diff --git a/config/kubernetes/base/kustomization.yaml b/config/kubernetes/base/kustomization.yaml index 9a2a1edb6f..4cf6421b53 100644 --- a/config/kubernetes/base/kustomization.yaml +++ b/config/kubernetes/base/kustomization.yaml @@ -34,4 +34,3 @@ resources: - ../../webhooks/ - operator_service.yaml - pipelinesascode.yaml -- networkpolicy.yaml diff --git a/config/kubernetes/base/networkpolicy.yaml b/config/kubernetes/base/networkpolicy.yaml deleted file mode 100644 index ca2af8b92e..0000000000 --- a/config/kubernetes/base/networkpolicy.yaml +++ /dev/null @@ -1,87 +0,0 @@ -# Copyright 2026 The Tekton Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -# NetworkPolicy resources for the operator's own namespace (tekton-operator). Unlike the -# NetworkPolicies documented in docs/NetworkPolicy.md (reconciled dynamically by the operator for -# operand namespaces such as tekton-pipelines/tekton-triggers), no CR watches the operator's own -# namespace, so these ship statically with the install manifests/bundle instead. podSelectors are -# scoped to this operator's own pod labels only — never an empty/namespace-wide selector — so -# installing this bundle never affects other pods/operators that might share the namespace. -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: tekton-operator -spec: - podSelector: - matchLabels: - name: tekton-operator - policyTypes: - - Ingress - - Egress - ingress: - - from: - - namespaceSelector: - matchLabels: - kubernetes.io/metadata.name: monitoring - ports: - - protocol: TCP - port: 9090 - egress: - - to: - - namespaceSelector: - matchLabels: - kubernetes.io/metadata.name: kube-system - podSelector: - matchLabels: - k8s-app: kube-dns - ports: - - protocol: UDP - port: 53 - - protocol: TCP - port: 53 - # NP cannot select host-network endpoints and API server port is configurable. - - {} ---- -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: tekton-operator-webhook -spec: - podSelector: - matchLabels: - name: tekton-operator-webhook - policyTypes: - - Ingress - - Egress - ingress: - # Admission webhook callbacks originate from the API server; source IPs vary by cluster - # network plugin, so no ingress "from" restriction is applied here. - - ports: - - protocol: TCP - port: 8443 - egress: - - to: - - namespaceSelector: - matchLabels: - kubernetes.io/metadata.name: kube-system - podSelector: - matchLabels: - k8s-app: kube-dns - ports: - - protocol: UDP - port: 53 - - protocol: TCP - port: 53 - # NP cannot select host-network endpoints and API server port is configurable. - - {} diff --git a/config/openshift/base/kustomization.yaml b/config/openshift/base/kustomization.yaml index f48152023e..afb1baba37 100644 --- a/config/openshift/base/kustomization.yaml +++ b/config/openshift/base/kustomization.yaml @@ -56,7 +56,6 @@ resources: - ../../webhooks - operator_service.yaml - operator_servicemonitor.yaml -- networkpolicy.yaml apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization diff --git a/config/openshift/base/networkpolicy.yaml b/config/openshift/base/networkpolicy.yaml deleted file mode 100644 index 9b77f605e1..0000000000 --- a/config/openshift/base/networkpolicy.yaml +++ /dev/null @@ -1,88 +0,0 @@ -# Copyright 2026 The Tekton Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -# NetworkPolicy resources for the operator's own namespace (openshift-operators). Unlike the -# NetworkPolicies documented in docs/NetworkPolicy.md (reconciled dynamically by the operator for -# operand namespaces such as openshift-pipelines), no CR watches the operator's own namespace, so -# these ship statically with the install manifests/OLM bundle instead. podSelectors are scoped to -# this operator's own pod labels only — never an empty/namespace-wide selector, per the OLM bundle -# guidance — so installing this bundle never affects other operators that may share the namespace -# (openshift-operators is typically shared across many cluster-scoped operators). -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: openshift-pipelines-operator -spec: - podSelector: - matchLabels: - name: openshift-pipelines-operator - policyTypes: - - Ingress - - Egress - ingress: - - from: - - namespaceSelector: - matchLabels: - openshift.io/cluster-monitoring: "true" - ports: - - protocol: TCP - port: 9090 - egress: - - to: - - namespaceSelector: - matchLabels: - kubernetes.io/metadata.name: openshift-dns - podSelector: - matchLabels: - dns.operator.openshift.io/daemonset-dns: default - ports: - - protocol: UDP - port: 5353 - - protocol: TCP - port: 5353 - # NP cannot select host-network endpoints and API server port is configurable. - - {} ---- -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: tekton-operator-webhook -spec: - podSelector: - matchLabels: - name: tekton-operator-webhook - policyTypes: - - Ingress - - Egress - ingress: - # Admission webhook callbacks originate from the API server; source IPs vary by cluster - # network plugin, so no ingress "from" restriction is applied here. - - ports: - - protocol: TCP - port: 8443 - egress: - - to: - - namespaceSelector: - matchLabels: - kubernetes.io/metadata.name: openshift-dns - podSelector: - matchLabels: - dns.operator.openshift.io/daemonset-dns: default - ports: - - protocol: UDP - port: 5353 - - protocol: TCP - port: 5353 - # NP cannot select host-network endpoints and API server port is configurable. - - {} diff --git a/docs/NetworkPolicy.md b/docs/NetworkPolicy.md index 18460a4e71..41f1c5b656 100644 --- a/docs/NetworkPolicy.md +++ b/docs/NetworkPolicy.md @@ -299,10 +299,6 @@ Deployed only when the scheduler is enabled with multi-cluster role = Hub. All component policies (TektonPipeline, TektonTrigger, TektonScheduler, TektonMulticlusterProxyAAE, SyncerService, and Console Plugin) are applied to the operand namespace (e.g. `tekton-pipelines` or `openshift-pipelines`). -None of these cover the operator's own namespace -(`tekton-operator` / `openshift-operators`), which ships fixed, non-configurable -NetworkPolicies as part of the operator's own install manifests/bundle (see -[Operator's own namespace](#operators-own-namespace) below). ### Platform differences @@ -312,44 +308,6 @@ NetworkPolicies as part of the operator's own install manifests/bundle (see | DNS namespace | `kube-system` | `openshift-dns` | | Prometheus namespace label | `kubernetes.io/metadata.name: monitoring` | `openshift.io/cluster-monitoring: "true"` | -## Operator's own namespace - -The operator's own namespace (`tekton-operator` on Kubernetes, `openshift-operators` -on OpenShift) ships two fixed NetworkPolicies as static manifests alongside the -operator's Deployment/RBAC — in `config/kubernetes/base/networkpolicy.yaml` and -`config/openshift/base/networkpolicy.yaml` respectively. These are **not** -reconciled by a controller and are **not** configurable via `spec.networkPolicy`: -no CR watches the operator's own namespace, so there is nothing to gate this on. -They are also not a namespace-wide default-deny — each policy's `podSelector` is -scoped to one of the operator's own pods (`name: tekton-operator` / -`name: openshift-pipelines-operator` for the main controller, and -`name: tekton-operator-webhook` for the CR admission webhook) so that installing -the operator's bundle never affects unrelated pods that might share the namespace -(`openshift-operators` in particular is commonly shared by many operators). - -| Policy | Direction | Port | Source / Destination | -|---|---|---|---| -| `tekton-operator` / `openshift-pipelines-operator` | ingress | TCP/9090 | Prometheus namespace | -| | egress | UDP+TCP/53 or 5353 | DNS resolver pods | -| | egress | all | API server (all egress allowed — NP cannot select host-network endpoints) | -| `tekton-operator-webhook` | ingress | TCP/8443 | Any (admission webhook) | -| | egress | UDP+TCP/53 or 5353 | DNS resolver pods | -| | egress | all | API server (all egress allowed — NP cannot select host-network endpoints) | - -**OpenShift caveat**: `openshift-operators` is a shared namespace where OLM installs -operators from OperatorHub, many of which ship no NetworkPolicy of their own. To -avoid silently breaking those operators' networking, OpenShift's platform payload -ships a permissive `default-allow-all` NetworkPolicy in that namespace out of the -box (labeled `capability.openshift.io/name: OperatorLifecycleManager`), with an -empty `podSelector` allowing all ingress/egress for every pod in the namespace. -Because NetworkPolicy rules are additive (a pod's allowed traffic is the union of -every policy that selects it, not the intersection), this platform-shipped policy -supersedes the two policies above in practice — the operator's own pods remain -fully open on a stock OpenShift cluster until a cluster admin removes or replaces -`default-allow-all`. The `openshift-pipelines` (operand) namespace has no such -baseline policy, so the `proxy-webhook` policies further up this page are enforced -as documented without this caveat. - ## Disabling ```yaml