OSDOCS-16585 created doc for config network policy for operand #100980

wgabor0427 · 2025-10-22T20:50:07Z

Version(s):
4.20+

Issue:
https://issues.redhat.com/browse/OSDOCS-16585

Link to docs preview:
https://100980--ocpdocs-pr.netlify.app/openshift-enterprise/latest/security/external_secrets_operator/external-secrets-operator-config-net-policy.html

QE review:

QE has approved this change.

Additional information:

ocpdocs-previewbot · 2025-10-22T21:04:54Z

🤖 Wed Oct 29 14:22:43 - Prow CI generated the docs preview:

https://100980--ocpdocs-pr.netlify.app/openshift-enterprise/latest/security/external_secrets_operator/external-secrets-operator-config-net-policy.html

bharath-b-rh

LGTM, except for couple of nits.

@siddhibhor-56 Could you please validate the suggestions made.

bharath-b-rh · 2025-10-28T04:39:01Z

modules/external-secrets-operator-egress-allow-all-traffic.adoc

+apiVersion: operator.openshift.io/v1alpha1
+kind: ExternalSecretsConfig
+metadata:
+  name: cluster
+spec:
+  networkPolicies:
+    - name: allow-external-secrets-egress
+      componentName: CoreController
+      policyTypes:
+        - Egress
+      egress: # Allow all egress traffic


Suggested change

apiVersion: operator.openshift.io/v1alpha1

kind: ExternalSecretsConfig

metadata:

name: cluster

spec:

networkPolicies:

- name: allow-external-secrets-egress

componentName: CoreController

policyTypes:

- Egress

egress: # Allow all egress traffic

apiVersion: operator.openshift.io/v1alpha1

kind: ExternalSecretsConfig

metadata:

name: cluster

spec:

controllerConfig:

networkPolicies:

- name: allow-external-secrets-egress

componentName: ExternalSecretsCoreController

egress: # Allow all egress traffic

bharath-b-rh · 2025-10-28T04:40:30Z

modules/external-secrets-operator-egress-specific-provider.adoc

+$ oc edit externalsecretsconfigs.operator.openshift.io cluster
+----
+
+. Set the policy by editing the `networkPolicies` section. The following example shows how to allow egress to {aws-first} endpoints, the Kubernetes API server, and the Domain Name Service (DNS).


Suggested change

. Set the policy by editing the `networkPolicies` section. The following example shows how to allow egress to {aws-first} endpoints, the Kubernetes API server, and the Domain Name Service (DNS).

. Set the policy by editing the `networkPolicies` section. The following example shows how to allow egress to {aws-first} endpoints.

bharath-b-rh · 2025-10-28T04:41:50Z

modules/external-secrets-operator-egress-specific-provider.adoc

+apiVersion: operator.openshift.io/v1alpha1
+kind: ExternalSecretsConfig
+metadata:
+  labels:
+    app.kubernetes.io/name: cluster
+    app.kubernetes.io/managed-by: external-secrets-operator-e2e
+  name: cluster
+spec:
+  controllerConfig:
+    networkPolicies:
+      - name: allow-external-secrets-egress
+        componentName: ExternalSecretsCoreController
+        egress:
+          # Allow egress to Kubernetes API server, AWS endpoints, and DNS
+          - to: []
+            ports:
+              - protocol: TCP
+                port: 6443  # Kubernetes API
+              - protocol: TCP
+                port: 443   # HTTPS (AWS Secrets Manager)


Suggested change

apiVersion: operator.openshift.io/v1alpha1

kind: ExternalSecretsConfig

metadata:

labels:

app.kubernetes.io/name: cluster

app.kubernetes.io/managed-by: external-secrets-operator-e2e

name: cluster

spec:

controllerConfig:

networkPolicies:

- name: allow-external-secrets-egress

componentName: ExternalSecretsCoreController

egress:

# Allow egress to Kubernetes API server, AWS endpoints, and DNS

- to: []

ports:

- protocol: TCP

port: 6443 # Kubernetes API

- protocol: TCP

port: 443 # HTTPS (AWS Secrets Manager)

apiVersion: operator.openshift.io/v1alpha1

kind: ExternalSecretsConfig

metadata:

labels:

app.kubernetes.io/name: cluster

app.kubernetes.io/managed-by: external-secrets-operator-e2e

name: cluster

spec:

controllerConfig:

networkPolicies:

- componentName: ExternalSecretsCoreController

egress:

- ports:

- port: 443 # HTTPS (AWS Secrets Manager)

protocol: TCP

name: allow-external-secrets-egress

we need to add DNS port for both TCP and UDP
- protocol: TCP
port: 5353 # DNS
- protocol: UDP
port: 5353 # DNS

It's now added by default correct, why does user need to include it here?

oh yes correct,Added by default no need to include

bharath-b-rh · 2025-10-28T04:42:27Z

modules/external-secrets-operator-egress-specific-provider.adoc

+
+componentName:: name for the core controller specified as `ExternalSecretsCoreController`.
+
+Egress rules must include the necessary ports, such as Transmission Control Protocol (TCP) port 6443 for the Kubernetes API and TCP port 443 (HTTPS) for services like the {aws-short} Secrets Manager.


Suggested change

Egress rules must include the necessary ports, such as Transmission Control Protocol (TCP) port 6443 for the Kubernetes API and TCP port 443 (HTTPS) for services like the {aws-short} Secrets Manager.

Egress rules must include the necessary ports, such as Transmission Control Protocol (TCP) 443 (HTTPS) for services like the {aws-short} Secrets Manager.

bharath-b-rh · 2025-10-28T04:43:24Z

modules/external-secrets-operator-ingress-egress-rules.adoc

+| `external-secrets`
+| 8080
+| 6443
+| Accesses metrics and communicates with the API server


@wgabor0427 Could you please help reword the description column.

Done. @bharath-b-rh Reworded the descriptions. Please review and comment on. Thanks.

bharath-b-rh · 2025-10-29T07:42:15Z

modules/external-secrets-operator-egress-specific-provider.adoc

+  labels:
+    app.kubernetes.io/name: cluster
+    app.kubernetes.io/managed-by: external-secrets-operator-e2e


Sorry missed in the previous review. Please remove the labels field.

Suggested change

labels:

app.kubernetes.io/name: cluster

app.kubernetes.io/managed-by: external-secrets-operator-e2e

bharath-b-rh · 2025-10-29T14:15:18Z

/lgtm

openshift-ci · 2025-10-29T14:23:23Z

@wgabor0427: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

emmajiafan · 2025-10-31T14:21:33Z

/lgtm

wgabor0427 · 2025-11-03T13:23:12Z

/label merge-review-needed

stevsmit · 2025-11-04T14:00:55Z

modules/external-secrets-operator-egress-allow-all-traffic.adoc

+
+* An `ExternalSecretsConfig` must be predefined.
+
+* You must be able to define specific egress rules, including desitination ports and protocols


Suggested change

* You must be able to define specific egress rules, including desitination ports and protocols

* You must be able to define specific egress rules, including destination ports and protocols.

stevsmit · 2025-11-04T14:02:12Z

modules/external-secrets-operator-egress-specific-provider.adoc

+
+* An `ExternalSecretsConfig` must be predefined.
+
+* You must be able to define specific egress rules, including desitination ports and protocols


Suggested change

* You must be able to define specific egress rules, including desitination ports and protocols

* You must be able to define specific egress rules, including destination ports and protocols.

stevsmit · 2025-11-04T14:06:28Z

modules/external-secrets-operator-egress-specific-provider.adoc

+      - name: allow-external-secrets-egress
+----
+
+componentName:: name for the core controller specified as `ExternalSecretsCoreController`.


I think this would technically have "where" about it. See https://redhat-documentation.github.io/supplementary-style-guide/#explain-commands-variables-in-code-blocks. They also usually start with "Specifies. . ."

stevsmit · 2025-11-04T14:09:06Z

security/external_secrets_operator/external-secrets-operator-config-net-policy.adoc

+
+toc::[]
+
+The {external-secrets-operator} includes pre-defined `NetworkPolicies` for security, but you must configure additonal, custom policies through the `ExternalSecretsConfig` custom resource to set the external-secrets controller egress allow policies to communicate with external providers. These configurable policies are set via the `ExternalSecretsConfig` custom resource to establish the egress allow policy.


First sentence is very long and hard to get through/understand, IMO.

stevsmit · 2025-11-04T14:17:29Z

Bill is bricked from fixing these and the PR is urgent. I'm merging under the conditions that we fix these in a future PR.

stevsmit · 2025-11-04T14:24:57Z

/cherry-pick enterprise-4.21

stevsmit · 2025-11-04T14:25:02Z

/cherry-pick enterprise-4.20

openshift-cherrypick-robot · 2025-11-04T14:25:54Z

@stevsmit: new pull request created: #101690

In response to this:

/cherry-pick enterprise-4.21

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-cherrypick-robot · 2025-11-04T14:25:58Z

@stevsmit: new pull request created: #101691

In response to this:

/cherry-pick enterprise-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Oct 22, 2025

wgabor0427 changed the title ~~OSDOCS-16585 created doc for config network policy for oeprand~~ OSDOCS-16585 created doc for config network policy for operand Oct 22, 2025

bharath-b-rh reviewed Oct 28, 2025

View reviewed changes

wgabor0427 force-pushed the OSDOCS-16585 branch from ff281e8 to 50daa60 Compare October 28, 2025 14:26

bharath-b-rh reviewed Oct 29, 2025

View reviewed changes

wgabor0427 force-pushed the OSDOCS-16585 branch 4 times, most recently from ddcbfcc to 7eb54d2 Compare October 29, 2025 14:13

openshift-ci bot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Oct 29, 2025

wgabor0427 force-pushed the OSDOCS-16585 branch from 7eb54d2 to ba4d86a Compare October 29, 2025 14:14

OSDOCS-16585 updated modules

cd5c7dc

wgabor0427 force-pushed the OSDOCS-16585 branch from ba4d86a to cd5c7dc Compare October 29, 2025 14:14

openshift-ci bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Oct 29, 2025

openshift-ci bot assigned bharath-b-rh Oct 29, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 29, 2025

openshift-ci bot assigned emmajiafan Oct 31, 2025

openshift-ci bot added the merge-review-needed Signifies that the merge review team needs to review this PR label Nov 3, 2025

stevsmit added merge-review-in-progress Signifies that the merge review team is reviewing this PR branch/enterprise-4.20 and removed merge-review-needed Signifies that the merge review team needs to review this PR labels Nov 4, 2025

stevsmit added this to the Continuous Release milestone Nov 4, 2025

stevsmit reviewed Nov 4, 2025

View reviewed changes

stevsmit added ok-to-merge and removed merge-review-in-progress Signifies that the merge review team is reviewing this PR labels Nov 4, 2025

stevsmit merged commit 3fec8f4 into openshift:main Nov 4, 2025
2 checks passed

openshift-cherrypick-robot mentioned this pull request Nov 4, 2025

[enterprise-4.21] OSDOCS-16585 created doc for config network policy for operand #101690

Merged

openshift-cherrypick-robot mentioned this pull request Nov 4, 2025

[enterprise-4.20] OSDOCS-16585 created doc for config network policy for operand #101691

Merged

	. Set the policy by editing the `networkPolicies` section. The following example shows how to allow egress to {aws-first} endpoints, the Kubernetes API server, and the Domain Name Service (DNS).
	. Set the policy by editing the `networkPolicies` section. The following example shows how to allow egress to {aws-first} endpoints.


		componentName:: name for the core controller specified as `ExternalSecretsCoreController`.

		Egress rules must include the necessary ports, such as Transmission Control Protocol (TCP) port 6443 for the Kubernetes API and TCP port 443 (HTTPS) for services like the {aws-short} Secrets Manager.

	labels:
	app.kubernetes.io/name: cluster
	app.kubernetes.io/managed-by: external-secrets-operator-e2e


		* An `ExternalSecretsConfig` must be predefined.

		* You must be able to define specific egress rules, including desitination ports and protocols


		toc::[]

		The {external-secrets-operator} includes pre-defined `NetworkPolicies` for security, but you must configure additonal, custom policies through the `ExternalSecretsConfig` custom resource to set the external-secrets controller egress allow policies to communicate with external providers. These configurable policies are set via the `ExternalSecretsConfig` custom resource to establish the egress allow policy.

OSDOCS-16585 created doc for config network policy for operand #100980

OSDOCS-16585 created doc for config network policy for operand #100980

Uh oh!

Conversation

wgabor0427 commented Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ocpdocs-previewbot commented Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bharath-b-rh left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bharath-b-rh commented Oct 29, 2025

Uh oh!

openshift-ci bot commented Oct 29, 2025

Uh oh!

emmajiafan commented Oct 31, 2025

Uh oh!

wgabor0427 commented Nov 3, 2025

Uh oh!

stevsmit Nov 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stevsmit commented Nov 4, 2025

Uh oh!

Uh oh!

stevsmit commented Nov 4, 2025

Uh oh!

stevsmit commented Nov 4, 2025

Uh oh!

openshift-cherrypick-robot commented Nov 4, 2025

Uh oh!

openshift-cherrypick-robot commented Nov 4, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

wgabor0427 commented Oct 22, 2025 •

edited

Loading

ocpdocs-previewbot commented Oct 22, 2025 •

edited

Loading

stevsmit Nov 4, 2025 •

edited

Loading