From 93f82e6f953f3e9389437c9408b105c34ae68c97 Mon Sep 17 00:00:00 2001 From: Jefferson Ramos Date: Wed, 19 Aug 2026 12:50:31 -0300 Subject: [PATCH] pkg/agenticrun: restrict console plugin NetworkPolicy to openshift-console namespace The allow-console-ingress NetworkPolicy opened port 9001 to any pod in the cluster. Restrict ingress to the openshift-console namespace using a namespaceSelector, matching the annotation's stated intent and enforcing least-privilege networking. Fixes OTA-2108 Co-Authored-By: Claude Opus 4.6 --- .../bindata/assets/networkpolicy-allow-console.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/pkg/agenticrun/bindata/assets/networkpolicy-allow-console.yaml b/pkg/agenticrun/bindata/assets/networkpolicy-allow-console.yaml index f9b0e3bb5d..afdf74c832 100644 --- a/pkg/agenticrun/bindata/assets/networkpolicy-allow-console.yaml +++ b/pkg/agenticrun/bindata/assets/networkpolicy-allow-console.yaml @@ -10,7 +10,11 @@ spec: matchLabels: app: cluster-update-console-plugin ingress: - - ports: + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: openshift-console + ports: - port: 9001 protocol: TCP policyTypes: