Address review comments

Author: rfredette

manifests/0000_70_dns-operator_00-cluster-role.yaml

@@ -145,5 +145,9 @@ rules:
   resources:
   - networkpolicies
   verbs:
-  - "*"
-  
+  - get
+  - list
+  - create
+  - update
+  - watch
+  - delete

manifests/0000_70_dns-operator_01-network-policy.yaml

@@ -38,6 +38,13 @@ spec:
       port: 53
     - protocol: UDP
       port: 53
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: openshift-apiserver
+    - podSelector:
+        matchLabels:
+          apiserver: "true"
   ingress:
   - from:
     - namespaceSelector:

manifests/0000_70_dns-operator_01-role.yaml

@@ -33,4 +33,9 @@ rules:
   resources:
   - networkpolicies
   verbs:
-  - "*"
+  - get
+  - list
+  - create
+  - update
+  - watch
+  - delete

pkg/manifests/assets/dns/networkpolicy-allow.yaml

@@ -32,8 +32,8 @@ spec:
     from:
     - namespaceSelector:
         matchLabels:
-          kubernetes.io/metadata.name: openshift-dns-operatorXXX
-          kubernetes.io/metadata.name: openshift-dnsXXX
+          kubernetes.io/metadata.name: openshift-dns-operator
+          kubernetes.io/metadata.name: openshift-dns
   egress:
   - to:
     - ipBlock:

pkg/operator/controller/status/controller.go

@@ -136,11 +136,18 @@ func (r *reconciler) Reconcile(ctx context.Context, request reconcile.Request) (
 			Resource: "dnses",
 			Name:     "default",
 		},
+		{
+			Resource:  "networkpolicies",
+			Namespace: r.Config.OperatorNamespace,
+		},
 	}
 	if state.haveNamespace {
 		related = append(related, configv1.ObjectReference{
 			Resource: "namespaces",
 			Name:     state.namespace.Name,
+		}, configv1.ObjectReference{
+			Resource:  "networkpolicies",
+			Namespace: state.namespace.Name,
 		})
 	}
 	co.Status.RelatedObjects = related

test/e2e/operator_test.go

@@ -533,6 +533,17 @@ func TestDNSForwarding(t *testing.T) {
 		t.Fatalf("version %s not found for clusteroperator %s", statuscontroller.CoreDNSVersionName, opName)
 	}
 
+	// Create the test pod network policy.
+	testPodNetworkPolicy := buildTestPodNetworkPolicy(types.NamespacedName{Name: "test-upstream-allow", Namespace: upstreamPodNs})
+	if err := cl.Create(context.TODO(), testPodNetworkPolicy); err != nil {
+		t.Fatalf("failed to create network policy %s/%s: %v", testPodNetworkPolicy.Namespace, testPodNetworkPolicy.Name, err)
+	}
+	defer func() {
+		if err := cl.Delete(context.TODO(), testPodNetworkPolicy); err != nil {
+			t.Fatalf("failed to delete network policy %s/%s: %v", testPodNetworkPolicy.Namespace, testPodNetworkPolicy.Name, err)
+		}
+	}()
+
 	// Create the upstream resolver Pod.
 	upstreamResolver := upstreamPod(upstreamPodName, upstreamPodNs, coreImage, upstreamPodName)
 	if err := cl.Create(context.TODO(), upstreamResolver); err != nil {
@@ -804,6 +815,17 @@ func TestDNSOverTLSForwarding(t *testing.T) {
 		t.Fatalf("version %s not found for clusteroperator %s", statuscontroller.OpenshiftCLIVersionName, opName)
 	}
 
+	// Create the test pod network policy.
+	testPodNetworkPolicy := buildTestPodNetworkPolicy(types.NamespacedName{Name: "test-upstream-tls-allow", Namespace: upstreamPodNs})
+	if err := cl.Create(context.TODO(), testPodNetworkPolicy); err != nil {
+		t.Fatalf("failed to create network policy %s/%s: %v", testPodNetworkPolicy.Namespace, testPodNetworkPolicy.Name, err)
+	}
+	defer func() {
+		if err := cl.Delete(context.TODO(), testPodNetworkPolicy); err != nil {
+			t.Fatalf("failed to delete network policy %s/%s: %v", testPodNetworkPolicy.Namespace, testPodNetworkPolicy.Name, err)
+		}
+	}()
+
 	// Create the upstream resolver Pods and the client pod
 	upstreamResolver := upstreamTLSPod(tlsUpstreamName, tlsUpstreamNamespace.Name, coreImage, upstreamTLSConfigMap)
 	if err := cl.Create(context.TODO(), upstreamResolver); err != nil {

test/e2e/utils.go

@@ -28,6 +28,7 @@ import (
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
+	networkingv1 "k8s.io/api/networking/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
@@ -236,7 +237,10 @@ func upstreamPod(name, ns, image, cfgMap string) *corev1.Pod {
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name,
 			Namespace: ns,
-			Labels:    map[string]string{"test": "upstream"},
+			Labels: map[string]string{
+				"test": "upstream",
+				"type": "test-pod",
+			},
 		},
 		Spec: corev1.PodSpec{
 			Volumes:            []corev1.Volume{cfgVol},
@@ -297,6 +301,7 @@ func buildPod(name, ns, image string, cmd []string) *corev1.Pod {
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name,
 			Namespace: ns,
+			Labels:    map[string]string{"type": "test-pod"},
 		},
 		Spec: corev1.PodSpec{
 			Containers: []corev1.Container{container},
@@ -433,7 +438,10 @@ func upstreamTLSPod(name, ns, image string, configMap *corev1.ConfigMap) *corev1
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name,
 			Namespace: ns,
-			Labels:    map[string]string{"test": "upstream-tls"},
+			Labels: map[string]string{
+				"test": "upstream-tls",
+				"type": "test-pod",
+			},
 		},
 		Spec: corev1.PodSpec{
 			Volumes:    []corev1.Volume{volume},
@@ -585,3 +593,23 @@ func lookForSubStringsInPodLogOneShot(ns, pod, container string, expectedStrings
 	slicedResultToString := strings.Join(slicedResult, " ")
 	return checkSubStrings(slicedResultToString, expectedStrings)
 }
+
+func buildTestPodNetworkPolicy(name types.NamespacedName) *networkingv1.NetworkPolicy {
+	return &networkingv1.NetworkPolicy{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: name.Namespace,
+			Name:      name.Name,
+		},
+		Spec: networkingv1.NetworkPolicySpec{
+			PodSelector: metav1.LabelSelector{
+				MatchLabels: map[string]string{"type": "test-pod"},
+			},
+			Ingress: []networkingv1.NetworkPolicyIngressRule{{
+				From: []networkingv1.NetworkPolicyPeer{{IPBlock: &networkingv1.IPBlock{CIDR: "0.0.0.0/0"}}},
+			}},
+			Egress: []networkingv1.NetworkPolicyEgressRule{{
+				To: []networkingv1.NetworkPolicyPeer{{IPBlock: &networkingv1.IPBlock{CIDR: "0.0.0.0/0"}}},
+			}},
+		},
+	}
+}