From 89429861b55211dec5b3842cf213ac56f8e5db1a Mon Sep 17 00:00:00 2001 From: grokspawn Date: Thu, 9 Jul 2026 14:15:16 -0500 Subject: [PATCH 1/2] deploy/chart: add static NetworkPolicies for CatalogSource gRPC ingress and bundle unpack egress The Helm chart's default-deny-all-traffic policy blocked two critical traffic paths that are not covered by the existing static NetworkPolicies: 1. CatalogSource registry pods need to accept inbound gRPC connections on port 50051 from within the cluster. The catalog-operator reconciler already creates per-CatalogSource NetworkPolicies for this, but there is a bootstrapping gap between when default-deny-all-traffic is applied and when the controller first reconciles each CatalogSource. 2. Bundle-unpack Job pods need egress to reach the Kubernetes API server and container registries. The API server port is not statically specifiable because it varies across Kubernetes implementations, so a wildcard egress rule is used. Adds two new NetworkPolicies to the chart: - catalog-source-grpc-server: selects all pods carrying the olm.catalogSource label and allows ingress on the gRPC port. - bundle-unpack-egress: selects all pods carrying both the olm.managed=true and operatorframework.io/bundle-unpack-ref labels and allows unrestricted egress. Fixes: https://github.com/operator-framework/operator-lifecycle-manager/issues/3676 Signed-off-by: grokspawn --- .../0000_50_olm_01-networkpolicies.yaml | 38 +++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/deploy/chart/templates/0000_50_olm_01-networkpolicies.yaml b/deploy/chart/templates/0000_50_olm_01-networkpolicies.yaml index 6ee410a64a..380bf70460 100644 --- a/deploy/chart/templates/0000_50_olm_01-networkpolicies.yaml +++ b/deploy/chart/templates/0000_50_olm_01-networkpolicies.yaml @@ -85,3 +85,41 @@ spec: - { } egress: - { } +--- +# Complements per-CatalogSource NPs from the controller; covers the bootstrapping window before reconciliation. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: catalog-source-grpc-server + namespace: {{ .Values.namespace }} +spec: + podSelector: + matchExpressions: + - key: olm.catalogSource + operator: Exists + policyTypes: + - Ingress + ingress: + - ports: + - protocol: TCP + port: {{ .Values.catalogGrpcPodPort }} +--- +# Wildcard egress; API server port omitted intentionally — it is implementation-defined and not statically knowable. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: bundle-unpack-egress + namespace: {{ .Values.namespace }} +spec: + podSelector: + matchExpressions: + - key: operatorframework.io/bundle-unpack-ref + operator: Exists + - key: olm.managed + operator: In + values: + - "true" + policyTypes: + - Egress + egress: + - { } From 7b126c2e5ee2be440c936cf1dcf35700025a46cc Mon Sep 17 00:00:00 2001 From: grokspawn Date: Thu, 9 Jul 2026 14:44:34 -0500 Subject: [PATCH 2/2] deploy/chart: use catalog_namespace for CatalogSource and bundle-unpack NPs CatalogSource registry pods and bundle-unpack Jobs run in the namespace determined by .Values.catalog_namespace, not .Values.namespace. When a user overrides catalog_namespace to differ from namespace, the NetworkPolicies must be created in catalog_namespace to actually apply to those pods. Fixes review feedback on #3863. Signed-off-by: grokspawn --- .../templates/0000_50_olm_01-networkpolicies.yaml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/deploy/chart/templates/0000_50_olm_01-networkpolicies.yaml b/deploy/chart/templates/0000_50_olm_01-networkpolicies.yaml index 380bf70460..fb28e05266 100644 --- a/deploy/chart/templates/0000_50_olm_01-networkpolicies.yaml +++ b/deploy/chart/templates/0000_50_olm_01-networkpolicies.yaml @@ -87,11 +87,17 @@ spec: - { } --- # Complements per-CatalogSource NPs from the controller; covers the bootstrapping window before reconciliation. +# Effective only when catalog_namespace == namespace (the default). When they differ, no OLM-managed +# deny-all exists in catalog_namespace, so this rule has no effect; adding one there is unsafe since +# OLM does not exclusively own that namespace. +# No 'from:' restriction is intentional, matching current dynamic NP behavior. If the controller ever +# restricts ingress sources, this Helm-owned NP (which the controller cannot delete) will silently +# override that — treat as a permanent design constraint. apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: - name: catalog-source-grpc-server - namespace: {{ .Values.namespace }} + name: olm-catalog-grpc-ingress + namespace: {{ .Values.catalog_namespace }} spec: podSelector: matchExpressions: @@ -105,11 +111,12 @@ spec: port: {{ .Values.catalogGrpcPodPort }} --- # Wildcard egress; API server port omitted intentionally — it is implementation-defined and not statically knowable. +# Carries the same split-namespace limitation as olm-catalog-grpc-ingress above. apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: bundle-unpack-egress - namespace: {{ .Values.namespace }} + namespace: {{ .Values.catalog_namespace }} spec: podSelector: matchExpressions: