[rm3l]

Description

See https://redhat-internal.slack.com/archives/C04CUSD4JSG/p1791554696886209

Add port 6443 (Kubernetes API server) to the allow-https-egress default NetworkPolicy alongside the existing port 443.

Plugins that query cluster resources — Tekton, ArgoCD/GitOps, Topology, KServe model catalog, and any catalog provider or frontend plugin that lists or watches Kubernetes objects — need to reach the API server. On OpenShift and kubeadm clusters the API server listens on port 6443, which was blocked by the default-deny NetworkPolicy. On some managed platforms (GKE, EKS) the API server listens on 443 instead, which was already allowed.

The rule has no destination selector, matching the existing port 443 pattern. Port 6443 is exclusively used by kube-apiserver, and RBAC on the ServiceAccount is the real access-control boundary — not NetworkPolicy.

Which issue(s) does this PR fix or relate to

• RHDHBUGS-3926
• Companion to fix(rhdh): allow egress to Kubernetes API server on port 6443 [RHDHBUGS-3926] rhdh-chart#619

PR acceptance criteria

• Tests
• Documentation

How to test changes / Special notes to the reviewer

1. Deploy the operator and create a Backstage CR.
2. Verify the allow-https-egress NetworkPolicy on the RHDH pod now includes both ports 443 and 6443.
3. Confirm that a plugin querying the Kubernetes API (e.g., Tekton, Topology) can reach the API server without additional user-created NetworkPolicies.

Container Images

Container images are built and pushed to Quay automatically when relevant files change.
Image links will be posted in a PR comment once the push completes.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rhdh-qodo-merge]

PR Summary by Qodo

Allow Kubernetes API egress on TCP port 6443

🐞 Bug fix 📝 Documentation 🕐 10-20 Minutes

AI Description

• Allow default Backstage egress to Kubernetes API servers on port 6443, alongside port 443.
• Regenerate packaged manifests so operator installations include the policy change.
• Document the new allowance and its effect on cluster-resource plugins.

Diagram

graph TD
  A["Policy source"] --> B["Packaged ConfigMap"] --> C["RHDH operator"] --> D["Egress policy"] --> E["Backstage pod"] --> F["Kubernetes API"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Scope egress to the API endpoint

• ➕ Would narrow destinations reachable on port 6443.
• ➖ API endpoint addresses vary by cluster and may not be selectable through NetworkPolicy, adding configuration and reconciliation complexity.

Recommendation: Keep the port-only rule: it matches the existing port 443 policy and works across cluster API endpoint layouts. Endpoint-specific restrictions would be more complex and less portable; ServiceAccount RBAC remains necessary to authorize API operations.

Files changed (6) +24 / -2

Bug fix (1) +7 / -0

networkpolicy.yamlAllow default Kubernetes API egress on port 6443 +7/-0

Allow default Kubernetes API egress on port 6443

• Adds TCP port 6443 to the Backstage pod's allow-https-egress policy without a destination selector. This lets plugins reach API servers that do not listen on port 443.

config/profile/rhdh/default-config/networkpolicy.yaml

Documentation (3) +3 / -2

configuration.mdDocument Kubernetes API egress in default policies +1/-0

Document Kubernetes API egress in default policies

• Notes that allow-https-egress permits TCP port 6443 for cluster-resource plugins, while some managed API servers use port 443.

docs/configuration.md

intelligent-assistant-okp-kubernetes.mdClarify default HTTPS egress ports for Kubernetes +1/-1

Clarify default HTTPS egress ports for Kubernetes

• Updates the OKP guidance to list both default HTTPS egress ports, 443 and 6443.

docs/intelligent-assistant-okp-kubernetes.md

intelligent-assistant-okp-openshift.mdClarify default HTTPS egress ports for OpenShift +1/-1

Clarify default HTTPS egress ports for OpenShift

• Updates the OKP Route guidance to list ports 443 and 6443 in the default Backstage egress policy.

docs/intelligent-assistant-okp-openshift.md

Other (2) +14 / -0

rhdh-default-config_v1_configmap.yamlInclude port 6443 in the bundled default policy +7/-0

Include port 6443 in the bundled default policy

• The generated default-config ConfigMap now includes TCP port 6443 in allow-https-egress, alongside port 443. Comments explain the cluster-plugin use case and RBAC boundary.

bundle/rhdh/manifests/rhdh-default-config_v1_configmap.yaml

install.yamlInclude the policy change in the install manifest +7/-0

Include the policy change in the install manifest

• Regenerates the distribution install manifest with port 6443 in its embedded default-config ConfigMap.

dist/rhdh/install.yaml

[rm3l]

/cherrypick release-2.1

[openshift-cherrypick-robot]

@rm3l: once the present PR merges, I will cherry-pick it on top of release-2.1 in a new PR and assign it to you.

Details

In response to this:

/cherrypick release-2.1

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (1) 🔗 Cross-repo conflicts (1) 📜 Skill insights (0)

1. Docs leave the 6443 change undated 📘 Rule violation § Compliance

Description

The updated network-policy documentation states that port 6443 is allowed without identifying the
release in which this behavior begins. Readers comparing deployments before and after this change
cannot determine which versions provide the new Kubernetes API access, and the same ambiguity
appears in the OKP integration guidance.

Code

docs/configuration.md[233]

+    - The `allow-https-egress` policy also allows egress on port 6443 TCP (Kubernetes API server) — needed by plugins that query cluster resources (Tekton, ArgoCD/GitOps, Topology, KServe model catalog, etc.). On some managed platforms (GKE, EKS) the API server listens on port 443 instead.

Relevance

●●● Strong

Recent documentation review accepted adding explicit version boundaries for changed behavior.

PR-#3215

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The changed documentation describes the newly added port 6443 behavior but contains no concrete
version number or before/ since boundary, which violates the requirement to document version
boundaries for behavior changes.

Rule 13: Document version boundaries for behavior changes
docs/configuration.md[233-233]
docs/intelligent-assistant-okp-kubernetes.md[83-83]
docs/intelligent-assistant-okp-openshift.md[54-54]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The documentation introduces the port 6443 egress behavior without stating the version boundary for that change, so readers cannot tell which releases include it.

## Fix Focus Areas
- docs/configuration.md[233-233]
- docs/intelligent-assistant-okp-kubernetes.md[83-83]
- docs/intelligent-assistant-okp-openshift.md[54-54]

## Recommended Fix
Add a concrete release boundary to the documentation, such as "Since vX.Y.Z, the default RHDH NetworkPolicies allow HTTPS egress on TCP ports 443 and 6443." Apply equivalent version-specific wording to the OKP integration documentation where it describes the updated default policy behavior.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Dismiss ↗ | View ↗

---

2. Chart deployments block API egress 🔗 Cross-repo conflict ≡ Correctness

Description

The operator's allow-https-egress policy now permits TCP 6443, but rhdh-chart still renders a
default-deny policy whose HTTPS exception permits only TCP 443. Chart-deployed RHDH pods accessing
an API server on 6443 remain blocked until the companion chart change is merged and released.

Code

config/profile/rhdh/default-config/networkpolicy.yaml[R60-61]

+        - port: 6443
+          protocol: TCP

Relevance

●●● Strong

Recent NetworkPolicy work explicitly mirrored equivalent Helm chart fixes, supporting synchronized
operator and chart changes.

PR-#3481

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The PR adds TCP 6443 to the operator policy. The chart's corresponding policy permits only TCP 443,
while its default-deny policy selects RHDH pods for egress restriction.

rhdh-operator -> rhdh-chart
config/profile/rhdh/default-config/networkpolicy.yaml[48-61]
External repo: redhat-developer/rhdh-chart, charts/rhdh/templates/network-policies.yaml [1-17]
External repo: redhat-developer/rhdh-chart, charts/rhdh/templates/network-policies.yaml [45-66]
External repo: redhat-developer/rhdh-chart, charts/rhdh/templates/_backstage-pod-template.tpl [8-16]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The operator permits API-server egress on TCP 6443, but the RHDH chart still denies it for chart-deployed pods.
## Fix Focus Areas
- config/profile/rhdh/default-config/networkpolicy.yaml[55-61]
- /cross_repos/rhdh-chart/charts/rhdh/templates/network-policies.yaml[60-65]
## Recommended Fix
Add TCP 6443 alongside TCP 443 in the chart's HTTPS egress policy, then coordinate the companion chart change's merge and release with this operator change.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Dismiss ↗ | View ↗

---

3. Backend pods can reach non-API services 🐞 Bug ⛨ Security

Description

allow-https-egress adds TCP port 6443 to a rule with no destination selector, so the allowance is
not limited to the Kubernetes API server. Every selected backend pod can now connect to other
services listening on that port, including services to which Kubernetes API RBAC does not apply.

Code

config/profile/rhdh/default-config/networkpolicy.yaml[R60-61]

+        - port: 6443
+          protocol: TCP

Relevance

● Weak

Team accepts broad port-specific egress when external services require it; similar NetworkPolicy
restriction was rejected.

PR-#3481
PR-#3394

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The default-deny policy isolates egress for the backend pods, while the modified allow policy
selects those pods and specifies ports without a to peer. The model rewrites its placeholder pod
label for each Backstage instance, so the unrestricted port allowance applies to its backend pods.

config/profile/rhdh/default-config/networkpolicy.yaml[7-15]
config/profile/rhdh/default-config/networkpolicy.yaml[43-61]
pkg/model/networkpolicy.go[58-72]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The new port 6443 egress allowance permits connections to any destination, not just the Kubernetes API server.

## Fix Focus Areas
- config/profile/rhdh/default-config/networkpolicy.yaml[43-61]
- bundle/rhdh/manifests/rhdh-default-config_v1_configmap.yaml[422-439]
- dist/rhdh/install.yaml[3247-3264]

## Recommended Fix
Restrict the 6443 rule to configured Kubernetes API endpoint CIDRs while retaining the existing unrestricted port 443 rule. Account for clusters whose API endpoint addresses differ, then regenerate the deployment manifests.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Dismiss ↗ | View ↗

---

Context sources

⚠️ Tickets: not configured — ticket URL found in PR but could not be fetched — check ticket provider credentials

✅ Compliance rules (platform): 18 rules

✅ Cross-repo context — repo relationships

  Explored: repo: redhat-developer/rhdh (sha: f00ae285) — View relationship

  Explored: repo: redhat-developer/rhdh-chart (sha: f84f7e33) — View relationship

Review mode: Auto: ⚖️ Balanced: NetworkPolicy changes affect runtime egress permissions and security boundaries.

Tip of the day

💡 Did you know, you can commit Qodo's fix in one click with committable suggestions (GitHub & GitLab)

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[rhdh-qodo-merge]

Important

The /generate_labels command by Qodo is sunsetting on the 1st of October 2026 and will no longer be available. We recommend switching to the latest Qodo review capabilities. Learn more

[github-actions]

✅ PR images built and pushed successfully!

Images are available for testing (expires in 7 days):

Image	Full tag	PR tag
Operator	quay.io/rhdh-community/operator:2.2.0-pr-3814-7765052	quay.io/rhdh-community/operator:2.2.0-pr-3814
Bundle	quay.io/rhdh-community/operator-bundle:2.2.0-pr-3814-7765052	quay.io/rhdh-community/operator-bundle:2.2.0-pr-3814
Catalog	quay.io/rhdh-community/operator-catalog:2.2.0-pr-3814-7765052	quay.io/rhdh-community/operator-catalog:2.2.0-pr-3814

[subhashkhileri]

/lgtm

[openshift-cherrypick-robot]

@rm3l: new pull request created: #3830

Details

In response to this:

/cherrypick release-2.1

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.