NETOBSERV-1377: Add controller to deploy netobserv network policy

apis/flowcollector/v1beta2/flowcollector_types.go

@@ -84,6 +84,23 @@ type FlowCollectorSpec struct {
 	// +optional
 	// +k8s:conversion-gen=false
 	Exporters []*FlowCollectorExporter `json:"exporters"`
+
+	// `networkPolicy` define network policy settings for netobserv
+	// +k8s:conversion-gen=false
+	NetworkPolicy NetworkPolicy `json:"networkPolicy,omitempty"`
+}
+
+type NetworkPolicy struct {
+	// Set `enable` to `false` to disable network policy deployment. It is enabled by default.
+	// This network policy better isolates the NetObserv components to prevent undesired connections to them. It is recommended to install it.
+	// +optional
+	Enable *bool `json:"enable,omitempty"`
+
+	// `additionalNamespaces` contains additional namespaces alowed to connect to the network observability namespaces
+	// In particular if additional application deployed in this namespaces (such as kafka or loki) need external connection, this should be added here.
+	//+kubebuilder:default:={"openshift-console", "openshift-monitoring"}
+	//+optional
+	AdditionalNamespaces []string `json:"additionalNamespaces"`
 }
 
 type FlowCollectorAgentType string

bundle/manifests/flows.netobserv.io_flowcollectors.yaml

@@ -6382,6 +6382,25 @@ spec:
                 default: netobserv
                 description: Namespace where NetObserv pods are deployed.
                 type: string
+              networkPolicy:
+                description: '`networkPolicy` define network policy settings for netobserv'
+                properties:
+                  additionalNamespaces:
+                    default:
+                    - openshift-console
+                    - openshift-monitoring
+                    description: |-
+                      `additionalNamespaces` contains additional namespaces alowed to connect to the network observability namespaces
+                      In particular if additional application deployed in this namespaces (such as kafka or loki) need external connection, this should be added here.
+                    items:
+                      type: string
+                    type: array
+                  enable:
+                    description: |-
+                      Set `enable` to `false` to disable network policy deployment. It is enabled by default.
+                      This network policy better isolates the NetObserv components to prevent undesired connections to them. It is recommended to install it.
+                    type: boolean
+                type: object
               processor:
                 description: |-
                   `processor` defines the settings of the component that receives the flows from the agent,

bundle/manifests/netobserv-operator.clusterserviceversion.yaml

@@ -776,6 +776,12 @@ spec:
         path: loki.readTimeout
       - displayName: Namespace
         path: namespace
+      - displayName: Network policy
+        path: networkPolicy
+      - displayName: Additional namespaces
+        path: networkPolicy.additionalNamespaces
+      - displayName: Enable
+        path: networkPolicy.enable
       - displayName: Log types
         path: processor.logTypes
       - displayName: Disable alerts
@@ -1070,6 +1076,16 @@ spec:
           - patch
           - update
           - watch
+        - apiGroups:
+          - networking.k8s.io
+          resources:
+          - networkpolicies
+          verbs:
+          - create
+          - get
+          - list
+          - update
+          - watch
         - apiGroups:
           - operator.openshift.io
           resources:

config/crd/bases/flows.netobserv.io_flowcollectors.yaml

@@ -5857,6 +5857,25 @@ spec:
                   default: netobserv
                   description: Namespace where NetObserv pods are deployed.
                   type: string
+                networkPolicy:
+                  description: '`networkPolicy` define network policy settings for netobserv'
+                  properties:
+                    additionalNamespaces:
+                      default:
+                        - openshift-console
+                        - openshift-monitoring
+                      description: |-
+                        `additionalNamespaces` contains additional namespaces alowed to connect to the network observability namespaces
+                        In particular if additional application deployed in this namespaces (such as kafka or loki) need external connection, this should be added here.
+                      items:
+                        type: string
+                      type: array
+                    enable:
+                      description: |-
+                        Set `enable` to `false` to disable network policy deployment. It is enabled by default.
+                        This network policy better isolates the NetObserv components to prevent undesired connections to them. It is recommended to install it.
+                      type: boolean
+                  type: object
                 processor:
                   description: |-
                     `processor` defines the settings of the component that receives the flows from the agent,

config/rbac/role.yaml

@@ -161,6 +161,16 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - networkpolicies
+  verbs:
+  - create
+  - get
+  - list
+  - update
+  - watch
 - apiGroups:
   - operator.openshift.io
   resources:

controllers/controllers.go

@@ -3,7 +3,8 @@ package controllers
 import (
 	"github.com/netobserv/network-observability-operator/controllers/flp"
 	"github.com/netobserv/network-observability-operator/controllers/monitoring"
+	"github.com/netobserv/network-observability-operator/controllers/networkpolicy"
 	"github.com/netobserv/network-observability-operator/pkg/manager"
 )
 
-var Registerers = []manager.Registerer{Start, flp.Start, monitoring.Start}
+var Registerers = []manager.Registerer{Start, flp.Start, monitoring.Start, networkpolicy.Start}

controllers/flowcollector_controller_iso_test.go

@@ -215,6 +215,10 @@ func flowCollectorIsoSpecs() {
 				},
 			},
 			Exporters: []*flowslatest.FlowCollectorExporter{},
+			NetworkPolicy: flowslatest.NetworkPolicy{
+				Enable:               nil,
+				AdditionalNamespaces: []string{},
+			},
 		}
 
 		It("Should create CR successfully", func() {

controllers/networkpolicy/np_controller.go

@@ -0,0 +1,90 @@
+package networkpolicy
+
+import (
+	"context"
+	"fmt"
+
+	networkingv1 "k8s.io/api/networking/v1"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+
+	flowslatest "github.com/netobserv/network-observability-operator/apis/flowcollector/v1beta2"
+	"github.com/netobserv/network-observability-operator/controllers/constants"
+	"github.com/netobserv/network-observability-operator/controllers/reconcilers"
+	"github.com/netobserv/network-observability-operator/pkg/helper"
+	"github.com/netobserv/network-observability-operator/pkg/manager"
+	"github.com/netobserv/network-observability-operator/pkg/manager/status"
+)
+
+type Reconciler struct {
+	client.Client
+	mgr              *manager.Manager
+	status           status.Instance
+}
+
+func Start(ctx context.Context, mgr *manager.Manager) error {
+	log := log.FromContext(ctx)
+	log.Info("Starting Network Policy controller")
+	r := Reconciler{
+		Client: mgr.Client,
+		mgr:    mgr,
+		status: mgr.Status.ForComponent(status.NetworkPolicy),
+	}
+	return ctrl.NewControllerManagedBy(mgr).
+		For(&flowslatest.FlowCollector{}, reconcilers.IgnoreStatusChange).
+		Named("networkPolicy").
+		Owns(&networkingv1.NetworkPolicy{}).
+		Complete(&r)
+}
+
+// Reconcile is the controller entry point for reconciling current state with desired state.
+// It manages the controller status at a high level. Business logic is delegated into `reconcile`.
+func (r *Reconciler) Reconcile(ctx context.Context, _ ctrl.Request) (ctrl.Result, error) {
+	l := log.Log.WithName("networkpolicy") // clear context (too noisy)
+	ctx = log.IntoContext(ctx, l)
+
+	// Get flowcollector & create dedicated client
+	clh, desired, err := helper.NewFlowCollectorClientHelper(ctx, r.Client)
+	if err != nil {
+		return ctrl.Result{}, fmt.Errorf("failed to get FlowCollector: %w", err)
+	} else if desired == nil {
+		// Delete case
+		return ctrl.Result{}, nil
+	}
+
+	r.status.SetUnknown()
+	defer r.status.Commit(ctx, r.Client)
+
+	err = r.reconcile(ctx, clh, desired)
+	if err != nil {
+		l.Error(err, "Network policy reconcile failure")
+		// Set status failure unless it was already set
+		if !r.status.HasFailure() {
+			r.status.SetFailure("NetworkPolicyError", err.Error())
+		}
+		return ctrl.Result{}, err
+	}
+
+	r.status.SetReady()
+	return ctrl.Result{}, nil
+}
+
+func (r *Reconciler) reconcile(ctx context.Context, clh *helper.Client, desired *flowslatest.FlowCollector) error {
+	// log := log.FromContext(ctx)
+	ns := helper.GetNamespace(&desired.Spec)
+	privilegedNs := ns + constants.EBPFPrivilegedNSSuffix
+	authorizedNs := append([]string{privilegedNs}, desired.Spec.NetworkPolicy.AdditionalNamespaces...)
+	if desired.Spec.Loki.Mode == flowslatest.LokiModeLokiStack && desired.Spec.Loki.LokiStack.Namespace != "" {
+		authorizedNs = append(authorizedNs, desired.Spec.Loki.LokiStack.Namespace)
+	}
+	npName, desiredNp := buildNetworkPolicy(ns, desired, authorizedNs)
+	if err := reconcilers.ReconcileNetworkPolicy(ctx, clh, npName, desiredNp); err != nil {
+		return err
+	}
+	privilegedNpName, desiredPrivilegedNp := buildNetworkPolicy(privilegedNs, desired, append([]string{ns}, desired.Spec.NetworkPolicy.AdditionalNamespaces...))
+
+	err := reconcilers.ReconcileNetworkPolicy(ctx, clh, privilegedNpName, desiredPrivilegedNp)
+
+	return err
+}