OCPBUGS-99489: Add NetworkPolicy manifests to openshift-cluster-machine-approver namespace

[nader-ziada]

The namespace was missing network policies. Adds default-deny, allow-all-egress, and allow-ingress for metrics scraping on ports 9192 and 9194.

Summary by CodeRabbit

• New Features
  • Added network security policies for the machine approver service.
  • Restricted inbound metrics traffic to designated monitoring ports.
  • Added default-deny rules for inbound and outbound traffic, with approved outbound access enabled.

[openshift-ci-robot]

@nader-ziada: This pull request references Jira Issue OCPBUGS-99489, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

The namespace was missing network policies. Adds default-deny, allow-all-egress, and allow-ingress for metrics scraping on ports 9192 and 9194.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 43810ba7-4916-464b-a902-2541a193cd37

📥 Commits

Reviewing files that changed from the base of the PR and between 1ae3f15 and 4fa9565.

📒 Files selected for processing (3)

• manifests/06-networkpolicy-allow-all-egress.yaml
• manifests/06-networkpolicy-allow-ingress-metrics.yaml
• manifests/06-networkpolicy-default-deny.yaml

---

Walkthrough

Three Kubernetes NetworkPolicy resources add default ingress and egress denial in the machine approver namespace, then permit unrestricted egress and targeted metrics ingress on TCP ports 9192 and 9194.

Changes

Network policy enforcement

Layer / File(s)	Summary
Default traffic restrictions manifests/06-networkpolicy-default-deny.yaml	Adds a namespace-wide default-deny policy covering ingress and egress without allow rules.
Allowed metrics and egress traffic manifests/06-networkpolicy-allow-all-egress.yaml, manifests/06-networkpolicy-allow-ingress-metrics.yaml	Allows unrestricted egress for all pods and TCP ingress on ports 9192 and 9194 for machine approver pods.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding NetworkPolicy manifests to the openshift-cluster-machine-approver namespace.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Only three NetworkPolicy manifests changed; no test files or Ginkgo titles were added or edited, so the check is not applicable.
Test Structure And Quality	✅ Passed	PR only adds Kubernetes manifests; no Ginkgo test code changed, so the test-quality checklist is not applicable.
Microshift Test Compatibility	✅ Passed	Only three NetworkPolicy manifests were added; no Ginkgo e2e tests or MicroShift-unsupported APIs/features were introduced.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR only adds three NetworkPolicy YAMLs; no new Ginkgo e2e tests or SNO-sensitive test logic were introduced.
Topology-Aware Scheduling Compatibility	✅ Passed	Only NetworkPolicy manifests were added; no node selectors, affinities, replica logic, topology spreads, or PDBs were introduced.
Ote Binary Stdout Contract	✅ Passed	PR changes only NetworkPolicy manifests; no process-level Go code or stdout writes were added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR only adds three NetworkPolicy YAML manifests; no Ginkgo e2e tests or external-connectivity code was introduced.
No-Weak-Crypto	✅ Passed	PR only adds NetworkPolicy YAML; scans found no weak-crypto, custom crypto, or secret-comparison code.
Container-Privileges	✅ Passed	The new manifests are NetworkPolicies only; no privileged, hostPID/Network/IPC, SYS_ADMIN, root, or allowPrivilegeEscalation fields are present.
No-Sensitive-Data-In-Logs	✅ Passed	The PR only adds NetworkPolicy YAML; no logging code or sensitive-data exposure was introduced.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign radekmanak for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@nader-ziada: This pull request references Jira Issue OCPBUGS-99489, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

The namespace was missing network policies. Adds default-deny, allow-all-egress, and allow-ingress for metrics scraping on ports 9192 and 9194.

Summary by CodeRabbit

• New Features
• Added network security policies for the machine approver service.
• Restricted inbound metrics traffic to designated monitoring ports.
• Added default-deny rules for inbound and outbound traffic, with approved outbound access enabled.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[nader-ziada]

/retest

[openshift-ci]

@nader-ziada: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[nader-ziada]

@racheljpg @theobarberbany can you please take a look