Skip to content

OCPBUGS-61175: Create NetworkPolicy for Manila CSI driver #424

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mpatlasov wants to merge 1 commit into
base: main
Choose a base branch
from
Open

OCPBUGS-61175: Create NetworkPolicy for Manila CSI driver #424

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions assets/overlays/openstack-manila/base/network-policy-allow-all-egress.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-all-egress
namespace: ${NAMESPACE}
Comment on lines +3 to +5

@coderabbitai coderabbitai Bot Aug 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win

Use ${ASSET_PREFIX} in each NetworkPolicy name.

The asset templates use generic resource names. Prefix each name with ${ASSET_PREFIX} to identify the owning driver consistently.

  • assets/overlays/openstack-manila/base/network-policy-allow-all-egress.yaml#L3-L5: change the name to ${ASSET_PREFIX}-allow-all-egress.
  • assets/overlays/openstack-manila/base/network-policy-allow-egress-to-api-server.yaml#L3-L5: change the name to ${ASSET_PREFIX}-allow-egress-to-api-server.
  • assets/overlays/openstack-manila/base/network-policy-allow-to-dns.yaml#L3-L5: change the name to ${ASSET_PREFIX}-allow-to-dns.
  • assets/overlays/openstack-manila/base/network-policy-allow-ingress-to-metrics.yaml#L3-L5: change the name to ${ASSET_PREFIX}-allow-ingress-to-metrics-range.
📍 Affects 4 files
  • assets/overlays/openstack-manila/base/network-policy-allow-all-egress.yaml#L3-L5 (this comment)
  • assets/overlays/openstack-manila/base/network-policy-allow-egress-to-api-server.yaml#L3-L5
  • assets/overlays/openstack-manila/base/network-policy-allow-to-dns.yaml#L3-L5
  • assets/overlays/openstack-manila/base/network-policy-allow-ingress-to-metrics.yaml#L3-L5
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@assets/overlays/openstack-manila/base/network-policy-allow-all-egress.yaml`
around lines 3 - 5, Prefix each NetworkPolicy metadata.name with
${ASSET_PREFIX}: update
assets/overlays/openstack-manila/base/network-policy-allow-all-egress.yaml:3-5
to ${ASSET_PREFIX}-allow-all-egress,
assets/overlays/openstack-manila/base/network-policy-allow-egress-to-api-server.yaml:3-5
to ${ASSET_PREFIX}-allow-egress-to-api-server,
assets/overlays/openstack-manila/base/network-policy-allow-to-dns.yaml:3-5 to
${ASSET_PREFIX}-allow-to-dns, and
assets/overlays/openstack-manila/base/network-policy-allow-ingress-to-metrics.yaml:3-5
to ${ASSET_PREFIX}-allow-ingress-to-metrics-range.

Source: Coding guidelines

annotations:
include.release.openshift.io/hypershift: "true"
include.release.openshift.io/ibm-cloud-managed: "true"
include.release.openshift.io/self-managed-high-availability: "true"
include.release.openshift.io/single-node-developer: "true"
capability.openshift.io/name: Storage
spec:
podSelector:
matchLabels:
openshift.storage.network-policy.all-egress: allow
egress:
- ports:
- protocol: TCP
port: 1
endPort: 65535
policyTypes:
- Egress
21 changes: 21 additions & 0 deletions assets/overlays/openstack-manila/base/network-policy-allow-egress-to-api-server.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-egress-to-api-server
namespace: ${NAMESPACE}
annotations:
include.release.openshift.io/hypershift: "true"
include.release.openshift.io/ibm-cloud-managed: "true"
include.release.openshift.io/self-managed-high-availability: "true"
include.release.openshift.io/single-node-developer: "true"
capability.openshift.io/name: Storage
spec:
podSelector:
matchLabels:
openshift.storage.network-policy.api-server: allow
egress:
- ports:
- protocol: TCP
port: 6443
Comment on lines +16 to +19

@coderabbitai coderabbitai Bot Aug 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Find existing API-server NetworkPolicy patterns and the labels that select Manila pods.
rg -n -C 6 'allow-egress-to-api-server|port:\s*6443|api-server:\s*allow|kubernetes\.default' \
  --glob '*.{yaml,yml}' --glob '*.go' .

# Inspect Manila controller patches for the selected label and deployment topology.
fd -t f . assets pkg | rg 'openstack-manila|network-policy|controller'

Repository: openshift/csi-operator

Length of output: 50378

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- Manila base policies ---'
for f in \
  assets/overlays/openstack-manila/base/network-policy-allow-egress-to-api-server.yaml \
  assets/overlays/openstack-manila/base/network-policy-allow-all-egress.yaml \
  assets/overlays/openstack-manila/base/network-policy-allow-to-dns.yaml
do
  echo "--- $f"
  cat -n "$f"
done

printf '%s\n' '--- Manila controller labels and asset registration ---'
sed -n '1,115p' pkg/driver/openstack-manila/openstack_manila.go
cat -n assets/overlays/openstack-manila/patches/controller_add_driver.yaml

printf '%s\n' '--- Exact policy selectors and egress peers ---'
python3 - <<'PY'
from pathlib import Path

files = [
    Path("assets/overlays/openstack-manila/base/network-policy-allow-egress-to-api-server.yaml"),
    Path("assets/overlays/openstack-manila/base/network-policy-allow-all-egress.yaml"),
    Path("assets/overlays/openstack-manila/base/network-policy-allow-to-dns.yaml"),
]
for path in files:
    text = path.read_text()
    print(path)
    print("  selects_api_server_label =", "openshift.storage.network-policy.api-server: allow" in text)
    print("  selects_all_egress_label =", "openshift.storage.network-policy.all-egress: allow" in text)
    print("  has_to_peer =", any(line.lstrip().startswith("to:") for line in text.splitlines()))
    print("  has_port_6443 =", "port: 6443" in text)
PY

Repository: openshift/csi-operator

Length of output: 14444

Security Misconfiguration (CWE-284)

Reachability: Internal · Exploitability: Moderate

Restrict Manila controller egress.

Both policies select the controller pods. allow-all-egress already permits TCP ports 1–65535, so adding a to peer only to the API-server policy will not enforce isolation. Replace the broad egress policy with topology-specific API-server peers and the required DNS and metrics exceptions.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@assets/overlays/openstack-manila/base/network-policy-allow-egress-to-api-server.yaml`
around lines 16 - 19, Update the egress rules in the controller-selected network
policies, replacing the broad allow-all-egress behavior with topology-specific
API-server peers. Retain TCP port 6443 for API-server access and add only the
required DNS and metrics exceptions, ensuring no unrestricted TCP 1–65535 rule
remains.

Source: Path instructions

policyTypes:
- Egress
22 changes: 22 additions & 0 deletions assets/overlays/openstack-manila/base/network-policy-allow-ingress-to-metrics.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-ingress-to-metrics-range
namespace: ${NAMESPACE}
annotations:
include.release.openshift.io/hypershift: "true"
include.release.openshift.io/ibm-cloud-managed: "true"
include.release.openshift.io/self-managed-high-availability: "true"
include.release.openshift.io/single-node-developer: "true"
capability.openshift.io/name: Storage
spec:
podSelector:
matchLabels:
openshift.storage.network-policy.metrics-range: allow
ingress:
- ports:
- protocol: TCP
port: 9201
endPort: 9223
policyTypes:
- Ingress
30 changes: 30 additions & 0 deletions assets/overlays/openstack-manila/base/network-policy-allow-to-dns.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-to-dns
namespace: ${NAMESPACE}
annotations:
include.release.openshift.io/hypershift: "true"
include.release.openshift.io/ibm-cloud-managed: "true"
include.release.openshift.io/self-managed-high-availability: "true"
include.release.openshift.io/single-node-developer: "true"
capability.openshift.io/name: Storage
spec:
podSelector:
matchLabels:
openshift.storage.network-policy.dns: allow
egress:
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: openshift-dns
podSelector:
matchLabels:
dns.operator.openshift.io/daemonset-dns: default
ports:
- protocol: TCP
port: dns-tcp
- protocol: UDP
port: dns
policyTypes:
- Egress
4 changes: 4 additions & 0 deletions assets/overlays/openstack-manila/generated/hypershift/manifests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,10 @@ controllerStaticAssetNames:
- controller.yaml
- controller_pdb.yaml
- controller_sa.yaml
- network-policy-allow-all-egress.yaml
- network-policy-allow-egress-to-api-server.yaml
- network-policy-allow-ingress-to-metrics.yaml
- network-policy-allow-to-dns.yaml
- service.yaml
guestStaticAssetNames:
- config_secret.yaml
Expand Down
28 changes: 28 additions & 0 deletions assets/overlays/openstack-manila/generated/hypershift/network-policy-allow-all-egress.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
# Generated file. Do not edit. Update using "make update".
#
# Loaded from overlays/openstack-manila/base/network-policy-allow-all-egress.yaml
#
#

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
annotations:
capability.openshift.io/name: Storage
include.release.openshift.io/hypershift: "true"
include.release.openshift.io/ibm-cloud-managed: "true"
include.release.openshift.io/self-managed-high-availability: "true"
include.release.openshift.io/single-node-developer: "true"
name: allow-all-egress
namespace: ${NAMESPACE}
spec:
egress:
- ports:
- endPort: 65535
port: 1
protocol: TCP
podSelector:
matchLabels:
openshift.storage.network-policy.all-egress: allow
policyTypes:
- Egress
27 changes: 27 additions & 0 deletions ...lays/openstack-manila/generated/hypershift/network-policy-allow-egress-to-api-server.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
# Generated file. Do not edit. Update using "make update".
#
# Loaded from overlays/openstack-manila/base/network-policy-allow-egress-to-api-server.yaml
#
#

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
annotations:
capability.openshift.io/name: Storage
include.release.openshift.io/hypershift: "true"
include.release.openshift.io/ibm-cloud-managed: "true"
include.release.openshift.io/self-managed-high-availability: "true"
include.release.openshift.io/single-node-developer: "true"
name: allow-egress-to-api-server
namespace: ${NAMESPACE}
spec:
egress:
- ports:
- port: 6443
protocol: TCP
podSelector:
matchLabels:
openshift.storage.network-policy.api-server: allow
policyTypes:
- Egress
28 changes: 28 additions & 0 deletions ...erlays/openstack-manila/generated/hypershift/network-policy-allow-ingress-to-metrics.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
# Generated file. Do not edit. Update using "make update".
#
# Loaded from overlays/openstack-manila/base/network-policy-allow-ingress-to-metrics.yaml
#
#

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
annotations:
capability.openshift.io/name: Storage
include.release.openshift.io/hypershift: "true"
include.release.openshift.io/ibm-cloud-managed: "true"
include.release.openshift.io/self-managed-high-availability: "true"
include.release.openshift.io/single-node-developer: "true"
name: allow-ingress-to-metrics-range
namespace: ${NAMESPACE}
spec:
ingress:
- ports:
- endPort: 9223
port: 9201
protocol: TCP
podSelector:
matchLabels:
openshift.storage.network-policy.metrics-range: allow
policyTypes:
- Ingress
36 changes: 36 additions & 0 deletions assets/overlays/openstack-manila/generated/hypershift/network-policy-allow-to-dns.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
# Generated file. Do not edit. Update using "make update".
#
# Loaded from overlays/openstack-manila/base/network-policy-allow-to-dns.yaml
#
#

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
annotations:
capability.openshift.io/name: Storage
include.release.openshift.io/hypershift: "true"
include.release.openshift.io/ibm-cloud-managed: "true"
include.release.openshift.io/self-managed-high-availability: "true"
include.release.openshift.io/single-node-developer: "true"
name: allow-to-dns
namespace: ${NAMESPACE}
spec:
egress:
- ports:
- port: dns-tcp
protocol: TCP
- port: dns
protocol: UDP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: openshift-dns
podSelector:
matchLabels:
dns.operator.openshift.io/daemonset-dns: default
podSelector:
matchLabels:
openshift.storage.network-policy.dns: allow
policyTypes:
- Egress
4 changes: 4 additions & 0 deletions assets/overlays/openstack-manila/generated/standalone/manifests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,10 @@ controllerStaticAssetNames:
- controller.yaml
- controller_pdb.yaml
- controller_sa.yaml
- network-policy-allow-all-egress.yaml
- network-policy-allow-egress-to-api-server.yaml
- network-policy-allow-ingress-to-metrics.yaml
- network-policy-allow-to-dns.yaml
- service.yaml
- servicemonitor.yaml
guestStaticAssetNames:
Expand Down
28 changes: 28 additions & 0 deletions assets/overlays/openstack-manila/generated/standalone/network-policy-allow-all-egress.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
# Generated file. Do not edit. Update using "make update".
#
# Loaded from overlays/openstack-manila/base/network-policy-allow-all-egress.yaml
#
#

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
annotations:
capability.openshift.io/name: Storage
include.release.openshift.io/hypershift: "true"
include.release.openshift.io/ibm-cloud-managed: "true"
include.release.openshift.io/self-managed-high-availability: "true"
include.release.openshift.io/single-node-developer: "true"
name: allow-all-egress
namespace: ${NAMESPACE}
spec:
egress:
- ports:
- endPort: 65535
port: 1
protocol: TCP
podSelector:
matchLabels:
openshift.storage.network-policy.all-egress: allow
policyTypes:
- Egress
27 changes: 27 additions & 0 deletions ...lays/openstack-manila/generated/standalone/network-policy-allow-egress-to-api-server.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
# Generated file. Do not edit. Update using "make update".
#
# Loaded from overlays/openstack-manila/base/network-policy-allow-egress-to-api-server.yaml
#
#

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
annotations:
capability.openshift.io/name: Storage
include.release.openshift.io/hypershift: "true"
include.release.openshift.io/ibm-cloud-managed: "true"
include.release.openshift.io/self-managed-high-availability: "true"
include.release.openshift.io/single-node-developer: "true"
name: allow-egress-to-api-server
namespace: ${NAMESPACE}
spec:
egress:
- ports:
- port: 6443
protocol: TCP
podSelector:
matchLabels:
openshift.storage.network-policy.api-server: allow
policyTypes:
- Egress
28 changes: 28 additions & 0 deletions ...erlays/openstack-manila/generated/standalone/network-policy-allow-ingress-to-metrics.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
# Generated file. Do not edit. Update using "make update".
#
# Loaded from overlays/openstack-manila/base/network-policy-allow-ingress-to-metrics.yaml
#
#

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
annotations:
capability.openshift.io/name: Storage
include.release.openshift.io/hypershift: "true"
include.release.openshift.io/ibm-cloud-managed: "true"
include.release.openshift.io/self-managed-high-availability: "true"
include.release.openshift.io/single-node-developer: "true"
name: allow-ingress-to-metrics-range
namespace: ${NAMESPACE}
spec:
ingress:
- ports:
- endPort: 9223
port: 9201
protocol: TCP
podSelector:
matchLabels:
openshift.storage.network-policy.metrics-range: allow
policyTypes:
- Ingress
36 changes: 36 additions & 0 deletions assets/overlays/openstack-manila/generated/standalone/network-policy-allow-to-dns.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
# Generated file. Do not edit. Update using "make update".
#
# Loaded from overlays/openstack-manila/base/network-policy-allow-to-dns.yaml
#
#

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
annotations:
capability.openshift.io/name: Storage
include.release.openshift.io/hypershift: "true"
include.release.openshift.io/ibm-cloud-managed: "true"
include.release.openshift.io/self-managed-high-availability: "true"
include.release.openshift.io/single-node-developer: "true"
name: allow-to-dns
namespace: ${NAMESPACE}
spec:
egress:
- ports:
- port: dns-tcp
protocol: TCP
- port: dns
protocol: UDP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: openshift-dns
podSelector:
matchLabels:
dns.operator.openshift.io/daemonset-dns: default
podSelector:
matchLabels:
openshift.storage.network-policy.dns: allow
policyTypes:
- Egress
8 changes: 7 additions & 1 deletion pkg/driver/openstack-manila/openstack_manila.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,13 @@ func GetOpenStackManilaGeneratorConfig() *generator.CSIDriverGeneratorConfig {
"--probe-timeout=10s",
),
},
Assets: commongenerator.DefaultControllerAssets,
Assets: commongenerator.DefaultControllerAssets.WithAssets(generator.AllFlavours,
"overlays/openstack-manila/base/network-policy-allow-all-egress.yaml",
"overlays/openstack-manila/base/network-policy-allow-egress-to-api-server.yaml",
"overlays/openstack-manila/base/network-policy-allow-to-dns.yaml",
"overlays/openstack-manila/base/network-policy-allow-ingress-to-metrics.yaml",
),

AssetPatches: commongenerator.DefaultAssetPatches.WithPatches(generator.HyperShiftOnly,
"controller.yaml", "overlays/openstack-manila/patches/controller_add_hypershift_volumes.yaml",
"controller.yaml", "overlays/openstack-manila/patches/controller_rename_config_map.yaml",
Expand Down