Skip to content

Commit 6c6c818

Browse files
snarayan-redhatsnarayan-redhat
authored
Merge pull request #102337 from openshift-cherrypick-robot/cherry-pick-101502-to-enterprise-4.18
[enterprise-4.18] OSDOCS#17055: Enabling and configuring network policy in cert-manager operator
2 parents 845705d + 72a8b3e commit 6c6c818

File tree

6 files changed

+222
-0
lines changed

6 files changed

+222
-0
lines changed

‎_topic_maps/_topic_map.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1221,6 +1221,8 @@ Topics:
12211221
File: cert-manager-securing-routes
12221222
- Name: Integrating the cert-manager Operator with Istio-CSR
12231223
File: cert-manager-operator-integrating-istio
1224+
- Name: Network policy configuration for cert-manager Operator
1225+
File: cert-manager-nw-policy
12241226
- Name: Monitoring the cert-manager Operator for Red Hat OpenShift
12251227
File: cert-manager-monitoring
12261228
- Name: Configuring log levels for cert-manager and the cert-manager Operator for Red Hat OpenShift

‎modules/cert-manager-nw-policy-examples.adoc‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/cert_manager_operator/cert-manager-nw-policy.adoc
4+
:_mod-docs-content-type: REFERENCE
5+
[id="cert-manager-nw-policy-examples_{context}"]
6+
= Network policy configuration examples
7+
8+
The following examples cover various scenarios related to enabling network policy and custom rules:
9+
10+
.Example for enabling the network policy management
11+
12+
[source, yaml]
13+
----
14+
apiVersion: operator.openshift.io/v1alpha1
15+
kind: CertManager
16+
metadata:
17+
name: cluster
18+
spec:
19+
defaultNetworkPolicy: "true"
20+
----
21+
22+
.Example for allowing egress to all external issuer providers
23+
24+
[source, yaml]
25+
----
26+
apiVersion: operator.openshift.io/v1alpha1
27+
kind: CertManager
28+
metadata:
29+
name: cluster
30+
spec:
31+
defaultNetworkPolicy: "true"
32+
networkPolicies:
33+
- name: allow-egress-to-all
34+
componentName: CoreController
35+
egress:
36+
- {}
37+
----
38+
39+
.Example for allowing egress to the specific issuer provider
40+
41+
The following configuration allows the cert-manager Operator controller to perform the ACME challenge self-check. This process requires connections to the ACME provider, DNS API endpoints, and recursive DNS servers.
42+
43+
[source, yaml]
44+
----
45+
apiVersion: operator.openshift.io/v1alpha1
46+
kind: CertManager
47+
metadata:
48+
name: cluster
49+
spec:
50+
defaultNetworkPolicy: "true"
51+
networkPolicies:
52+
- name: allow-egress-to-acme-server
53+
componentName: CoreController
54+
egress:
55+
- ports:
56+
- port: 80
57+
protocol: TCP
58+
- port: 443
59+
protocol: TCP
60+
- name: allow-egress-to-dns-service
61+
componentName: CoreController
62+
egress:
63+
- ports:
64+
- port: 53
65+
protocol: UDP
66+
- port: 53
67+
protocol: TCP
68+
----

‎modules/cert-manager-nw-policy-params.adoc‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/cert_manager_operator/cert-manager-nw-policy.adoc
4+
:_mod-docs-content-type: REFERENCE
5+
[id="cert-manager-nw-policy-params_{context}"]
6+
= Network policy configuration parameters
7+
8+
You can enable and configure network policies for the cert-manager Operator components by updating the `CertManager` custom resource (CR). The CR includes the following parameters for enabling default network policies and defining custom egress rules.
9+
10+
[cols="1,1,3", options="header"]
11+
|===
12+
| Field
13+
| Type
14+
| Description
15+
16+
|`spec.defaultNetworkPolicy`
17+
|`boolean`
18+
a|Specifies whether to enable the default network policy for the cert-manager Operator components.
19+
[IMPORTANT]
20+
====
21+
Once you enable default network policies, you cannot disable them. This restriction prevents accidental security degradation. Before enabling this setting, ensure that you plan the network policy requirements.
22+
====
23+
24+
|`spec.networkPolicies`
25+
|`object`
26+
|Defines a list of custom network policy configuration. To apply the configuration, you must set `spec.defaultNetworkPolicy` to `true`.
27+
28+
|`spec.networkPolicies.componentName`
29+
|`string`
30+
|Specifies the component that this network policy targets. The only valid value is `CoreController`.
31+
32+
|`spec.networkPolicies.egress`
33+
|`object`
34+
|Defines the egress rules for the specified component. Set to `{}` to allow connections to all external providers.
35+
36+
|`spec.networkPolicies.egress.ports`
37+
|`object`
38+
|Defines a list of network ports and protocols for the specified providers.
39+
40+
|`spec.networkPolicies.name`
41+
|`string`
42+
|Specifies a unique name for the custom network policy, which is used to generate the `NetworkPolicy` resource name.
43+
|===

‎modules/cert-manager-nw-policy-rules.adoc‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/cert_manager_operator/cert-manager-nw-policy.adoc
4+
:_mod-docs-content-type: REFERENCE
5+
[id="cert-manager-nw-policy-rules_{context}"]
6+
= Default ingress and egress rules
7+
8+
The default network policy applies the following ingress and egress rules to each component.
9+
10+
[cols="1,1,1,1",options="header"]
11+
|===
12+
| Component
13+
| Ingress ports
14+
| Egress ports
15+
| Description
16+
17+
| `cert-manager`
18+
| 9402
19+
| 6443, 5353
20+
| Allows ingress traffic to metrics server and egress traffic to OpenShift API server.
21+
22+
| `cert-manager-webhook`
23+
| 9402, 10250
24+
| 6443
25+
| Allows ingress traffic to metrics and webhook servers, and egress traffic to OpenShift API server and internal DNS server.
26+
27+
| `cert-manager-cainjector`
28+
| 9402
29+
| 6443
30+
| Allows ingress traffic to metrics server and egress traffic to OpenShift API server.
31+
32+
| `istio-csr`
33+
| 6443, 9402
34+
| 6443
35+
| Allows ingress traffic to the gRPC Istio certificate request API, metrics servers and egress traffic to OpenShift API server.
36+
|===

‎modules/cert-manager-nw-policy-verify.adoc‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/cert_manager_operator/cert-manager-nw-policy.adoc
4+
:_mod-docs-content-type: PROCEDURE
5+
[id="verifying-network-policy-creation_{context}"]
6+
= Verifying the network policy creation
7+
8+
You can verify that the default and custom `NetworkPolicy` resources are created.
9+
10+
.Prerequisites
11+
12+
* You have enabled network policy for {cert-manager-operator} in the `CertManager` custom resource.
13+
14+
.Procedure
15+
16+
* Verify the list of `NetworkPolicy` resources in the `cert-manager` namespace by running the following command:
17+
+
18+
[source, terminal]
19+
----
20+
$ oc get networkpolicy -n cert-manager
21+
----
22+
+
23+
.Example output
24+
+
25+
[source, terminal]
26+
----
27+
NAME POD-SELECTOR AGE
28+
cert-manager-allow-egress-to-api-server app.kubernetes.io/instance=cert-manager 7s
29+
cert-manager-allow-egress-to-dns app=cert-manager 6s
30+
cert-manager-allow-ingress-to-metrics app.kubernetes.io/instance=cert-manager 7s
31+
cert-manager-allow-ingress-to-webhook app=webhook 6s
32+
cert-manager-deny-all app.kubernetes.io/instance=cert-manager 8s
33+
cert-manager-user-allow-egress-to-acme-server app=cert-manager 8s
34+
cert-manager-user-allow-egress-to-dns-service app=cert-manager 7s
35+
----
36+
+
37+
The output lists the default policies and any custom policies that you created.

‎security/cert_manager_operator/cert-manager-nw-policy.adoc‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="cert-manager-nw-policy"]
3+
= Network policy configuration for cert-manager Operator
4+
include::_attributes/common-attributes.adoc[]
5+
:context: cert-manager-nw-policy
6+
7+
toc::[]
8+
9+
The {cert-manager-operator} provides predefined `NetworkPolicy` resources to enhance security by controlling the ingress and egress traffic for its components. By default, this feature is disabled to prevent connectivity issues or breaking changes during an upgrade. To use this feature, you must enable it in the `CertManager` custom resource (CR).
10+
11+
After enabling the default policies, you must manually configure additional egress rules to allow outbound traffic. These rules are required for {cert-manager-operator} to communicate with external services beyond the API server and internal DNS.
12+
13+
The examples of services that require custom egress rules include the following:
14+
15+
* ACME servers, for example, Let's Encrypt
16+
17+
* DNS-01 challenge providers, for example, AWS Route53 or Cloudflare
18+
19+
* External CAs, such as HashiCorp Vault
20+
21+
[NOTE]
22+
====
23+
Network policies are expected to be enabled by default in a future release, which could cause connectivity failures during an upgrade. To prepare for this change, configure the required egress policies.
24+
====
25+
26+
// Egress and ingress rules
27+
include::modules/cert-manager-nw-policy-rules.adoc[leveloffset=+1]
28+
29+
//Network policy parameters
30+
include::modules/cert-manager-nw-policy-params.adoc[leveloffset=+1]
31+
32+
//Network policy examples
33+
include::modules/cert-manager-nw-policy-examples.adoc[leveloffset=+1]
34+
35+
//Verification
36+
include::modules/cert-manager-nw-policy-verify.adoc[leveloffset=+1]

0 commit comments

Comments
 (0)