From cad5d971d4c6d1b372e6e6d52b85198dc3d065a0 Mon Sep 17 00:00:00 2001 From: "Niranjan M.R" Date: Fri, 21 Aug 2026 13:19:17 +0000 Subject: [PATCH] NROP tls-scanner: allow scanner ingress to scheduler pods via NetworkPolicy The TLS scanner could not reach NROP scheduler pods (port 10259) in the openshift-numaresources namespace because the namespace's NetworkPolicy denies cross-namespace ingress. - Add telcov10n-functional-cnf-compute-nrop-create-network-policy pre-step that applies an additive NetworkPolicy allowing ingress to the secondary-scheduler pods from the scanner namespace, and ensures the scanner namespace exists. - Wire the step into the nrop-tls-scanner workflow before tls-scanner-run. - Set SCANNER_NAMESPACE=tls-scanner on the scan step so the scanner runs pod-networked, letting the NetworkPolicy namespaceSelector match its traffic (host-networked traffic sources from the node IP and would not). Co-Authored-By: Claude Opus 4.8 --- ...-main__cnf-compute-nrop-stage-nightly.yaml | 1 + .../nrop/create-network-policy/OWNERS | 7 +++ ...ute-nrop-create-network-policy-commands.sh | 55 +++++++++++++++++++ ...op-create-network-policy-ref.metadata.json | 13 +++++ ...ompute-nrop-create-network-policy-ref.yaml | 31 +++++++++++ ...cnf-compute-nrop-tls-scanner-workflow.yaml | 1 + 6 files changed, 108 insertions(+) create mode 100644 ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/create-network-policy/OWNERS create mode 100755 ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/create-network-policy/telcov10n-functional-cnf-compute-nrop-create-network-policy-commands.sh create mode 100644 ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/create-network-policy/telcov10n-functional-cnf-compute-nrop-create-network-policy-ref.metadata.json create mode 100644 ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/create-network-policy/telcov10n-functional-cnf-compute-nrop-create-network-policy-ref.yaml diff --git a/ci-operator/config/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main__cnf-compute-nrop-stage-nightly.yaml b/ci-operator/config/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main__cnf-compute-nrop-stage-nightly.yaml index b8c29079d472b..c211affbec1a7 100644 --- a/ci-operator/config/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main__cnf-compute-nrop-stage-nightly.yaml +++ b/ci-operator/config/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main__cnf-compute-nrop-stage-nightly.yaml @@ -75,6 +75,7 @@ tests: PQC_CHECK: "true" SCAN_NAMESPACE: openshift-numaresources SCANNER_CPU: "2" + SCANNER_NAMESPACE: tls-scanner TEST_ENV: stage VERSION: "5.0" workflow: telcov10n-functional-cnf-compute-nrop-tls-scanner diff --git a/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/create-network-policy/OWNERS b/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/create-network-policy/OWNERS new file mode 100644 index 0000000000000..42fcae862b9e3 --- /dev/null +++ b/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/create-network-policy/OWNERS @@ -0,0 +1,7 @@ +approvers: +- eifrach +- ccardenosa +- mrniranjan +- rshemtov13 +- sargunnarula +- oblau diff --git a/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/create-network-policy/telcov10n-functional-cnf-compute-nrop-create-network-policy-commands.sh b/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/create-network-policy/telcov10n-functional-cnf-compute-nrop-create-network-policy-commands.sh new file mode 100755 index 0000000000000..f59230883d009 --- /dev/null +++ b/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/create-network-policy/telcov10n-functional-cnf-compute-nrop-create-network-policy-commands.sh @@ -0,0 +1,55 @@ +#!/bin/bash +set -o nounset +set -o errexit +set -o pipefail + +# The TLS scanner connects to pods in the NROP namespace (e.g. the secondary +# scheduler metrics endpoint on port 10259) over the pod network. NROP +# namespaces enforce NetworkPolicy that denies ingress from other namespaces, +# so the scanner running in its own namespace cannot reach those pods. +# +# NetworkPolicies are additive: this creates a policy that allows ingress to the +# scheduler pods from both the NROP namespace and the scanner namespace, so the +# scan can complete without loosening the existing isolation for other traffic. + +SCAN_NAMESPACE="${SCAN_NAMESPACE:-openshift-numaresources}" +SCANNER_NAMESPACE="${SCANNER_NAMESPACE:-tls-scanner}" +SCHEDULER_POD_LABEL_KEY="${SCHEDULER_POD_LABEL_KEY:-app}" +SCHEDULER_POD_LABEL_VALUE="${SCHEDULER_POD_LABEL_VALUE:-secondary-scheduler}" +SCHEDULER_PORT="${SCHEDULER_PORT:-10259}" + +# The scanner runs pod-networked in SCANNER_NAMESPACE so the namespaceSelector +# below matches its traffic. In that mode the tls-scanner-run step does not +# create the namespace itself, so ensure it exists here before the scan. +echo "Ensuring scanner namespace ${SCANNER_NAMESPACE} exists..." +oc create namespace "${SCANNER_NAMESPACE}" --dry-run=client -o yaml | oc apply -f - + +echo "Allowing TLS scanner (ns: ${SCANNER_NAMESPACE}) ingress to ${SCHEDULER_POD_LABEL_KEY}=${SCHEDULER_POD_LABEL_VALUE} pods on port ${SCHEDULER_PORT} in ${SCAN_NAMESPACE}..." + +cat <