Skip to content

CORENET-6714: Enable Network Observability on Day 0 #3087

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
OlivierCazade wants to merge 1 commit into
base: master
Choose a base branch
from
Open

CORENET-6714: Enable Network Observability on Day 0 #3087

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
252 changes: 252 additions & 0 deletions bindata/observability/07-observability-operator.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,252 @@
apiVersion: v1
kind: Namespace
metadata:
name: netobserv-operator
Comment on lines +1 to +4

@coderabbitai coderabbitai Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Add NetworkPolicy resources to isolate the netobserv-operator namespace.

This new operator namespace is introduced without any NetworkPolicy to explicitly isolate ingress and egress, unlike the established operator-namespace pattern in this repo. NetObserv runs highly privileged workloads, so locking down the namespace is important.

Add default-deny + scoped-allow ingress/egress NetworkPolicy objects for netobserv-operator following the existing operator-namespace pattern.

Based on learnings: whenever introducing an operator namespace in bindata/, ensure the namespace includes NetworkPolicy resources that explicitly isolate both ingress and egress traffic, following the existing operator-namespace NetworkPolicy pattern.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@bindata/observability/07-observability-operator.yaml` around lines 1 - 4, Add
NetworkPolicy resources alongside the netobserv-operator Namespace to explicitly
isolate both ingress and egress. Follow the repository’s established
operator-namespace pattern: include default-deny policies and narrowly scoped
allow policies required by the operator, its workloads, and necessary cluster
communication.

Source: Learnings

---
apiVersion: v1
kind: ServiceAccount
metadata:
name: netobserv-operator-installer
namespace: netobserv-operator
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: netobserv-operator-installer
rules:
# Permissions needed by OLM v1 to install the Network Observability operator
# Based on OLM v1 pre-authorization requirements from the operator bundle

# Core resources
- apiGroups: [""]
resources: ["endpoints", "nodes", "pods"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["events"]
verbs: ["create", "patch"]
- apiGroups: [""]
resources: ["namespaces"]
verbs: ["create", "get", "list", "watch", "update", "patch", "delete"]
- apiGroups: [""]
resources: ["serviceaccounts", "services", "configmaps"]
verbs: ["create", "get", "list", "watch", "update", "patch", "delete"]
- apiGroups: [""]
resources: ["secrets", "persistentvolumeclaims"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]

# Webhooks - validating webhook configurations
- apiGroups: ["admissionregistration.k8s.io"]
resources: ["validatingwebhookconfigurations"]
verbs: ["create", "list", "watch"]
- apiGroups: ["admissionregistration.k8s.io"]
resources: ["validatingwebhookconfigurations"]
resourceNames: ["flowcollectorconversionwebhook.netobserv.io", "flowmetricvalidationwebhook.netobserv.io"]
verbs: ["delete", "get", "patch", "update"]

# CRDs and API services
- apiGroups: ["apiextensions.k8s.io"]
resources: ["customresourcedefinitions"]
verbs: ["create", "get", "list", "watch", "update", "patch"]
- apiGroups: ["apiextensions.k8s.io"]
resources: ["customresourcedefinitions/status"]
verbs: ["patch", "update"]
- apiGroups: ["apiextensions.k8s.io"]
resources: ["customresourcedefinitions"]
resourceNames: ["flowcollectors.flows.netobserv.io", "flowcollectorslices.flows.netobserv.io", "flowmetrics.flows.netobserv.io"]
verbs: ["delete"]
- apiGroups: ["apiregistration.k8s.io"]
resources: ["apiservices"]
verbs: ["get", "list", "watch"]

# Workloads
- apiGroups: ["apps"]
resources: ["deployments", "daemonsets"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- apiGroups: ["apps"]
resources: ["replicasets"]
verbs: ["get", "list", "watch"]

# Authentication and authorization
- apiGroups: ["authentication.k8s.io"]
resources: ["tokenreviews"]
verbs: ["create"]
- apiGroups: ["authorization.k8s.io"]
resources: ["subjectaccessreviews"]
verbs: ["create"]

# Autoscaling
- apiGroups: ["autoscaling"]
resources: ["horizontalpodautoscalers"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]

# eBPF (bpfman.io)
- apiGroups: ["bpfman.io"]
resources: ["clusterbpfapplications"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- apiGroups: ["bpfman.io"]
resources: ["clusterbpfapplications/status"]
verbs: ["get", "patch", "update"]

# OpenShift config
- apiGroups: ["config.openshift.io"]
resources: ["clusterversions", "networks"]
verbs: ["get", "list", "watch"]

# Console plugin
- apiGroups: ["console.openshift.io"]
resources: ["consoleplugins"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]

# Coordination (leader election)
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]

# Discovery
- apiGroups: ["discovery.k8s.io"]
resources: ["endpointslices"]
verbs: ["get", "list", "watch"]

# FlowCollector CRs
- apiGroups: ["flows.netobserv.io"]
resources: ["flowcollectors", "flowcollectorslices", "flowmetrics"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- apiGroups: ["flows.netobserv.io"]
resources: ["flowcollectors/finalizers"]
verbs: ["update"]
- apiGroups: ["flows.netobserv.io"]
resources: ["flowcollectors/status", "flowcollectorslices/status", "flowmetrics/status"]
verbs: ["get", "patch", "update"]

# OVN-Kubernetes
- apiGroups: ["k8s.ovn.org"]
resources: ["clusteruserdefinednetworks", "userdefinednetworks"]
verbs: ["get", "list", "watch"]

# Loki integration
- apiGroups: ["loki.grafana.com"]
resources: ["lokistacks"]
verbs: ["get", "list", "watch"]
- apiGroups: ["loki.grafana.com"]
resources: ["network"]
resourceNames: ["logs"]
verbs: ["create", "get"]

# Metrics
- apiGroups: ["metrics.k8s.io"]
resources: ["pods"]
verbs: ["create"]

# Monitoring
- apiGroups: ["monitoring.coreos.com"]
resources: ["prometheusrules", "servicemonitors"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]

# Network policies
- apiGroups: ["networking.k8s.io"]
resources: ["networkpolicies"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]

# OLM ClusterExtension finalizers
- apiGroups: ["olm.operatorframework.io"]
resources: ["clusterextensions/finalizers"]
resourceNames: ["netobserv-operator"]
verbs: ["update"]

# OLM ClusterObjectSet finalizers
- apiGroups: ["olm.operatorframework.io"]
resources: ["clusterobjectsets/finalizers"]
resourceNames: ["netobserv-operator-1"]
verbs: ["update"]

# OpenShift console and network config
- apiGroups: ["operator.openshift.io"]
resources: ["consoles"]
verbs: ["get", "list", "update", "watch"]
- apiGroups: ["operator.openshift.io"]
resources: ["networks"]
verbs: ["get", "list", "watch"]

# RBAC
- apiGroups: ["rbac.authorization.k8s.io"]
resources: ["clusterroles", "clusterrolebindings"]
verbs: ["create", "delete", "get", "list", "update", "watch", "patch"]
- apiGroups: ["rbac.authorization.k8s.io"]
resources: ["roles"]
verbs: ["list", "watch"]
- apiGroups: ["rbac.authorization.k8s.io"]
resources: ["rolebindings"]
verbs: ["create", "delete", "get", "list", "update", "watch"]

# Security context constraints
- apiGroups: ["security.openshift.io"]
resources: ["securitycontextconstraints"]
verbs: ["create", "list", "update", "watch"]
- apiGroups: ["security.openshift.io"]
resources: ["securitycontextconstraints"]
resourceNames: ["hostnetwork"]
verbs: ["use"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: netobserv-operator-installer
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: netobserv-operator-installer
subjects:
- kind: ServiceAccount
name: netobserv-operator-installer
namespace: netobserv-operator
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: netobserv-operator-installer
namespace: netobserv-operator
rules:
# Namespace-scoped permissions needed for operator installation
# The operator needs to manage Roles and RoleBindings in its own namespace
- apiGroups: ["rbac.authorization.k8s.io"]
resources: ["roles"]
verbs: ["create"]
- apiGroups: ["rbac.authorization.k8s.io"]
resources: ["roles"]
resourceNames: ["netobserv-openshift-netobserv-operator-prometheus"]
verbs: ["delete", "get", "patch", "update"]
- apiGroups: ["rbac.authorization.k8s.io"]
resources: ["rolebindings"]
resourceNames: ["netobserv-openshift-netobserv-operator-prometheus"]
verbs: ["delete", "get", "patch", "update"]
- apiGroups: ["rbac.authorization.k8s.io"]
resources: ["rolebindings"]
verbs: ["create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: netobserv-operator-installer
namespace: netobserv-operator
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: netobserv-operator-installer
subjects:
- kind: ServiceAccount
name: netobserv-operator-installer
namespace: netobserv-operator
---
apiVersion: olm.operatorframework.io/v1
kind: ClusterExtension
metadata:
name: netobserv-operator
spec:
namespace: netobserv-operator
serviceAccount:
name: netobserv-operator-installer
source:
sourceType: Catalog
catalog:
packageName: netobserv-operator
channels: [stable]
25 changes: 25 additions & 0 deletions bindata/observability/08-flowcollector.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
apiVersion: flows.netobserv.io/v1beta2
kind: FlowCollector
metadata:
name: cluster
spec:
agent:
ebpf:
features:
- DNSTracking
sampling: 400
metrics:
server:
tls:
type: Auto
type: eBPF
processor:
metrics:
server:
tls:
type: Auto

deploymentModel: Service
loki:
enable: false
namespace: netobserv
2 changes: 2 additions & 0 deletions pkg/controller/add_networkconfig.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ import (
"github.com/openshift/cluster-network-operator/pkg/controller/egress_router"
"github.com/openshift/cluster-network-operator/pkg/controller/infrastructureconfig"
"github.com/openshift/cluster-network-operator/pkg/controller/ingressconfig"
"github.com/openshift/cluster-network-operator/pkg/controller/observability"
"github.com/openshift/cluster-network-operator/pkg/controller/operconfig"
pkictrl "github.com/openshift/cluster-network-operator/pkg/controller/pki"
"github.com/openshift/cluster-network-operator/pkg/controller/proxyconfig"
Expand All @@ -27,5 +28,6 @@ func init() {
allowlist.Add,
dashboards.Add,
pkictrl.Add,
observability.Add,
)
}
Loading