NETOBSERV-1377: Add controller to deploy netobserv network policy

apis/flowcollector/v1beta2/flowcollector_types.go

@@ -84,6 +84,25 @@ type FlowCollectorSpec struct {
 	// +optional
 	// +k8s:conversion-gen=false
 	Exporters []*FlowCollectorExporter `json:"exporters"`
+
+	// `networkPolicy` defines ingress network policy settings for NetObserv components isolation.
+	// +k8s:conversion-gen=false
+	NetworkPolicy NetworkPolicy `json:"networkPolicy,omitempty"`
+}
+
+type NetworkPolicy struct {
+	// Set `enable` to `true` to deploy network policies on the namespaces used by NetObserv (main and privileged). It is disabled by default.
+	// These network policies better isolate the NetObserv components to prevent undesired connections to them.
+	// We recommend you either enable it, or create your own network policy for NetObserv.
+	// +optional
+	Enable *bool `json:"enable,omitempty"`
+
+	// `additionalNamespaces` contains additional namespaces allowed to connect to the NetObserv namespace.
+	// It gives some flexibility in the network policy configuration, however should you need a more specific
+	// configuration, you can disable it and install your own instead.
+	//+kubebuilder:default:={"openshift-console", "openshift-monitoring"}
+	//+optional
+	AdditionalNamespaces []string `json:"additionalNamespaces"`
 }
 
 type FlowCollectorAgentType string

bundle/manifests/flows.netobserv.io_flowcollectors.yaml

@@ -6382,6 +6382,28 @@ spec:
                 default: netobserv
                 description: Namespace where NetObserv pods are deployed.
                 type: string
+              networkPolicy:
+                description: '`networkPolicy` defines ingress network policy settings
+                  for NetObserv components isolation.'
+                properties:
+                  additionalNamespaces:
+                    default:
+                    - openshift-console
+                    - openshift-monitoring
+                    description: |-
+                      `additionalNamespaces` contains additional namespaces allowed to connect to the NetObserv namespace.
+                      It gives some flexibility in the network policy configuration, however should you need a more specific
+                      configuration, you can disable it and install your own instead.
+                    items:
+                      type: string
+                    type: array
+                  enable:
+                    description: |-
+                      Set `enable` to `true` to deploy network policies on the namespaces used by NetObserv (main and privileged). It is disabled by default.
+                      These network policies better isolate the NetObserv components to prevent undesired connections to them.
+                      We recommend you either enable it, or create your own network policy for NetObserv.
+                    type: boolean
+                type: object
               processor:
                 description: |-
                   `processor` defines the settings of the component that receives the flows from the agent,

bundle/manifests/netobserv-operator.clusterserviceversion.yaml

@@ -393,6 +393,10 @@ metadata:
               "writeTimeout": "10s"
             },
             "namespace": "netobserv",
+            "networkPolicy": {
+              "additionalNamespaces": [],
+              "enable": false
+            },
             "processor": {
               "imagePullPolicy": "IfNotPresent",
               "kafkaConsumerAutoscaler": null,
@@ -776,6 +780,12 @@ spec:
         path: loki.readTimeout
       - displayName: Namespace
         path: namespace
+      - displayName: Network policy
+        path: networkPolicy
+      - displayName: Additional namespaces
+        path: networkPolicy.additionalNamespaces
+      - displayName: Enable
+        path: networkPolicy.enable
       - displayName: Log types
         path: processor.logTypes
       - displayName: Disable alerts
@@ -1070,6 +1080,18 @@ spec:
           - patch
           - update
           - watch
+        - apiGroups:
+          - networking.k8s.io
+          resources:
+          - networkpolicies
+          verbs:
+          - create
+          - delete
+          - get
+          - list
+          - patch
+          - update
+          - watch
         - apiGroups:
           - operator.openshift.io
           resources:

config/crd/bases/flows.netobserv.io_flowcollectors.yaml

@@ -5857,6 +5857,27 @@ spec:
                   default: netobserv
                   description: Namespace where NetObserv pods are deployed.
                   type: string
+                networkPolicy:
+                  description: '`networkPolicy` defines ingress network policy settings for NetObserv components isolation.'
+                  properties:
+                    additionalNamespaces:
+                      default:
+                        - openshift-console
+                        - openshift-monitoring
+                      description: |-
+                        `additionalNamespaces` contains additional namespaces allowed to connect to the NetObserv namespace.
+                        It gives some flexibility in the network policy configuration, however should you need a more specific
+                        configuration, you can disable it and install your own instead.
+                      items:
+                        type: string
+                      type: array
+                    enable:
+                      description: |-
+                        Set `enable` to `true` to deploy network policies on the namespaces used by NetObserv (main and privileged). It is disabled by default.
+                        These network policies better isolate the NetObserv components to prevent undesired connections to them.
+                        We recommend you either enable it, or create your own network policy for NetObserv.
+                      type: boolean
+                  type: object
                 processor:
                   description: |-
                     `processor` defines the settings of the component that receives the flows from the agent,

config/rbac/role.yaml

@@ -161,6 +161,18 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - networkpolicies
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - operator.openshift.io
   resources:

config/samples/flows_v1beta2_flowcollector.yaml

@@ -5,6 +5,9 @@ metadata:
 spec:
   namespace: netobserv
   deploymentModel: Direct
+  networkPolicy:
+    enable: false
+    additionalNamespaces: []
   agent:
     type: eBPF
     ebpf:

controllers/constants/constants.go

@@ -40,6 +40,8 @@ const (
 
 	MonitoringNamespace      = "openshift-monitoring"
 	MonitoringServiceAccount = "prometheus-k8s"
+	UWMonitoringNamespace    = "openshift-user-workload-monitoring"
+	ConsoleNamespace         = "openshift-console"
 
 	// Loki roles
 	LokiCRWriter  = "netobserv-writer"

controllers/controllers.go

@@ -3,7 +3,8 @@ package controllers
 import (
 	"github.com/netobserv/network-observability-operator/controllers/flp"
 	"github.com/netobserv/network-observability-operator/controllers/monitoring"
+	"github.com/netobserv/network-observability-operator/controllers/networkpolicy"
 	"github.com/netobserv/network-observability-operator/pkg/manager"
 )
 
-var Registerers = []manager.Registerer{Start, flp.Start, monitoring.Start}
+var Registerers = []manager.Registerer{Start, flp.Start, monitoring.Start, networkpolicy.Start}

controllers/flowcollector_controller_iso_test.go

@@ -215,6 +215,10 @@ func flowCollectorIsoSpecs() {
 				},
 			},
 			Exporters: []*flowslatest.FlowCollectorExporter{},
+			NetworkPolicy: flowslatest.NetworkPolicy{
+				Enable:               nil,
+				AdditionalNamespaces: []string{},
+			},
 		}
 
 		It("Should create CR successfully", func() {

controllers/networkpolicy/np_controller.go

@@ -0,0 +1,80 @@
+package networkpolicy
+
+import (
+	"context"
+	"fmt"
+
+	networkingv1 "k8s.io/api/networking/v1"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+
+	flowslatest "github.com/netobserv/network-observability-operator/apis/flowcollector/v1beta2"
+	"github.com/netobserv/network-observability-operator/controllers/reconcilers"
+	"github.com/netobserv/network-observability-operator/pkg/helper"
+	"github.com/netobserv/network-observability-operator/pkg/manager"
+	"github.com/netobserv/network-observability-operator/pkg/manager/status"
+)
+
+type Reconciler struct {
+	client.Client
+	mgr    *manager.Manager
+	status status.Instance
+}
+
+func Start(ctx context.Context, mgr *manager.Manager) error {
+	log := log.FromContext(ctx)
+	log.Info("Starting Network Policy controller")
+	r := Reconciler{
+		Client: mgr.Client,
+		mgr:    mgr,
+		status: mgr.Status.ForComponent(status.NetworkPolicy),
+	}
+	return ctrl.NewControllerManagedBy(mgr).
+		For(&flowslatest.FlowCollector{}, reconcilers.IgnoreStatusChange).
+		Named("networkPolicy").
+		Owns(&networkingv1.NetworkPolicy{}).
+		Complete(&r)
+}
+
+// Reconcile is the controller entry point for reconciling current state with desired state.
+// It manages the controller status at a high level. Business logic is delegated into `reconcile`.
+func (r *Reconciler) Reconcile(ctx context.Context, _ ctrl.Request) (ctrl.Result, error) {
+	l := log.Log.WithName("networkpolicy") // clear context (too noisy)
+	ctx = log.IntoContext(ctx, l)
+
+	// Get flowcollector & create dedicated client
+	clh, desired, err := helper.NewFlowCollectorClientHelper(ctx, r.Client)
+	if err != nil {
+		return ctrl.Result{}, fmt.Errorf("failed to get FlowCollector: %w", err)
+	} else if desired == nil {
+		// Delete case
+		return ctrl.Result{}, nil
+	}
+
+	r.status.SetUnknown()
+	defer r.status.Commit(ctx, r.Client)
+
+	err = r.reconcile(ctx, clh, desired)
+	if err != nil {
+		l.Error(err, "Network policy reconcile failure")
+		// Set status failure unless it was already set
+		if !r.status.HasFailure() {
+			r.status.SetFailure("NetworkPolicyError", err.Error())
+		}
+		return ctrl.Result{}, err
+	}
+
+	r.status.SetReady()
+	return ctrl.Result{}, nil
+}
+
+func (r *Reconciler) reconcile(ctx context.Context, clh *helper.Client, desired *flowslatest.FlowCollector) error {
+	npName, desiredNp := buildMainNetworkPolicy(desired, r.mgr)
+	if err := reconcilers.ReconcileNetworkPolicy(ctx, clh, npName, desiredNp); err != nil {
+		return err
+	}
+
+	privilegedNpName, desiredPrivilegedNp := buildPrivilegedNetworkPolicy(desired, r.mgr)
+	return reconcilers.ReconcileNetworkPolicy(ctx, clh, privilegedNpName, desiredPrivilegedNp)
+}