Skip to content

Commit 3fec8f4

Browse files
stevsmitstevsmit
authored
Merge pull request #100980 from wgabor0427/OSDOCS-16585
OSDOCS-16585 created doc for config network policy for operand
2 parents b75440e + cd5c7dc commit 3fec8f4

File tree

5 files changed

+153
-0
lines changed

5 files changed

+153
-0
lines changed

‎_topic_maps/_topic_map.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1256,6 +1256,8 @@ Topics:
12561256
File: external-secrets-operator-release-notes
12571257
- Name: Installing the External Secrets Operator
12581258
File: external-secrets-operator-install
1259+
- Name: Configuring Network Policy for the Operand
1260+
File: external-secrets-operator-config-net-policy
12591261
- Name: Uninstalling the External Secrets Operator
12601262
File: external-secrets-operator-uninstall
12611263
- Name: External Secrets Operator APIs

‎modules/external-secrets-operator-egress-allow-all-traffic.adoc‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/external_secrets_operator/external-secrets-operator-install.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="external-secrets-operator-egress-allow-all-traffic_{context}"]
7+
= Adding a custom network policy to allow egress to all external providers
8+
9+
You must configure custom policies through the `ExternalSecretsConfig` custom resource to allow all egress to all external providers.
10+
11+
.Prerequisites
12+
13+
* An `ExternalSecretsConfig` must be predefined.
14+
15+
* You must be able to define specific egress rules, including desitination ports and protocols
16+
17+
.Procedure
18+
19+
. Edit the `ExternalSecretsConfig` CR by running the following command:
20+
+
21+
[source,terminal]
22+
----
23+
$ oc edit externalsecretsconfigs.operator.openshift.io cluster
24+
----
25+
26+
. Set the policy by editing the `networkPolicies` section:
27+
+
28+
[source,yaml]
29+
----
30+
apiVersion: operator.openshift.io/v1alpha1
31+
kind: ExternalSecretsConfig
32+
metadata:
33+
name: cluster
34+
spec:
35+
controllerConfig:
36+
networkPolicies:
37+
- name: allow-external-secrets-egress
38+
componentName: CoreController
39+
egress: # Allow all egress traffic
40+
----

‎modules/external-secrets-operator-egress-specific-provider.adoc‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/external_secrets_operator/external-secrets-operator-install.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="external-secrets-operator-egress-specific-provider_{context}"]
7+
= Adding a custom network policy to allow egress to a specific provider
8+
9+
You must configure custom policies through the `ExternalSecretsConfig` custom resource to allow all egress to a specific provider.
10+
11+
.Prerequisites
12+
13+
* An `ExternalSecretsConfig` must be predefined.
14+
15+
* You must be able to define specific egress rules, including desitination ports and protocols
16+
17+
.Procedure
18+
19+
. Edit the `ExternalSecretsConfig` CR by running the following command:
20+
+
21+
[source,terminal]
22+
----
23+
$ oc edit externalsecretsconfigs.operator.openshift.io cluster
24+
----
25+
26+
. Set the policy by editing the `networkPolicies` section. The following example shows how to allow egress to {aws-first} endpoints.
27+
+
28+
[source,yaml]
29+
----
30+
apiVersion: operator.openshift.io/v1alpha1
31+
kind: ExternalSecretsConfig
32+
metadata:
33+
name: cluster
34+
spec:
35+
controllerConfig:
36+
networkPolicies:
37+
- componentName: ExternalSecretsCoreController
38+
egress:
39+
# Allow egress to Kubernetes API server, AWS endpoints, and DNS
40+
- ports:
41+
- port: 443 # HTTPS (AWS Secrets Manager)
42+
protocol: TCP
43+
- name: allow-external-secrets-egress
44+
----
45+
46+
componentName:: name for the core controller specified as `ExternalSecretsCoreController`.
47+
48+
Egress rules must include the necessary ports, such as Transmission Control Protocol (TCP) port 443 for services like the {aws-short} Secrets Manager.
49+

‎modules/external-secrets-operator-ingress-egress-rules.adoc‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/external_secrets_operator/external-secrets-operator-install.adoc
4+
5+
:_mod-docs-content-type: REFERENCE
6+
[id="external-secrets-operator-ingress-egress-rules_{context}"]
7+
= Default ingress and egress rules
8+
9+
The following table summarizes the default ingress and egress rules.
10+
11+
[cols="1,1,1,1",options="header"]
12+
|===
13+
| Component
14+
| Ingress ports
15+
| Egress ports
16+
| Description
17+
18+
| `external-secrets`
19+
| 8080
20+
| 6443
21+
| Allows retrieving metrics and interacting with the API server
22+
23+
| `external-secrets-webhook`
24+
| 8080/10250
25+
| 6443
26+
| Allows retrieving metrics, handling webhook requests, and interacting with the API server
27+
28+
| `external-secrets-cert-controller`
29+
| 8080
30+
| 6443
31+
| Allows retrieving metrics and interacting with the API server
32+
33+
| `external-secrets-bitwarden-server`
34+
| 9998
35+
| 6443
36+
| Handles Bitwarden server connections and interacts with the API server
37+
38+
| `external-secrets-allow-dns`
39+
|
40+
| 5353
41+
| Enables DNS lookups to find external secret providers.
42+
|===

‎security/external_secrets_operator/external-secrets-operator-config-net-policy.adoc‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="external-secrets-operator-config-net-policy"]
3+
= Configuring network policy for the operand
4+
include::_attributes/common-attributes.adoc[]
5+
:context: external-secrets-operator-uninstall
6+
7+
toc::[]
8+
9+
The {external-secrets-operator} includes pre-defined `NetworkPolicies` for security, but you must configure additonal, custom policies through the `ExternalSecretsConfig` custom resource to set the external-secrets controller egress allow policies to communicate with external providers. These configurable policies are set via the `ExternalSecretsConfig` custom resource to establish the egress allow policy.
10+
11+
// Adding network policy to connect to permit all egress traffic
12+
include::modules/external-secrets-operator-egress-allow-all-traffic.adoc[leveloffset=+1]
13+
14+
// Adding network policy to connect to a specific provider
15+
include::modules/external-secrets-operator-egress-specific-provider.adoc[leveloffset=+1]
16+
17+
// Default ingress and egress rules
18+
include::modules/external-secrets-operator-ingress-egress-rules.adoc[leveloffset=+1]
19+
20+

0 commit comments

Comments
 (0)