Skip to content

Commit 193c1a6

Browse files
andrewazoresebaron
andrewazores
and
ebaron
authored
feat(network): implement ingress network policies (#1017)
Co-authored-by: Elliott Baron <[email protected]>
1 parent 7f7dfd6 commit 193c1a6

File tree

14 files changed

+742
-22
lines changed

14 files changed

+742
-22
lines changed

‎api/v1beta2/cryostat_types.go‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,10 @@ type CryostatSpec struct {
5353
// +optional
5454
// +operator-sdk:csv:customresourcedefinitions:type=spec
5555
ServiceOptions *ServiceConfigList `json:"serviceOptions,omitempty"`
56+
// Options to customize the NetworkPolicy objects created for Cryostat's various Services.
57+
// +optional
58+
// +operator-sdk:csv:customresourcedefinitions:type=spec
59+
NetworkPolicies *NetworkPoliciesList `json:"networkPolicies,omitempty"`
5660
// Options to control how the operator exposes the application outside of the cluster,
5761
// such as using an Ingress or Route.
5862
// +optional
@@ -372,6 +376,30 @@ type ServiceConfigList struct {
372376
AgentConfig *AgentServiceConfig `json:"agentConfig,omitempty"`
373377
}
374378

379+
// NetworkPoliciesList holds the configurations for NetworkPolicy
380+
// objects for each service created by the operator.
381+
type NetworkPoliciesList struct {
382+
// NetworkPolicy configuration for the Cryostat application service.
383+
// +optional
384+
CoreConfig *NetworkPolicyConfig `json:"coreConfig,omitempty"`
385+
// NetworkPolicy configuration for the cryostat-reports service.
386+
// +optional
387+
ReportsConfig *NetworkPolicyConfig `json:"reportsConfig,omitempty"`
388+
// NetworkPolicy configuration for the database service.
389+
// +optional
390+
DatabaseConfig *NetworkPolicyConfig `json:"databaseConfig,omitempty"`
391+
// NetworkPolicy configuration for the storage service.
392+
// +optional
393+
StorageConfig *NetworkPolicyConfig `json:"storageConfig,omitempty"`
394+
}
395+
396+
type NetworkPolicyConfig struct {
397+
// Disable the NetworkPolicy for a given service.
398+
// +optional
399+
// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Disable NetworkPolicy creation",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:booleanSwitch"}
400+
Disabled *bool `json:"disabled,omitempty"`
401+
}
402+
375403
// NetworkConfiguration provides customization for how to expose a Cryostat
376404
// service, so that it can be reached from outside the cluster.
377405
// On OpenShift, a Route is created by default. On Kubernetes, an Ingress will

‎api/v1beta2/zz_generated.deepcopy.go‎

Lines changed: 60 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎bundle/manifests/cryostat-operator.clusterserviceversion.yaml‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ metadata:
1313
"spec": {
1414
"enableCertManager": true,
1515
"eventTemplates": [],
16+
"networkPolicies": {},
1617
"reportOptions": {
1718
"replicas": 0
1819
},
@@ -30,7 +31,7 @@ metadata:
3031
capabilities: Seamless Upgrades
3132
categories: Monitoring, Developer Tools
3233
containerImage: quay.io/cryostat/cryostat-operator:4.0.0-dev
33-
createdAt: "2025-01-14T19:21:36Z"
34+
createdAt: "2025-01-16T17:07:46Z"
3435
description: JVM monitoring and profiling tool
3536
operatorframework.io/initialization-resource: |-
3637
{
@@ -160,6 +161,29 @@ spec:
160161
- description: Labels to add to the Ingress or Route during its creation. The label with key "app" is reserved for use by the operator.
161162
displayName: Labels
162163
path: networkOptions.coreConfig.labels
164+
- description: Options to customize the NetworkPolicy objects created for Cryostat's various Services.
165+
displayName: Network Policies
166+
path: networkPolicies
167+
- description: Disable the NetworkPolicy for a given service.
168+
displayName: Disable NetworkPolicy creation
169+
path: networkPolicies.coreConfig.disabled
170+
x-descriptors:
171+
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
172+
- description: Disable the NetworkPolicy for a given service.
173+
displayName: Disable NetworkPolicy creation
174+
path: networkPolicies.databaseConfig.disabled
175+
x-descriptors:
176+
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
177+
- description: Disable the NetworkPolicy for a given service.
178+
displayName: Disable NetworkPolicy creation
179+
path: networkPolicies.reportsConfig.disabled
180+
x-descriptors:
181+
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
182+
- description: Disable the NetworkPolicy for a given service.
183+
displayName: Disable NetworkPolicy creation
184+
path: networkPolicies.storageConfig.disabled
185+
x-descriptors:
186+
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
163187
- description: Options to configure the Cryostat deployments and pods metadata
164188
displayName: Operand metadata
165189
path: operandMetadata
@@ -916,6 +940,7 @@ spec:
916940
- networking.k8s.io
917941
resources:
918942
- ingresses
943+
- networkpolicies
919944
verbs:
920945
- '*'
921946
- apiGroups:

‎bundle/manifests/operator.cryostat.io_cryostats.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5794,6 +5794,41 @@ spec:
57945794
type: object
57955795
type: object
57965796
type: object
5797+
networkPolicies:
5798+
description: Options to customize the NetworkPolicy objects created
5799+
for Cryostat's various Services.
5800+
properties:
5801+
coreConfig:
5802+
description: NetworkPolicy configuration for the Cryostat application
5803+
service.
5804+
properties:
5805+
disabled:
5806+
description: Disable the NetworkPolicy for a given service.
5807+
type: boolean
5808+
type: object
5809+
databaseConfig:
5810+
description: NetworkPolicy configuration for the database service.
5811+
properties:
5812+
disabled:
5813+
description: Disable the NetworkPolicy for a given service.
5814+
type: boolean
5815+
type: object
5816+
reportsConfig:
5817+
description: NetworkPolicy configuration for the cryostat-reports
5818+
service.
5819+
properties:
5820+
disabled:
5821+
description: Disable the NetworkPolicy for a given service.
5822+
type: boolean
5823+
type: object
5824+
storageConfig:
5825+
description: NetworkPolicy configuration for the storage service.
5826+
properties:
5827+
disabled:
5828+
description: Disable the NetworkPolicy for a given service.
5829+
type: boolean
5830+
type: object
5831+
type: object
57975832
operandMetadata:
57985833
description: Options to configure the Cryostat deployments and pods
57995834
metadata

‎config/crd/bases/operator.cryostat.io_cryostats.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5781,6 +5781,41 @@ spec:
57815781
type: object
57825782
type: object
57835783
type: object
5784+
networkPolicies:
5785+
description: Options to customize the NetworkPolicy objects created
5786+
for Cryostat's various Services.
5787+
properties:
5788+
coreConfig:
5789+
description: NetworkPolicy configuration for the Cryostat application
5790+
service.
5791+
properties:
5792+
disabled:
5793+
description: Disable the NetworkPolicy for a given service.
5794+
type: boolean
5795+
type: object
5796+
databaseConfig:
5797+
description: NetworkPolicy configuration for the database service.
5798+
properties:
5799+
disabled:
5800+
description: Disable the NetworkPolicy for a given service.
5801+
type: boolean
5802+
type: object
5803+
reportsConfig:
5804+
description: NetworkPolicy configuration for the cryostat-reports
5805+
service.
5806+
properties:
5807+
disabled:
5808+
description: Disable the NetworkPolicy for a given service.
5809+
type: boolean
5810+
type: object
5811+
storageConfig:
5812+
description: NetworkPolicy configuration for the storage service.
5813+
properties:
5814+
disabled:
5815+
description: Disable the NetworkPolicy for a given service.
5816+
type: boolean
5817+
type: object
5818+
type: object
57845819
operandMetadata:
57855820
description: Options to configure the Cryostat deployments and pods
57865821
metadata

‎config/manifests/bases/cryostat-operator.clusterserviceversion.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -165,6 +165,30 @@ spec:
165165
label with key "app" is reserved for use by the operator.
166166
displayName: Labels
167167
path: networkOptions.coreConfig.labels
168+
- description: Options to customize the NetworkPolicy objects created for Cryostat's
169+
various Services.
170+
displayName: Network Policies
171+
path: networkPolicies
172+
- description: Disable the NetworkPolicy for a given service.
173+
displayName: Disable NetworkPolicy creation
174+
path: networkPolicies.coreConfig.disabled
175+
x-descriptors:
176+
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
177+
- description: Disable the NetworkPolicy for a given service.
178+
displayName: Disable NetworkPolicy creation
179+
path: networkPolicies.databaseConfig.disabled
180+
x-descriptors:
181+
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
182+
- description: Disable the NetworkPolicy for a given service.
183+
displayName: Disable NetworkPolicy creation
184+
path: networkPolicies.reportsConfig.disabled
185+
x-descriptors:
186+
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
187+
- description: Disable the NetworkPolicy for a given service.
188+
displayName: Disable NetworkPolicy creation
189+
path: networkPolicies.storageConfig.disabled
190+
x-descriptors:
191+
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
168192
- description: Options to configure the Cryostat deployments and pods metadata
169193
displayName: Operand metadata
170194
path: operandMetadata

‎config/rbac/role.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,7 @@ rules:
118118
- networking.k8s.io
119119
resources:
120120
- ingresses
121+
- networkpolicies
121122
verbs:
122123
- '*'
123124
- apiGroups:

‎config/samples/operator_v1beta2_cryostat.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,3 +13,4 @@ spec:
1313
spec: {}
1414
reportOptions:
1515
replicas: 0
16+
networkPolicies: {}

0 commit comments

Comments
 (0)