NE-1476: Added network policies for the router #1263
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@knobunc: This pull request references NE-1476 which is a valid jira issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
knobunc
added
the
do-not-merge/work-in-progress
knobunc
force-pushed
the
NE-1476-Network-Policies-For-Router
branch
from
9a40cd0 to
b8fc7f7
Compare
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
knobunc
force-pushed
the
NE-1476-Network-Policies-For-Router
branch
2 times, most recently
from
b392321 to
777addf
Compare
|
/retest-required |
knobunc
force-pushed
the
NE-1476-Network-Policies-For-Router
branch
5 times, most recently
from
71e5e0a to
abb8394
Compare
Added the framework for network policies for the router. The operator has a deny all network policy that for the openshift-ingress-operator namespace and an allow policy for egress to the apiserver and dns ports at any IP. The operator installs a deny all network policy for the openshift-ingress namespace. Then for each ingresscontroller that it manages it installs an allow policy for ingress for http and https traffic and metrics. It has to allow ingress from the router pods to any IP because the route endpoints can be at any ip or pod. It also needs access to the api server, but that is covered by the wildcard allow policy. https://issues.redhat.com/browse/NE-1476
knobunc
force-pushed
the
NE-1476-Network-Policies-For-Router
branch
from
abb8394 to
cf93ea5
Compare
|
@knobunc: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
@knobunc the e2e-gcp-operator CI tests are failing with:
|
|
@candita thanks. I've been focusing on the e2e-aws-ovn tests and those are consistently failing on: I am pretty sure the issue is that the test is creating a pod and it is unreachable without policy, but I haven't had time to chase it all the way down yet. |
Added the framework for network policies for the router.
The operator has a deny all network policy that for the openshift-ingress-operator namespace and an allow policy for egress to the apiserver and dns ports at any IP.
The operator installs a deny all network policy for the openshift-ingress namespace.
Then for each ingresscontroller that it manages it installs an allow policy for ingress for http and https traffic and metrics.
It has to allow ingress from the router pods to any IP because the route endpoints can be at any ip or pod.
It also needs access to the api server, but that is covered by the wildcard allow policy.
https://issues.redhat.com/browse/NE-1476