chore: Add NetworkPolicy reconciler by tolusha · Pull Request #2169 · eclipse-che/che-operator

tolusha · 2026-07-27T13:22:18Z

What does this PR do?

Introduces operator-managed NetworkPolicy resources for both the Che namespace and user workspace namespaces on OpenShift clusters.

A new spec.networking.networkPolicy.enabled field controls the feature (disabled by default). When enabled, the operator creates fine-grained ingress and egress NetworkPolicy resources to restrict network traffic to only the flows required by Che components and workspaces.

Che namespace policies:

allow-from-same-namespace — allows ingress traffic between Che pods in the same namespace
allow-from-workspaces — allows ingress traffic from user workspace namespaces
allow-from-openshift-ingress — allows ingress traffic from the OpenShift ingress namespace
allow-from-openshift-monitoring — allows ingress traffic from the OpenShift monitoring namespace
allow-from-operator — allows ingress traffic from the operator pod to Che components
allow-all-egress — allows all egress traffic from Che pods

User workspace namespace policies:

allow-from-<che-namespace> — allows ingress traffic from Che namespace pods
allow-from-same-namespace — allows ingress traffic between pods in the same namespace
allow-from-devworkspace-operator — allows ingress traffic from the DevWorkspace operator
allow-from-openshift-monitoring — allows ingress traffic from the OpenShift monitoring namespace
allow-from-openshift-ingress — allows ingress traffic from the OpenShift ingress namespace
allow-all-egress — allows all egress traffic from Che pods

Additional changes:

Refactored DwoNamespaceReconciler into a utility function GetDevWorkspaceOperatorNamespace
Extended cache selector to also watch DevWorkspace operator pods (for namespace lookup)
Added NetworkPolicy diff option, DeleteIgnoreNotFound k8s client method, and related constants

Screenshot/screencast of this PR

N/A — infrastructure change, no UI impact.

What issues does this PR fix or reference?

CRW-10821

How to test this PR?

Deploy the operator:

OpenShift

./build/scripts/olm/test-catalog-from-sources.sh

or

build/scripts/docker-run.sh /bin/bash -c "
  oc login \
    --token=<...> \
    --server=<...> \
    --insecure-skip-tls-verify=true && \
  build/scripts/olm/test-catalog-from-sources.sh
"

Enable network policies in the CheCluster CR:

kubectl patch checluster eclipse-che -n eclipse-che --type merge -p '{"spec":{"networking":{"networkPolicy":{"enabled":true}}}}'

Verify NetworkPolicy resources are created in the Che namespace:

kubectl get networkpolicies -n eclipse-che

Expected: 7 NetworkPolicy resources (allow-from-same-namespace, allow-from-workspaces-namespaces-to-openvsx-registry, allow-from-workspaces-namespaces-to-plugin-registry, allow-from-openshift-ingress, allow-from-openshift-monitoring, allow-from-operator, allow-to-everywhere).

Start a workspace and verify NetworkPolicy resources are created in the user namespace:

kubectl get networkpolicies -n <user-namespace>

Expected: 6 NetworkPolicy resources (allow-from-eclipse-che, allow-from-same-namespace, allow-from-devworkspace-operator, allow-from-openshift-monitoring, allow-from-openshift-ingress, allow-to-everywhere).

Disable network policies and verify cleanup:

kubectl patch checluster eclipse-che -n eclipse-che --type merge -p '{"spec":{"networking":{"networkPolicy":{"enabled":false}}}}'
kubectl get networkpolicies -n eclipse-che
kubectl get networkpolicies -n <user-namespace>

Expected: all Che-managed NetworkPolicy resources are deleted.

Common Test Scenarios

Deploy Eclipse Che
Start an empty workspace
Open terminal and build/run an image
Stop a workspace
GitHub Device authentication
Check operator logs for reconciliation errors or infinite reconciliation loops

PR Checklist

As the author of this Pull Request I made sure that:

Reviewers

Reviewers, please comment how you tested the PR when approving it.

openshift-ci · 2026-07-27T13:22:53Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tolusha

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

Introduces operator-managed NetworkPolicy resources for both the Che namespace and user workspace namespaces on OpenShift. A new `spec.networking.networkPolicy.enabled` field controls the feature (disabled by default). When enabled, the operator creates fine-grained ingress and egress policies: Che namespace policies: - allow-from-same-namespace: Che-to-Che pod traffic - allow-from-workspaces-namespaces-to-openvsx-registry - allow-from-workspaces-namespaces-to-plugin-registry - allow-from-openshift-ingress - allow-from-openshift-monitoring - allow-from-operator: operator pod to Che components - allow-to-everywhere: all egress from Che pods User workspace namespace policies: - allow-from-<che-namespace>: ingress from Che namespace - allow-from-same-namespace: intra-namespace traffic - allow-from-devworkspace-operator: DWO to workspace pods - allow-from-openshift-monitoring - allow-from-openshift-ingress - allow-to-everywhere: all egress from workspace pods Also refactors DwoNamespaceReconciler into a utility function and extends the cache selector to watch DevWorkspace operator pods. Assisted-by: Claude Opus 4.6 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

rohanKanojia · 2026-07-28T10:27:23Z

+		},
+	}
+
+	allowFromOpenShiftIngress := &networkingv1.NetworkPolicy{


nit, I see a lot of repeated NetworkPolicy construction. Maybe we can create a small helper (or a builder for common metadata) to reduce duplication?

They are slightly different, all NP for eclipse-che namespace has a pod selector:

PodSelector: metav1.LabelSelector{ MatchLabels: map[string]string{ constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg, }, },

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

tolusha

Review of PR #2169 - Add NetworkPolicy reconciler

Overall the feature is well-structured: disabled by default, OpenShift-only guard, proper owner references for Che-namespace policies, and reasonable test coverage. A few things worth addressing before merge.

User-namespace NetworkPolicies orphaned on CheCluster CR deletion

When the CheCluster CR is deleted, the user namespace controller's Reconcile returns early without cleaning up NetworkPolicies in user namespaces. Cross-namespace owner references are not supported, so GC won't handle these. The Che-namespace policies are fine - owner references cover them. But user-namespace NPs will persist after Che is uninstalled, potentially blocking workspace traffic with no obvious origin (the CR and operator are both gone at that point).

Does it make sense to add cleanup logic when checluster == nil, or at least document this as a known limitation requiring manual cleanup after uninstall?

`allow-all-egress` permits unrestricted outbound traffic - worth documenting

Both reconcilers create an allow-all-egress policy with an empty egress rule, which permits all outbound traffic. This is the right default for workspaces (git, extensions, etc.), but administrators enabling this feature in a hardened environment may not expect unrestricted egress. Consider noting in the API doc comment that egress is intentionally unrestricted.

tolusha · 2026-07-28T12:23:59Z

+	targetNs string,
+	deployContext *chetypes.DeployContext,
+) error {
+	policies, err := r.getNetworkPolicies(targetNs, deployContext)


getNetworkPolicies is called unconditionally here, before the IsNetworkPoliciesEnabled() guard at line 635. getNetworkPolicies calls GetDevWorkspaceOperatorNamespace, which returns an error when no DWO pod is found. Since network policies are disabled by default, user-namespace reconciliation will fail with a spurious error any time the DWO pod is temporarily unavailable - for example during cluster startup or DWO upgrades.

Consider moving the IsNetworkPoliciesEnabled check to the top of reconcileNetworkPolicies, before calling getNetworkPolicies, so that DWO discovery is skipped entirely when the feature is off.

tolusha · 2026-07-28T12:23:59Z

+	// When enabled, the following policies are created:
+	// In the Che namespace:
+	//   - allow-from-same-namespace: allows ingress traffic between Che pods in the same namespace.
+	//   - allow-from-workspaces-namespaces-to-openvsx-registry: allows ingress traffic from user workspace


The comment lists allow-from-workspaces-namespaces-to-openvsx-registry and allow-from-workspaces-namespaces-to-plugin-registry as two separate policies, but networkpolicies.go creates a single policy named allow-from-workspaces that allows ingress from all workspace namespaces to all Che pods. Would it be possible to update this to match the actual policy name?

tolusha · 2026-07-28T12:23:59Z

+type NetworkPolicy struct {
+	// Enabled controls whether the operator creates NetworkPolicy resources.
+	// +optional
+	Enabled *bool `json:"enabled"`


Similar bool pointer fields in the API use json:"enabled,omitempty" (e.g., PersistentHomeConfig.Enabled). Consider adding omitempty for consistency:

Suggested change

Enabled *bool `json:"enabled"`

Enabled *bool `json:"enabled,omitempty"`

tolusha · 2026-07-28T12:23:59Z

+
+func init() {
+	test.EnableTestMode()
+


The reconciler is guarded by infrastructure.IsOpenShift() at registration time, but the test infrastructure initializes as Kubernetes. The tests work because they call the reconciler directly and bypass that guard, but it would be more consistent to use OpenShiftV4 here - the init_test.go in the usernamespace package does this correctly.

Suggested change

infrastructure.InitializeForTesting(infrastructure.OpenShiftV4)

tolusha · 2026-07-28T12:23:59Z

+	targetNs string,
+	deployContext *chetypes.DeployContext,
+) ([]*networkingv1.NetworkPolicy, error) {
+	devWorkspaceOperatorNamespace, err := devworkspace.GetDevWorkspaceOperatorNamespace(deployContext.ClusterAPI.ClientWrapper)


GetDevWorkspaceOperatorNamespace does a pod list on every user-namespace reconciliation. The main controller already resolves and stores DwoNamespace in deployContext.DwoNamespace (see checluster_controller.go), but the user namespace controller builds its own DeployContext without populating that field, then calls GetDevWorkspaceOperatorNamespace again here.

Does it make sense to populate deployContext.DwoNamespace once in the user namespace controller's Reconcile function, and pass it into getNetworkPolicies as a parameter rather than re-discovering it on each call?

tolusha · 2026-07-28T12:23:59Z

+	npList := &networkingv1.NetworkPolicyList{}
+	err = ctx.ClusterAPI.Client.List(context.TODO(), npList, &client.ListOptions{Namespace: "eclipse-che"})
+	assert.NoError(t, err)
+	assert.Equal(t, len(allNetworkPolicyNames), len(npList.Items))


The test asserts on policy count and Get success, but never inspects the Spec of any created policy. A bug that creates allow-from-operator with the wrong namespace selector, or allow-from-workspaces with an empty ingress rule, would pass silently.

Would it be possible to add at least one assertion on the spec of a representative policy - for example, verifying that allow-from-operator has the correct NamespaceSelector for the operator namespace?

tolusha requested review from SDawley, dkwon17, ibuziuk and mkuznyetsov as code owners July 27, 2026 13:22

openshift-ci Bot added the needs-rebase label Jul 27, 2026

tolusha and others added 3 commits July 27, 2026 15:31

chore: Add NetworkPolicy reconciler

fcd6d3a

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

chore: Add NetworkPolicy reconciler

9824465

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

tolusha force-pushed the CRW-10821-3 branch from cf7c5c0 to 2462897 Compare July 27, 2026 13:39

openshift-ci Bot removed the needs-rebase label Jul 27, 2026

commit .claude/rules/pull-requests.md

4b5408d

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

tolusha changed the title ~~chore: Add NetworkPolicy reconciler~~ chore: Add NetworkPolicy reconciler Jul 27, 2026

chore: fixup

fa5682f

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

tolusha requested review from akurinnoy and rohanKanojia July 27, 2026 15:36

chore: fixup

9cb67c5

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

rohanKanojia reviewed Jul 28, 2026

View reviewed changes

tolusha changed the title ~~chore: Add NetworkPolicy reconciler~~ chore: Add NetworkPolicy reconciler Jul 28, 2026

Rename allow-all-ingress -> allow-all-egress

09b928a

Signed-off-by: Anatolii Bazko <abazko@redhat.com>

tolusha commented Jul 28, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: Add NetworkPolicy reconciler - #2169

chore: Add NetworkPolicy reconciler#2169
tolusha wants to merge 7 commits into
mainfrom
CRW-10821-3

tolusha commented Jul 27, 2026 •

edited

Loading

Uh oh!

openshift-ci Bot commented Jul 27, 2026

Uh oh!

rohanKanojia Jul 28, 2026

Uh oh!

tolusha Jul 28, 2026 •

edited

Loading

Uh oh!

tolusha left a comment

Uh oh!

tolusha Jul 28, 2026

Uh oh!

tolusha Jul 28, 2026

Uh oh!

tolusha Jul 28, 2026

Uh oh!

tolusha Jul 28, 2026

Uh oh!

tolusha Jul 28, 2026

Uh oh!

tolusha Jul 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	Enabled *bool `json:"enabled"`
	Enabled *bool `json:"enabled,omitempty"`


	infrastructure.InitializeForTesting(infrastructure.OpenShiftV4)

Uh oh!

Conversation

tolusha commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Screenshot/screencast of this PR

What issues does this PR fix or reference?

How to test this PR?

OpenShift

Common Test Scenarios

PR Checklist

Reviewers

Uh oh!

openshift-ci Bot commented Jul 27, 2026

Uh oh!

rohanKanojia Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

tolusha Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tolusha left a comment

Choose a reason for hiding this comment

Review of PR #2169 - Add NetworkPolicy reconciler

User-namespace NetworkPolicies orphaned on CheCluster CR deletion

allow-all-egress permits unrestricted outbound traffic - worth documenting

Uh oh!

tolusha Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

tolusha Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

tolusha Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

tolusha Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

tolusha Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

tolusha Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

tolusha commented Jul 27, 2026 •

edited

Loading

tolusha Jul 28, 2026 •

edited

Loading

`allow-all-egress` permits unrestricted outbound traffic - worth documenting