NE-1476: Added network policies for DNS by rfredette · Pull Request #458 · openshift/cluster-dns-operator

rfredette · 2026-01-21T19:39:06Z

Taking over from #443 from @knobunc. Original description:

Added the framework for network policies for DNS for the operator and the dns pods.

The operator has a deny all network policy that for the openshift-dns-operator namespace and an allow policy for egress to the apiserver and dns ports at any IP.

The operator installs a deny all network policy for the openshift-dns namespace.

Then for each dns that it manages it installs an allow policy for ingress for dns traffic and metrics.

It has to allow ingress from the dns pods to any IP because we allow configuration to set the upstream server and port, so any valid IP and port needs to be allowed.

It also needs access to the api server, but that is covered by the wildcard allow policy.

https://issues.redhat.com/browse/NE-1476

Added the framework for network policies for DNS for the operator and the dns pods. The operator has a deny all network policy that for the openshift-dns-operator namespace and an allow policy for egress to the apiserver and dns ports at any IP. The operator installs a deny all network policy for the openshift-dns namespace. Then for each dns that it manages it installs an allow policy for ingress for dns traffic and metrics. It has to allow ingress from the dns pods to any IP because we allow configuration to set the upstream server and port, so any valid IP and port needs to be allowed. It also needs access to the api server, but that is covered by the wildcard allow policy. https://issues.redhat.com/browse/NE-1476

openshift-ci-robot · 2026-01-21T19:39:11Z

@rfredette: This pull request references NE-1476 which is a valid jira issue.

Details

In response to this:

Taking over from #443 from @knobunc. Original description:

Added the framework for network policies for DNS for the operator and the dns pods.

The operator has a deny all network policy that for the openshift-dns-operator namespace and an allow policy for egress to the apiserver and dns ports at any IP.

The operator installs a deny all network policy for the openshift-dns namespace.

Then for each dns that it manages it installs an allow policy for ingress for dns traffic and metrics.

It has to allow ingress from the dns pods to any IP because we allow configuration to set the upstream server and port, so any valid IP and port needs to be allowed.

It also needs access to the api server, but that is covered by the wildcard allow policy.

https://issues.redhat.com/browse/NE-1476

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-01-21T19:40:06Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign alebedev87 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

melvinjoseph86 · 2026-01-28T15:59:20Z

/retest

melvinjoseph86 · 2026-02-02T17:15:28Z

Tested with cluster bot

 oc get networkpolicies -n openshift-dns 
NAME                     POD-SELECTOR                                      AGE
dns-default              dns.operator.openshift.io/daemonset-dns=default   53m
openshift-dns-deny-all   <none>    
                                     53m

oc get networkpolicies -n openshift-dns  dns-default -oyaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  creationTimestamp: "2026-02-02T16:08:15Z"
  generation: 1
  labels:
    dns.operator.openshift.io/owning-dns: default
  name: dns-default
  namespace: openshift-dns
  ownerReferences:
  - apiVersion: operator.openshift.io/v1
    controller: true
    kind: DNS
    name: default
    uid: b0ae5ffa-8601-4b3e-b42a-2e63f158c3db
  resourceVersion: "10369"
  uid: 15852e28-4d3c-4cd1-9bdd-8f653fd84046
spec:
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
  ingress:
  - ports:
    - port: 5353
      protocol: UDP
    - port: 5353
      protocol: TCP
  - ports:
    - port: 9154
      protocol: TCP
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: openshift-dns
    ports:
    - port: 8080
      protocol: TCP
    - port: 8181
      protocol: TCP
  podSelector:
    matchLabels:
      dns.operator.openshift.io/daemonset-dns: default
  policyTypes:
  - Ingress
  - Egress

oc get networkpolicies -n openshift-dns  openshift-dns-deny-all  -oyaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  creationTimestamp: "2026-02-02T16:08:15Z"
  generation: 1
  name: openshift-dns-deny-all
  namespace: openshift-dns
  resourceVersion: "10329"
  uid: 57eb5be7-393e-4bef-8847-3ded55d841a5
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress


oc get networkpolicies -n openshift-dns-operator
NAME                    POD-SELECTOR        AGE
dns-operator-allow      name=dns-operator   66m


oc get networkpolicies -n openshift-dns-operator dns-operator-allow -oyaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
    include.release.openshift.io/single-node-developer: "true"
  creationTimestamp: "2026-02-02T16:02:28Z"
  generation: 1
  name: dns-operator-allow
  namespace: openshift-dns-operator
  ownerReferences:
  - apiVersion: config.openshift.io/v1
    controller: true
    kind: ClusterVersion
    name: version
    uid: d6095c34-760c-4798-91e1-7d95eb6a80c4
  resourceVersion: "1535"
  uid: c96b6e62-1e97-477c-a400-1f25b2ce85e9
spec:
  egress:
  - ports:
    - port: 6443
      protocol: TCP
    - port: 53
      protocol: TCP
    - port: 53
      protocol: UDP
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: openshift-apiserver
    - podSelector:
        matchLabels:
          apiserver: "true"
  ingress:
  - ports:
    - port: 9393
      protocol: TCP
  podSelector:
    matchLabels:
      name: dns-operator
  policyTypes:
  - Egress
  - Ingress


oc get networkpolicies -n openshift-dns-operator dns-operator-deny-all -oyaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
    include.release.openshift.io/single-node-developer: "true"
  creationTimestamp: "2026-02-02T16:02:23Z"
  generation: 1
  name: dns-operator-deny-all
  namespace: openshift-dns-operator
  ownerReferences:
  - apiVersion: config.openshift.io/v1
    controller: true
    kind: ClusterVersion
    name: version
    uid: d6095c34-760c-4798-91e1-7d95eb6a80c4
  resourceVersion: "1309"
  uid: 8562f790-975a-4ad9-baa5-a6af8804017c
spec:
  podSelector: {}
  policyTypes:
  - Ingress

Changes are visible in the cluster, hence marking as verified.
/verified by @mjoseph
Will update with more functionality tests

openshift-ci-robot · 2026-02-02T17:15:39Z

@melvinjoseph86: This PR has been marked as verified by @mjoseph.

Details

In response to this:

Tested with cluster bot
oc get networkpolicies -n openshift-dns 
NAME                     POD-SELECTOR                                      AGE
dns-default              dns.operator.openshift.io/daemonset-dns=default   53m
openshift-dns-deny-all   <none>    
```                                        53m
oc get networkpolicies -n openshift-dns dns-default -oyaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
creationTimestamp: "2026-02-02T16:08:15Z"
generation: 1
labels:
dns.operator.openshift.io/owning-dns: default
name: dns-default
namespace: openshift-dns
ownerReferences:

apiVersion: operator.openshift.io/v1
controller: true
kind: DNS
name: default
uid: b0ae5ffa-8601-4b3e-b42a-2e63f158c3db
resourceVersion: "10369"
uid: 15852e28-4d3c-4cd1-9bdd-8f653fd84046
spec:
egress:

to:

ipBlock:
cidr: 0.0.0.0/0
ingress:

ports:

port: 5353
protocol: UDP

port: 5353
protocol: TCP

ports:

port: 9154
protocol: TCP

from:

namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: openshift-dns
ports:

port: 8080
protocol: TCP

port: 8181
protocol: TCP
podSelector:
matchLabels:
dns.operator.openshift.io/daemonset-dns: default
policyTypes:

Ingress

Egress
oc get networkpolicies -n openshift-dns openshift-dns-deny-all -oyaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
creationTimestamp: "2026-02-02T16:08:15Z"
generation: 1
name: openshift-dns-deny-all
namespace: openshift-dns
resourceVersion: "10329"
uid: 57eb5be7-393e-4bef-8847-3ded55d841a5
spec:
podSelector: {}
policyTypes:

Ingress

Egress
oc get networkpolicies -n openshift-dns-operator
NAME POD-SELECTOR AGE
dns-operator-allow name=dns-operator 66m
oc get networkpolicies -n openshift-dns-operator dns-operator-allow -oyaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
annotations:
include.release.openshift.io/self-managed-high-availability: "true"
include.release.openshift.io/single-node-developer: "true"
creationTimestamp: "2026-02-02T16:02:28Z"
generation: 1
name: dns-operator-allow
namespace: openshift-dns-operator
ownerReferences:

apiVersion: config.openshift.io/v1
controller: true
kind: ClusterVersion
name: version
uid: d6095c34-760c-4798-91e1-7d95eb6a80c4
resourceVersion: "1535"
uid: c96b6e62-1e97-477c-a400-1f25b2ce85e9
spec:
egress:

ports:

port: 6443
protocol: TCP

port: 53
protocol: TCP

port: 53
protocol: UDP

to:

namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: openshift-apiserver

podSelector:
matchLabels:
apiserver: "true"
ingress:

ports:

port: 9393
protocol: TCP
podSelector:
matchLabels:
name: dns-operator
policyTypes:

Egress

Ingress
oc get networkpolicies -n openshift-dns-operator dns-operator-deny-all -oyaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
annotations:
include.release.openshift.io/self-managed-high-availability: "true"
include.release.openshift.io/single-node-developer: "true"
creationTimestamp: "2026-02-02T16:02:23Z"
generation: 1
name: dns-operator-deny-all
namespace: openshift-dns-operator
ownerReferences:

apiVersion: config.openshift.io/v1
controller: true
kind: ClusterVersion
name: version
uid: d6095c34-760c-4798-91e1-7d95eb6a80c4
resourceVersion: "1309"
uid: 8562f790-975a-4ad9-baa5-a6af8804017c
spec:
podSelector: {}
policyTypes:

Ingress
Changes are visible in the cluster, hence marking as verified.
/verified by @mjoseph
Will update with more functionality tests

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-02-04T01:32:51Z

@rfredette: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn-serial-2of2	`66e8615`	link	true	`/test e2e-aws-ovn-serial-2of2`
ci/prow/e2e-aws-ovn-serial-1of2	`66e8615`	link	true	`/test e2e-aws-ovn-serial-1of2`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

rfredette · 2026-02-04T02:22:51Z

e2e-aws-ovn-serial failures will be fixed by openshift/origin#30753

alebedev87 · 2026-02-04T16:01:16Z

/assign @bentito
/assign @rikatz

rikatz · 2026-02-04T17:01:05Z

/cc

rikatz · 2026-02-06T17:44:50Z

manifests/0000_70_dns-operator_01-network-policy.yaml

+  - Egress
+  - Ingress
+  egress:
+  - ports:


@rfredette this rule seems a bit weird, so let me echo what you tried to do here:

DNS must be able to speak with pods on namespace "openshift-apiserver" on port 6443

DNS must be able to speak with anything on port 53 TCP and UDP

If so, what you need are two egress rules (right now what your rule is saying: allow any egress to port 6443, 53 TCP and UDP, and also allow any egress to any pod with label apiserver=true on namespace openshift-apiserver

I guess the network policy you were expecting is something like this:

egress: - to: - ipBlock: cidr: 0.0.0.0/0 ports: - port: 53 protocol: TCP - port: 53 protocol: UDP - to: - namespaceSelector: matchLabels: kubernetes.io/metadata.name: openshift-apiserver podSelector: matchLabels: apiserver: "true" ports: - port: 6443

rikatz · 2026-02-06T17:48:09Z

pkg/manifests/assets/dns/networkpolicy-allow.yaml

+    - protocol: TCP
+      port: 8181
+    from:
+    - namespaceSelector:


I think this will fail, the namespaceSelector.matchLabels is an AND operator. You are saying here you want traffic just from pods that are on a namespace that contains the labels metadata.name=openshift-dns-operator AND metadata.name=openshift-dns

Instead, you could do something like:

from: - namespaceSelector: matchLabels: kubernetes.io/metadata.name: openshift-dns-operator - namespaceSelector: matchLabels: kubernetes.io/metadata.name: openshift-dns

Tho, I am wondering why workloads running on openshift-dns would need to be able to reach metrics from other workloads on the same namespace. Would it make sense to limit just "from: openshift-dns-operator"?

ah btw this is also conflicting, matchLabels is a map[string]string so you are setting the same key twice. Probably worth removing "openshift-dns" from here and leaving just openshift-dns-operator

rikatz · 2026-02-06T18:39:05Z

manifests/0000_70_dns-operator_01-role.yaml

  verbs:
  - "*"
+
+- apiGroups:


do we really need this to be added to the Role? I can see the following ClusterRoleBinding on the cluster:

apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: openshift-dns-operator roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: openshift-dns-operator subjects: - kind: ServiceAccount name: dns-operator namespace: openshift-dns-operator

Which means the Pod from the operator (who will be creating the Network Policies) already has its permissions. I am not sure why the dns-operator role exists and why it would need to be able to add Network Policies as well

knobunc added 2 commits August 11, 2025 12:14

Updated with review suggestions

333c04b

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jan 21, 2026

openshift-ci bot requested review from knobunc and rikatz January 21, 2026 19:40

rfredette force-pushed the dns-network-policies branch from 3964cc9 to d30b60b Compare January 26, 2026 19:45

Address review comments

66e8615

rfredette force-pushed the dns-network-policies branch 2 times, most recently from 470923d to 14ce844 Compare January 30, 2026 18:47

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Feb 2, 2026

rfredette force-pushed the dns-network-policies branch from 14ce844 to 66e8615 Compare February 3, 2026 22:29

openshift-ci-robot removed the verified Signifies that the PR passed pre-merge verification criteria label Feb 3, 2026

openshift-ci bot assigned bentito and rikatz Feb 4, 2026

rikatz reviewed Feb 6, 2026

View reviewed changes

Conversation

rfredette commented Jan 21, 2026

Uh oh!

openshift-ci-robot commented Jan 21, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci bot commented Jan 21, 2026

Uh oh!

melvinjoseph86 commented Jan 28, 2026

Uh oh!

melvinjoseph86 commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Feb 2, 2026

Uh oh!

openshift-ci bot commented Feb 4, 2026

Uh oh!

rfredette commented Feb 4, 2026

Uh oh!

alebedev87 commented Feb 4, 2026

Uh oh!

rikatz commented Feb 4, 2026

Uh oh!

rikatz Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

rikatz Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

rikatz Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

rikatz Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

openshift-ci-robot commented Jan 21, 2026 •

edited by openshift-ci bot

Loading

melvinjoseph86 commented Feb 2, 2026 •

edited

Loading