feat: add in-cluster HTTP (port 80) egress NetworkPolicy

config/profile/rhdh/default-config/networkpolicy.yaml

@@ -53,6 +53,27 @@ spec:
         - port: 443
           protocol: TCP
 
+---
+# Internal HTTP egress: plugins that talk to in-cluster services behind plain
+# HTTP routes or services (e.g., Keycloak without TLS termination) need port 80.
+# Restricted to cluster-internal destinations via namespaceSelector.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-http-egress
+spec:
+  podSelector:
+    matchLabels:
+      rhdh.redhat.com/app: backstage # replaced at runtime with 'backstage-<cr-name>'
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector: {}
+      ports:
+        - port: 80
+          protocol: TCP
+
 ---
 # Redis is part of the recommended checklist for production deployments
 # (see https://docs.redhat.com/en/documentation/red_hat_developer_hub/1.10/html/setting_up_and_configuring_your_first_red_hat_developer_hub_instance/checklist-to-run-your-first-rhdh-instance-in-production_setting-up-and-configuring-your-first-red-hat-developer-hub-instance).

docs/configuration.md

@@ -229,6 +229,7 @@ For example, Backstage CR named **mybackstage** will create K8s Deployment resou
     - The placeholder value in `podSelector.matchLabels` (`backstage` vs `backstage-psql`) determines whether a policy targets the backend or the database at runtime
     - DB-scoped policies are filtered out when `spec.database.enableLocalDb` is `false`
     - When local DB is disabled, the `allow-psql-egress` policy allows egress on port 5432 to any destination (for external databases)
+    - The `allow-http-egress` policy allows egress on port 80 TCP to in-cluster destinations only (`namespaceSelector: {}`), for services behind plain HTTP routes or services (e.g., Keycloak without TLS termination)
     - The `allow-redis-egress` policy allows egress on port 6379 TCP to any destination (Redis is not deployed by the operator; users bring their own)
     - The `allow-metrics-ingress` policy allows ingress on port 9464 from `openshift-monitoring`, `openshift-user-workload-monitoring`, GKE GMP namespaces (`gmp-system`, `gke-gmp-system`), and `monitoring` (kube-prometheus-stack convention)
     - On OpenShift, the `allow-router-ingress` policy's `namespaceSelector` is set to `policy-group.network.openshift.io/ingress: ""`

pkg/model/networkpolicy_test.go

@@ -33,7 +33,7 @@ func TestDefaultNetworkPolicies(t *testing.T) {
 	assert.NotNil(t, obj)
 
 	mo := obj.Object().(*multiobject.MultiObject)
-	assert.Equal(t, 10, len(mo.Items), "expected 7 backend + 3 DB NPs")
+	assert.Equal(t, 11, len(mo.Items), "expected 8 backend + 3 DB NPs")
 
 	backendLabel := utils.BackstageAppLabelValue(bs.Name)
 	dbLabel := utils.BackstageDbAppLabelValue(bs.Name)
@@ -48,7 +48,7 @@ func TestDefaultNetworkPolicies(t *testing.T) {
 			backendCount++
 		}
 	}
-	assert.Equal(t, 7, backendCount, "expected 7 backend NPs")
+	assert.Equal(t, 8, backendCount, "expected 8 backend NPs")
 	assert.Equal(t, 3, dbCount, "expected 3 DB NPs")
 }
 
@@ -63,7 +63,7 @@ func TestNetworkPoliciesWithoutLocalDb(t *testing.T) {
 	assert.NotNil(t, obj)
 
 	mo := obj.Object().(*multiobject.MultiObject)
-	assert.Equal(t, 7, len(mo.Items), "expected only 7 backend NPs when localDb is disabled")
+	assert.Equal(t, 8, len(mo.Items), "expected only 8 backend NPs when localDb is disabled")
 
 	backendLabel := utils.BackstageAppLabelValue(testObj.backstage.Name)
 	for _, item := range mo.Items {
@@ -218,7 +218,7 @@ func TestNetworkPolicyFlavourMergePreservesNamespaceWidePodSelector(t *testing.T
 	assert.NotNil(t, obj)
 
 	mo := obj.Object().(*multiobject.MultiObject)
-	assert.Equal(t, 8, len(mo.Items), "expected 7 backend + 1 flavour NP (DB NPs filtered out)")
+	assert.Equal(t, 9, len(mo.Items), "expected 8 backend + 1 flavour NP (DB NPs filtered out)")
 
 	backendLabel := utils.BackstageAppLabelValue(testObj.backstage.Name)
 	var foundNamespaceWide bool

pkg/model/testdata/default-config/networkpolicy.yaml

@@ -48,6 +48,23 @@ spec:
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
+metadata:
+  name: allow-http-egress
+spec:
+  podSelector:
+    matchLabels:
+      rhdh.redhat.com/app: backstage
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector: {}
+      ports:
+        - port: 80
+          protocol: TCP
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: allow-redis-egress
 spec:

pkg/model/testdata/testflavours/default-config/networkpolicy.yaml

@@ -48,6 +48,23 @@ spec:
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
+metadata:
+  name: allow-http-egress
+spec:
+  podSelector:
+    matchLabels:
+      rhdh.redhat.com/app: backstage
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector: {}
+      ports:
+        - port: 80
+          protocol: TCP
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: allow-redis-egress
 spec: