Skip to content

Commit 754f1f7

Browse files
celeztyneceleztyne
authored
Merge branch 'main' into pentest-removal2
2 parents 8101e18 + 2efeff5 commit 754f1f7

File tree

13 files changed

+554
-12
lines changed

13 files changed

+554
-12
lines changed

‎components/external-secrets-operator/staging/kustomization.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
22
kind: Kustomization
33
resources:
44
- ../base
5+
- networkpolicy-default-deny.yaml
6+
- networkpolicy-allow-egress.yaml
7+
- networkpolicy-allow-ingress.yaml
8+
- networkpolicy-allow-same-ns.yaml

‎components/external-secrets-operator/staging/networkpolicy-allow-egress.yaml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
# Network Policy: DNS Egress
2+
#
3+
# Purpose: Allow the external-secrets pods to communicate with DNS (for name resolution)
4+
apiVersion: networking.k8s.io/v1
5+
kind: NetworkPolicy
6+
metadata:
7+
name: allow-dns-egress
8+
namespace: external-secrets-operator
9+
spec:
10+
# Selects ALL ESO Pods: main-controller, webhook, and cert-controller
11+
podSelector:
12+
matchLabels:
13+
app.kubernetes.io/instance: external-secrets-operator
14+
policyTypes:
15+
- Egress
16+
egress:
17+
# Allow DNS queries to both the DNS pods and the DNS service (ClusterIP)
18+
# The DNS service is typically at 172.30.0.10 in the service network
19+
- to:
20+
- namespaceSelector:
21+
matchLabels:
22+
kubernetes.io/metadata.name: openshift-dns
23+
- ipBlock:
24+
cidr: 172.30.0.10/32
25+
ports:
26+
- protocol: UDP
27+
port: 53
28+
- protocol: TCP
29+
port: 53
30+
---
31+
# Network Policy: Main Controller Egress
32+
#
33+
# Purpose: Allow the main external-secrets controller to communicate with:
34+
# - Kubernetes API server (for watching CRDs, updating satus)
35+
# - External secret providers (AWS, GCP, Vault, etc.)
36+
# - OpenShift internal services
37+
apiVersion: networking.k8s.io/v1
38+
kind: NetworkPolicy
39+
metadata:
40+
name: allow-main-controller-egress
41+
namespace: external-secrets-operator
42+
spec:
43+
podSelector:
44+
matchLabels:
45+
app.kubernetes.io/instance: external-secrets-operator
46+
app.kubernetes.io/name: external-secrets
47+
policyTypes:
48+
- Egress
49+
egress:
50+
- to:
51+
- ipBlock:
52+
cidr: 0.0.0.0/0
53+
---
54+
# Network Policy: Cert Controller and Webhook Egress
55+
#
56+
# Purpose: Allow the cert-controller and webhook to communicate with
57+
# Kubernetes API server:
58+
# - cert-controller: for managing webhook certificates
59+
# - webhook: for CRD validation and cert management
60+
apiVersion: networking.k8s.io/v1
61+
kind: NetworkPolicy
62+
metadata:
63+
name: allow-cert-controller-webhook-egress
64+
namespace: external-secrets-operator
65+
spec:
66+
podSelector:
67+
matchExpressions:
68+
- key: app.kubernetes.io/name
69+
operator: In
70+
values:
71+
- external-secrets-cert-controller
72+
- external-secrets-webhook
73+
matchLabels:
74+
app.kubernetes.io/instance: external-secrets-operator
75+
policyTypes:
76+
- Egress
77+
egress:
78+
# Allow egress to Kubernetes API server
79+
# As kube-apiserver uses host network, support multiple cluster
80+
# configurations with different network CIDRs
81+
- to:
82+
# kubernetes default service
83+
- ipBlock:
84+
cidr: 172.30.0.1/32
85+
# Aggregated node network for internal clusters (10.28.x.x - 10.29.x.x)
86+
- ipBlock:
87+
cidr: 10.28.0.0/15
88+
# Aggregated node network for public clusters (10.200 - 10.210)
89+
- ipBlock:
90+
cidr: 10.192.0.0/11
91+
ports:
92+
- protocol: TCP
93+
port: 443
94+
- protocol: TCP
95+
port: 6443
96+

‎components/external-secrets-operator/staging/networkpolicy-allow-ingress.yaml‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
---
2+
# Network Policy: Webhook Ingress
3+
#
4+
# Purpose: Allow incoming traffic to the validating webhook on port 10250 from:
5+
# - Kubernetes API server (required for CRD validation)
6+
apiVersion: networking.k8s.io/v1
7+
kind: NetworkPolicy
8+
metadata:
9+
name: allow-webhook-ingress
10+
namespace: external-secrets-operator
11+
spec:
12+
podSelector:
13+
matchLabels:
14+
app.kubernetes.io/instance: external-secrets-operator
15+
app.kubernetes.io/name: external-secrets-webhook
16+
policyTypes:
17+
- Ingress
18+
ingress:
19+
- from:
20+
# Allow webhook traffic from Kubernetes API server
21+
# The kube-apiserver uses host network (node IPs) but the call
22+
# is NATed and comes from a pod IP assigned to interface ovn-k8s-mp0
23+
# - 192.168.0.0/16 (pod CIDR in most clusters)
24+
# - 10.128.0.0/14 (pod CIDR in stg-rh01, prd-rh01 and prd-p01 clusters)
25+
- ipBlock:
26+
cidr: 10.128.0.0/14
27+
- ipBlock:
28+
cidr: 192.168.0.0/16
29+
ports:
30+
- protocol: TCP
31+
port: 10250 # Webhook port
32+
---
33+
# Network Policy: Metrics Ingress
34+
#
35+
# Purpose: Allow Prometheus/monitoring systems to scrape metrics from all ESO components
36+
# Port: 8080 (metrics endpoint)
37+
#
38+
# Allows traffic from:
39+
# - appstudio-workload-monitoring namespace
40+
# - openshift-monitoring namespace
41+
apiVersion: networking.k8s.io/v1
42+
kind: NetworkPolicy
43+
metadata:
44+
name: allow-metrics-ingress
45+
namespace: external-secrets-operator
46+
spec:
47+
# Selects ALL ESO Pods (Controller, Webhook, Cert Controller)
48+
podSelector:
49+
matchLabels:
50+
app.kubernetes.io/instance: external-secrets-operator
51+
policyTypes:
52+
- Ingress
53+
ingress:
54+
- from:
55+
# Allow Prometheus to scrape metrics
56+
- namespaceSelector:
57+
matchLabels:
58+
kubernetes.io/metadata.name: appstudio-workload-monitoring
59+
# Also allow from openshift-monitoring if it exists
60+
- namespaceSelector:
61+
matchLabels:
62+
kubernetes.io/metadata.name: openshift-monitoring
63+
ports:
64+
- protocol: TCP
65+
port: 8080 # Metrics port
66+
---
67+
# Network Policy: Health Checks
68+
#
69+
# Purpose: Allow liveness/readiness probes on all ESO components
70+
# Port: 8081 (health check endpoint)
71+
apiVersion: networking.k8s.io/v1
72+
kind: NetworkPolicy
73+
metadata:
74+
name: allow-health-checks-ingress
75+
namespace: external-secrets-operator
76+
spec:
77+
# Selects ALL ESO Pods (Controller, Webhook, Cert Controller)
78+
podSelector:
79+
matchLabels:
80+
app.kubernetes.io/instance: external-secrets-operator
81+
policyTypes:
82+
- Ingress
83+
ingress:
84+
# Allow health checks on port 8081
85+
- from:
86+
- ipBlock:
87+
cidr: 10.128.0.0/14
88+
- ipBlock:
89+
cidr: 192.168.0.0/16
90+
ports:
91+
- protocol: TCP
92+
port: 8081
93+

‎components/external-secrets-operator/staging/networkpolicy-allow-same-ns.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
# Network Policy: Intra-namespace Communication
3+
#
4+
# Purpose: Allow all ESO components to communicate with each other
5+
# within the same namespace, including localhost communication
6+
#
7+
# Applies to: Main controller, webhook, and cert-controller
8+
# Note: This provides a fallback for any internal coordination between ESO components
9+
# that is not explicitly covered by more specific policies
10+
apiVersion: networking.k8s.io/v1
11+
kind: NetworkPolicy
12+
metadata:
13+
name: allow-same-namespace
14+
namespace: external-secrets-operator
15+
spec:
16+
podSelector:
17+
matchLabels:
18+
app.kubernetes.io/instance: external-secrets-operator
19+
policyTypes:
20+
- Ingress
21+
- Egress
22+
ingress:
23+
- from:
24+
- podSelector:
25+
matchLabels:
26+
app.kubernetes.io/instance: external-secrets-operator
27+
# Allow pods to communicate with themselves (localhost)
28+
# This is needed for health checks and internal probe endpoints
29+
- from:
30+
- podSelector: {}
31+
ports:
32+
- protocol: TCP
33+
port: 8081 # Health check port
34+
egress:
35+
- to:
36+
- podSelector:
37+
matchLabels:
38+
app.kubernetes.io/instance: external-secrets-operator
39+
# Allow pods to reach their own localhost
40+
- to:
41+
- podSelector: {}
42+
ports:
43+
- protocol: TCP
44+
port: 8081 # Health check port

‎components/external-secrets-operator/staging/networkpolicy-default-deny.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
# Network Policy: Default Deny All
3+
#
4+
# Purpose: Implements a "deny all / permit by exception" security model
5+
#
6+
# Behavior:
7+
# - Blocks ALL ingress traffic by default
8+
# - Blocks ALL egress traffic by default
9+
# - Other NetworkPolicies selectively allow specific traffic patterns
10+
#
11+
# Security: Aligns with ESO threat model recommendations
12+
# Reference: https://external-secrets.io/latest/guides/threat-model/
13+
apiVersion: networking.k8s.io/v1
14+
kind: NetworkPolicy
15+
metadata:
16+
name: default-deny-all
17+
namespace: external-secrets-operator
18+
spec:
19+
podSelector: {}
20+
policyTypes:
21+
- Ingress
22+
- Egress

‎components/kueue/production/stone-prod-p02/queue-config/cluster-queue.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,8 @@ spec:
149149
- linux-x86-64
150150
- local
151151
- localhost
152+
- macos-mac2metal-arm64
153+
- windows-amd64
152154
flavors:
153155
- name: platform-group-3
154156
resources:
@@ -174,6 +176,10 @@ spec:
174176
nominalQuota: '1000'
175177
- name: localhost
176178
nominalQuota: '1000'
179+
- name: macos-mac2metal-arm64
180+
nominalQuota: '5'
181+
- name: windows-amd64
182+
nominalQuota: '5'
177183
stopPolicy: None
178184
---
179185
apiVersion: kueue.x-k8s.io/v1beta1

‎components/mintmaker/development/kustomization.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,13 @@ apiVersion: kustomize.config.k8s.io/v1beta1
22
kind: Kustomization
33
resources:
44
- ../base
5-
- https://github.com/konflux-ci/mintmaker/config/default?ref=d697b66123406f17ad538425e0f3ab60e45f8083
6-
- https://github.com/konflux-ci/mintmaker/config/renovate?ref=d697b66123406f17ad538425e0f3ab60e45f8083
5+
- https://github.com/konflux-ci/mintmaker/config/default?ref=fc5c9899e3778a3ba25decc179e2044426abf13b
6+
- https://github.com/konflux-ci/mintmaker/config/renovate?ref=fc5c9899e3778a3ba25decc179e2044426abf13b
77

88
images:
99
- name: quay.io/konflux-ci/mintmaker
1010
newName: quay.io/konflux-ci/mintmaker
11-
newTag: d697b66123406f17ad538425e0f3ab60e45f8083
11+
newTag: fc5c9899e3778a3ba25decc179e2044426abf13b
1212
- name: quay.io/konflux-ci/mintmaker-renovate-image
1313
newName: quay.io/konflux-ci/mintmaker-renovate-image
1414
newTag: latest

‎components/mintmaker/staging/base/kustomization.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,18 +4,18 @@ resources:
44
- ../../base
55
- ../../base/external-secrets
66
- ../blackbox
7-
- https://github.com/konflux-ci/mintmaker/config/default?ref=d697b66123406f17ad538425e0f3ab60e45f8083
8-
- https://github.com/konflux-ci/mintmaker/config/renovate?ref=d697b66123406f17ad538425e0f3ab60e45f8083
7+
- https://github.com/konflux-ci/mintmaker/config/default?ref=fc5c9899e3778a3ba25decc179e2044426abf13b
8+
- https://github.com/konflux-ci/mintmaker/config/renovate?ref=fc5c9899e3778a3ba25decc179e2044426abf13b
99

1010
namespace: mintmaker
1111

1212
images:
1313
- name: quay.io/konflux-ci/mintmaker
1414
newName: quay.io/konflux-ci/mintmaker
15-
newTag: d697b66123406f17ad538425e0f3ab60e45f8083
15+
newTag: fc5c9899e3778a3ba25decc179e2044426abf13b
1616
- name: quay.io/konflux-ci/mintmaker-renovate-image
1717
newName: quay.io/konflux-ci/mintmaker-renovate-image
18-
newTag: 66ba659c9e490c87a057e5443526a37fa7ba1705
18+
newTag: d626233abbe78bbd7a2abd1e51592d3d1a667f49
1919

2020
commonAnnotations:
2121
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true

0 commit comments

Comments
 (0)