telcov10n: NROP tls-scanner: allow scanner ingress to scheduler pods via Network…

ci-operator/config/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main__cnf-compute-nrop-stage-nightly.yaml

@@ -75,6 +75,7 @@ tests:
       PQC_CHECK: "true"
       SCAN_NAMESPACE: openshift-numaresources
       SCANNER_CPU: "2"
+      SCANNER_NAMESPACE: tls-scanner
       TEST_ENV: stage
       VERSION: "5.0"
     workflow: telcov10n-functional-cnf-compute-nrop-tls-scanner

ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/create-network-policy/OWNERS

@@ -0,0 +1,7 @@
+approvers:
+- eifrach
+- ccardenosa
+- mrniranjan
+- rshemtov13
+- sargunnarula
+- oblau

ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/create-network-policy/telcov10n-functional-cnf-compute-nrop-create-network-policy-commands.sh

@@ -0,0 +1,55 @@
+#!/bin/bash
+set -o nounset
+set -o errexit
+set -o pipefail
+
+# The TLS scanner connects to pods in the NROP namespace (e.g. the secondary
+# scheduler metrics endpoint on port 10259) over the pod network. NROP
+# namespaces enforce NetworkPolicy that denies ingress from other namespaces,
+# so the scanner running in its own namespace cannot reach those pods.
+#
+# NetworkPolicies are additive: this creates a policy that allows ingress to the
+# scheduler pods from both the NROP namespace and the scanner namespace, so the
+# scan can complete without loosening the existing isolation for other traffic.
+
+SCAN_NAMESPACE="${SCAN_NAMESPACE:-openshift-numaresources}"
+SCANNER_NAMESPACE="${SCANNER_NAMESPACE:-tls-scanner}"
+SCHEDULER_POD_LABEL_KEY="${SCHEDULER_POD_LABEL_KEY:-app}"
+SCHEDULER_POD_LABEL_VALUE="${SCHEDULER_POD_LABEL_VALUE:-secondary-scheduler}"
+SCHEDULER_PORT="${SCHEDULER_PORT:-10259}"
+
+# The scanner runs pod-networked in SCANNER_NAMESPACE so the namespaceSelector
+# below matches its traffic. In that mode the tls-scanner-run step does not
+# create the namespace itself, so ensure it exists here before the scan.
+echo "Ensuring scanner namespace ${SCANNER_NAMESPACE} exists..."
+oc create namespace "${SCANNER_NAMESPACE}" --dry-run=client -o yaml | oc apply -f -
+
+echo "Allowing TLS scanner (ns: ${SCANNER_NAMESPACE}) ingress to ${SCHEDULER_POD_LABEL_KEY}=${SCHEDULER_POD_LABEL_VALUE} pods on port ${SCHEDULER_PORT} in ${SCAN_NAMESPACE}..."
+
+cat <<EOF | oc apply -f -
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: scheduler-ingress-tls-scan
+  namespace: ${SCAN_NAMESPACE}
+spec:
+  podSelector:
+    matchLabels:
+      ${SCHEDULER_POD_LABEL_KEY}: ${SCHEDULER_POD_LABEL_VALUE}
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: ${SCAN_NAMESPACE}
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: ${SCANNER_NAMESPACE}
+    ports:
+    - protocol: TCP
+      port: ${SCHEDULER_PORT}
+  policyTypes:
+  - Ingress
+EOF
+
+echo "NetworkPolicy scheduler-ingress-tls-scan applied in ${SCAN_NAMESPACE}:"
+oc get networkpolicy scheduler-ingress-tls-scan -n "${SCAN_NAMESPACE}"

ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/create-network-policy/telcov10n-functional-cnf-compute-nrop-create-network-policy-ref.metadata.json

@@ -0,0 +1,13 @@
+{
+	"path": "telcov10n/functional/cnf-compute/nrop/create-network-policy/telcov10n-functional-cnf-compute-nrop-create-network-policy-ref.yaml",
+	"owners": {
+		"approvers": [
+			"eifrach",
+			"ccardenosa",
+			"mrniranjan",
+			"rshemtov13",
+			"sargunnarula",
+			"oblau"
+		]
+	}
+}

ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/create-network-policy/telcov10n-functional-cnf-compute-nrop-create-network-policy-ref.yaml

@@ -0,0 +1,31 @@
+ref:
+  as: telcov10n-functional-cnf-compute-nrop-create-network-policy
+  from: cli
+  cli: latest
+  commands: telcov10n-functional-cnf-compute-nrop-create-network-policy-commands.sh
+  env:
+  - name: SCAN_NAMESPACE
+    default: "openshift-numaresources"
+    documentation: "NROP namespace that hosts the pods to be scanned and where the NetworkPolicy is created."
+  - name: SCANNER_NAMESPACE
+    default: "tls-scanner"
+    documentation: "Namespace the TLS scanner pod runs in. Must match the scan step's namespace so its ingress is allowed."
+  - name: SCHEDULER_POD_LABEL_KEY
+    default: "app"
+    documentation: "Pod label key used to select the scheduler pods the scanner needs to reach."
+  - name: SCHEDULER_POD_LABEL_VALUE
+    default: "secondary-scheduler"
+    documentation: "Pod label value used to select the scheduler pods the scanner needs to reach."
+  - name: SCHEDULER_PORT
+    default: "10259"
+    documentation: "TCP port on the scheduler pods that the scanner connects to."
+  resources:
+    requests:
+      cpu: 100m
+      memory: 200Mi
+  timeout: 10m0s
+  documentation: |-
+    Creates an additive NetworkPolicy in the NROP namespace that allows the TLS
+    scanner namespace to reach the secondary scheduler pods on their metrics port,
+    so the TLS scanner can probe endpoints that are otherwise isolated by the
+    namespace's existing NetworkPolicy.

ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/tls-scanner/telcov10n-functional-cnf-compute-nrop-tls-scanner-workflow.yaml

@@ -10,6 +10,7 @@ workflow:
       env:
       - name: KUBECONFIG
         default: "/tmp/shared/kubeconfig"
+    - ref: telcov10n-functional-cnf-compute-nrop-create-network-policy
     test:
     - ref: tls-scanner-run
     post: []