Skip to content

Fix enterprise contract: olm.required_network_policy_rbac_for_operands - #163

Open
Jakob-Naucke wants to merge 2 commits into
confidential-clusters:mainfrom
Jakob-Naucke:net-rbac
Open

Fix enterprise contract: olm.required_network_policy_rbac_for_operands#163
Jakob-Naucke wants to merge 2 commits into
confidential-clusters:mainfrom
Jakob-Naucke:net-rbac

Conversation

@Jakob-Naucke

Copy link
Copy Markdown
Contributor

#161 is failing:

"msg": "Operator \"confidential-cluster-operator\" version \"0.2.1\" is missing required NetworkPolicy RBAC (networking.k8s.io/networkpolicies with create, delete, and update/patch)",
"metadata": {
  "code": "olm.required_network_policy_rbac_for_operands",
  "collections": [
    "redhat"
  ],
  "description": "Operators are required to manage the network policies of their operands. This rule verifies that operator bundles request sufficient RBAC permissions to manage NetworkPolicy lifecycle (create, delete, and update/patch) for networking.k8s.io/networkpolicies in their ClusterServiceVersion. Bundles whose operator name and major.minor version are listed in the `operator_network_policy_rbac_exceptions` rule data key are exempt from this requirement. To exclude this rule add \"olm.required_network_policy_rbac_for_operands\" to the `exclude` section of the policy configuration.",
  "effective_on": "2026-08-07T00:00:00Z",
  "solution": "Add a rule granting create, delete, and update/patch on networking.k8s.io/networkpolicies to the ClusterServiceVersion clusterPermissions or permissions, or add the operator name and its major.minor version to the operator_network_policy_rbac_exceptions rule data key.",
  "title": "NetworkPolicy RBAC present in OLM bundle"
}

Have a potential fix but would like to test it here before going back and forth on upstream. As a first step, don't apply the fix at all, but verify we get the same failure here.

Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
@Jakob-Naucke

Copy link
Copy Markdown
Contributor Author

It does, so let's test

Bumping upstream as a whole requires a new buildroot. Bump to its
v0.2.1-net-rbac branch first to make enterprise contract checks pass,
and to get the new buildroot.

Signed-off-by: Jakob Naucke <jnaucke@redhat.com>
@Jakob-Naucke
Jakob-Naucke marked this pull request as ready for review August 19, 2026 09:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant