OCPSTRAT-3567: Replace console allow-all NetworkPolicy with scoped policies by redhat-chai-bot · Pull Request #1227 · openshift/console-operator

redhat-chai-bot · 2026-09-03T20:30:03Z

Summary

Replace the namespace-wide allow-all NetworkPolicy in openshift-console with explicit policies that reduce unintended ingress while preserving required console backend egress.

Add namespace default-deny for ingress and egress.
Allow router ingress to console UI on pod ports 8443 and 8444.
Allow monitoring ingress to console UI metrics on pod port 8443.
Allow router ingress to downloads pods on pod port 8080.
Retain broad egress only for console UI pods because ConsolePlugin services and external integrations are dynamic.
Leave downloads pods with no egress allowance.

Validation

make verify
make test-unit
Reviewed the complete diff and confirmed a clean working tree.

Tracking: OCPSTRAT-3567

AI-generated. Review for accuracy.

@spadgett requested in Slack thread

Summary by CodeRabbit

Security Enhancements
- Added network controls for the console UI, allowing required inbound traffic from platform routing and monitoring services.
- Added controlled access for the console downloads service from the OpenShift router.
- Permitted the console UI’s required outbound network traffic.
- Changed console networking to deny inbound and outbound traffic by default unless explicitly permitted by an approved policy.

… explicit policies Replace the namespace-wide allow-all NetworkPolicy in the openshift-console namespace with four explicit, auditable policies: 1. default-deny: Deny all ingress and egress for all pods in the namespace. 2. allow-ingress-console-ui: Allow ingress from the OpenShift router (openshift-ingress namespace) on ports 8443 and 8444, and from the monitoring stack (openshift-monitoring namespace) on port 8443 for Prometheus metrics scraping. 3. allow-ingress-downloads: Allow ingress from the OpenShift router (openshift-ingress namespace) on port 8080 for CLI binary downloads. 4. allow-egress-console-ui: Allow all egress from console UI pods only. Broad egress is required because the console backend communicates with the Kubernetes API server (address varies per cluster), dynamically registered ConsolePlugin backend services (arbitrary namespaces/ports), external Helm chart repositories, and OAuth/OIDC endpoints. The downloads server pods are intentionally excluded and have no egress allowance under the default-deny policy. Namespace selectors use the well-known labels network.openshift.io/ policy-group set by the cluster-ingress-operator and cluster-monitoring- operator on the openshift-ingress and openshift-monitoring namespaces. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

openshift-merge-bot · 2026-09-03T20:30:06Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci-robot · 2026-09-03T20:30:07Z

@redhat-chai-bot: This pull request references OCPSTRAT-3567 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the initiative to target the "5.1.0" version, but no target version was set.

Details

In response to this:

Summary

Replace the namespace-wide allow-all NetworkPolicy in openshift-console with explicit policies that reduce unintended ingress while preserving required console backend egress.

Add namespace default-deny for ingress and egress.

Allow router ingress to console UI on pod ports 8443 and 8444.

Allow monitoring ingress to console UI metrics on pod port 8443.

Allow router ingress to downloads pods on pod port 8080.

Retain broad egress only for console UI pods because ConsolePlugin services and external integrations are dynamic.

Leave downloads pods with no egress allowance.

Validation

make verify

make test-unit

Reviewed the complete diff and confirmed a clean working tree.

Tracking: OCPSTRAT-3567

AI-generated. Review for accuracy.

@spadgett requested in Slack thread

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-09-03T20:30:43Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: 8994a17b-941a-4859-b340-9a5d9d756a6d

📥 Commits

Reviewing files that changed from the base of the PR and between 25074b4 and 0db17b0.

📒 Files selected for processing (1)

manifests/03-networkpolicy-console-allow-egress-console-ui.yaml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

openshift/console (manual)

🚧 Files skipped from review as they are similar to previous changes (1)

manifests/03-networkpolicy-console-allow-egress-console-ui.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

🧰 Additional context used

🔀 Multi-repo context openshift/console

Linked repositories findings

openshift/console

cmd/downloads/main.go:19 sets the downloads server’s default port to 8080, matching the new router ingress policy. [::openshift/console::]
pkg/server/server.go:416-425 proxies monitoring requests through Thanos endpoints, confirming the console UI requires connectivity to monitoring services. [::openshift/console::]
pkg/serverconfig/config.go:302-320 configures Alertmanager and Prometheus-related endpoints consumed by the console, relevant to retaining console UI egress. [::openshift/console::]
pkg/olm/catalog_client.go:84-91 and pkg/proxy/proxy.go show runtime proxying to configured service endpoints, supporting the policy’s broad UI egress requirement. [::openshift/console::]

Walkthrough

The console namespace changes from allow-all to default-deny behavior. New policies allow console UI ingress, console UI egress, and downloads ingress from defined namespace groups and ports. Tests validate selectors and ports.

Changes

Console network policy enforcement

Layer / File(s)	Summary
Default-deny and workload allow rules `manifests/03-networkpolicy-console-default-deny.yaml`, `manifests/03-networkpolicy-console-allow-ingress-console-ui.yaml`, `manifests/03-networkpolicy-console-allow-ingress-downloads.yaml`, `manifests/03-networkpolicy-console-allow-egress-console-ui.yaml`	Renames the policy to `default-deny` and removes its allow-all rules. Adds explicit console UI ingress and egress policies and downloads ingress rules.
Network policy manifest validation `pkg/console/subresource/deployment/networkpolicy_test.go`	Adds tests that compare policy selectors and TCP ports with console deployments and services.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 0db17

The change replaces unrestricted console namespace networking with scoped ingress and egress policies. No current merge-blocking risk is identified.

Suggested reviewers: wking

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 1 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the primary change: replacing the console allow-all NetworkPolicy with scoped policies. It also includes the required Jira issue prefix.
Description check	✅ Passed	The description clearly explains the policy changes, validation commands, tracking issue, and request context. It omits several template headings, including explicit root cause, browser conformance, a…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The changed test adds one standard Go `Test...` function and `t.Run` subtests. The subtest names are fixed literals: `console UI egress`, `console UI ingress`, and `downloads ingress`. No Ginkgo title…
Test Structure And Quality	✅ Passed	PASS. The PR adds a standard Go unit test, not Ginkgo code. The test reads embedded manifests and local files only; it creates no cluster resources and has no cluster waits, Eventually, or Consistentl…
Microshift Test Compatibility	✅ Passed	PASS: The pull request adds one test function, `TestNetworkPolicyAllowRulesMatchWorkloadManifests`, using the standard Go `testing` package. It does not add Ginkgo `It`, `Describe`, `Context`, or `Whe…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request adds a standard Go `testing.Test` function, not a Ginkgo e2e test. The test reads local Kubernetes manifests and compares selectors and ports. It does not inspect or schedule nodes, u…
Topology-Aware Scheduling Compatibility	✅ Passed	No topology-aware scheduling issue is introduced. The complete diff from main changes only four openshift-console NetworkPolicy manifests and one validation test. The manifests define pod selectors, i…
Ote Binary Stdout Contract	✅ Passed	PASS — The PR changes three NetworkPolicy manifests, renames one manifest, and adds a test function with helpers. The new Go file has no main(), init(), TestMain(), suite hook, fmt/log/klog, or stdout…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The PR adds one Go unit test, `TestNetworkPolicyAllowRulesMatchWorkloadManifests`, using the standard `testing` package. It does not add Ginkgo constructs such as `It`, `Describe`, `Context`, or…
No-Weak-Crypto	✅ Passed	PASS. The pull request changes only Kubernetes NetworkPolicy manifests and a test for selectors and ports. The added Go test imports file, runtime, testing, Kubernetes API, and comparison packages; it…
Container-Privileges	✅ Passed	PASS. The PR changes only NetworkPolicy manifests and a validation test. The added and renamed manifest lines contain no `privileged: true`, `hostPID`, `hostNetwork`, `hostIPC`, `SYS_ADMIN`, or `allow…
No-Sensitive-Data-In-Logs	✅ Passed	No sensitive-data logging was introduced. The PR adds NetworkPolicy YAML and a test; the test diagnostics report only static policy filenames, selectors, service names, protocols, and ports. The manif…

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 1 files. (1 skipped: 1 unsupported.)

Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

spadgett · 2026-09-04T14:33:30Z

@redhat-chai-bot Can you add some unit tests to check that the ports/selectors are validated against actual deployments?

spadgett · 2026-09-04T14:53:50Z

/test e2e-aws-console

wking · 2026-09-04T19:21:53Z

+      explicitly allowed policies. Companion policies grant ingress
+      from the OpenShift router and monitoring stack, and egress for
+      the console UI pods.


Suggested change

explicitly allowed policies. Companion policies grant ingress

from the OpenShift router and monitoring stack, and egress for

the console UI pods.

explicitly allowed policies.

I think we should drop the "Companion policies grant ingress..." sentence from this policy. The previous "...ensuring that pods only communicate through explicitly allowed policies" is a sufficient hint that other NetworkPolicies exist, and cluster-admins can go read the descriptions on those policies to figure out what they do. That way, we don't have to remember to come back and bump this description as other NetworkPolicies are added, removed, or otherwise evolved.

Agreed. I’ll remove the companion-policy inventory from the default-deny description and keep the stable generic isolation description, so it won’t need follow-up edits as policies evolve.

AI-generated. Review for accuracy.

wking · 2026-09-04T19:26:49Z

+	"github.com/openshift/library-go/pkg/operator/resource/resourceread"
+)
+
+func TestNetworkPolicyAllowRulesMatchWorkloadManifests(t *testing.T) {


I dunno if this test-coverage is worth it. If we flub one of the matches, won't the blocking e2e presubmits turn up things like "hey, I can't access the Console UI?" or "TargetDown from errors from the console metrics?" etc.?

That’s a fair concern. The e2e presubmits are still the end-to-end guard, but this test is a cheap deterministic check that catches selector/target-port drift before a cluster run. It also covers the custom-route redirect and downloads paths that a normal console UI flow may not exercise. I’ll keep it as a focused manifest-contract test rather than relying on e2e alone.

AI-generated. Review for accuracy.

The e2e presubmits are still the end-to-end guard, but this test is a cheap deterministic check that catches selector/target-port drift before a cluster run.

Selector/target-port drift seems unlikely, and I'm not sure there's any garuntee that unit test success gates the launching of the e2e runs, vs. those happening in parallel.

It also covers the custom-route redirect and downloads paths that a normal console UI flow may not exercise.

Seems like those paths should have some e2e test coverage too then, because "NetworkPolicy metadata matches!" isn't sufficient to confirm they work end to end.

Agreed — this unit test does not gate or replace the e2e jobs, and it does not prove that the routes work end to end. Its narrower purpose is to validate the intended manifest contract early and cheaply; it is not a runtime-coverage claim. I won’t add e2e coverage or expand the egress design in this PR. Since the original review request asked for this exact ports/selectors check and the test is local/static with the full suite passing, I’m leaving it in place unless maintainers prefer to drop the contract check entirely.

AI-generated. Review for accuracy.

spadgett

/lgtm

openshift-merge-bot · 2026-09-08T11:36:17Z

Scheduling required tests:
/test e2e-aws-console
/test e2e-aws-operator
/test e2e-azure-ovn-upgrade
/test e2e-gcp-ovn

openshift-ci · 2026-09-08T11:36:19Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: redhat-chai-bot, spadgett

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [spadgett]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2026-09-08T15:27:44Z

@redhat-chai-bot: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-console	`0db17b0`	link	true	`/test e2e-aws-console`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Sep 3, 2026

openshift-ci Bot requested review from jhadvig and spadgett September 3, 2026 20:30

spadgett self-assigned this Sep 4, 2026

OCPSTRAT-3567: Validate NetworkPolicy workload manifests

b7336e4

wking reviewed Sep 4, 2026

View reviewed changes

redhat-chai-bot added 2 commits September 4, 2026 19:33

OCPSTRAT-3567: Remove stale NetworkPolicy description

25074b4

OCPSTRAT-3567: Clarify console egress rationale

0db17b0

spadgett approved these changes Sep 8, 2026

View reviewed changes

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Sep 8, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 8, 2026

Uh oh!

Conversation

redhat-chai-bot commented Sep 3, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Summary by CodeRabbit

Uh oh!

openshift-merge-bot Bot commented Sep 3, 2026

Uh oh!

openshift-ci-robot commented Sep 3, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Uh oh!

coderabbitai Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Linked repositories findings

openshift/console

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

spadgett commented Sep 4, 2026

Uh oh!

spadgett commented Sep 4, 2026

Uh oh!

wking Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

redhat-chai-bot Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

wking Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

redhat-chai-bot Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

wking Sep 5, 2026

Choose a reason for hiding this comment

Uh oh!

redhat-chai-bot Sep 5, 2026

Choose a reason for hiding this comment

Uh oh!

spadgett left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-merge-bot Bot commented Sep 8, 2026

Uh oh!

openshift-ci Bot commented Sep 8, 2026

Uh oh!

openshift-ci Bot commented Sep 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

redhat-chai-bot commented Sep 3, 2026 •

edited by coderabbitai Bot

Loading

openshift-ci-robot commented Sep 3, 2026 •

edited by openshift-ci Bot

Loading

coderabbitai Bot commented Sep 3, 2026 •

edited

Loading