Skip to content

Commit e313041

Browse files
andrewazoresandrewazores
authored
feat(network): implement optional cryostat egress network policy (#1051)
1 parent a276d28 commit e313041

File tree

11 files changed

+529
-104
lines changed

11 files changed

+529
-104
lines changed

‎api/v1beta2/cryostat_types.go‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -444,10 +444,19 @@ type NetworkPoliciesList struct {
444444
}
445445

446446
type NetworkPolicyConfig struct {
447-
// Disable the NetworkPolicy for a given service.
447+
// Disable the NetworkPolicies (Ingress and Egress) for a given service.
448+
// Deprecated: use IngressDisabled and EgressEnabled instead.
448449
// +optional
449450
// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Disable NetworkPolicy creation",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:booleanSwitch"}
450451
Disabled *bool `json:"disabled,omitempty"`
452+
// Disable the NetworkPolicy for ingress to a given pod. Enabled by default.
453+
// +optional
454+
// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Disable ingress NetworkPolicy creation",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:booleanSwitch"}
455+
IngressDisabled *bool `json:"ingressDisabled,omitempty"`
456+
// Enable the NetworkPolicy for egress from a given pod. Disabled by default.
457+
// +optional
458+
// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Enable egress NetworkPolicy creation",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:booleanSwitch"}
459+
EgressEnabled *bool `json:"egressEnabled,omitempty"`
451460
}
452461

453462
// NetworkConfiguration provides customization for how to expose a Cryostat

‎api/v1beta2/zz_generated.deepcopy.go‎

Lines changed: 10 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎bundle/manifests/cryostat-operator.clusterserviceversion.yaml‎

Lines changed: 45 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ metadata:
2424
capabilities: Seamless Upgrades
2525
categories: Monitoring, Developer Tools
2626
containerImage: quay.io/cryostat/cryostat-operator:4.1.0-dev
27-
createdAt: "2025-06-12T15:56:01Z"
27+
createdAt: "2025-08-26T15:38:48Z"
2828
description: JVM monitoring and profiling tool
2929
operatorframework.io/initialization-resource: |-
3030
{
@@ -183,26 +183,66 @@ spec:
183183
- description: Options to customize the NetworkPolicy objects created for Cryostat's various Services.
184184
displayName: Network Policies
185185
path: networkPolicies
186-
- description: Disable the NetworkPolicy for a given service.
186+
- description: 'Disable the NetworkPolicies (Ingress and Egress) for a given service. Deprecated: use IngressDisabled and EgressEnabled instead.'
187187
displayName: Disable NetworkPolicy creation
188188
path: networkPolicies.coreConfig.disabled
189189
x-descriptors:
190190
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
191-
- description: Disable the NetworkPolicy for a given service.
191+
- description: Enable the NetworkPolicy for egress from a given pod. Disabled by default.
192+
displayName: Enable egress NetworkPolicy creation
193+
path: networkPolicies.coreConfig.egressEnabled
194+
x-descriptors:
195+
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
196+
- description: Disable the NetworkPolicy for ingress to a given pod. Enabled by default.
197+
displayName: Disable ingress NetworkPolicy creation
198+
path: networkPolicies.coreConfig.ingressDisabled
199+
x-descriptors:
200+
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
201+
- description: 'Disable the NetworkPolicies (Ingress and Egress) for a given service. Deprecated: use IngressDisabled and EgressEnabled instead.'
192202
displayName: Disable NetworkPolicy creation
193203
path: networkPolicies.databaseConfig.disabled
194204
x-descriptors:
195205
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
196-
- description: Disable the NetworkPolicy for a given service.
206+
- description: Enable the NetworkPolicy for egress from a given pod. Disabled by default.
207+
displayName: Enable egress NetworkPolicy creation
208+
path: networkPolicies.databaseConfig.egressEnabled
209+
x-descriptors:
210+
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
211+
- description: Disable the NetworkPolicy for ingress to a given pod. Enabled by default.
212+
displayName: Disable ingress NetworkPolicy creation
213+
path: networkPolicies.databaseConfig.ingressDisabled
214+
x-descriptors:
215+
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
216+
- description: 'Disable the NetworkPolicies (Ingress and Egress) for a given service. Deprecated: use IngressDisabled and EgressEnabled instead.'
197217
displayName: Disable NetworkPolicy creation
198218
path: networkPolicies.reportsConfig.disabled
199219
x-descriptors:
200220
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
201-
- description: Disable the NetworkPolicy for a given service.
221+
- description: Enable the NetworkPolicy for egress from a given pod. Disabled by default.
222+
displayName: Enable egress NetworkPolicy creation
223+
path: networkPolicies.reportsConfig.egressEnabled
224+
x-descriptors:
225+
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
226+
- description: Disable the NetworkPolicy for ingress to a given pod. Enabled by default.
227+
displayName: Disable ingress NetworkPolicy creation
228+
path: networkPolicies.reportsConfig.ingressDisabled
229+
x-descriptors:
230+
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
231+
- description: 'Disable the NetworkPolicies (Ingress and Egress) for a given service. Deprecated: use IngressDisabled and EgressEnabled instead.'
202232
displayName: Disable NetworkPolicy creation
203233
path: networkPolicies.storageConfig.disabled
204234
x-descriptors:
205235
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
236+
- description: Enable the NetworkPolicy for egress from a given pod. Disabled by default.
237+
displayName: Enable egress NetworkPolicy creation
238+
path: networkPolicies.storageConfig.egressEnabled
239+
x-descriptors:
240+
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
241+
- description: Disable the NetworkPolicy for ingress to a given pod. Enabled by default.
242+
displayName: Disable ingress NetworkPolicy creation
243+
path: networkPolicies.storageConfig.ingressDisabled
244+
x-descriptors:
245+
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
206246
- description: Options to configure the Cryostat deployments and pods metadata
207247
displayName: Operand metadata
208248
path: operandMetadata

‎bundle/manifests/operator.cryostat.io_cryostats.yaml‎

Lines changed: 44 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5890,29 +5890,69 @@ spec:
58905890
service.
58915891
properties:
58925892
disabled:
5893-
description: Disable the NetworkPolicy for a given service.
5893+
description: |-
5894+
Disable the NetworkPolicies (Ingress and Egress) for a given service.
5895+
Deprecated: use IngressDisabled and EgressEnabled instead.
5896+
type: boolean
5897+
egressEnabled:
5898+
description: Enable the NetworkPolicy for egress from a given
5899+
pod. Disabled by default.
5900+
type: boolean
5901+
ingressDisabled:
5902+
description: Disable the NetworkPolicy for ingress to a given
5903+
pod. Enabled by default.
58945904
type: boolean
58955905
type: object
58965906
databaseConfig:
58975907
description: NetworkPolicy configuration for the database service.
58985908
properties:
58995909
disabled:
5900-
description: Disable the NetworkPolicy for a given service.
5910+
description: |-
5911+
Disable the NetworkPolicies (Ingress and Egress) for a given service.
5912+
Deprecated: use IngressDisabled and EgressEnabled instead.
5913+
type: boolean
5914+
egressEnabled:
5915+
description: Enable the NetworkPolicy for egress from a given
5916+
pod. Disabled by default.
5917+
type: boolean
5918+
ingressDisabled:
5919+
description: Disable the NetworkPolicy for ingress to a given
5920+
pod. Enabled by default.
59015921
type: boolean
59025922
type: object
59035923
reportsConfig:
59045924
description: NetworkPolicy configuration for the cryostat-reports
59055925
service.
59065926
properties:
59075927
disabled:
5908-
description: Disable the NetworkPolicy for a given service.
5928+
description: |-
5929+
Disable the NetworkPolicies (Ingress and Egress) for a given service.
5930+
Deprecated: use IngressDisabled and EgressEnabled instead.
5931+
type: boolean
5932+
egressEnabled:
5933+
description: Enable the NetworkPolicy for egress from a given
5934+
pod. Disabled by default.
5935+
type: boolean
5936+
ingressDisabled:
5937+
description: Disable the NetworkPolicy for ingress to a given
5938+
pod. Enabled by default.
59095939
type: boolean
59105940
type: object
59115941
storageConfig:
59125942
description: NetworkPolicy configuration for the storage service.
59135943
properties:
59145944
disabled:
5915-
description: Disable the NetworkPolicy for a given service.
5945+
description: |-
5946+
Disable the NetworkPolicies (Ingress and Egress) for a given service.
5947+
Deprecated: use IngressDisabled and EgressEnabled instead.
5948+
type: boolean
5949+
egressEnabled:
5950+
description: Enable the NetworkPolicy for egress from a given
5951+
pod. Disabled by default.
5952+
type: boolean
5953+
ingressDisabled:
5954+
description: Disable the NetworkPolicy for ingress to a given
5955+
pod. Enabled by default.
59165956
type: boolean
59175957
type: object
59185958
type: object

‎config/crd/bases/operator.cryostat.io_cryostats.yaml‎

Lines changed: 44 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5877,29 +5877,69 @@ spec:
58775877
service.
58785878
properties:
58795879
disabled:
5880-
description: Disable the NetworkPolicy for a given service.
5880+
description: |-
5881+
Disable the NetworkPolicies (Ingress and Egress) for a given service.
5882+
Deprecated: use IngressDisabled and EgressEnabled instead.
5883+
type: boolean
5884+
egressEnabled:
5885+
description: Enable the NetworkPolicy for egress from a given
5886+
pod. Disabled by default.
5887+
type: boolean
5888+
ingressDisabled:
5889+
description: Disable the NetworkPolicy for ingress to a given
5890+
pod. Enabled by default.
58815891
type: boolean
58825892
type: object
58835893
databaseConfig:
58845894
description: NetworkPolicy configuration for the database service.
58855895
properties:
58865896
disabled:
5887-
description: Disable the NetworkPolicy for a given service.
5897+
description: |-
5898+
Disable the NetworkPolicies (Ingress and Egress) for a given service.
5899+
Deprecated: use IngressDisabled and EgressEnabled instead.
5900+
type: boolean
5901+
egressEnabled:
5902+
description: Enable the NetworkPolicy for egress from a given
5903+
pod. Disabled by default.
5904+
type: boolean
5905+
ingressDisabled:
5906+
description: Disable the NetworkPolicy for ingress to a given
5907+
pod. Enabled by default.
58885908
type: boolean
58895909
type: object
58905910
reportsConfig:
58915911
description: NetworkPolicy configuration for the cryostat-reports
58925912
service.
58935913
properties:
58945914
disabled:
5895-
description: Disable the NetworkPolicy for a given service.
5915+
description: |-
5916+
Disable the NetworkPolicies (Ingress and Egress) for a given service.
5917+
Deprecated: use IngressDisabled and EgressEnabled instead.
5918+
type: boolean
5919+
egressEnabled:
5920+
description: Enable the NetworkPolicy for egress from a given
5921+
pod. Disabled by default.
5922+
type: boolean
5923+
ingressDisabled:
5924+
description: Disable the NetworkPolicy for ingress to a given
5925+
pod. Enabled by default.
58965926
type: boolean
58975927
type: object
58985928
storageConfig:
58995929
description: NetworkPolicy configuration for the storage service.
59005930
properties:
59015931
disabled:
5902-
description: Disable the NetworkPolicy for a given service.
5932+
description: |-
5933+
Disable the NetworkPolicies (Ingress and Egress) for a given service.
5934+
Deprecated: use IngressDisabled and EgressEnabled instead.
5935+
type: boolean
5936+
egressEnabled:
5937+
description: Enable the NetworkPolicy for egress from a given
5938+
pod. Disabled by default.
5939+
type: boolean
5940+
ingressDisabled:
5941+
description: Disable the NetworkPolicy for ingress to a given
5942+
pod. Enabled by default.
59035943
type: boolean
59045944
type: object
59055945
type: object

‎config/manifests/bases/cryostat-operator.clusterserviceversion.yaml‎

Lines changed: 56 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -203,26 +203,78 @@ spec:
203203
various Services.
204204
displayName: Network Policies
205205
path: networkPolicies
206-
- description: Disable the NetworkPolicy for a given service.
206+
- description: 'Disable the NetworkPolicies (Ingress and Egress) for a given
207+
service. Deprecated: use IngressDisabled and EgressEnabled instead.'
207208
displayName: Disable NetworkPolicy creation
208209
path: networkPolicies.coreConfig.disabled
209210
x-descriptors:
210211
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
211-
- description: Disable the NetworkPolicy for a given service.
212+
- description: Enable the NetworkPolicy for egress from a given pod. Disabled
213+
by default.
214+
displayName: Enable egress NetworkPolicy creation
215+
path: networkPolicies.coreConfig.egressEnabled
216+
x-descriptors:
217+
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
218+
- description: Disable the NetworkPolicy for ingress to a given pod. Enabled
219+
by default.
220+
displayName: Disable ingress NetworkPolicy creation
221+
path: networkPolicies.coreConfig.ingressDisabled
222+
x-descriptors:
223+
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
224+
- description: 'Disable the NetworkPolicies (Ingress and Egress) for a given
225+
service. Deprecated: use IngressDisabled and EgressEnabled instead.'
212226
displayName: Disable NetworkPolicy creation
213227
path: networkPolicies.databaseConfig.disabled
214228
x-descriptors:
215229
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
216-
- description: Disable the NetworkPolicy for a given service.
230+
- description: Enable the NetworkPolicy for egress from a given pod. Disabled
231+
by default.
232+
displayName: Enable egress NetworkPolicy creation
233+
path: networkPolicies.databaseConfig.egressEnabled
234+
x-descriptors:
235+
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
236+
- description: Disable the NetworkPolicy for ingress to a given pod. Enabled
237+
by default.
238+
displayName: Disable ingress NetworkPolicy creation
239+
path: networkPolicies.databaseConfig.ingressDisabled
240+
x-descriptors:
241+
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
242+
- description: 'Disable the NetworkPolicies (Ingress and Egress) for a given
243+
service. Deprecated: use IngressDisabled and EgressEnabled instead.'
217244
displayName: Disable NetworkPolicy creation
218245
path: networkPolicies.reportsConfig.disabled
219246
x-descriptors:
220247
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
221-
- description: Disable the NetworkPolicy for a given service.
248+
- description: Enable the NetworkPolicy for egress from a given pod. Disabled
249+
by default.
250+
displayName: Enable egress NetworkPolicy creation
251+
path: networkPolicies.reportsConfig.egressEnabled
252+
x-descriptors:
253+
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
254+
- description: Disable the NetworkPolicy for ingress to a given pod. Enabled
255+
by default.
256+
displayName: Disable ingress NetworkPolicy creation
257+
path: networkPolicies.reportsConfig.ingressDisabled
258+
x-descriptors:
259+
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
260+
- description: 'Disable the NetworkPolicies (Ingress and Egress) for a given
261+
service. Deprecated: use IngressDisabled and EgressEnabled instead.'
222262
displayName: Disable NetworkPolicy creation
223263
path: networkPolicies.storageConfig.disabled
224264
x-descriptors:
225265
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
266+
- description: Enable the NetworkPolicy for egress from a given pod. Disabled
267+
by default.
268+
displayName: Enable egress NetworkPolicy creation
269+
path: networkPolicies.storageConfig.egressEnabled
270+
x-descriptors:
271+
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
272+
- description: Disable the NetworkPolicy for ingress to a given pod. Enabled
273+
by default.
274+
displayName: Disable ingress NetworkPolicy creation
275+
path: networkPolicies.storageConfig.ingressDisabled
276+
x-descriptors:
277+
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
226278
- description: Options to configure the Cryostat deployments and pods metadata
227279
displayName: Operand metadata
228280
path: operandMetadata

‎config/samples/sample-app.yaml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,11 @@ spec:
1919
- image: quay.io/redhat-java-monitoring/quarkus-cryostat-agent:latest
2020
imagePullPolicy: Always
2121
name: quarkus-test
22+
env:
23+
- name: JAVA_OPTS_APPEND
24+
value: -Djava.util.logging.manager=org.jboss.logmanager.LogManager -Dcom.sun.management.jmxremote.port=9097 -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.authenticate=false
25+
- name: QUARKUS_HTTP_HOST
26+
value: 0.0.0.0
2227
ports:
2328
- containerPort: 10010
2429
protocol: TCP
@@ -27,12 +32,9 @@ spec:
2732
protocol: TCP
2833
name: jfr-jmx
2934
resources:
30-
requests:
31-
cpu: 200m
32-
memory: 96Mi
3335
limits:
3436
cpu: 500m
35-
memory: 192Mi
37+
memory: 256Mi
3638
securityContext:
3739
allowPrivilegeEscalation: false
3840
capabilities:

0 commit comments

Comments
 (0)