Skip to content

refactor(modelsasservice): [3.5-ea.2] move NetworkPolicy to upstream manifests #34511

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ugiordan wants to merge 1 commit into
base: rhoai-3.5-ea.2
Choose a base branch
from
Open

refactor(modelsasservice): [3.5-ea.2] move NetworkPolicy to upstream manifests #34511

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
88 changes: 0 additions & 88 deletions internal/controller/components/modelsasservice/modelsasservice_support.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,8 +179,6 @@ func buildMaasOperatorInstallManifests(ctx context.Context, rr *odhtypes.Reconci
}
extra = append(extra, *paramsCM)

extra = append(extra, payloadProcessingNetworkPolicy(componentLabels))

out := make([]client.Object, len(extra))
for i := range extra {
out[i] = &extra[i]
Expand Down Expand Up @@ -226,92 +224,6 @@ func maasParametersConfigMapFromParamsEnv(manifestsBasePath string, appNs string
return cm, nil
}

// payloadProcessingNetworkPolicy returns a NetworkPolicy for the
// payload-processing pod in the gateway namespace. OCP 4.22 introduced a
// deny-all NetworkPolicy in openshift-ingress; without explicit rules the pod
// cannot reach the Kubernetes API server (egress) or receive ext_proc calls
// from the gateway (ingress).
func payloadProcessingNetworkPolicy(componentLabels map[string]string) unstructured.Unstructured {
npLabels := make(map[string]any, len(componentLabels)+1)
for k, v := range componentLabels {
npLabels[k] = v
}
npLabels["app"] = "payload-processing"

return unstructured.Unstructured{
Object: map[string]any{
"apiVersion": "networking.k8s.io/v1",
"kind": "NetworkPolicy",
"metadata": map[string]any{
"name": "payload-processing",
"namespace": DefaultGatewayNamespace,
"labels": npLabels,
},
"spec": map[string]any{
"podSelector": map[string]any{
"matchLabels": map[string]any{
"app": "payload-processing",
},
},
"policyTypes": []any{"Ingress", "Egress"},
"ingress": []any{
map[string]any{
"from": []any{
map[string]any{
"podSelector": map[string]any{
"matchLabels": map[string]any{
"gateway.networking.k8s.io/gateway-name": "data-science-gateway",
},
},
"namespaceSelector": map[string]any{
"matchLabels": map[string]any{
"kubernetes.io/metadata.name": DefaultGatewayNamespace,
},
},
},
},
"ports": []any{
map[string]any{
"protocol": "TCP",
"port": int64(9004),
},
},
},
map[string]any{
"from": []any{
map[string]any{
"namespaceSelector": map[string]any{
"matchLabels": map[string]any{
"kubernetes.io/metadata.name": "openshift-monitoring",
},
},
},
map[string]any{
"namespaceSelector": map[string]any{
"matchLabels": map[string]any{
"kubernetes.io/metadata.name": "openshift-user-workload-monitoring",
},
},
},
},
"ports": []any{
map[string]any{
"protocol": "TCP",
"port": int64(9005),
},
map[string]any{
"protocol": "TCP",
"port": int64(9090),
},
},
},
},
"egress": []any{map[string]any{}},
},
},
}
}

// parseParamsEnv reads a key=value env file, skipping comments and blank lines.
func parseParamsEnv(filename string) (map[string]string, error) {
f, err := os.Open(filename)
Expand Down
59 changes: 8 additions & 51 deletions internal/controller/components/modelsasservice/modelsasservice_support_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,13 +55,6 @@ kind: ConfigMap
metadata:
name: payload-processing-plugins
namespace: redhat-ods-applications
`,
`
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: payload-processing
namespace: redhat-ods-applications
`,
// Unrelated resource that should NOT be moved
`
Expand Down Expand Up @@ -187,50 +180,6 @@ roleRef:
}
}

func TestPayloadProcessingNetworkPolicy(t *testing.T) {
g := NewWithT(t)

labels := map[string]string{
"opendatahub.io/component": "true",
"app.kubernetes.io/part-of": "modelsasservice",
}

np := payloadProcessingNetworkPolicy(labels)

g.Expect(np.GetKind()).To(Equal("NetworkPolicy"))
g.Expect(np.GetName()).To(Equal("payload-processing"))
g.Expect(np.GetNamespace()).To(Equal(DefaultGatewayNamespace))

npLabels := np.GetLabels()
g.Expect(npLabels).To(HaveKeyWithValue("app", "payload-processing"))
g.Expect(npLabels).To(HaveKeyWithValue("opendatahub.io/component", "true"))
g.Expect(npLabels).To(HaveKeyWithValue("app.kubernetes.io/part-of", "modelsasservice"))

spec, ok := np.Object["spec"].(map[string]any)
g.Expect(ok).To(BeTrue(), "spec should be a map")

podSelector, ok := spec["podSelector"].(map[string]any)
g.Expect(ok).To(BeTrue(), "podSelector should be a map")
matchLabels, ok := podSelector["matchLabels"].(map[string]any)
g.Expect(ok).To(BeTrue(), "matchLabels should be a map")
g.Expect(matchLabels).To(HaveKeyWithValue("app", "payload-processing"))

policyTypes, ok := spec["policyTypes"].([]any)
g.Expect(ok).To(BeTrue(), "policyTypes should be an array")
g.Expect(policyTypes).To(ConsistOf("Ingress", "Egress"))

// Verify egress allows all outbound traffic
egress, ok := spec["egress"].([]any)
g.Expect(ok).To(BeTrue(), "egress should be an array")
g.Expect(egress).To(HaveLen(1))
g.Expect(egress[0]).To(Equal(map[string]any{}))

// Verify ingress rules: gateway on 9004, monitoring on 9090
ingress, ok := spec["ingress"].([]any)
g.Expect(ok).To(BeTrue(), "ingress should be an array")
g.Expect(ingress).To(HaveLen(2))
}

func TestRestoreCRBSubjectsNamespace_NoSubjects(t *testing.T) {
g := NewWithT(t)

Expand All @@ -249,3 +198,11 @@ roleRef:
err = restoreCRBSubjectsNamespace(res, "openshift-ingress")
g.Expect(err).ShouldNot(HaveOccurred())
}

func TestGatewayNamespaceResources_IncludesNetworkPolicy(t *testing.T) {
g := NewWithT(t)

g.Expect(gatewayNamespaceResources).To(HaveKey(
resourceKey{kind: "NetworkPolicy", name: "payload-processing"}),
"NetworkPolicy must be registered for namespace restoration")
}
8 changes: 5 additions & 3 deletions tests/e2e/modelsasservice_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -329,12 +329,14 @@ func (tc *ModelsAsServiceTestCtx) ValidatePayloadProcessingNetworkPolicy(t *test
Namespace: maasGatewayNamespace,
}),
WithCondition(And(
jq.Match(`.spec.podSelector.matchLabels.app == "payload-processing"`),
jq.Match(`.spec.podSelector.matchExpressions[]
| select(.key == "app") | .operator == "In" and (.values | sort == ["payload-pre-processing","payload-processing"])`),
jq.Match(`.spec.policyTypes | any(. == "Ingress")`),
jq.Match(`.spec.policyTypes | any(. == "Egress")`),
jq.Match(`.spec.ingress | length == 2`),
jq.Match(`.spec.egress | length == 1`),
jq.Match(`.spec.egress[0] == {}`),
jq.Match(`.spec.egress | length == 2`),
jq.Match(`.spec.egress[] | select(.ports[] | .port == 53) | .ports | length == 4`),
jq.Match(`.spec.egress[] | select(.ports[] | .port == 443) | .ports | length == 2`),
)),
WithCustomErrorMsg("NetworkPolicy should exist with correct ingress and egress rules for payload-processing in %s", maasGatewayNamespace),
)
Expand Down
Loading