chore: Updating Orchestrator flavour NetworkPolicies to SonataFlow-specific labels

charts/rhdh/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 name: redhat-developer-hub
 type: application
-version: 3.5.11
+version: 3.5.12
 appVersion: 2.2.0
 annotations:
   artifacthub.io/category: integration-delivery

charts/rhdh/README.md

@@ -1,7 +1,7 @@
 
 # RHDH Helm Chart for OpenShift and Kubernetes
 
-![Version: 3.5.11](https://img.shields.io/badge/Version-3.5.11-informational?style=flat-square)
+![Version: 3.5.12](https://img.shields.io/badge/Version-3.5.12-informational?style=flat-square)
 ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 A Helm chart for deploying Red Hat Developer Hub, which is a Red Hat supported version of Backstage.
@@ -36,7 +36,7 @@ For the **Generally Available** version of this chart, see:
 helm repo add bitnami https://charts.bitnami.com/bitnami
 helm repo add redhat-developer https://redhat-developer.github.io/rhdh-chart
 
-helm install my-rhdh redhat-developer/redhat-developer-hub --version 3.5.11
+helm install my-rhdh redhat-developer/redhat-developer-hub --version 3.5.12
 ```
 
 ## Introduction
@@ -567,6 +567,8 @@ extraDeploy:
 
 This chart deploys a **default-deny** NetworkPolicy for the RHDH backend pod, blocking all ingress and egress traffic that is not explicitly allowed. When the built-in PostgreSQL is enabled (`postgresql.enabled=true`), the database pods also get their own default-deny policy with selective allow rules. When OKP is active, its pods receive a separate default-deny ingress and egress policy with rules allowing only the required HTTP ingress.
 
+When `orchestrator.enabled=true`, the chart also creates NetworkPolicies for SonataFlow Data Index and Jobs Service pods (default-deny, then selective allow) and for other pods labeled `app.kubernetes.io/managed-by: sonataflow-operator`. These include RHDH ↔ SonataFlow access, scoped SonataFlow egress (DNS, HTTPS, Kubernetes API, PostgreSQL, and RHDH on port 7007), and (when built-in PostgreSQL is enabled) PostgreSQL ingress from SonataFlow-managed pods. The Orchestrator create-db Job uses `rhdh.selectorLabels`, so it is covered by the existing RHDH → PostgreSQL allow. These policies are label-scoped and do not use namespace-wide `podSelector: {}`.
+
 The following traffic is allowed out of the box:
 
 | Direction | Port | Destination / Source | Purpose |
@@ -581,11 +583,25 @@ The following traffic is allowed out of the box:
 | Ingress | 7007 (TCP) | OpenShift router namespace or any namespace (non-OCP) | User traffic via Route / Ingress |
 | Ingress | 8080 (TCP) | RHDH pods and the OpenShift router namespace or any namespace (non-OCP) | OKP queries and product-document citations via Route / Ingress |
 | Ingress | 9464 (TCP) | `openshift-monitoring`, `openshift-user-workload-monitoring`, `gmp-system`, `gke-gmp-system`, `monitoring` | Prometheus metrics scraping |
+| Ingress | any | OpenShift router namespace → SonataFlow pods | Orchestrator / SonataFlow Routes (NP created only when `orchestrator.enabled=true`) |
+| Ingress | any | RHDH pods → SonataFlow pods | Orchestrator backend to Data Index / workflows (NP created only when `orchestrator.enabled=true`) |
+| Ingress | any | SonataFlow pods → SonataFlow pods (same or other namespaces) | SonataFlow inter-pod ingress and egress (NP created only when `orchestrator.enabled=true`) |
+| Ingress | any | `knative-eventing`, `knative-serving`, `openshift-serverless-logic` → SonataFlow pods | Orchestrator infra namespaces (NP created only when `orchestrator.enabled=true`) |
+| Ingress | 8080 (TCP) | `openshift-monitoring`, `openshift-user-workload-monitoring`, `gmp-system`, `gke-gmp-system`, `monitoring` → SonataFlow pods | SonataFlow metrics scrape (NP created only when `orchestrator.enabled=true` and `orchestrator.sonataflowPlatform.monitoring.enabled=true`) |
+| Ingress | 7007 (TCP) | SonataFlow pods → RHDH pods | Workflows calling RHDH APIs (NP created only when `orchestrator.enabled=true`) |
+| Egress | any | RHDH pods → SonataFlow pods | Orchestrator backend to SonataFlow / Data Index (NP created only when `orchestrator.enabled=true`) |
+| Egress | 53, 5353 (UDP/TCP) | SonataFlow pods → any | SonataFlow DNS (NP created only when `orchestrator.enabled=true`) |
+| Egress | 443, 6443 (TCP) | SonataFlow pods → any | SonataFlow HTTPS and Kubernetes API (NP created only when `orchestrator.enabled=true`) |
+| Egress | 5432 (TCP) | SonataFlow pods → built-in PostgreSQL (scoped) or any (external DB) | SonataFlow database access (NP created only when `orchestrator.enabled=true`) |
+| Egress | 7007 (TCP) | SonataFlow pods → RHDH pods | Workflows calling RHDH APIs (NP created only when `orchestrator.enabled=true`) |
+| Ingress | 5432 (TCP) | SonataFlow pods (same or other namespaces) → built-in PostgreSQL primary | Orchestrator / SonataFlow database access (NP created only when `orchestrator.enabled=true` and `postgresql.enabled=true`) |
 
 OKP initiates no outbound connections: its HTTP server and Solr process run in the same pod and serve the documentation embedded in the image. Its default-deny policy therefore blocks all new egress connections. NetworkPolicy is stateful, so response traffic for allowed ingress connections remains permitted.
 
 RHDH already permits HTTPS egress on port 443. When OKP uses HTTP instead, the chart permits RHDH egress on port 80 for a Kubernetes Ingress or restricts port 8080 egress to OKP pods for the internal Service fallback. No additional RHDH egress policy is created when `OKP_SERVICE_URL` uses HTTPS.
 
+When Orchestrator is enabled (`orchestrator.enabled=true`), the chart first creates default-deny NetworkPolicies for the SonataFlow Data Index and Jobs Service pods, then selective allow policies for pods labeled `app.kubernetes.io/managed-by: sonataflow-operator`. These allow ingress from the Knative Eventing/Serving and OpenShift Serverless Logic namespaces, from the OpenShift router (any port), from other SonataFlow pods in the same or other namespaces (ingress and egress), from RHDH (any port), and (when `orchestrator.sonataflowPlatform.monitoring.enabled=true`) from known monitoring namespaces on port 8080. SonataFlow egress is scoped to DNS, HTTPS (443), the Kubernetes API (6443), PostgreSQL (5432), and RHDH on port 7007; additional destinations must be allowed explicitly. Separately, the RHDH backend pod (selected via `rhdh.selectorLabels`) is allowed to reach SonataFlow pods (any port), and SonataFlow pods are allowed to reach RHDH on port 7007. When the built-in PostgreSQL is enabled (`postgresql.enabled=true`), Postgres admits TCP/5432 from SonataFlow-managed pods in the same or other namespaces; the Orchestrator create-db Job uses `rhdh.selectorLabels` and is covered by the existing RHDH backend PostgreSQL allow.
+
 **Redis egress is intentionally unscoped.** RHDH does not deploy Redis; users bring their own instance, which may live in the same namespace, a different namespace, or an external managed service. The rule therefore allows egress on port 6379 to any destination.
 
 **Bitnami subchart NetworkPolicies are disabled** (`postgresql.primary.networkPolicy.enabled=false`, `postgresql.readReplicas.networkPolicy.enabled=false`) because this chart provides its own tighter policies for the built-in database pods.
@@ -676,6 +692,7 @@ helm install <release_name> redhat-developer/redhat-developer-hub-orchestrator-i
 ```
 helm install <release_name> redhat-developer/redhat-developer-hub --set orchestrator.enabled=true
 ```
+Enabling Orchestrator also creates label-scoped NetworkPolicies for SonataFlow-managed pods (default-deny for Data Index and Jobs Service, then selective allows), for RHDH ↔ SonataFlow access, and (when built-in PostgreSQL is enabled) for SonataFlow access to Postgres on TCP/5432; they are not namespace-wide. See [NetworkPolicies](#networkpolicies) for details.
 Note that serverlessLogicOperator, and serverlessOperator are enabled by default. They can be disabled together or seperately by passing the following flags:
 `--set orchestrator.serverlessLogicOperator.enabled=false --set orchestrator.serverlessOperator.enabled=false`
 

charts/rhdh/README.md.gotmpl

@@ -392,6 +392,8 @@ extraDeploy:
 
 This chart deploys a **default-deny** NetworkPolicy for the RHDH backend pod, blocking all ingress and egress traffic that is not explicitly allowed. When the built-in PostgreSQL is enabled (`postgresql.enabled=true`), the database pods also get their own default-deny policy with selective allow rules. When OKP is active, its pods receive a separate default-deny ingress and egress policy with rules allowing only the required HTTP ingress.
 
+When `orchestrator.enabled=true`, the chart also creates NetworkPolicies for SonataFlow Data Index and Jobs Service pods (default-deny, then selective allow) and for other pods labeled `app.kubernetes.io/managed-by: sonataflow-operator`. These include RHDH ↔ SonataFlow access, scoped SonataFlow egress (DNS, HTTPS, Kubernetes API, PostgreSQL, and RHDH on port 7007), and (when built-in PostgreSQL is enabled) PostgreSQL ingress from SonataFlow-managed pods. The Orchestrator create-db Job uses `rhdh.selectorLabels`, so it is covered by the existing RHDH → PostgreSQL allow. These policies are label-scoped and do not use namespace-wide `podSelector: {}`.
+
 The following traffic is allowed out of the box:
 
 | Direction | Port | Destination / Source | Purpose |
@@ -406,11 +408,25 @@ The following traffic is allowed out of the box:
 | Ingress | 7007 (TCP) | OpenShift router namespace or any namespace (non-OCP) | User traffic via Route / Ingress |
 | Ingress | 8080 (TCP) | RHDH pods and the OpenShift router namespace or any namespace (non-OCP) | OKP queries and product-document citations via Route / Ingress |
 | Ingress | 9464 (TCP) | `openshift-monitoring`, `openshift-user-workload-monitoring`, `gmp-system`, `gke-gmp-system`, `monitoring` | Prometheus metrics scraping |
+| Ingress | any | OpenShift router namespace → SonataFlow pods | Orchestrator / SonataFlow Routes (NP created only when `orchestrator.enabled=true`) |
+| Ingress | any | RHDH pods → SonataFlow pods | Orchestrator backend to Data Index / workflows (NP created only when `orchestrator.enabled=true`) |
+| Ingress | any | SonataFlow pods → SonataFlow pods (same or other namespaces) | SonataFlow inter-pod ingress and egress (NP created only when `orchestrator.enabled=true`) |
+| Ingress | any | `knative-eventing`, `knative-serving`, `openshift-serverless-logic` → SonataFlow pods | Orchestrator infra namespaces (NP created only when `orchestrator.enabled=true`) |
+| Ingress | 8080 (TCP) | `openshift-monitoring`, `openshift-user-workload-monitoring`, `gmp-system`, `gke-gmp-system`, `monitoring` → SonataFlow pods | SonataFlow metrics scrape (NP created only when `orchestrator.enabled=true` and `orchestrator.sonataflowPlatform.monitoring.enabled=true`) |
+| Ingress | 7007 (TCP) | SonataFlow pods → RHDH pods | Workflows calling RHDH APIs (NP created only when `orchestrator.enabled=true`) |
+| Egress | any | RHDH pods → SonataFlow pods | Orchestrator backend to SonataFlow / Data Index (NP created only when `orchestrator.enabled=true`) |
+| Egress | 53, 5353 (UDP/TCP) | SonataFlow pods → any | SonataFlow DNS (NP created only when `orchestrator.enabled=true`) |
+| Egress | 443, 6443 (TCP) | SonataFlow pods → any | SonataFlow HTTPS and Kubernetes API (NP created only when `orchestrator.enabled=true`) |
+| Egress | 5432 (TCP) | SonataFlow pods → built-in PostgreSQL (scoped) or any (external DB) | SonataFlow database access (NP created only when `orchestrator.enabled=true`) |
+| Egress | 7007 (TCP) | SonataFlow pods → RHDH pods | Workflows calling RHDH APIs (NP created only when `orchestrator.enabled=true`) |
+| Ingress | 5432 (TCP) | SonataFlow pods (same or other namespaces) → built-in PostgreSQL primary | Orchestrator / SonataFlow database access (NP created only when `orchestrator.enabled=true` and `postgresql.enabled=true`) |
 
 OKP initiates no outbound connections: its HTTP server and Solr process run in the same pod and serve the documentation embedded in the image. Its default-deny policy therefore blocks all new egress connections. NetworkPolicy is stateful, so response traffic for allowed ingress connections remains permitted.
 
 RHDH already permits HTTPS egress on port 443. When OKP uses HTTP instead, the chart permits RHDH egress on port 80 for a Kubernetes Ingress or restricts port 8080 egress to OKP pods for the internal Service fallback. No additional RHDH egress policy is created when `OKP_SERVICE_URL` uses HTTPS.
 
+When Orchestrator is enabled (`orchestrator.enabled=true`), the chart first creates default-deny NetworkPolicies for the SonataFlow Data Index and Jobs Service pods, then selective allow policies for pods labeled `app.kubernetes.io/managed-by: sonataflow-operator`. These allow ingress from the Knative Eventing/Serving and OpenShift Serverless Logic namespaces, from the OpenShift router (any port), from other SonataFlow pods in the same or other namespaces (ingress and egress), from RHDH (any port), and (when `orchestrator.sonataflowPlatform.monitoring.enabled=true`) from known monitoring namespaces on port 8080. SonataFlow egress is scoped to DNS, HTTPS (443), the Kubernetes API (6443), PostgreSQL (5432), and RHDH on port 7007; additional destinations must be allowed explicitly. Separately, the RHDH backend pod (selected via `rhdh.selectorLabels`) is allowed to reach SonataFlow pods (any port), and SonataFlow pods are allowed to reach RHDH on port 7007. When the built-in PostgreSQL is enabled (`postgresql.enabled=true`), Postgres admits TCP/5432 from SonataFlow-managed pods in the same or other namespaces; the Orchestrator create-db Job uses `rhdh.selectorLabels` and is covered by the existing RHDH backend PostgreSQL allow.
+
 **Redis egress is intentionally unscoped.** RHDH does not deploy Redis; users bring their own instance, which may live in the same namespace, a different namespace, or an external managed service. The rule therefore allows egress on port 6379 to any destination.
 
 **Bitnami subchart NetworkPolicies are disabled** (`postgresql.primary.networkPolicy.enabled=false`, `postgresql.readReplicas.networkPolicy.enabled=false`) because this chart provides its own tighter policies for the built-in database pods.
@@ -501,6 +517,7 @@ helm install <release_name> redhat-developer/redhat-developer-hub-orchestrator-i
 ```
 helm install <release_name> redhat-developer/redhat-developer-hub --set orchestrator.enabled=true
 ```
+Enabling Orchestrator also creates label-scoped NetworkPolicies for SonataFlow-managed pods (default-deny for Data Index and Jobs Service, then selective allows), for RHDH ↔ SonataFlow access, and (when built-in PostgreSQL is enabled) for SonataFlow access to Postgres on TCP/5432; they are not namespace-wide. See [NetworkPolicies](#networkpolicies) for details.
 Note that serverlessLogicOperator, and serverlessOperator are enabled by default. They can be disabled together or seperately by passing the following flags:
 `--set orchestrator.serverlessLogicOperator.enabled=false --set orchestrator.serverlessOperator.enabled=false`
 

charts/rhdh/templates/network-policies.yaml

@@ -367,6 +367,40 @@ spec:
       ports:
         - port: 5432
           protocol: TCP
+{{- if .Values.orchestrator.enabled }}
+---
+# Allow SonataFlow-managed pods to reach the built-in PostgreSQL.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "rhdh.fullname" . }}-db-allow-sonataflow-ingress
+  labels:
+    {{- include "rhdh.labels" . | nindent 4 }}
+  {{- with .Values.commonAnnotations }}
+  annotations:
+    {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }}
+  {{- end }}
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: postgresql
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/component: primary
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/managed-by: sonataflow-operator
+        - namespaceSelector: {}
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/managed-by: sonataflow-operator
+      ports:
+        - port: 5432
+          protocol: TCP
+{{- end }}
 
 {{- if $isReplication }}