OCPBUGS-42579: Add network policies for konnectivity server and ignition server proxy #4840

davidvossel · 2024-10-02T14:32:53Z

This fixes two issues that impact HCP with the NodePort publishing strategy.

The konnectivity server component has moved in and out of the kas pod throughout several releases. The result is, some releases have network policies that allow connections to the konnectivity server, and others do not. To account for this, the hypershift operator needs to support both when the konnectivity server is in the kas pod and when it is outside of the pod.

This is resolved by adding a new network policy that allows access to the konnectivity server when it is hosted within the kas pod (which is how this is currently deployed in 4.17)

Nodes currently can't access the ignition proxy to retrieve their configs. This is resolved by adding a network policy for the ignition proxy.

openshift-ci-robot · 2024-10-02T14:32:59Z

@davidvossel: This pull request references Jira Issue OCPBUGS-42579, which is invalid:

expected the bug to target the "4.18.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

This fixes two issues that impact HCP with the NodePort publishing strategy.

The konnectivity server component has moved in and out of the kas pod throughout several releases. The result is, some releases have network policies that allow connections to the konnectivity server, and others do not. To account for this, the hypershift operator needs to support both when the konnectivity server is in the kas pod and when it is outside of the pod.

This is resolved by adding a new network policy that allows access to the konnectivity server when it is hosted within the kas pod (which is how this is currently deployed in 4.17)

Nodes currently can't access the ignition proxy to retrieve their configs. This is resolved by adding a network policy for the ignition proxy.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2024-10-02T14:35:00Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: davidvossel

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [davidvossel]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

davidvossel · 2024-10-02T14:58:26Z

/jira refresh

openshift-ci-robot · 2024-10-02T14:58:33Z

@davidvossel: This pull request references Jira Issue OCPBUGS-42579, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.18.0) matches configured target version for branch (4.18.0)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira ([email protected]), skipping review request.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

jparrill

Hey David, thanks for the PR. It's there any chance to add a unitTest around the netpol reconciliation to identify the policy is placed properly when is in or out of the KAS?

jparrill · 2024-10-02T15:11:34Z

hypershift-operator/controllers/hostedcluster/network_policies.go

@@ -151,6 +151,13 @@ func (r *HostedClusterReconciler) reconcileNetworkPolicies(ctx context.Context,
 				}); err != nil {
 					return fmt.Errorf("failed to reconcile ignition nodeport network policy: %w", err)
 				}
+				// Reconcile nodeport-ignition-procy Network Policy


nit: s/nodeport-ignition-procy/nodeport-ignition-proxy/

jparrill · 2024-10-02T15:23:21Z

hypershift-operator/controllers/hostedcluster/network_policies.go

+
+				// Reconcile nodeport-konnectivity Network Policy when konnectivity is hosted in the kas pod
+				policy = networkpolicy.NodePortKonnectivityKASNetworkPolicy(controlPlaneNamespaceName)
+				if _, err := createOrUpdate(ctx, r.Client, policy, func() error {


I think this will create the policy always, we need to identify where is konnectivity and then place the netpol accordingly.

we need to identify where is konnectivity and then place the netpol accordingly.

how? the hypershift operator isn't responsible for laying down the konnectivity agent.

Yeah you're right. I had an eye in the security people that maybe they will concern to have that gate opened.

davidvossel

It's there any chance to add a unitTest around the netpol reconciliation to identify the policy is placed properly when is in or out of the KAS?

i don't believe the hypershift operator has knowledge of where the konnectivity server is placed.

davidvossel · 2024-10-02T19:24:03Z

hypershift-operator/controllers/hostedcluster/network_policies.go

+
+				// Reconcile nodeport-konnectivity Network Policy when konnectivity is hosted in the kas pod
+				policy = networkpolicy.NodePortKonnectivityKASNetworkPolicy(controlPlaneNamespaceName)
+				if _, err := createOrUpdate(ctx, r.Client, policy, func() error {


we need to identify where is konnectivity and then place the netpol accordingly.

how? the hypershift operator isn't responsible for laying down the konnectivity agent.

Signed-off-by: David Vossel <[email protected]>

jparrill

Looks good so far. This also will cover this other bug OCPBUGS-39317. I will mark it as dup and remark it will be solved with this PR.

jparrill · 2024-10-07T12:07:26Z

hypershift-operator/controllers/hostedcluster/network_policies.go

+
+				// Reconcile nodeport-konnectivity Network Policy when konnectivity is hosted in the kas pod
+				policy = networkpolicy.NodePortKonnectivityKASNetworkPolicy(controlPlaneNamespaceName)
+				if _, err := createOrUpdate(ctx, r.Client, policy, func() error {


Yeah you're right. I had an eye in the security people that maybe they will concern to have that gate opened.

jparrill · 2024-10-07T13:37:22Z

/lgtm

openshift-ci · 2024-10-07T17:05:12Z

@davidvossel: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot · 2024-10-07T17:07:43Z

@davidvossel: Jira Issue OCPBUGS-42579: All pull requests linked via external trackers have merged:

openshift/hypershift#4840

Jira Issue OCPBUGS-42579 has been moved to the MODIFIED state.

In response to this:

This fixes two issues that impact HCP with the NodePort publishing strategy.

The konnectivity server component has moved in and out of the kas pod throughout several releases. The result is, some releases have network policies that allow connections to the konnectivity server, and others do not. To account for this, the hypershift operator needs to support both when the konnectivity server is in the kas pod and when it is outside of the pod.

This is resolved by adding a new network policy that allows access to the konnectivity server when it is hosted within the kas pod (which is how this is currently deployed in 4.17)

Nodes currently can't access the ignition proxy to retrieve their configs. This is resolved by adding a network policy for the ignition proxy.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-bot · 2024-10-07T19:16:43Z

[ART PR BUILD NOTIFIER]

Distgit: hypershift
This PR has been included in build ose-hypershift-container-v4.18.0-202410071842.p0.g605ee5a.assembly.stream.el9.
All builds following this will include this PR.

davidvossel · 2024-10-08T20:50:21Z

/cherry-pick release-4.17 release-4.16 release-4.15 release-4.14

openshift-cherrypick-robot · 2024-10-08T20:51:13Z

@davidvossel: new pull request created: #4865

In response to this:

/cherry-pick release-4.17 release-4.16 release-4.15 release-4.14

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Oct 2, 2024

openshift-ci bot added the do-not-merge/needs-area label Oct 2, 2024

openshift-ci bot requested review from csrwng and isco-rodriguez October 2, 2024 14:34

openshift-ci bot added the area/hypershift-operator Indicates the PR includes changes for the hypershift operator and API - outside an OCP release label Oct 2, 2024

openshift-ci bot added approved Indicates a PR has been approved by an approver from all required OWNERS files. and removed do-not-merge/needs-area labels Oct 2, 2024

openshift-ci-robot added the jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. label Oct 2, 2024

openshift-ci-robot removed the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Oct 2, 2024

jparrill reviewed Oct 2, 2024

View reviewed changes

davidvossel commented Oct 2, 2024

View reviewed changes

Add network policies for konnectivity server and ignition server proxy

0d97fdd

Signed-off-by: David Vossel <[email protected]>

davidvossel force-pushed the np-fix-v1 branch from c66c03c to 0d97fdd Compare October 2, 2024 19:33

jparrill reviewed Oct 7, 2024

View reviewed changes

openshift-ci bot assigned jparrill Oct 7, 2024

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 7, 2024

openshift-merge-bot bot merged commit 605ee5a into openshift:main Oct 7, 2024
15 checks passed

openshift-cherrypick-robot mentioned this pull request Oct 8, 2024

[release-4.17] OCPBUGS-42879: Add network policies for konnectivity server and ignition server proxy #4865

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OCPBUGS-42579: Add network policies for konnectivity server and ignition server proxy #4840

OCPBUGS-42579: Add network policies for konnectivity server and ignition server proxy #4840

davidvossel commented Oct 2, 2024

openshift-ci-robot commented Oct 2, 2024

openshift-ci bot commented Oct 2, 2024

davidvossel commented Oct 2, 2024

openshift-ci-robot commented Oct 2, 2024

jparrill left a comment

jparrill Oct 2, 2024 •

edited

Loading

jparrill Oct 2, 2024

davidvossel Oct 2, 2024

jparrill Oct 7, 2024

davidvossel left a comment

davidvossel Oct 2, 2024

jparrill left a comment

jparrill Oct 7, 2024

jparrill commented Oct 7, 2024

openshift-ci bot commented Oct 7, 2024

openshift-ci-robot commented Oct 7, 2024

openshift-bot commented Oct 7, 2024

davidvossel commented Oct 8, 2024

openshift-cherrypick-robot commented Oct 8, 2024

OCPBUGS-42579: Add network policies for konnectivity server and ignition server proxy #4840

OCPBUGS-42579: Add network policies for konnectivity server and ignition server proxy #4840

Conversation

davidvossel commented Oct 2, 2024

openshift-ci-robot commented Oct 2, 2024

openshift-ci bot commented Oct 2, 2024

davidvossel commented Oct 2, 2024

openshift-ci-robot commented Oct 2, 2024

jparrill left a comment

Choose a reason for hiding this comment

jparrill Oct 2, 2024 • edited Loading

Choose a reason for hiding this comment

jparrill Oct 2, 2024

Choose a reason for hiding this comment

davidvossel Oct 2, 2024

Choose a reason for hiding this comment

jparrill Oct 7, 2024

Choose a reason for hiding this comment

davidvossel left a comment

Choose a reason for hiding this comment

davidvossel Oct 2, 2024

Choose a reason for hiding this comment

jparrill left a comment

Choose a reason for hiding this comment

jparrill Oct 7, 2024

Choose a reason for hiding this comment

jparrill commented Oct 7, 2024

openshift-ci bot commented Oct 7, 2024

openshift-ci-robot commented Oct 7, 2024

openshift-bot commented Oct 7, 2024

davidvossel commented Oct 8, 2024

openshift-cherrypick-robot commented Oct 8, 2024

jparrill Oct 2, 2024 •

edited

Loading