kubevirt / containerized-data-importer / #5658

49%

Build Type

push

travis-ci

Committed by web-flow

Commit Message

Add network policies to CDI (#3938)

* Add np.kubevirt.io/allow-access-cluster-services label to components

`np.kubevirt.io/allow-access-cluster-services` is a pod label to be set by
CDI components to indicate that they require access to cluster services otherwise
blocked by the strict network policy (NP).
This label will be applied to the following CDI pods:
- cdi-operator
- cdi-deployment
- cdi-apiserver
- cdi-uploadproxy
- poller (DataImportCron poller pods that run in the CDI namespace)
This label is then used as pod selector to create a NP to give the pods
access to cluster services (apiserver/dns).

Signed-off-by: Adi Aloni <aaloni@redhat.com>
Co-authored-by: fossedihelm <ffossemo@redhat.com>

* dataimportcron, poller: add identifier label to DIC poller

The DIC poller which is used to sample the digest of a container image
from a remote registry currently lacks an identifier labels which can be
used by NetworkPolicies to control its traffic patterns, this commit
adds one.

Signed-off-by: Adi Aloni <aaloni@redhat.com>

* namespaced, factory: add networkpolicies function

This commit adds an additional factory function that isn't included as
part of the standard create all resources to generate the network
policies required by CDI to function properly.

This new function will be used in following commits to generate network
policies as part of manifest-generator and csv-gen.

Signed-off-by: Adi Aloni <aaloni@redhat.com>

* manifest-generator: add network-policies generation support

A new environment variable CDI_DEPLOY_NP has been added with the
options of true and false (defaults to false) to control the deployment
of CDI's network policies.

The network policies deployed when CDI_DEPLOY_NP is set to true are the
ones generated by the createNetworkPolicies factory function as well as
static ones for denying all traffic in the namespace and allow traffic
to kube-apiserver and DNS for pods labeled with `np.kubevirt.io/allow-access-cluster-servic... (continued)

Run Details

31 of 193 new or added lines in 7 files covered. (16.06%)

7 existing lines in 1 file now uncovered.

17264 of 29385 relevant lines covered (58.75%)

0.65 hits per line