Skip to content

OCPBUGS-59566: Add openshift-marketplace network policy #6575

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 3 commits into from
Apr 27, 2026
Merged

OCPBUGS-59566: Add openshift-marketplace network policy #6575

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4297f27
OCPBUGS-59566: Add OLM netpol for marketplace namespace
pacevedom Apr 24, 2026
803bc81
OCPBUGS-59566: Add test for OLM netpol in marketplace ns
pacevedom Apr 24, 2026
8889921
OCPBUGS-59566: Adjust new asset policy for rebase
pacevedom Apr 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions assets/optional/operator-lifecycle-manager/0000_50_olm_01-marketplace-networkpolicy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny-all
namespace: openshift-marketplace
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
Comment on lines +1 to +11
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Apr 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check existing OLM network policies for any allow rules targeting openshift-marketplace
fd -t f 'networkpolic' assets/ | xargs -I{} sh -c 'echo "=== {} ==="; cat {}'
echo "---"
# Check the catalog-source test asset to confirm it targets openshift-marketplace
fd -t f 'catalog-source' assets/olm/ | xargs -I{} sh -c 'echo "=== {} ==="; cat {}'

Repository: openshift/microshift

Length of output: 3156

🏁 Script executed:

# Search for all NetworkPolicy resources mentioning openshift-marketplace
rg -t yaml "openshift-marketplace" assets/ --context 5

# Search for CatalogSource definitions to understand where they're deployed
fd -t f "\.yaml$" assets/ | head -50 | xargs rg -l "CatalogSource"

# Search for any test files or references to AmqBroker
rg -r "AmqBroker|catalog.*test" assets/ --context 3

Repository: openshift/microshift

Length of output: 50379

🏁 Script executed:

# Check all YAML files in the OLM assets directory specifically
cd assets/optional/operator-lifecycle-manager
ls -la *.yaml | grep -i network

# Search for any ingress rules in marketplace context
grep -r "ingress:" . --include="*.yaml" -A 3 | grep -i marketplace

# Look for any allow policies or exceptions
grep -r "default-allow" . --include="*.yaml" -B 2

Repository: openshift/microshift

Length of output: 418

Add an allow-rule for CatalogSource connectivity or exclude catalog pods from the default-deny-all.

The default-deny-all policy in openshift-marketplace blocks all ingress and egress traffic. However, catalog-operator in openshift-operator-lifecycle-manager requires egress to port 50051 (gRPC) to reach CatalogSource pods in this namespace. Without a matching allow-rule in marketplace, this policy will break operator catalog functionality.

Either:

  1. Add a NetworkPolicy in openshift-marketplace to permit ingress on port 50051 from catalog-operator pods, or
  2. Modify the podSelector in the default-deny-all to exclude CatalogSource pods (e.g., with a label selector), or
  3. Confirm this is intentional if CatalogSources are no longer meant to be deployed in the marketplace namespace.
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In
`@assets/optional/operator-lifecycle-manager/0000_50_olm_01-marketplace-networkpolicy.yaml`
around lines 1 - 11, The NetworkPolicy named default-deny-all in namespace
openshift-marketplace currently blocks all ingress/egress and prevents
CatalogSource connectivity; fix by either adding a new NetworkPolicy in
openshift-marketplace that allows ingress to pods matching the CatalogSource
selector on TCP port 50051 from catalog-operator pods (e.g., match podSelector
for CatalogSource pods and from: podSelector matching catalog-operator labels /
namespaceSelector for openshift-operator-lifecycle-manager), or modify the
existing default-deny-all podSelector to exclude CatalogSource pods by using a
labelSelector that omits the CatalogSource label; alternatively, document and
confirm if CatalogSources should no longer be deployed in marketplace.

1 change: 1 addition & 0 deletions assets/optional/operator-lifecycle-manager/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ resources:
- 0000_50_olm_00-packageserver.pdb.yaml
- 0000_50_olm_00-subscriptions.crd.yaml
- 0000_50_olm_01-networkpolicies.yaml
- 0000_50_olm_01-marketplace-networkpolicy.yaml
- 0000_50_olm_02-olm-operator.serviceaccount.yaml
- 0000_50_olm_03-olmconfig.yaml
- 0000_50_olm_03-services.yaml
Expand Down
2 changes: 2 additions & 0 deletions scripts/auto-rebase/assets.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -251,6 +251,8 @@ assets:
- file: 0000_50_olm_00-packageserver.pdb.yaml
- file: 0000_50_olm_00-subscriptions.crd.yaml
- file: 0000_50_olm_01-networkpolicies.yaml
- file: 0000_50_olm_01-marketplace-networkpolicy.yaml
git_restore: True
- file: 0000_50_olm_02-olm-operator.serviceaccount.yaml
- file: 0000_50_olm_03-olmconfig.yaml
- file: 0000_50_olm_03-services.yaml
Expand Down
6 changes: 6 additions & 0 deletions test/suites/optional/olm.robot
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,6 +128,12 @@ OLM Network Policies Are Correctly Configured
Verify NetworkPolicy Spec Field olm-operator ${OLM_NAMESPACE} ingress metrics
Verify NetworkPolicy Spec Field olm-operator ${OLM_NAMESPACE} egress 53

# default-deny-all: no ingress/egress rules, applies to all pods in marketplace namespace
Verify NetworkPolicy Has Empty Pod Selector default-deny-all ${MARKETPLACE_NAMESPACE}
Verify NetworkPolicy Policy Types default-deny-all ${MARKETPLACE_NAMESPACE}
Verify NetworkPolicy Spec Field default-deny-all ${MARKETPLACE_NAMESPACE} ingress ${EMPTY}
Verify NetworkPolicy Spec Field default-deny-all ${MARKETPLACE_NAMESPACE} egress ${EMPTY}

# default-allow-all: both Ingress and Egress defined with no port restrictions in openshift-operators
Verify NetworkPolicy Has Empty Pod Selector default-allow-all ${OPERATORS_NAMESPACE}
Verify NetworkPolicy Policy Types default-allow-all ${OPERATORS_NAMESPACE}
Expand Down