From 4925d8b52a615e99df8af78d7bd58618d2d75fd3 Mon Sep 17 00:00:00 2001 From: Armel Soro Date: Mon, 12 Oct 2026 13:39:01 +0200 Subject: [PATCH 1/2] fix: allow egress to Kubernetes API server on port 6443 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Plugins that query cluster resources (Tekton, ArgoCD/GitOps, Topology, KServe model catalog, and any catalog provider or frontend plugin that lists or watches Kubernetes objects) need to reach the API server. On OpenShift and kubeadm clusters the API server listens on port 6443, which was blocked by the default-deny NetworkPolicy. Add port 6443 alongside the existing port 443 in the allow-https-egress policy. The rule has no destination selector, matching the existing 443 pattern — port 6443 is exclusively used by kube-apiserver, and RBAC on the ServiceAccount is the real access-control boundary. --- config/profile/rhdh/default-config/networkpolicy.yaml | 7 +++++++ docs/configuration.md | 1 + docs/intelligent-assistant-okp-kubernetes.md | 2 +- docs/intelligent-assistant-okp-openshift.md | 2 +- 4 files changed, 10 insertions(+), 2 deletions(-) diff --git a/config/profile/rhdh/default-config/networkpolicy.yaml b/config/profile/rhdh/default-config/networkpolicy.yaml index b58ba4016..e4f571c88 100644 --- a/config/profile/rhdh/default-config/networkpolicy.yaml +++ b/config/profile/rhdh/default-config/networkpolicy.yaml @@ -52,6 +52,13 @@ spec: - ports: - port: 443 protocol: TCP + # Kubernetes API server (e.g., OpenShift uses 6443; some managed platforms + # use 443 above). Needed by plugins that query cluster resources: Tekton, + # ArgoCD/GitOps, Topology, KServe model catalog, and any catalog provider + # or frontend plugin that lists or watches Kubernetes objects. + # RBAC on the ServiceAccount is the access-control boundary, not NetworkPolicy. + - port: 6443 + protocol: TCP --- # Redis is part of the recommended checklist for production deployments diff --git a/docs/configuration.md b/docs/configuration.md index ad6f1f744..18c43d791 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -230,6 +230,7 @@ For example, Backstage CR named **mybackstage** will create K8s Deployment resou - DB-scoped policies are filtered out when `spec.database.enableLocalDb` is `false` - When local DB is disabled, the `allow-psql-egress` policy allows egress on port 5432 to any destination (for external databases) - The `allow-redis-egress` policy allows egress on port 6379 TCP to any destination (Redis is not deployed by the operator; users bring their own) + - The `allow-https-egress` policy also allows egress on port 6443 TCP (Kubernetes API server) — needed by plugins that query cluster resources (Tekton, ArgoCD/GitOps, Topology, KServe model catalog, etc.). On some managed platforms (GKE, EKS) the API server listens on port 443 instead. - The `allow-metrics-ingress` policy allows ingress on port 9464 from `openshift-monitoring`, `openshift-user-workload-monitoring`, GKE GMP namespaces (`gmp-system`, `gke-gmp-system`), and `monitoring` (kube-prometheus-stack convention) - On OpenShift, the `allow-router-ingress` policy's `namespaceSelector` is set to `policy-group.network.openshift.io/ingress: ""` diff --git a/docs/intelligent-assistant-okp-kubernetes.md b/docs/intelligent-assistant-okp-kubernetes.md index f8f03454a..ceee2a9d7 100644 --- a/docs/intelligent-assistant-okp-kubernetes.md +++ b/docs/intelligent-assistant-okp-kubernetes.md @@ -80,7 +80,7 @@ spec: number: 8080 ``` -The default RHDH NetworkPolicies already allow HTTPS egress from the Backstage pod on TCP port 443. The OKP add-on additionally allows HTTP egress on ports 80 and 8080. If you replace the default policies, ensure that the replacement permits the port used by `OKP_SERVICE_URL`. +The default RHDH NetworkPolicies already allow HTTPS egress from the Backstage pod on TCP ports 443 and 6443 (Kubernetes API server). The OKP add-on additionally allows HTTP egress on ports 80 and 8080. If you replace the default policies, ensure that the replacement permits the port used by `OKP_SERVICE_URL`. ## Configure the public OKP URL diff --git a/docs/intelligent-assistant-okp-openshift.md b/docs/intelligent-assistant-okp-openshift.md index a2f499ada..f994937c9 100644 --- a/docs/intelligent-assistant-okp-openshift.md +++ b/docs/intelligent-assistant-okp-openshift.md @@ -51,7 +51,7 @@ The ConfigMap contains only a public CA certificate. Do not copy the router Secr ### Verify HTTPS egress -The default RHDH NetworkPolicies allow HTTPS egress from the Backstage pod on TCP port 443. If you replace the default policies, ensure that the replacement permits HTTPS access to the OKP Route. +The default RHDH NetworkPolicies allow HTTPS egress from the Backstage pod on TCP ports 443 and 6443 (Kubernetes API server). If you replace the default policies, ensure that the replacement permits HTTPS access to the OKP Route. ### Mount and trust the CA From 7765052b7f4a4d8eca2db9fdd23a601a838a8b56 Mon Sep 17 00:00:00 2001 From: Armel Soro Date: Mon, 12 Oct 2026 13:40:14 +0200 Subject: [PATCH 2/2] chore: regen bundle manifests --- .../rhdh/manifests/rhdh-default-config_v1_configmap.yaml | 7 +++++++ dist/rhdh/install.yaml | 7 +++++++ 2 files changed, 14 insertions(+) diff --git a/bundle/rhdh/manifests/rhdh-default-config_v1_configmap.yaml b/bundle/rhdh/manifests/rhdh-default-config_v1_configmap.yaml index 23006b509..eed57dcd3 100644 --- a/bundle/rhdh/manifests/rhdh-default-config_v1_configmap.yaml +++ b/bundle/rhdh/manifests/rhdh-default-config_v1_configmap.yaml @@ -430,6 +430,13 @@ data: - ports: - port: 443 protocol: TCP + # Kubernetes API server (e.g., OpenShift uses 6443; some managed platforms + # use 443 above). Needed by plugins that query cluster resources: Tekton, + # ArgoCD/GitOps, Topology, KServe model catalog, and any catalog provider + # or frontend plugin that lists or watches Kubernetes objects. + # RBAC on the ServiceAccount is the access-control boundary, not NetworkPolicy. + - port: 6443 + protocol: TCP --- # Redis is part of the recommended checklist for production deployments diff --git a/dist/rhdh/install.yaml b/dist/rhdh/install.yaml index 7c569491f..4b8e7f492 100644 --- a/dist/rhdh/install.yaml +++ b/dist/rhdh/install.yaml @@ -3255,6 +3255,13 @@ data: - ports: - port: 443 protocol: TCP + # Kubernetes API server (e.g., OpenShift uses 6443; some managed platforms + # use 443 above). Needed by plugins that query cluster resources: Tekton, + # ArgoCD/GitOps, Topology, KServe model catalog, and any catalog provider + # or frontend plugin that lists or watches Kubernetes objects. + # RBAC on the ServiceAccount is the access-control boundary, not NetworkPolicy. + - port: 6443 + protocol: TCP --- # Redis is part of the recommended checklist for production deployments