464 (TCP) | `openshift-monitoring`, `openshift-user-workload-monitoring`, `gmp-system`, `gke-gmp-system`, `monitoring` | Prometheus metrics scraping | -| Ingress | 80 (TCP) | OpenShift router namespace → SonataFlow pods | Orchestrator / SonataFlow Routes (NP created only when `orchestrator.enabled=true`) | -| Ingress | 80 (TCP) | RHDH pods → SonataFlow pods | Orchestrator backend to Data Index / workflows (NP created only when `orchestrator.enabled=true`) | -| Ingress | 80 (TCP) | SonataFlow pods → SonataFlow pods | SonataFlow inter-pod traffic (NP created only when `orchestrator.enabled=true`) | -| Ingress | any | `knative-eventing`, `knative-serving`, `openshift-serverless-logic` → SonataFlow pods | Orchestrator infra namespaces (NP created only when `orchestrator.enabled=true`) | -| Ingress | any | `openshift-user-workload-monitoring` → SonataFlow pods | SonataFlow metrics scrape (NP created only when `orchestrator.enabled=true` and `orchestrator.sonataflowPlatform.monitoring.enabled=true`) | -| Egress | 80 (TCP) | RHDH pods → SonataFlow pods | Orchestrator backend HTTP to SonataFlow / Data Index (NP created only when `orchestrator.enabled=true`) | -| Egress | any | SonataFlow pods → any | SonataFlow / workflow outbound access (NP created only when `orchestrator.enabled=true`) | OKP initiates no outbound connections: its HTTP server and Solr process run in the same pod and serve the documentation embedded in the image. Its default-deny policy therefore blocks all new egress connections. NetworkPolicy is stateful, so response traffic for allowed ingress connections remains permitted. RHDH already permits HTTPS egress on port 443. When OKP uses HTTP instead, the chart permits RHDH egress on port 80 for a Kubernetes Ingress or restricts port 8080 egress to OKP pods for the internal Service fallback. No additional RHDH egress policy is created when `OKP_SERVICE_URL` uses HTTPS. -When Orchestrator is enabled (`orchestrator.enabled=true`), the chart creates additional NetworkPolicies scoped to pods labeled `app.kubernetes.io/managed-by: sonataflow-operator` (Data Index, Jobs Service, and workflow pods managed by the SonataFlow Operator). These allow ingress from the Knative Eventing/Serving and OpenShift Serverless Logic namespaces, from the OpenShift router on port 80, from other SonataFlow pods on port 80, and (when `orchestrator.sonataflowPlatform.monitoring.enabled=true`) from `openshift-user-workload-monitoring`. SonataFlow pods also receive unrestricted egress. Separately, the RHDH backend pod (selected via `rhdh.selectorLabels`) is allowed to reach SonataFlow pods on port 80 (RHDH egress and matching SonataFlow ingress) so the Orchestrator plugins can reach Data Index and workflow services. - **Redis egress is intentionally unscoped.** RHDH does not deploy Redis; users bring their own instance, which may live in the same namespace, a different namespace, or an external managed service. The rule therefore allows egress on port 6379 to any destination. **Bitnami subchart NetworkPolicies are disabled** (`postgresql.primary.networkPolicy.enabled=false`, `postgresql.readReplicas.networkPolicy.enabled=false`) because this chart provides its own tighter policies for the built-in database pods. @@ -683,7 +672,6 @@ helm install redhat-developer/redhat-developer-hub-orchestrator-i ``` helm install redhat-developer/redhat-developer-hub --set orchestrator.enabled=true ``` -Enabling Orchestrator also creates label-scoped NetworkPolicies for SonataFlow-managed pods and for RHDH access to SonataFlow on port 80; they are not namespace-wide. See [NetworkPolicies](#networkpolicies) for details. Note that serverlessLogicOperator, and serverlessOperator are enabled by default. They can be disabled together or seperately by passing the following flags: `--set orchestrator.serverlessLogicOperator.enabled=false --set orchestrator.serverlessOperator.enabled=false` From 79a3ba2293f9d591fdca52951ee4039e37a1f305 Mon Sep 17 00:00:00 2001 From: Leanne Ahern Date: Tue, 6 Oct 2026 01:02:43 +0100 Subject: [PATCH 04/10] Updating Readme template as readme was being over written with pre-commit Signed-off-by: Leanne Ahern --- charts/rhdh/README.md | 12 ++++++++++++ charts/rhdh/README.md.gotmpl | 12 ++++++++++++ 2 files changed, 24 insertions(+) diff --git a/charts/rhdh/README.md b/charts/rhdh/README.md index 6b8943b67..b0b481cfd 100644 --- a/charts/rhdh/README.md +++ b/charts/rhdh/README.md @@ -564,6 +564,8 @@ extraDeploy: This chart deploys a **default-deny** NetworkPolicy for the RHDH backend pod, blocking all ingress and egress traffic that is not explicitly allowed. When the built-in PostgreSQL is enabled (`postgresql.enabled=true`), the database pods also get their own default-deny policy with selective allow rules. When OKP is active, its pods receive a separate default-deny ingress and egress policy with rules allowing only the required HTTP ingress. +When `orchestrator.enabled=true`, the chart also creates NetworkPolicies for SonataFlow-managed pods (`app.kubernetes.io/managed-by: sonataflow-operator`) and for RHDH-to-SonataFlow access on port 80; these policies are label-scoped and do not use namespace-wide `podSelector: {}`. + The following traffic is allowed out of the box: | Direction | Port | Destination / Source | Purpose | @@ -577,11 +579,20 @@ The following traffic is allowed out of the box: | Ingress | 7007 (TCP) | OpenShift router namespace or any namespace (non-OCP) | User traffic via Route / Ingress | | Ingress | 8080 (TCP) | RHDH pods and the OpenShift router namespace or any namespace (non-OCP) | OKP queries and product-document citations via Route / Ingress | | Ingress | 9464 (TCP) | `openshift-monitoring`, `openshift-user-workload-monitoring`, `gmp-system`, `gke-gmp-system`, `monitoring` | Prometheus metrics scraping | +| Ingress | 80 (TCP) | OpenShift router namespace → SonataFlow pods | Orchestrator / SonataFlow Routes (NP created only when `orchestrator.enabled=true`) | +| Ingress | 80 (TCP) | RHDH pods → SonataFlow pods | Orchestrator backend to Data Index / workflows (NP created only when `orchestrator.enabled=true`) | +| Ingress | 80 (TCP) | SonataFlow pods → SonataFlow pods | SonataFlow inter-pod traffic (NP created only when `orchestrator.enabled=true`) | +| Ingress | any | `knative-eventing`, `knative-serving`, `openshift-serverless-logic` → SonataFlow pods | Orchestrator infra namespaces (NP created only when `orchestrator.enabled=true`) | +| Ingress | any | `openshift-user-workload-monitoring` → SonataFlow pods | SonataFlow metrics scrape (NP created only when `orchestrator.enabled=true` and `orchestrator.sonataflowPlatform.monitoring.enabled=true`) | +| Egress | 80 (TCP) | RHDH pods → SonataFlow pods | Orchestrator backend HTTP to SonataFlow / Data Index (NP created only when `orchestrator.enabled=true`) | +| Egress | any | SonataFlow pods → any | SonataFlow / workflow outbound access (NP created only when `orchestrator.enabled=true`) | OKP initiates no outbound connections: its HTTP server and Solr process run in the same pod and serve the documentation embedded in the image. Its default-deny policy therefore blocks all new egress connections. NetworkPolicy is stateful, so response traffic for allowed ingress connections remains permitted. RHDH already permits HTTPS egress on port 443. When OKP uses HTTP instead, the chart permits RHDH egress on port 80 for a Kubernetes Ingress or restricts port 8080 egress to OKP pods for the internal Service fallback. No additional RHDH egress policy is created when `OKP_SERVICE_URL` uses HTTPS. +When Orchestrator is enabled (`orchestrator.enabled=true`), the chart creates additional NetworkPolicies scoped to pods labeled `app.kubernetes.io/managed-by: sonataflow-operator` (Data Index, Jobs Service, and workflow pods managed by the SonataFlow Operator). These allow ingress from the Knative Eventing/Serving and OpenShift Serverless Logic namespaces, from the OpenShift router on port 80, from other SonataFlow pods on port 80, and (when `orchestrator.sonataflowPlatform.monitoring.enabled=true`) from `openshift-user-workload-monitoring`. SonataFlow pods also receive unrestricted egress. Separately, the RHDH backend pod (selected via `rhdh.selectorLabels`) is allowed to reach SonataFlow pods on port 80 (RHDH egress and matching SonataFlow ingress) so the Orchestrator plugins can reach Data Index and workflow services. The chart does not create a default-deny NetworkPolicy for SonataFlow pods. + **Redis egress is intentionally unscoped.** RHDH does not deploy Redis; users bring their own instance, which may live in the same namespace, a different namespace, or an external managed service. The rule therefore allows egress on port 6379 to any destination. **Bitnami subchart NetworkPolicies are disabled** (`postgresql.primary.networkPolicy.enabled=false`, `postgresql.readReplicas.networkPolicy.enabled=false`) because this chart provides its own tighter policies for the built-in database pods. @@ -672,6 +683,7 @@ helm install redhat-developer/redhat-developer-hub-orchestrator-i ``` helm install redhat-developer/redhat-developer-hub --set orchestrator.enabled=true ``` +Enabling Orchestrator also creates label-scoped NetworkPolicies for SonataFlow-managed pods and for RHDH access to SonataFlow on port 80; they are not namespace-wide. See [NetworkPolicies](#networkpolicies) for details. Note that serverlessLogicOperator, and serverlessOperator are enabled by default. They can be disabled together or seperately by passing the following flags: `--set orchestrator.serverlessLogicOperator.enabled=false --set orchestrator.serverlessOperator.enabled=false` diff --git a/charts/rhdh/README.md.gotmpl b/charts/rhdh/README.md.gotmpl index 3821a9e75..864678b3a 100644 --- a/charts/rhdh/README.md.gotmpl +++ b/charts/rhdh/README.md.gotmpl @@ -392,6 +392,8 @@ extraDeploy: This chart deploys a **default-deny** NetworkPolicy for the RHDH backend pod, blocking all ingress and egress traffic that is not explicitly allowed. When the built-in PostgreSQL is enabled (`postgresql.enabled=true`), the database pods also get their own default-deny policy with selective allow rules. When OKP is active, its pods receive a separate default-deny ingress and egress policy with rules allowing only the required HTTP ingress. +When `orchestrator.enabled=true`, the chart also creates NetworkPolicies for SonataFlow-managed pods (`app.kubernetes.io/managed-by: sonataflow-operator`) and for RHDH-to-SonataFlow access on port 80; these policies are label-scoped and do not use namespace-wide `podSelector: {}`. + The following traffic is allowed out of the box: | Direction | Port | Destination / Source | Purpose | @@ -405,11 +407,20 @@ The following traffic is allowed out of the box: | Ingress | 7007 (TCP) | OpenShift router namespace or any namespace (non-OCP) | User traffic via Route / Ingress | | Ingress | 8080 (TCP) | RHDH pods and the OpenShift router namespace or any namespace (non-OCP) | OKP queries and product-document citations via Route / Ingress | | Ingress | 9464 (TCP) | `openshift-monitoring`, `openshift-user-workload-monitoring`, `gmp-system`, `gke-gmp-system`, `monitoring` | Prometheus metrics scraping | +| Ingress | 80 (TCP) | OpenShift router namespace → SonataFlow pods | Orchestrator / SonataFlow Routes (NP created only when `orchestrator.enabled=true`) | +| Ingress | 80 (TCP) | RHDH pods → SonataFlow pods | Orchestrator backend to Data Index / workflows (NP created only when `orchestrator.enabled=true`) | +| Ingress | 80 (TCP) | SonataFlow pods → SonataFlow pods | SonataFlow inter-pod traffic (NP created only when `orchestrator.enabled=true`) | +| Ingress | any | `knative-eventing`, `knative-serving`, `openshift-serverless-logic` → SonataFlow pods | Orchestrator infra namespaces (NP created only when `orchestrator.enabled=true`) | +| Ingress | any | `openshift-user-workload-monitoring` → SonataFlow pods | SonataFlow metrics scrape (NP created only when `orchestrator.enabled=true` and `orchestrator.sonataflowPlatform.monitoring.enabled=true`) | +| Egress | 80 (TCP) | RHDH pods → SonataFlow pods | Orchestrator backend HTTP to SonataFlow / Data Index (NP created only when `orchestrator.enabled=true`) | +| Egress | any | SonataFlow pods → any | SonataFlow / workflow outbound access (NP created only when `orchestrator.enabled=true`) | OKP initiates no outbound connections: its HTTP server and Solr process run in the same pod and serve the documentation embedded in the image. Its default-deny policy therefore blocks all new egress connections. NetworkPolicy is stateful, so response traffic for allowed ingress connections remains permitted. RHDH already permits HTTPS egress on port 443. When OKP uses HTTP instead, the chart permits RHDH egress on port 80 for a Kubernetes Ingress or restricts port 8080 egress to OKP pods for the internal Service fallback. No additional RHDH egress policy is created when `OKP_SERVICE_URL` uses HTTPS. +When Orchestrator is enabled (`orchestrator.enabled=true`), the chart creates additional NetworkPolicies scoped to pods labeled `app.kubernetes.io/managed-by: sonataflow-operator` (Data Index, Jobs Service, and workflow pods managed by the SonataFlow Operator). These allow ingress from the Knative Eventing/Serving and OpenShift Serverless Logic namespaces, from the OpenShift router on port 80, from other SonataFlow pods on port 80, and (when `orchestrator.sonataflowPlatform.monitoring.enabled=true`) from `openshift-user-workload-monitoring`. SonataFlow pods also receive unrestricted egress. Separately, the RHDH backend pod (selected via `rhdh.selectorLabels`) is allowed to reach SonataFlow pods on port 80 (RHDH egress and matching SonataFlow ingress) so the Orchestrator plugins can reach Data Index and workflow services. The chart does not create a default-deny NetworkPolicy for SonataFlow pods. + **Redis egress is intentionally unscoped.** RHDH does not deploy Redis; users bring their own instance, which may live in the same namespace, a different namespace, or an external managed service. The rule therefore allows egress on port 6379 to any destination. **Bitnami subchart NetworkPolicies are disabled** (`postgresql.primary.networkPolicy.enabled=false`, `postgresql.readReplicas.networkPolicy.enabled=false`) because this chart provides its own tighter policies for the built-in database pods. @@ -500,6 +511,7 @@ helm install redhat-developer/redhat-developer-hub-orchestrator-i ``` helm install redhat-developer/redhat-developer-hub --set orchestrator.enabled=true ``` +Enabling Orchestrator also creates label-scoped NetworkPolicies for SonataFlow-managed pods and for RHDH access to SonataFlow on port 80; they are not namespace-wide. See [NetworkPolicies](#networkpolicies) for details. Note that serverlessLogicOperator, and serverlessOperator are enabled by default. They can be disabled together or seperately by passing the following flags: `--set orchestrator.serverlessLogicOperator.enabled=false --set orchestrator.serverlessOperator.enabled=false` From cfbccfb5c110ac8b2797a6b4f14c41dffbe4d3ca Mon Sep 17 00:00:00 2001 From: Leanne Ahern Date: Wed, 7 Oct 2026 12:43:15 +0100 Subject: [PATCH 05/10] Adding labels to sonataflows.yaml Signed-off-by: Leanne Ahern --- charts/rhdh/templates/orchestrator/sonataflows.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/charts/rhdh/templates/orchestrator/sonataflows.yaml b/charts/rhdh/templates/orchestrator/sonataflows.yaml index de951f350..aed902d01 100644 --- a/charts/rhdh/templates/orchestrator/sonataflows.yaml +++ b/charts/rhdh/templates/orchestrator/sonataflows.yaml @@ -103,6 +103,12 @@ spec: {{- end }} activeDeadlineSeconds: {{ .Values.orchestrator.sonataflowPlatform.dbCreationJob.activeDeadlineSeconds }} template: + metadata: + labels: + app.kubernetes.io/name: {{ include "rhdh.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/component: orchestrator-db-job + rhdh.redhat.com/orchestrator-db-job: "true" spec: initContainers: - name: wait-for-db From db836d0f2605b9844a6775c52baa9451a3ee32fc Mon Sep 17 00:00:00 2001 From: Leanne Ahern Date: Wed, 7 Oct 2026 13:47:32 +0100 Subject: [PATCH 06/10] Adding postgress ingress allow for sonataflow Signed-off-by: Leanne Ahern --- charts/rhdh/templates/network-policies.yaml | 33 +++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/charts/rhdh/templates/network-policies.yaml b/charts/rhdh/templates/network-policies.yaml index 5be32b576..1a7d066d0 100644 --- a/charts/rhdh/templates/network-policies.yaml +++ b/charts/rhdh/templates/network-policies.yaml @@ -360,6 +360,39 @@ spec: ports: - port: 5432 protocol: TCP +{{- if .Values.orchestrator.enabled }} +--- +# Allow SonataFlow-managed pods and the Orchestrator create-db job to reach the built-in PostgreSQL. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "rhdh.fullname" . }}-db-allow-sonataflow-ingress + labels: + {{- include "rhdh.labels" . | nindent 4 }} + {{- with .Values.commonAnnotations }} + annotations: + {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: + app.kubernetes.io/name: postgresql + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/component: primary + policyTypes: + - Ingress + ingress: + - from: + - podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator + - podSelector: + matchLabels: + rhdh.redhat.com/orchestrator-db-job: "true" + ports: + - port: 5432 + protocol: TCP +{{- end }} {{- if $isReplication }} From 92fdff7a223ef70fe166825fc11efc1eea67c456 Mon Sep 17 00:00:00 2001 From: Leanne Ahern Date: Wed, 7 Oct 2026 13:58:46 +0100 Subject: [PATCH 07/10] Updating ReadMe Signed-off-by: Leanne Ahern --- charts/rhdh/README.md | 7 ++++--- charts/rhdh/README.md.gotmpl | 7 ++++--- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/charts/rhdh/README.md b/charts/rhdh/README.md index b0b481cfd..467e46ff5 100644 --- a/charts/rhdh/README.md +++ b/charts/rhdh/README.md @@ -564,7 +564,7 @@ extraDeploy: This chart deploys a **default-deny** NetworkPolicy for the RHDH backend pod, blocking all ingress and egress traffic that is not explicitly allowed. When the built-in PostgreSQL is enabled (`postgresql.enabled=true`), the database pods also get their own default-deny policy with selective allow rules. When OKP is active, its pods receive a separate default-deny ingress and egress policy with rules allowing only the required HTTP ingress. -When `orchestrator.enabled=true`, the chart also creates NetworkPolicies for SonataFlow-managed pods (`app.kubernetes.io/managed-by: sonataflow-operator`) and for RHDH-to-SonataFlow access on port 80; these policies are label-scoped and do not use namespace-wide `podSelector: {}`. +When `orchestrator.enabled=true`, the chart also creates NetworkPolicies for SonataFlow-managed pods (`app.kubernetes.io/managed-by: sonataflow-operator`) and for RHDH-to-SonataFlow access on port 80; when the built-in PostgreSQL is also enabled, it adds a PostgreSQL ingress allow for those SonataFlow pods and the Orchestrator create-db Job. These policies are label-scoped and do not use namespace-wide `podSelector: {}`. The following traffic is allowed out of the box: @@ -586,12 +586,13 @@ The following traffic is allowed out of the box: | Ingress | any | `openshift-user-workload-monitoring` → SonataFlow pods | SonataFlow metrics scrape (NP created only when `orchestrator.enabled=true` and `orchestrator.sonataflowPlatform.monitoring.enabled=true`) | | Egress | 80 (TCP) | RHDH pods → SonataFlow pods | Orchestrator backend HTTP to SonataFlow / Data Index (NP created only when `orchestrator.enabled=true`) | | Egress | any | SonataFlow pods → any | SonataFlow / workflow outbound access (NP created only when `orchestrator.enabled=true`) | +| Ingress | 5432 (TCP) | SonataFlow pods and Orchestrator create-db Job → built-in PostgreSQL primary | Orchestrator / SonataFlow database access (NP created only when `orchestrator.enabled=true` and `postgresql.enabled=true`) | OKP initiates no outbound connections: its HTTP server and Solr process run in the same pod and serve the documentation embedded in the image. Its default-deny policy therefore blocks all new egress connections. NetworkPolicy is stateful, so response traffic for allowed ingress connections remains permitted. RHDH already permits HTTPS egress on port 443. When OKP uses HTTP instead, the chart permits RHDH egress on port 80 for a Kubernetes Ingress or restricts port 8080 egress to OKP pods for the internal Service fallback. No additional RHDH egress policy is created when `OKP_SERVICE_URL` uses HTTPS. -When Orchestrator is enabled (`orchestrator.enabled=true`), the chart creates additional NetworkPolicies scoped to pods labeled `app.kubernetes.io/managed-by: sonataflow-operator` (Data Index, Jobs Service, and workflow pods managed by the SonataFlow Operator). These allow ingress from the Knative Eventing/Serving and OpenShift Serverless Logic namespaces, from the OpenShift router on port 80, from other SonataFlow pods on port 80, and (when `orchestrator.sonataflowPlatform.monitoring.enabled=true`) from `openshift-user-workload-monitoring`. SonataFlow pods also receive unrestricted egress. Separately, the RHDH backend pod (selected via `rhdh.selectorLabels`) is allowed to reach SonataFlow pods on port 80 (RHDH egress and matching SonataFlow ingress) so the Orchestrator plugins can reach Data Index and workflow services. The chart does not create a default-deny NetworkPolicy for SonataFlow pods. +When Orchestrator is enabled (`orchestrator.enabled=true`), the chart creates additional NetworkPolicies scoped to pods labeled `app.kubernetes.io/managed-by: sonataflow-operator` (Data Index, Jobs Service, and workflow pods managed by the SonataFlow Operator). These allow ingress from the Knative Eventing/Serving and OpenShift Serverless Logic namespaces, from the OpenShift router on port 80, from other SonataFlow pods on port 80, and (when `orchestrator.sonataflowPlatform.monitoring.enabled=true`) from `openshift-user-workload-monitoring`. SonataFlow pods also receive unrestricted egress. Separately, the RHDH backend pod (selected via `rhdh.selectorLabels`) is allowed to reach SonataFlow pods on port 80 (RHDH egress and matching SonataFlow ingress) so the Orchestrator plugins can reach Data Index and workflow services. When the built-in PostgreSQL is enabled (`postgresql.enabled=true`), Postgres also admits TCP/5432 from SonataFlow-managed pods and from the Orchestrator create-db Job (labeled `rhdh.redhat.com/orchestrator-db-job: "true"`), in addition to the existing RHDH backend allow. The chart does not create a default-deny NetworkPolicy for SonataFlow pods. **Redis egress is intentionally unscoped.** RHDH does not deploy Redis; users bring their own instance, which may live in the same namespace, a different namespace, or an external managed service. The rule therefore allows egress on port 6379 to any destination. @@ -683,7 +684,7 @@ helm install redhat-developer/redhat-developer-hub-orchestrator-i ``` helm install redhat-developer/redhat-developer-hub --set orchestrator.enabled=true ``` -Enabling Orchestrator also creates label-scoped NetworkPolicies for SonataFlow-managed pods and for RHDH access to SonataFlow on port 80; they are not namespace-wide. See [NetworkPolicies](#networkpolicies) for details. +Enabling Orchestrator also creates label-scoped NetworkPolicies for SonataFlow-managed pods, for RHDH access to SonataFlow on port 80, and (when built-in PostgreSQL is enabled) for SonataFlow and create-db Job access to Postgres on TCP/5432; they are not namespace-wide. See [NetworkPolicies](#networkpolicies) for details. Note that serverlessLogicOperator, and serverlessOperator are enabled by default. They can be disabled together or seperately by passing the following flags: `--set orchestrator.serverlessLogicOperator.enabled=false --set orchestrator.serverlessOperator.enabled=false` diff --git a/charts/rhdh/README.md.gotmpl b/charts/rhdh/README.md.gotmpl index 864678b3a..7f8ab7af4 100644 --- a/charts/rhdh/README.md.gotmpl +++ b/charts/rhdh/README.md.gotmpl @@ -392,7 +392,7 @@ extraDeploy: This chart deploys a **default-deny** NetworkPolicy for the RHDH backend pod, blocking all ingress and egress traffic that is not explicitly allowed. When the built-in PostgreSQL is enabled (`postgresql.enabled=true`), the database pods also get their own default-deny policy with selective allow rules. When OKP is active, its pods receive a separate default-deny ingress and egress policy with rules allowing only the required HTTP ingress. -When `orchestrator.enabled=true`, the chart also creates NetworkPolicies for SonataFlow-managed pods (`app.kubernetes.io/managed-by: sonataflow-operator`) and for RHDH-to-SonataFlow access on port 80; these policies are label-scoped and do not use namespace-wide `podSelector: {}`. +When `orchestrator.enabled=true`, the chart also creates NetworkPolicies for SonataFlow-managed pods (`app.kubernetes.io/managed-by: sonataflow-operator`) and for RHDH-to-SonataFlow access on port 80; when the built-in PostgreSQL is also enabled, it adds a PostgreSQL ingress allow for those SonataFlow pods and the Orchestrator create-db Job. These policies are label-scoped and do not use namespace-wide `podSelector: {}`. The following traffic is allowed out of the box: @@ -414,12 +414,13 @@ The following traffic is allowed out of the box: | Ingress | any | `openshift-user-workload-monitoring` → SonataFlow pods | SonataFlow metrics scrape (NP created only when `orchestrator.enabled=true` and `orchestrator.sonataflowPlatform.monitoring.enabled=true`) | | Egress | 80 (TCP) | RHDH pods → SonataFlow pods | Orchestrator backend HTTP to SonataFlow / Data Index (NP created only when `orchestrator.enabled=true`) | | Egress | any | SonataFlow pods → any | SonataFlow / workflow outbound access (NP created only when `orchestrator.enabled=true`) | +| Ingress | 5432 (TCP) | SonataFlow pods and Orchestrator create-db Job → built-in PostgreSQL primary | Orchestrator / SonataFlow database access (NP created only when `orchestrator.enabled=true` and `postgresql.enabled=true`) | OKP initiates no outbound connections: its HTTP server and Solr process run in the same pod and serve the documentation embedded in the image. Its default-deny policy therefore blocks all new egress connections. NetworkPolicy is stateful, so response traffic for allowed ingress connections remains permitted. RHDH already permits HTTPS egress on port 443. When OKP uses HTTP instead, the chart permits RHDH egress on port 80 for a Kubernetes Ingress or restricts port 8080 egress to OKP pods for the internal Service fallback. No additional RHDH egress policy is created when `OKP_SERVICE_URL` uses HTTPS. -When Orchestrator is enabled (`orchestrator.enabled=true`), the chart creates additional NetworkPolicies scoped to pods labeled `app.kubernetes.io/managed-by: sonataflow-operator` (Data Index, Jobs Service, and workflow pods managed by the SonataFlow Operator). These allow ingress from the Knative Eventing/Serving and OpenShift Serverless Logic namespaces, from the OpenShift router on port 80, from other SonataFlow pods on port 80, and (when `orchestrator.sonataflowPlatform.monitoring.enabled=true`) from `openshift-user-workload-monitoring`. SonataFlow pods also receive unrestricted egress. Separately, the RHDH backend pod (selected via `rhdh.selectorLabels`) is allowed to reach SonataFlow pods on port 80 (RHDH egress and matching SonataFlow ingress) so the Orchestrator plugins can reach Data Index and workflow services. The chart does not create a default-deny NetworkPolicy for SonataFlow pods. +When Orchestrator is enabled (`orchestrator.enabled=true`), the chart creates additional NetworkPolicies scoped to pods labeled `app.kubernetes.io/managed-by: sonataflow-operator` (Data Index, Jobs Service, and workflow pods managed by the SonataFlow Operator). These allow ingress from the Knative Eventing/Serving and OpenShift Serverless Logic namespaces, from the OpenShift router on port 80, from other SonataFlow pods on port 80, and (when `orchestrator.sonataflowPlatform.monitoring.enabled=true`) from `openshift-user-workload-monitoring`. SonataFlow pods also receive unrestricted egress. Separately, the RHDH backend pod (selected via `rhdh.selectorLabels`) is allowed to reach SonataFlow pods on port 80 (RHDH egress and matching SonataFlow ingress) so the Orchestrator plugins can reach Data Index and workflow services. When the built-in PostgreSQL is enabled (`postgresql.enabled=true`), Postgres also admits TCP/5432 from SonataFlow-managed pods and from the Orchestrator create-db Job (labeled `rhdh.redhat.com/orchestrator-db-job: "true"`), in addition to the existing RHDH backend allow. The chart does not create a default-deny NetworkPolicy for SonataFlow pods. **Redis egress is intentionally unscoped.** RHDH does not deploy Redis; users bring their own instance, which may live in the same namespace, a different namespace, or an external managed service. The rule therefore allows egress on port 6379 to any destination. @@ -511,7 +512,7 @@ helm install redhat-developer/redhat-developer-hub-orchestrator-i ``` helm install redhat-developer/redhat-developer-hub --set orchestrator.enabled=true ``` -Enabling Orchestrator also creates label-scoped NetworkPolicies for SonataFlow-managed pods and for RHDH access to SonataFlow on port 80; they are not namespace-wide. See [NetworkPolicies](#networkpolicies) for details. +Enabling Orchestrator also creates label-scoped NetworkPolicies for SonataFlow-managed pods, for RHDH access to SonataFlow on port 80, and (when built-in PostgreSQL is enabled) for SonataFlow and create-db Job access to Postgres on TCP/5432; they are not namespace-wide. See [NetworkPolicies](#networkpolicies) for details. Note that serverlessLogicOperator, and serverlessOperator are enabled by default. They can be disabled together or seperately by passing the following flags: `--set orchestrator.serverlessLogicOperator.enabled=false --set orchestrator.serverlessOperator.enabled=false` From 72ec7e494938b6c8fd0e49eae99571a02b036d6e Mon Sep 17 00:00:00 2001 From: Leanne Ahern Date: Fri, 9 Oct 2026 16:36:30 +0100 Subject: [PATCH 08/10] bumping chart version for failing lint test Signed-off-by: Leanne Ahern --- charts/rhdh/Chart.yaml | 2 +- charts/rhdh/README.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/rhdh/Chart.yaml b/charts/rhdh/Chart.yaml index 30e422c43..704f994db 100644 --- a/charts/rhdh/Chart.yaml +++ b/charts/rhdh/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 name: redhat-developer-hub type: application -version: 3.5.4 +version: 3.5.5 appVersion: 2.2.0 annotations: artifacthub.io/category: integration-delivery diff --git a/charts/rhdh/README.md b/charts/rhdh/README.md index 467e46ff5..0466199fa 100644 --- a/charts/rhdh/README.md +++ b/charts/rhdh/README.md @@ -1,7 +1,7 @@ # RHDH Helm Chart for OpenShift and Kubernetes -![Version: 3.5.4](https://img.shields.io/badge/Version-3.5.4-informational?style=flat-square) +![Version: 3.5.5](https://img.shields.io/badge/Version-3.5.5-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) A Helm chart for deploying Red Hat Developer Hub, which is a Red Hat supported version of Backstage. @@ -36,7 +36,7 @@ For the **Generally Available** version of this chart, see: helm repo add bitnami https://charts.bitnami.com/bitnami helm repo add redhat-developer https://redhat-developer.github.io/rhdh-chart -helm install my-rhdh redhat-developer/redhat-developer-hub --version 3.5.4 +helm install my-rhdh redhat-developer/redhat-developer-hub --version 3.5.5 ``` ## Introduction From 97a56bdb5eacf05e9f8416b51731cb2032088a02 Mon Sep 17 00:00:00 2001 From: Leanne Ahern Date: Tue, 13 Oct 2026 01:04:54 +0100 Subject: [PATCH 09/10] Fixing policies to address comments Signed-off-by: Leanne Ahern --- charts/rhdh/README.md | 20 +- charts/rhdh/README.md.gotmpl | 20 +- charts/rhdh/templates/network-policies.yaml | 5 +- .../orchestrator/network-policies.yaml | 187 +++++++++++++++++- .../templates/orchestrator/sonataflows.yaml | 5 +- 5 files changed, 204 insertions(+), 33 deletions(-) diff --git a/charts/rhdh/README.md b/charts/rhdh/README.md index 7db925553..26135bf82 100644 --- a/charts/rhdh/README.md +++ b/charts/rhdh/README.md @@ -566,7 +566,7 @@ extraDeploy: This chart deploys a **default-deny** NetworkPolicy for the RHDH backend pod, blocking all ingress and egress traffic that is not explicitly allowed. When the built-in PostgreSQL is enabled (`postgresql.enabled=true`), the database pods also get their own default-deny policy with selective allow rules. When OKP is active, its pods receive a separate default-deny ingress and egress policy with rules allowing only the required HTTP ingress. -When `orchestrator.enabled=true`, the chart also creates NetworkPolicies for SonataFlow-managed pods (`app.kubernetes.io/managed-by: sonataflow-operator`) and for RHDH-to-SonataFlow access on port 80; when the built-in PostgreSQL is also enabled, it adds a PostgreSQL ingress allow for those SonataFlow pods and the Orchestrator create-db Job. These policies are label-scoped and do not use namespace-wide `podSelector: {}`. +When `orchestrator.enabled=true`, the chart also creates NetworkPolicies for SonataFlow Data Index and Jobs Service pods (default-deny, then selective allow) and for other pods labeled `app.kubernetes.io/managed-by: sonataflow-operator`. These include RHDH ↔ SonataFlow access, scoped SonataFlow egress (DNS, HTTPS, Kubernetes API, PostgreSQL, and RHDH on port 7007), and (when built-in PostgreSQL is enabled) PostgreSQL ingress from SonataFlow-managed pods. The Orchestrator create-db Job uses `rhdh.selectorLabels`, so it is covered by the existing RHDH → PostgreSQL allow. These policies are label-scoped and do not use namespace-wide `podSelector: {}`. The following traffic is allowed out of the box: @@ -581,20 +581,24 @@ The following traffic is allowed out of the box: | Ingress | 7007 (TCP) | OpenShift router namespace or any namespace (non-OCP) | User traffic via Route / Ingress | | Ingress | 8080 (TCP) | RHDH pods and the OpenShift router namespace or any namespace (non-OCP) | OKP queries and product-document citations via Route / Ingress | | Ingress | 9464 (TCP) | `openshift-monitoring`, `openshift-user-workload-monitoring`, `gmp-system`, `gke-gmp-system`, `monitoring` | Prometheus metrics scraping | -| Ingress | 80 (TCP) | OpenShift router namespace → SonataFlow pods | Orchestrator / SonataFlow Routes (NP created only when `orchestrator.enabled=true`) | +| Ingress | any | OpenShift router namespace → SonataFlow pods | Orchestrator / SonataFlow Routes (NP created only when `orchestrator.enabled=true`) | | Ingress | 80 (TCP) | RHDH pods → SonataFlow pods | Orchestrator backend to Data Index / workflows (NP created only when `orchestrator.enabled=true`) | -| Ingress | 80 (TCP) | SonataFlow pods → SonataFlow pods | SonataFlow inter-pod traffic (NP created only when `orchestrator.enabled=true`) | +| Ingress | any | SonataFlow pods → SonataFlow pods (same or other namespaces) | SonataFlow inter-pod traffic (NP created only when `orchestrator.enabled=true`) | | Ingress | any | `knative-eventing`, `knative-serving`, `openshift-serverless-logic` → SonataFlow pods | Orchestrator infra namespaces (NP created only when `orchestrator.enabled=true`) | -| Ingress | any | `openshift-user-workload-monitoring` → SonataFlow pods | SonataFlow metrics scrape (NP created only when `orchestrator.enabled=true` and `orchestrator.sonataflowPlatform.monitoring.enabled=true`) | +| Ingress | any | `openshift-monitoring`, `openshift-user-workload-monitoring`, `gmp-system`, `gke-gmp-system`, `monitoring` → SonataFlow pods | SonataFlow metrics scrape (NP created only when `orchestrator.enabled=true` and `orchestrator.sonataflowPlatform.monitoring.enabled=true`) | +| Ingress | 7007 (TCP) | SonataFlow pods → RHDH pods | Workflows calling RHDH APIs (NP created only when `orchestrator.enabled=true`) | | Egress | 80 (TCP) | RHDH pods → SonataFlow pods | Orchestrator backend HTTP to SonataFlow / Data Index (NP created only when `orchestrator.enabled=true`) | -| Egress | any | SonataFlow pods → any | SonataFlow / workflow outbound access (NP created only when `orchestrator.enabled=true`) | -| Ingress | 5432 (TCP) | SonataFlow pods and Orchestrator create-db Job → built-in PostgreSQL primary | Orchestrator / SonataFlow database access (NP created only when `orchestrator.enabled=true` and `postgresql.enabled=true`) | +| Egress | 53, 5353 (UDP/TCP) | SonataFlow pods → any | SonataFlow DNS (NP created only when `orchestrator.enabled=true`) | +| Egress | 443, 6443 (TCP) | SonataFlow pods → any | SonataFlow HTTPS and Kubernetes API (NP created only when `orchestrator.enabled=true`) | +| Egress | 5432 (TCP) | SonataFlow pods → built-in PostgreSQL (scoped) or any (external DB) | SonataFlow database access (NP created only when `orchestrator.enabled=true`) | +| Egress | 7007 (TCP) | SonataFlow pods → RHDH pods | Workflows calling RHDH APIs (NP created only when `orchestrator.enabled=true`) | +| Ingress | 5432 (TCP) | SonataFlow pods → built-in PostgreSQL primary | Orchestrator / SonataFlow database access (NP created only when `orchestrator.enabled=true` and `postgresql.enabled=true`) | OKP initiates no outbound connections: its HTTP server and Solr process run in the same pod and serve the documentation embedded in the image. Its default-deny policy therefore blocks all new egress connections. NetworkPolicy is stateful, so response traffic for allowed ingress connections remains permitted. RHDH already permits HTTPS egress on port 443. When OKP uses HTTP instead, the chart permits RHDH egress on port 80 for a Kubernetes Ingress or restricts port 8080 egress to OKP pods for the internal Service fallback. No additional RHDH egress policy is created when `OKP_SERVICE_URL` uses HTTPS. -When Orchestrator is enabled (`orchestrator.enabled=true`), the chart creates additional NetworkPolicies scoped to pods labeled `app.kubernetes.io/managed-by: sonataflow-operator` (Data Index, Jobs Service, and workflow pods managed by the SonataFlow Operator). These allow ingress from the Knative Eventing/Serving and OpenShift Serverless Logic namespaces, from the OpenShift router on port 80, from other SonataFlow pods on port 80, and (when `orchestrator.sonataflowPlatform.monitoring.enabled=true`) from `openshift-user-workload-monitoring`. SonataFlow pods also receive unrestricted egress. Separately, the RHDH backend pod (selected via `rhdh.selectorLabels`) is allowed to reach SonataFlow pods on port 80 (RHDH egress and matching SonataFlow ingress) so the Orchestrator plugins can reach Data Index and workflow services. When the built-in PostgreSQL is enabled (`postgresql.enabled=true`), Postgres also admits TCP/5432 from SonataFlow-managed pods and from the Orchestrator create-db Job (labeled `rhdh.redhat.com/orchestrator-db-job: "true"`), in addition to the existing RHDH backend allow. The chart does not create a default-deny NetworkPolicy for SonataFlow pods. +When Orchestrator is enabled (`orchestrator.enabled=true`), the chart first creates default-deny NetworkPolicies for the SonataFlow Data Index and Jobs Service pods, then selective allow policies for pods labeled `app.kubernetes.io/managed-by: sonataflow-operator`. These allow ingress from the Knative Eventing/Serving and OpenShift Serverless Logic namespaces, from the OpenShift router (any port), from other SonataFlow pods in the same or other namespaces, from RHDH on port 80, and (when `orchestrator.sonataflowPlatform.monitoring.enabled=true`) from known monitoring namespaces. SonataFlow egress is scoped to DNS, HTTPS (443), the Kubernetes API (6443), PostgreSQL (5432), and RHDH on port 7007; additional destinations must be allowed explicitly. Separately, the RHDH backend pod (selected via `rhdh.selectorLabels`) is allowed to reach SonataFlow pods on port 80, and SonataFlow pods are allowed to reach RHDH on port 7007. When the built-in PostgreSQL is enabled (`postgresql.enabled=true`), Postgres admits TCP/5432 from SonataFlow-managed pods; the Orchestrator create-db Job uses `rhdh.selectorLabels` and is covered by the existing RHDH backend PostgreSQL allow. **Redis egress is intentionally unscoped.** RHDH does not deploy Redis; users bring their own instance, which may live in the same namespace, a different namespace, or an external managed service. The rule therefore allows egress on port 6379 to any destination. @@ -686,7 +690,7 @@ helm install redhat-developer/redhat-developer-hub-orchestrator-i ``` helm install redhat-developer/redhat-developer-hub --set orchestrator.enabled=true ``` -Enabling Orchestrator also creates label-scoped NetworkPolicies for SonataFlow-managed pods, for RHDH access to SonataFlow on port 80, and (when built-in PostgreSQL is enabled) for SonataFlow and create-db Job access to Postgres on TCP/5432; they are not namespace-wide. See [NetworkPolicies](#networkpolicies) for details. +Enabling Orchestrator also creates label-scoped NetworkPolicies for SonataFlow-managed pods (default-deny for Data Index and Jobs Service, then selective allows), for RHDH ↔ SonataFlow access, and (when built-in PostgreSQL is enabled) for SonataFlow access to Postgres on TCP/5432; they are not namespace-wide. See [NetworkPolicies](#networkpolicies) for details. Note that serverlessLogicOperator, and serverlessOperator are enabled by default. They can be disabled together or seperately by passing the following flags: `--set orchestrator.serverlessLogicOperator.enabled=false --set orchestrator.serverlessOperator.enabled=false` diff --git a/charts/rhdh/README.md.gotmpl b/charts/rhdh/README.md.gotmpl index 7f8ab7af4..ca7a4a16d 100644 --- a/charts/rhdh/README.md.gotmpl +++ b/charts/rhdh/README.md.gotmpl @@ -392,7 +392,7 @@ extraDeploy: This chart deploys a **default-deny** NetworkPolicy for the RHDH backend pod, blocking all ingress and egress traffic that is not explicitly allowed. When the built-in PostgreSQL is enabled (`postgresql.enabled=true`), the database pods also get their own default-deny policy with selective allow rules. When OKP is active, its pods receive a separate default-deny ingress and egress policy with rules allowing only the required HTTP ingress. -When `orchestrator.enabled=true`, the chart also creates NetworkPolicies for SonataFlow-managed pods (`app.kubernetes.io/managed-by: sonataflow-operator`) and for RHDH-to-SonataFlow access on port 80; when the built-in PostgreSQL is also enabled, it adds a PostgreSQL ingress allow for those SonataFlow pods and the Orchestrator create-db Job. These policies are label-scoped and do not use namespace-wide `podSelector: {}`. +When `orchestrator.enabled=true`, the chart also creates NetworkPolicies for SonataFlow Data Index and Jobs Service pods (default-deny, then selective allow) and for other pods labeled `app.kubernetes.io/managed-by: sonataflow-operator`. These include RHDH ↔ SonataFlow access, scoped SonataFlow egress (DNS, HTTPS, Kubernetes API, PostgreSQL, and RHDH on port 7007), and (when built-in PostgreSQL is enabled) PostgreSQL ingress from SonataFlow-managed pods. The Orchestrator create-db Job uses `rhdh.selectorLabels`, so it is covered by the existing RHDH → PostgreSQL allow. These policies are label-scoped and do not use namespace-wide `podSelector: {}`. The following traffic is allowed out of the box: @@ -407,20 +407,24 @@ The following traffic is allowed out of the box: | Ingress | 7007 (TCP) | OpenShift router namespace or any namespace (non-OCP) | User traffic via Route / Ingress | | Ingress | 8080 (TCP) | RHDH pods and the OpenShift router namespace or any namespace (non-OCP) | OKP queries and product-document citations via Route / Ingress | | Ingress | 9464 (TCP) | `openshift-monitoring`, `openshift-user-workload-monitoring`, `gmp-system`, `gke-gmp-system`, `monitoring` | Prometheus metrics scraping | -| Ingress | 80 (TCP) | OpenShift router namespace → SonataFlow pods | Orchestrator / SonataFlow Routes (NP created only when `orchestrator.enabled=true`) | +| Ingress | any | OpenShift router namespace → SonataFlow pods | Orchestrator / SonataFlow Routes (NP created only when `orchestrator.enabled=true`) | | Ingress | 80 (TCP) | RHDH pods → SonataFlow pods | Orchestrator backend to Data Index / workflows (NP created only when `orchestrator.enabled=true`) | -| Ingress | 80 (TCP) | SonataFlow pods → SonataFlow pods | SonataFlow inter-pod traffic (NP created only when `orchestrator.enabled=true`) | +| Ingress | any | SonataFlow pods → SonataFlow pods (same or other namespaces) | SonataFlow inter-pod traffic (NP created only when `orchestrator.enabled=true`) | | Ingress | any | `knative-eventing`, `knative-serving`, `openshift-serverless-logic` → SonataFlow pods | Orchestrator infra namespaces (NP created only when `orchestrator.enabled=true`) | -| Ingress | any | `openshift-user-workload-monitoring` → SonataFlow pods | SonataFlow metrics scrape (NP created only when `orchestrator.enabled=true` and `orchestrator.sonataflowPlatform.monitoring.enabled=true`) | +| Ingress | any | `openshift-monitoring`, `openshift-user-workload-monitoring`, `gmp-system`, `gke-gmp-system`, `monitoring` → SonataFlow pods | SonataFlow metrics scrape (NP created only when `orchestrator.enabled=true` and `orchestrator.sonataflowPlatform.monitoring.enabled=true`) | +| Ingress | 7007 (TCP) | SonataFlow pods → RHDH pods | Workflows calling RHDH APIs (NP created only when `orchestrator.enabled=true`) | | Egress | 80 (TCP) | RHDH pods → SonataFlow pods | Orchestrator backend HTTP to SonataFlow / Data Index (NP created only when `orchestrator.enabled=true`) | -| Egress | any | SonataFlow pods → any | SonataFlow / workflow outbound access (NP created only when `orchestrator.enabled=true`) | -| Ingress | 5432 (TCP) | SonataFlow pods and Orchestrator create-db Job → built-in PostgreSQL primary | Orchestrator / SonataFlow database access (NP created only when `orchestrator.enabled=true` and `postgresql.enabled=true`) | +| Egress | 53, 5353 (UDP/TCP) | SonataFlow pods → any | SonataFlow DNS (NP created only when `orchestrator.enabled=true`) | +| Egress | 443, 6443 (TCP) | SonataFlow pods → any | SonataFlow HTTPS and Kubernetes API (NP created only when `orchestrator.enabled=true`) | +| Egress | 5432 (TCP) | SonataFlow pods → built-in PostgreSQL (scoped) or any (external DB) | SonataFlow database access (NP created only when `orchestrator.enabled=true`) | +| Egress | 7007 (TCP) | SonataFlow pods → RHDH pods | Workflows calling RHDH APIs (NP created only when `orchestrator.enabled=true`) | +| Ingress | 5432 (TCP) | SonataFlow pods → built-in PostgreSQL primary | Orchestrator / SonataFlow database access (NP created only when `orchestrator.enabled=true` and `postgresql.enabled=true`) | OKP initiates no outbound connections: its HTTP server and Solr process run in the same pod and serve the documentation embedded in the image. Its default-deny policy therefore blocks all new egress connections. NetworkPolicy is stateful, so response traffic for allowed ingress connections remains permitted. RHDH already permits HTTPS egress on port 443. When OKP uses HTTP instead, the chart permits RHDH egress on port 80 for a Kubernetes Ingress or restricts port 8080 egress to OKP pods for the internal Service fallback. No additional RHDH egress policy is created when `OKP_SERVICE_URL` uses HTTPS. -When Orchestrator is enabled (`orchestrator.enabled=true`), the chart creates additional NetworkPolicies scoped to pods labeled `app.kubernetes.io/managed-by: sonataflow-operator` (Data Index, Jobs Service, and workflow pods managed by the SonataFlow Operator). These allow ingress from the Knative Eventing/Serving and OpenShift Serverless Logic namespaces, from the OpenShift router on port 80, from other SonataFlow pods on port 80, and (when `orchestrator.sonataflowPlatform.monitoring.enabled=true`) from `openshift-user-workload-monitoring`. SonataFlow pods also receive unrestricted egress. Separately, the RHDH backend pod (selected via `rhdh.selectorLabels`) is allowed to reach SonataFlow pods on port 80 (RHDH egress and matching SonataFlow ingress) so the Orchestrator plugins can reach Data Index and workflow services. When the built-in PostgreSQL is enabled (`postgresql.enabled=true`), Postgres also admits TCP/5432 from SonataFlow-managed pods and from the Orchestrator create-db Job (labeled `rhdh.redhat.com/orchestrator-db-job: "true"`), in addition to the existing RHDH backend allow. The chart does not create a default-deny NetworkPolicy for SonataFlow pods. +When Orchestrator is enabled (`orchestrator.enabled=true`), the chart first creates default-deny NetworkPolicies for the SonataFlow Data Index and Jobs Service pods, then selective allow policies for pods labeled `app.kubernetes.io/managed-by: sonataflow-operator`. These allow ingress from the Knative Eventing/Serving and OpenShift Serverless Logic namespaces, from the OpenShift router (any port), from other SonataFlow pods in the same or other namespaces, from RHDH on port 80, and (when `orchestrator.sonataflowPlatform.monitoring.enabled=true`) from known monitoring namespaces. SonataFlow egress is scoped to DNS, HTTPS (443), the Kubernetes API (6443), PostgreSQL (5432), and RHDH on port 7007; additional destinations must be allowed explicitly. Separately, the RHDH backend pod (selected via `rhdh.selectorLabels`) is allowed to reach SonataFlow pods on port 80, and SonataFlow pods are allowed to reach RHDH on port 7007. When the built-in PostgreSQL is enabled (`postgresql.enabled=true`), Postgres admits TCP/5432 from SonataFlow-managed pods; the Orchestrator create-db Job uses `rhdh.selectorLabels` and is covered by the existing RHDH backend PostgreSQL allow. **Redis egress is intentionally unscoped.** RHDH does not deploy Redis; users bring their own instance, which may live in the same namespace, a different namespace, or an external managed service. The rule therefore allows egress on port 6379 to any destination. @@ -512,7 +516,7 @@ helm install redhat-developer/redhat-developer-hub-orchestrator-i ``` helm install redhat-developer/redhat-developer-hub --set orchestrator.enabled=true ``` -Enabling Orchestrator also creates label-scoped NetworkPolicies for SonataFlow-managed pods, for RHDH access to SonataFlow on port 80, and (when built-in PostgreSQL is enabled) for SonataFlow and create-db Job access to Postgres on TCP/5432; they are not namespace-wide. See [NetworkPolicies](#networkpolicies) for details. +Enabling Orchestrator also creates label-scoped NetworkPolicies for SonataFlow-managed pods (default-deny for Data Index and Jobs Service, then selective allows), for RHDH ↔ SonataFlow access, and (when built-in PostgreSQL is enabled) for SonataFlow access to Postgres on TCP/5432; they are not namespace-wide. See [NetworkPolicies](#networkpolicies) for details. Note that serverlessLogicOperator, and serverlessOperator are enabled by default. They can be disabled together or seperately by passing the following flags: `--set orchestrator.serverlessLogicOperator.enabled=false --set orchestrator.serverlessOperator.enabled=false` diff --git a/charts/rhdh/templates/network-policies.yaml b/charts/rhdh/templates/network-policies.yaml index 1a7d066d0..c56d4533f 100644 --- a/charts/rhdh/templates/network-policies.yaml +++ b/charts/rhdh/templates/network-policies.yaml @@ -362,7 +362,7 @@ spec: protocol: TCP {{- if .Values.orchestrator.enabled }} --- -# Allow SonataFlow-managed pods and the Orchestrator create-db job to reach the built-in PostgreSQL. +# Allow SonataFlow-managed pods to reach the built-in PostgreSQL. apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: @@ -386,9 +386,6 @@ spec: - podSelector: matchLabels: app.kubernetes.io/managed-by: sonataflow-operator - - podSelector: - matchLabels: - rhdh.redhat.com/orchestrator-db-job: "true" ports: - port: 5432 protocol: TCP diff --git a/charts/rhdh/templates/orchestrator/network-policies.yaml b/charts/rhdh/templates/orchestrator/network-policies.yaml index 6aaebdab3..2333cbb25 100644 --- a/charts/rhdh/templates/orchestrator/network-policies.yaml +++ b/charts/rhdh/templates/orchestrator/network-policies.yaml @@ -1,4 +1,44 @@ {{- if .Values.orchestrator.enabled }} +# Default-deny for SonataFlow Data Index pods created by the operator. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "rhdh.fullname" . }}-sonataflow-data-index-default-deny + labels: + {{- include "rhdh.labels" . | nindent 4 }} + {{- with .Values.commonAnnotations }} + annotations: + {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: + app.kubernetes.io/name: data-index-service + app.kubernetes.io/managed-by: sonataflow-operator + policyTypes: + - Ingress + - Egress +--- +# Default-deny for SonataFlow Jobs Service pods created by the operator. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "rhdh.fullname" . }}-sonataflow-jobs-service-default-deny + labels: + {{- include "rhdh.labels" . | nindent 4 }} + {{- with .Values.commonAnnotations }} + annotations: + {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: + app.kubernetes.io/name: jobs-service + app.kubernetes.io/managed-by: sonataflow-operator + policyTypes: + - Ingress + - Egress +--- apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: @@ -50,9 +90,6 @@ spec: matchLabels: # Allow OpenShift Router / ingress controller to reach SonataFlow pods. policy-group.network.openshift.io/ingress: "" - ports: - - port: 80 - protocol: TCP --- apiVersion: networking.k8s.io/v1 kind: NetworkPolicy @@ -101,16 +138,105 @@ spec: - podSelector: matchLabels: app.kubernetes.io/managed-by: sonataflow-operator + - namespaceSelector: {} + podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator +--- +# Allow DNS egress from SonataFlow-managed pods. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "rhdh.fullname" . }}-allow-sonataflow-dns-egress + labels: + {{- include "rhdh.labels" . | nindent 4 }} + {{- with .Values.commonAnnotations }} + annotations: + {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator + policyTypes: + - Egress + egress: + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + - port: 5353 + protocol: UDP + - port: 5353 + protocol: TCP +--- +# Allow HTTPS and Kubernetes API egress from SonataFlow-managed pods. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "rhdh.fullname" . }}-allow-sonataflow-https-egress + labels: + {{- include "rhdh.labels" . | nindent 4 }} + {{- with .Values.commonAnnotations }} + annotations: + {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator + policyTypes: + - Egress + egress: + - ports: + - port: 443 + protocol: TCP + - port: 6443 + protocol: TCP +--- +# Allow SonataFlow-managed pods to reach PostgreSQL. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "rhdh.fullname" . }}-allow-sonataflow-postgresql-egress + labels: + {{- include "rhdh.labels" . | nindent 4 }} + {{- with .Values.commonAnnotations }} + annotations: + {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator + policyTypes: + - Egress + egress: + - {{- if .Values.postgresql.enabled }} + to: + - podSelector: + matchLabels: + app.kubernetes.io/name: postgresql + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/component: primary + {{- if eq (default "standalone" .Values.postgresql.architecture) "replication" }} + - podSelector: + matchLabels: + app.kubernetes.io/name: postgresql + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/component: read + {{- end }} + {{- end }} ports: - - port: 80 + - port: {{ if .Values.postgresql.enabled }}5432{{ else }}{{ .Values.orchestrator.sonataflowPlatform.externalDB.port | default 5432 }}{{ end }} protocol: TCP --- -# Allow all egress from SonataFlow-managed pods. -# SonataFlow workflows may need arbitrary outbound access. +# Allow SonataFlow-managed pods to call RHDH APIs on port 7007. apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: - name: {{ include "rhdh.fullname" . }}-allow-sonataflow-all-egress + name: {{ include "rhdh.fullname" . }}-allow-sonataflow-to-backstage-egress labels: {{- include "rhdh.labels" . | nindent 4 }} {{- with .Values.commonAnnotations }} @@ -124,7 +250,39 @@ spec: policyTypes: - Egress egress: - - {} + - to: + - podSelector: + matchLabels: + {{- include "rhdh.selectorLabels" . | nindent 14 }} + ports: + - port: 7007 + protocol: TCP +--- +# Allow SonataFlow-managed pods to reach the RHDH backend on port 7007 (matching ingress). +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "rhdh.fullname" . }}-allow-sonataflow-to-backstage-ingress + labels: + {{- include "rhdh.labels" . | nindent 4 }} + {{- with .Values.commonAnnotations }} + annotations: + {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: + {{- include "rhdh.selectorLabels" . | nindent 6 }} + policyTypes: + - Ingress + ingress: + - from: + - podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator + ports: + - port: 7007 + protocol: TCP --- # Allow the Orchestrator backend plugin to reach SonataFlow / Data Index services. apiVersion: networking.k8s.io/v1 @@ -174,6 +332,17 @@ spec: - from: - namespaceSelector: matchLabels: - # Allow openshift-user-workload-monitoring pods to access SonataFlow pods + kubernetes.io/metadata.name: openshift-monitoring + - namespaceSelector: + matchLabels: kubernetes.io/metadata.name: openshift-user-workload-monitoring + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: gmp-system + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: gke-gmp-system + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: monitoring {{- end }} diff --git a/charts/rhdh/templates/orchestrator/sonataflows.yaml b/charts/rhdh/templates/orchestrator/sonataflows.yaml index aed902d01..4881a0749 100644 --- a/charts/rhdh/templates/orchestrator/sonataflows.yaml +++ b/charts/rhdh/templates/orchestrator/sonataflows.yaml @@ -105,10 +105,7 @@ spec: template: metadata: labels: - app.kubernetes.io/name: {{ include "rhdh.name" . }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/component: orchestrator-db-job - rhdh.redhat.com/orchestrator-db-job: "true" + {{- include "rhdh.selectorLabels" . | nindent 8 }} spec: initContainers: - name: wait-for-db From be777dee399c75a13643c80b61fbf0103a700ab6 Mon Sep 17 00:00:00 2001 From: Armel Soro Date: Fri, 16 Oct 2026 18:54:50 +0200 Subject: [PATCH 10/10] fix: correct Orchestrator NetworkPolicies for port, cross-namespace, and egress gaps MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Remove port 80 restriction from RHDH↔SonataFlow NPs; SonataFlow pods listen on containerPort 8080, not 80, and workflow ports are unpredictable. The wrong port was silently blocking RHDH→Data Index traffic. - Add namespaceSelector to db-allow-sonataflow-ingress so cross-namespace workflows (e.g. in a separate namespace) can reach the built-in PostgreSQL. - Add egress rules to allow-sonataflow-intra so SonataFlow pods can initiate connections to each other, not just receive them. - Add explicit policyTypes to allow-infra-ns-to-sonataflow for consistency with all other NPs. - Fix stray '---' document separator rendered when orchestrator is disabled. - Add port 8080 restriction to the SonataFlow monitoring NP, consistent with the RHDH metrics NP pattern. --- charts/rhdh/Chart.yaml | 2 +- charts/rhdh/README.md | 16 ++++++------- charts/rhdh/README.md.gotmpl | 12 +++++----- charts/rhdh/templates/network-policies.yaml | 4 ++++ .../orchestrator/network-policies.yaml | 23 +++++++++++++------ 5 files changed, 35 insertions(+), 22 deletions(-) diff --git a/charts/rhdh/Chart.yaml b/charts/rhdh/Chart.yaml index caa39caf3..64d24a20a 100644 --- a/charts/rhdh/Chart.yaml +++ b/charts/rhdh/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 name: redhat-developer-hub type: application -version: 3.5.11 +version: 3.5.12 appVersion: 2.2.0 annotations: artifacthub.io/category: integration-delivery diff --git a/charts/rhdh/README.md b/charts/rhdh/README.md index 3922eca37..ed71692f8 100644 --- a/charts/rhdh/README.md +++ b/charts/rhdh/README.md @@ -1,7 +1,7 @@ # RHDH Helm Chart for OpenShift and Kubernetes -![Version: 3.5.11](https://img.shields.io/badge/Version-3.5.11-informational?style=flat-square) +![Version: 3.5.12](https://img.shields.io/badge/Version-3.5.12-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) A Helm chart for deploying Red Hat Developer Hub, which is a Red Hat supported version of Backstage. @@ -36,7 +36,7 @@ For the **Generally Available** version of this chart, see: helm repo add bitnami https://charts.bitnami.com/bitnami helm repo add redhat-developer https://redhat-developer.github.io/rhdh-chart -helm install my-rhdh redhat-developer/redhat-developer-hub --version 3.5.11 +helm install my-rhdh redhat-developer/redhat-developer-hub --version 3.5.12 ``` ## Introduction @@ -584,23 +584,23 @@ The following traffic is allowed out of the box: | Ingress | 8080 (TCP) | RHDH pods and the OpenShift router namespace or any namespace (non-OCP) | OKP queries and product-document citations via Route / Ingress | | Ingress | 9464 (TCP) | `openshift-monitoring`, `openshift-user-workload-monitoring`, `gmp-system`, `gke-gmp-system`, `monitoring` | Prometheus metrics scraping | | Ingress | any | OpenShift router namespace → SonataFlow pods | Orchestrator / SonataFlow Routes (NP created only when `orchestrator.enabled=true`) | -| Ingress | 80 (TCP) | RHDH pods → SonataFlow pods | Orchestrator backend to Data Index / workflows (NP created only when `orchestrator.enabled=true`) | -| Ingress | any | SonataFlow pods → SonataFlow pods (same or other namespaces) | SonataFlow inter-pod traffic (NP created only when `orchestrator.enabled=true`) | +| Ingress | any | RHDH pods → SonataFlow pods | Orchestrator backend to Data Index / workflows (NP created only when `orchestrator.enabled=true`) | +| Ingress | any | SonataFlow pods → SonataFlow pods (same or other namespaces) | SonataFlow inter-pod ingress and egress (NP created only when `orchestrator.enabled=true`) | | Ingress | any | `knative-eventing`, `knative-serving`, `openshift-serverless-logic` → SonataFlow pods | Orchestrator infra namespaces (NP created only when `orchestrator.enabled=true`) | -| Ingress | any | `openshift-monitoring`, `openshift-user-workload-monitoring`, `gmp-system`, `gke-gmp-system`, `monitoring` → SonataFlow pods | SonataFlow metrics scrape (NP created only when `orchestrator.enabled=true` and `orchestrator.sonataflowPlatform.monitoring.enabled=true`) | +| Ingress | 8080 (TCP) | `openshift-monitoring`, `openshift-user-workload-monitoring`, `gmp-system`, `gke-gmp-system`, `monitoring` → SonataFlow pods | SonataFlow metrics scrape (NP created only when `orchestrator.enabled=true` and `orchestrator.sonataflowPlatform.monitoring.enabled=true`) | | Ingress | 7007 (TCP) | SonataFlow pods → RHDH pods | Workflows calling RHDH APIs (NP created only when `orchestrator.enabled=true`) | -| Egress | 80 (TCP) | RHDH pods → SonataFlow pods | Orchestrator backend HTTP to SonataFlow / Data Index (NP created only when `orchestrator.enabled=true`) | +| Egress | any | RHDH pods → SonataFlow pods | Orchestrator backend to SonataFlow / Data Index (NP created only when `orchestrator.enabled=true`) | | Egress | 53, 5353 (UDP/TCP) | SonataFlow pods → any | SonataFlow DNS (NP created only when `orchestrator.enabled=true`) | | Egress | 443, 6443 (TCP) | SonataFlow pods → any | SonataFlow HTTPS and Kubernetes API (NP created only when `orchestrator.enabled=true`) | | Egress | 5432 (TCP) | SonataFlow pods → built-in PostgreSQL (scoped) or any (external DB) | SonataFlow database access (NP created only when `orchestrator.enabled=true`) | | Egress | 7007 (TCP) | SonataFlow pods → RHDH pods | Workflows calling RHDH APIs (NP created only when `orchestrator.enabled=true`) | -| Ingress | 5432 (TCP) | SonataFlow pods → built-in PostgreSQL primary | Orchestrator / SonataFlow database access (NP created only when `orchestrator.enabled=true` and `postgresql.enabled=true`) | +| Ingress | 5432 (TCP) | SonataFlow pods (same or other namespaces) → built-in PostgreSQL primary | Orchestrator / SonataFlow database access (NP created only when `orchestrator.enabled=true` and `postgresql.enabled=true`) | OKP initiates no outbound connections: its HTTP server and Solr process run in the same pod and serve the documentation embedded in the image. Its default-deny policy therefore blocks all new egress connections. NetworkPolicy is stateful, so response traffic for allowed ingress connections remains permitted. RHDH already permits HTTPS egress on port 443. When OKP uses HTTP instead, the chart permits RHDH egress on port 80 for a Kubernetes Ingress or restricts port 8080 egress to OKP pods for the internal Service fallback. No additional RHDH egress policy is created when `OKP_SERVICE_URL` uses HTTPS. -When Orchestrator is enabled (`orchestrator.enabled=true`), the chart first creates default-deny NetworkPolicies for the SonataFlow Data Index and Jobs Service pods, then selective allow policies for pods labeled `app.kubernetes.io/managed-by: sonataflow-operator`. These allow ingress from the Knative Eventing/Serving and OpenShift Serverless Logic namespaces, from the OpenShift router (any port), from other SonataFlow pods in the same or other namespaces, from RHDH on port 80, and (when `orchestrator.sonataflowPlatform.monitoring.enabled=true`) from known monitoring namespaces. SonataFlow egress is scoped to DNS, HTTPS (443), the Kubernetes API (6443), PostgreSQL (5432), and RHDH on port 7007; additional destinations must be allowed explicitly. Separately, the RHDH backend pod (selected via `rhdh.selectorLabels`) is allowed to reach SonataFlow pods on port 80, and SonataFlow pods are allowed to reach RHDH on port 7007. When the built-in PostgreSQL is enabled (`postgresql.enabled=true`), Postgres admits TCP/5432 from SonataFlow-managed pods; the Orchestrator create-db Job uses `rhdh.selectorLabels` and is covered by the existing RHDH backend PostgreSQL allow. +When Orchestrator is enabled (`orchestrator.enabled=true`), the chart first creates default-deny NetworkPolicies for the SonataFlow Data Index and Jobs Service pods, then selective allow policies for pods labeled `app.kubernetes.io/managed-by: sonataflow-operator`. These allow ingress from the Knative Eventing/Serving and OpenShift Serverless Logic namespaces, from the OpenShift router (any port), from other SonataFlow pods in the same or other namespaces (ingress and egress), from RHDH (any port), and (when `orchestrator.sonataflowPlatform.monitoring.enabled=true`) from known monitoring namespaces on port 8080. SonataFlow egress is scoped to DNS, HTTPS (443), the Kubernetes API (6443), PostgreSQL (5432), and RHDH on port 7007; additional destinations must be allowed explicitly. Separately, the RHDH backend pod (selected via `rhdh.selectorLabels`) is allowed to reach SonataFlow pods (any port), and SonataFlow pods are allowed to reach RHDH on port 7007. When the built-in PostgreSQL is enabled (`postgresql.enabled=true`), Postgres admits TCP/5432 from SonataFlow-managed pods in the same or other namespaces; the Orchestrator create-db Job uses `rhdh.selectorLabels` and is covered by the existing RHDH backend PostgreSQL allow. **Redis egress is intentionally unscoped.** RHDH does not deploy Redis; users bring their own instance, which may live in the same namespace, a different namespace, or an external managed service. The rule therefore allows egress on port 6379 to any destination. diff --git a/charts/rhdh/README.md.gotmpl b/charts/rhdh/README.md.gotmpl index 55ae64189..9aba7cfc3 100644 --- a/charts/rhdh/README.md.gotmpl +++ b/charts/rhdh/README.md.gotmpl @@ -409,23 +409,23 @@ The following traffic is allowed out of the box: | Ingress | 8080 (TCP) | RHDH pods and the OpenShift router namespace or any namespace (non-OCP) | OKP queries and product-document citations via Route / Ingress | | Ingress | 9464 (TCP) | `openshift-monitoring`, `openshift-user-workload-monitoring`, `gmp-system`, `gke-gmp-system`, `monitoring` | Prometheus metrics scraping | | Ingress | any | OpenShift router namespace → SonataFlow pods | Orchestrator / SonataFlow Routes (NP created only when `orchestrator.enabled=true`) | -| Ingress | 80 (TCP) | RHDH pods → SonataFlow pods | Orchestrator backend to Data Index / workflows (NP created only when `orchestrator.enabled=true`) | -| Ingress | any | SonataFlow pods → SonataFlow pods (same or other namespaces) | SonataFlow inter-pod traffic (NP created only when `orchestrator.enabled=true`) | +| Ingress | any | RHDH pods → SonataFlow pods | Orchestrator backend to Data Index / workflows (NP created only when `orchestrator.enabled=true`) | +| Ingress | any | SonataFlow pods → SonataFlow pods (same or other namespaces) | SonataFlow inter-pod ingress and egress (NP created only when `orchestrator.enabled=true`) | | Ingress | any | `knative-eventing`, `knative-serving`, `openshift-serverless-logic` → SonataFlow pods | Orchestrator infra namespaces (NP created only when `orchestrator.enabled=true`) | -| Ingress | any | `openshift-monitoring`, `openshift-user-workload-monitoring`, `gmp-system`, `gke-gmp-system`, `monitoring` → SonataFlow pods | SonataFlow metrics scrape (NP created only when `orchestrator.enabled=true` and `orchestrator.sonataflowPlatform.monitoring.enabled=true`) | +| Ingress | 8080 (TCP) | `openshift-monitoring`, `openshift-user-workload-monitoring`, `gmp-system`, `gke-gmp-system`, `monitoring` → SonataFlow pods | SonataFlow metrics scrape (NP created only when `orchestrator.enabled=true` and `orchestrator.sonataflowPlatform.monitoring.enabled=true`) | | Ingress | 7007 (TCP) | SonataFlow pods → RHDH pods | Workflows calling RHDH APIs (NP created only when `orchestrator.enabled=true`) | -| Egress | 80 (TCP) | RHDH pods → SonataFlow pods | Orchestrator backend HTTP to SonataFlow / Data Index (NP created only when `orchestrator.enabled=true`) | +| Egress | any | RHDH pods → SonataFlow pods | Orchestrator backend to SonataFlow / Data Index (NP created only when `orchestrator.enabled=true`) | | Egress | 53, 5353 (UDP/TCP) | SonataFlow pods → any | SonataFlow DNS (NP created only when `orchestrator.enabled=true`) | | Egress | 443, 6443 (TCP) | SonataFlow pods → any | SonataFlow HTTPS and Kubernetes API (NP created only when `orchestrator.enabled=true`) | | Egress | 5432 (TCP) | SonataFlow pods → built-in PostgreSQL (scoped) or any (external DB) | SonataFlow database access (NP created only when `orchestrator.enabled=true`) | | Egress | 7007 (TCP) | SonataFlow pods → RHDH pods | Workflows calling RHDH APIs (NP created only when `orchestrator.enabled=true`) | -| Ingress | 5432 (TCP) | SonataFlow pods → built-in PostgreSQL primary | Orchestrator / SonataFlow database access (NP created only when `orchestrator.enabled=true` and `postgresql.enabled=true`) | +| Ingress | 5432 (TCP) | SonataFlow pods (same or other namespaces) → built-in PostgreSQL primary | Orchestrator / SonataFlow database access (NP created only when `orchestrator.enabled=true` and `postgresql.enabled=true`) | OKP initiates no outbound connections: its HTTP server and Solr process run in the same pod and serve the documentation embedded in the image. Its default-deny policy therefore blocks all new egress connections. NetworkPolicy is stateful, so response traffic for allowed ingress connections remains permitted. RHDH already permits HTTPS egress on port 443. When OKP uses HTTP instead, the chart permits RHDH egress on port 80 for a Kubernetes Ingress or restricts port 8080 egress to OKP pods for the internal Service fallback. No additional RHDH egress policy is created when `OKP_SERVICE_URL` uses HTTPS. -When Orchestrator is enabled (`orchestrator.enabled=true`), the chart first creates default-deny NetworkPolicies for the SonataFlow Data Index and Jobs Service pods, then selective allow policies for pods labeled `app.kubernetes.io/managed-by: sonataflow-operator`. These allow ingress from the Knative Eventing/Serving and OpenShift Serverless Logic namespaces, from the OpenShift router (any port), from other SonataFlow pods in the same or other namespaces, from RHDH on port 80, and (when `orchestrator.sonataflowPlatform.monitoring.enabled=true`) from known monitoring namespaces. SonataFlow egress is scoped to DNS, HTTPS (443), the Kubernetes API (6443), PostgreSQL (5432), and RHDH on port 7007; additional destinations must be allowed explicitly. Separately, the RHDH backend pod (selected via `rhdh.selectorLabels`) is allowed to reach SonataFlow pods on port 80, and SonataFlow pods are allowed to reach RHDH on port 7007. When the built-in PostgreSQL is enabled (`postgresql.enabled=true`), Postgres admits TCP/5432 from SonataFlow-managed pods; the Orchestrator create-db Job uses `rhdh.selectorLabels` and is covered by the existing RHDH backend PostgreSQL allow. +When Orchestrator is enabled (`orchestrator.enabled=true`), the chart first creates default-deny NetworkPolicies for the SonataFlow Data Index and Jobs Service pods, then selective allow policies for pods labeled `app.kubernetes.io/managed-by: sonataflow-operator`. These allow ingress from the Knative Eventing/Serving and OpenShift Serverless Logic namespaces, from the OpenShift router (any port), from other SonataFlow pods in the same or other namespaces (ingress and egress), from RHDH (any port), and (when `orchestrator.sonataflowPlatform.monitoring.enabled=true`) from known monitoring namespaces on port 8080. SonataFlow egress is scoped to DNS, HTTPS (443), the Kubernetes API (6443), PostgreSQL (5432), and RHDH on port 7007; additional destinations must be allowed explicitly. Separately, the RHDH backend pod (selected via `rhdh.selectorLabels`) is allowed to reach SonataFlow pods (any port), and SonataFlow pods are allowed to reach RHDH on port 7007. When the built-in PostgreSQL is enabled (`postgresql.enabled=true`), Postgres admits TCP/5432 from SonataFlow-managed pods in the same or other namespaces; the Orchestrator create-db Job uses `rhdh.selectorLabels` and is covered by the existing RHDH backend PostgreSQL allow. **Redis egress is intentionally unscoped.** RHDH does not deploy Redis; users bring their own instance, which may live in the same namespace, a different namespace, or an external managed service. The rule therefore allows egress on port 6379 to any destination. diff --git a/charts/rhdh/templates/network-policies.yaml b/charts/rhdh/templates/network-policies.yaml index bacfb766f..835deaedf 100644 --- a/charts/rhdh/templates/network-policies.yaml +++ b/charts/rhdh/templates/network-policies.yaml @@ -393,6 +393,10 @@ spec: - podSelector: matchLabels: app.kubernetes.io/managed-by: sonataflow-operator + - namespaceSelector: {} + podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator ports: - port: 5432 protocol: TCP diff --git a/charts/rhdh/templates/orchestrator/network-policies.yaml b/charts/rhdh/templates/orchestrator/network-policies.yaml index 2333cbb25..05dab892b 100644 --- a/charts/rhdh/templates/orchestrator/network-policies.yaml +++ b/charts/rhdh/templates/orchestrator/network-policies.yaml @@ -53,6 +53,8 @@ spec: podSelector: matchLabels: app.kubernetes.io/managed-by: sonataflow-operator + policyTypes: + - Ingress ingress: - from: - namespaceSelector: @@ -112,9 +114,6 @@ spec: - podSelector: matchLabels: {{- include "rhdh.selectorLabels" . | nindent 14 }} - ports: - - port: 80 - protocol: TCP --- apiVersion: networking.k8s.io/v1 kind: NetworkPolicy @@ -133,6 +132,7 @@ spec: app.kubernetes.io/managed-by: sonataflow-operator policyTypes: - Ingress + - Egress ingress: - from: - podSelector: @@ -142,6 +142,15 @@ spec: podSelector: matchLabels: app.kubernetes.io/managed-by: sonataflow-operator + egress: + - to: + - podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator + - namespaceSelector: {} + podSelector: + matchLabels: + app.kubernetes.io/managed-by: sonataflow-operator --- # Allow DNS egress from SonataFlow-managed pods. apiVersion: networking.k8s.io/v1 @@ -306,12 +315,9 @@ spec: - podSelector: matchLabels: app.kubernetes.io/managed-by: sonataflow-operator - ports: - - port: 80 - protocol: TCP {{- end }} ---- {{- if and .Values.orchestrator.enabled .Values.orchestrator.sonataflowPlatform.monitoring.enabled }} +--- apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: @@ -345,4 +351,7 @@ spec: - namespaceSelector: matchLabels: kubernetes.io/metadata.name: monitoring + ports: + - port: 8080 + protocol: TCP {{- end }}