fix: add Redis egress NP and allow metrics from openshift-user-workload-monitoring [RHDHBUGS-3724]

config/profile/rhdh/default-config/networkpolicy.yaml

@@ -53,6 +53,27 @@ spec:
         - port: 443
           protocol: TCP
 
+---
+# Redis is part of the recommended checklist for production deployments
+# (see https://docs.redhat.com/en/documentation/red_hat_developer_hub/1.10/html/setting_up_and_configuring_your_first_red_hat_developer_hub_instance/checklist-to-run-your-first-rhdh-instance-in-production_setting-up-and-configuring-your-first-red-hat-developer-hub-instance).
+# RHDH does not deploy Redis OOTB; users bring their own, which could be in the same
+# namespace, a different namespace, or an external managed service. The rule therefore
+# has no pod or namespace selector.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-redis-egress
+spec:
+  podSelector:
+    matchLabels:
+      rhdh.redhat.com/app: backstage # replaced at runtime with 'backstage-<cr-name>'
+  policyTypes:
+    - Egress
+  egress:
+    - ports:
+        - port: 6379
+          protocol: TCP
+
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
@@ -92,6 +113,10 @@ spec:
             matchLabels:
               # OpenShift platform monitoring
               kubernetes.io/metadata.name: openshift-monitoring
+        - namespaceSelector:
+            matchLabels:
+              # OpenShift user workload monitoring (scrapes user-deployed ServiceMonitors)
+              kubernetes.io/metadata.name: openshift-user-workload-monitoring
         - namespaceSelector:
             matchLabels:
               # GKE Standard: Google Managed Prometheus

docs/configuration.md

@@ -229,6 +229,8 @@ For example, Backstage CR named **mybackstage** will create K8s Deployment resou
     - The placeholder value in `podSelector.matchLabels` (`backstage` vs `backstage-psql`) determines whether a policy targets the backend or the database at runtime
     - DB-scoped policies are filtered out when `spec.database.enableLocalDb` is `false`
     - When local DB is disabled, the `allow-psql-egress` policy allows egress on port 5432 to any destination (for external databases)
+    - The `allow-redis-egress` policy allows egress on port 6379 TCP to any destination (Redis is not deployed by the operator; users bring their own)
+    - The `allow-metrics-ingress` policy allows ingress on port 9464 from `openshift-monitoring`, `openshift-user-workload-monitoring`, GKE GMP namespaces (`gmp-system`, `gke-gmp-system`), and `monitoring` (kube-prometheus-stack convention)
     - On OpenShift, the `allow-router-ingress` policy's `namespaceSelector` is set to `policy-group.network.openshift.io/ingress: ""`
 
 ### Multi objects

docs/monitoring.md

@@ -117,6 +117,8 @@ When monitoring is disabled, the operator will automatically clean up any existi
 
 To enable metrics monitoring on OpenShift, ensure you have enabled [monitoring for user-defined projects](https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/monitoring/configuring-user-workload-monitoring#preparing-to-configure-the-monitoring-stack-uwm) for the metrics to be ingested by the built-in Prometheus instances.
 
+**NetworkPolicy note:** When monitoring is enabled, the default `allow-metrics-ingress` NetworkPolicy allows Prometheus in `openshift-user-workload-monitoring` to scrape `/metrics` on port 9464. Platform Prometheus in `openshift-monitoring` does not scrape user-deployed ServiceMonitors.
+
 #### Complete Example
 
 Here's a complete example of a Backstage Custom Resource with monitoring enabled:
@@ -269,6 +271,10 @@ If the ServiceMonitor is not being created automatically:
    $ oc get crd servicemonitors.monitoring.coreos.com
    ```
 
+### Scrapes fail after enabling monitoring on OpenShift
+
+If scrapes fail after enabling `spec.monitoring.enabled: true`, confirm the `allow-metrics-ingress` NetworkPolicy includes `kubernetes.io/metadata.name: openshift-user-workload-monitoring` in its namespace selectors. The default policy already includes this, but if you have overridden it via raw configuration, the user-workload-monitoring namespace must be present for Prometheus to reach port 9464.
+
 ### Metrics Not Appearing in Prometheus
 
 If metrics are not appearing in Prometheus:

pkg/model/networkpolicy_test.go

@@ -33,7 +33,7 @@ func TestDefaultNetworkPolicies(t *testing.T) {
 	assert.NotNil(t, obj)
 
 	mo := obj.Object().(*multiobject.MultiObject)
-	assert.Equal(t, 9, len(mo.Items), "expected 6 backend + 3 DB NPs")
+	assert.Equal(t, 10, len(mo.Items), "expected 7 backend + 3 DB NPs")
 
 	backendLabel := utils.BackstageAppLabelValue(bs.Name)
 	dbLabel := utils.BackstageDbAppLabelValue(bs.Name)
@@ -48,7 +48,7 @@ func TestDefaultNetworkPolicies(t *testing.T) {
 			backendCount++
 		}
 	}
-	assert.Equal(t, 6, backendCount, "expected 6 backend NPs")
+	assert.Equal(t, 7, backendCount, "expected 7 backend NPs")
 	assert.Equal(t, 3, dbCount, "expected 3 DB NPs")
 }
 
@@ -63,7 +63,7 @@ func TestNetworkPoliciesWithoutLocalDb(t *testing.T) {
 	assert.NotNil(t, obj)
 
 	mo := obj.Object().(*multiobject.MultiObject)
-	assert.Equal(t, 6, len(mo.Items), "expected only 6 backend NPs when localDb is disabled")
+	assert.Equal(t, 7, len(mo.Items), "expected only 7 backend NPs when localDb is disabled")
 
 	backendLabel := utils.BackstageAppLabelValue(testObj.backstage.Name)
 	for _, item := range mo.Items {
@@ -218,7 +218,7 @@ func TestNetworkPolicyFlavourMergePreservesNamespaceWidePodSelector(t *testing.T
 	assert.NotNil(t, obj)
 
 	mo := obj.Object().(*multiobject.MultiObject)
-	assert.Equal(t, 7, len(mo.Items), "expected 6 backend + 1 flavour NP (DB NPs filtered out)")
+	assert.Equal(t, 8, len(mo.Items), "expected 7 backend + 1 flavour NP (DB NPs filtered out)")
 
 	backendLabel := utils.BackstageAppLabelValue(testObj.backstage.Name)
 	var foundNamespaceWide bool

pkg/model/testdata/default-config/networkpolicy.yaml

@@ -48,6 +48,21 @@ spec:
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
+metadata:
+  name: allow-redis-egress
+spec:
+  podSelector:
+    matchLabels:
+      rhdh.redhat.com/app: backstage
+  policyTypes:
+    - Egress
+  egress:
+    - ports:
+        - port: 6379
+          protocol: TCP
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: allow-psql-egress
 spec:
@@ -80,6 +95,9 @@ spec:
         - namespaceSelector:
             matchLabels:
               kubernetes.io/metadata.name: openshift-monitoring
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: openshift-user-workload-monitoring
         - namespaceSelector:
             matchLabels:
               kubernetes.io/metadata.name: gmp-system

pkg/model/testdata/testflavours/default-config/networkpolicy.yaml

@@ -48,6 +48,21 @@ spec:
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
+metadata:
+  name: allow-redis-egress
+spec:
+  podSelector:
+    matchLabels:
+      rhdh.redhat.com/app: backstage
+  policyTypes:
+    - Egress
+  egress:
+    - ports:
+        - port: 6379
+          protocol: TCP
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: allow-psql-egress
 spec:
@@ -80,6 +95,9 @@ spec:
         - namespaceSelector:
             matchLabels:
               kubernetes.io/metadata.name: openshift-monitoring
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: openshift-user-workload-monitoring
         - namespaceSelector:
             matchLabels:
               kubernetes.io/metadata.name: gmp-system