NE-1476: Added network policies for DNS

[rfredette]

Taking over from #443 from @knobunc. Original description:

Added the framework for network policies for DNS for the operator and the dns pods.

The operator has a deny all network policy that for the openshift-dns-operator namespace and an allow policy for egress to the apiserver and dns ports at any IP.

The operator installs a deny all network policy for the openshift-dns namespace.

Then for each dns that it manages it installs an allow policy for ingress for dns traffic and metrics.

It has to allow ingress from the dns pods to any IP because we allow configuration to set the upstream server and port, so any valid IP and port needs to be allowed.

It also needs access to the api server, but that is covered by the wildcard allow policy.

https://issues.redhat.com/browse/NE-1476

[openshift-ci-robot]

@rfredette: This pull request references NE-1476 which is a valid jira issue.

Details

In response to this:

Taking over from #443 from @knobunc. Original description:

Added the framework for network policies for DNS for the operator and the dns pods.

The operator has a deny all network policy that for the openshift-dns-operator namespace and an allow policy for egress to the apiserver and dns ports at any IP.

The operator installs a deny all network policy for the openshift-dns namespace.

Then for each dns that it manages it installs an allow policy for ingress for dns traffic and metrics.

It has to allow ingress from the dns pods to any IP because we allow configuration to set the upstream server and port, so any valid IP and port needs to be allowed.

It also needs access to the api server, but that is covered by the wildcard allow policy.

https://issues.redhat.com/browse/NE-1476

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign alebedev87 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@rfredette: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn-serial-2of2	3964cc9	link	true	/test e2e-aws-ovn-serial-2of2
ci/prow/e2e-aws-ovn-operator	3964cc9	link	true	/test e2e-aws-ovn-operator
ci/prow/e2e-aws-ovn-serial-1of2	3964cc9	link	true	/test e2e-aws-ovn-serial-1of2

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.