deploy/chart: add static NetworkPolicies for CatalogSource gRPC ingress and bundle unpack egress#3863
Merged
openshift-merge-bot[bot] merged 2 commits intoJul 15, 2026
Conversation
…ss and bundle unpack egress The Helm chart's default-deny-all-traffic policy blocked two critical traffic paths that are not covered by the existing static NetworkPolicies: 1. CatalogSource registry pods need to accept inbound gRPC connections on port 50051 from within the cluster. The catalog-operator reconciler already creates per-CatalogSource NetworkPolicies for this, but there is a bootstrapping gap between when default-deny-all-traffic is applied and when the controller first reconciles each CatalogSource. 2. Bundle-unpack Job pods need egress to reach the Kubernetes API server and container registries. The API server port is not statically specifiable because it varies across Kubernetes implementations, so a wildcard egress rule is used. Adds two new NetworkPolicies to the chart: - catalog-source-grpc-server: selects all pods carrying the olm.catalogSource label and allows ingress on the gRPC port. - bundle-unpack-egress: selects all pods carrying both the olm.managed=true and operatorframework.io/bundle-unpack-ref labels and allows unrestricted egress. Fixes: operator-framework#3676 Signed-off-by: grokspawn <jordan@nimblewidget.com>
There was a problem hiding this comment.
Pull request overview
This PR updates the OLM Helm chart’s static NetworkPolicy set to avoid connectivity failures caused by the chart’s default-deny-all-traffic policy during the bootstrapping window (before the catalog controller has reconciled per-CatalogSource policies). It specifically targets allowing gRPC ingress to CatalogSource registry pods and enabling bundle-unpack job egress.
Changes:
- Add
catalog-source-grpc-serverNetworkPolicyto allow ingress to pods labeledolm.catalogSourceon the configured gRPC port. - Add
bundle-unpack-egressNetworkPolicyto allow wildcard egress from bundle-unpack job pods (selected byolm.managed=trueandoperatorframework.io/bundle-unpack-ref).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
grokspawn
added a commit
to grokspawn/operator-lifecycle-manager
that referenced
this pull request
Jul 9, 2026
…ck NPs CatalogSource registry pods and bundle-unpack Jobs run in the namespace determined by .Values.catalog_namespace, not .Values.namespace. When a user overrides catalog_namespace to differ from namespace, the NetworkPolicies must be created in catalog_namespace to actually apply to those pods. Fixes review feedback on operator-framework#3863. Signed-off-by: grokspawn <jordan@nimblewidget.com>
perdasilva
reviewed
Jul 10, 2026
perdasilva
left a comment
perdasilva
left a comment
Collaborator
There was a problem hiding this comment.
Code review — 3 findings on the new NetworkPolicy templates.
…ck NPs CatalogSource registry pods and bundle-unpack Jobs run in the namespace determined by .Values.catalog_namespace, not .Values.namespace. When a user overrides catalog_namespace to differ from namespace, the NetworkPolicies must be created in catalog_namespace to actually apply to those pods. Fixes review feedback on operator-framework#3863. Signed-off-by: grokspawn <jordan@nimblewidget.com>
grokspawn
force-pushed
the
fix/networkpolicy-gaps-3676
branch
from
July 13, 2026 16:05
b4fea33 to
7b126c2
Compare
Collaborator
|
/approve |
openshift-ci
Bot
added
the
approved
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: perdasilva, rashmigottipati The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-merge-bot
Bot
merged commit Jul 15, 2026
174dccd
into
operator-framework:master
19 of 21 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #3676.
The Helm chart's
default-deny-all-trafficNetworkPolicy blocked two traffic paths not covered by the existing static policies:default-deny-all-traffictakes effect immediately on install/upgrade, while the per-CatalogSource policies only exist after the controller reconciles each object.Two new NetworkPolicies are added to the chart:
olm-catalog-grpc-ingressolm.catalogSourcelabel (any value)catalogGrpcPodPort(50051)bundle-unpack-egressolm.managed=true+operatorframework.io/bundle-unpack-reflabelThe
olm-catalog-grpc-ingresspolicy only listsIngressinpolicyTypes, so it does not restrict egress of catalog pods (that remains under the per-CatalogSource policies from the controller). Thebundle-unpack-egresspolicy only listsEgress, so it does not affect ingress on those pods.Test plan
quay.io/operatorhubio/catalog:latest; verifylastObservedStatereachesREADYBundleLookupFailedolm-catalog-grpc-ingressandbundle-unpack-egressNetworkPolicies are present in the OLM namespace afterhelm install🤖 Generated with Claude Code