CMP-4496: Add NetworkPolicy RBAC for operands to operator Role and CSV

[taimurhafeez]

What

• Adds networking.k8s.io/networkpolicies RBAC rule (verbs: create, delete, get, update) to the operator Role (config/rbac/operator_role.yaml)
• Adds matching entry in the CSV namespace-scoped permissions (config/manifests/bases/compliance-operator.clusterserviceversion.yaml) under the compliance-operator service account
• Adds kubebuilder RBAC marker in compliancescan_controller.go to keep the three RBAC sources of truth in sync
• Regenerates the bundle CSV via make bundle

Why

The Conforma policy olm.required_network_policy_rbac_for_operands requires the CSV to declare RBAC permissions for networking.k8s.io/networkpolicies with verbs create, delete, and update (or patch).

Test plan

Prerequisites

• Access to an OpenShift cluster (Tested on OCP 4.22)
• podman installed and logged into registry (e.g.,quay.io)
• A quay.io org with repos for compliance-operator, compliance-operator-bundle, and compliance-operator-catalog

1. Build and push images

# Set your quay org
export IMAGE_REPO=quay.io/<your-quay-org>

# Generate bundle (regenerates bundle/manifests/compliance-operator.clusterserviceversion.yaml)
make bundle VERSION=1.8.0-dev

# Build operator image
make image

# Push operator image
podman tag ghcr.io/complianceascode/compliance-operator:latest ${IMAGE_REPO}/compliance-operator:latest
podman push ${IMAGE_REPO}/compliance-operator:latest

# Build and push bundle image
make bundle-image VERSION=1.8.0-dev
make bundle-push

# Build and push catalog image
make catalog

2. Deploy via OLM

# Deploy CatalogSource, OperatorGroup, and Subscription
make catalog-deploy
oc get csv -n openshift-compliance
NAME                             DISPLAY               VERSION     REPLACES   PHASE
compliance-operator.v1.8.0-dev   Compliance Operator   1.8.0-dev              Succeeded

3.Verify OLM installation is complete

# CSV is Succeeded
oc get csv -n openshift-compliance
# NAME                             DISPLAY               VERSION     PHASE
# compliance-operator.v1.8.0-dev   Compliance Operator   1.8.0-dev   Succeeded

# Subscription exists
oc get subscription -n openshift-compliance
# NAME                      PACKAGE               SOURCE                CHANNEL
# compliance-operator-sub   compliance-operator   compliance-operator   alpha

# InstallPlan completed
oc get installplan -n openshift-compliance
# NAME            CSV                              APPROVAL    APPROVED
# install-cdt2v   compliance-operator.v1.8.0-dev   Automatic   true

# Operator pod is running
oc get pods -n openshift-compliance
# NAME                                   READY   STATUS    RESTARTS   AGE
# compliance-operator-7d8b6779b6-mn7gs   1/1     Running   0          4m

4. Verify NetworkPolicy RBAC in the OLM-created Role

Check the OLM-created Role contains the networkpolicies rule
oc get roles -n openshift-compliance -o yaml | grep -B 2 -A 6 networkpolicies
Expected output:

  - networking.k8s.io
  resources:
  - networkpolicies
  verbs:
  - create
  - delete
  - get
  - update

5. Verify the CSV permissions section

Expected output should show networkpolicies with verbs create, delete, get, update under the permissions (namespace-scoped) section.

6. Verify SA has the permissions

oc auth can-i create networkpolicies --as=system:serviceaccount:openshift-compliance:compliance-operator -n openshift-compliance
yes

oc auth can-i delete networkpolicies --as=system:serviceaccount:openshift-compliance:compliance-operator -n openshift-compliance
yes

oc auth can-i get networkpolicies --as=system:serviceaccount:openshift-compliance:compliance-operator -n openshift-compliance
yes

oc auth can-i update networkpolicies --as=system:serviceaccount:openshift-compliance:compliance-operator -n openshift-compliance
yes

[openshift-ci-robot]

@taimurhafeez: This pull request references CMP-4496 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

What

• Adds networking.k8s.io/networkpolicies RBAC rule (verbs: create, delete, get, update) to the operator Role (config/rbac/operator_role.yaml)
• Adds matching entry in the CSV namespace-scoped permissions (config/manifests/bases/compliance-operator.clusterserviceversion.yaml) under the compliance-operator service account
• Regenerates the bundle CSV via make bundle

Why

The Conforma policy olm.required_network_policy_rbac_for_operands requires the CSV to declare RBAC permissions for networking.k8s.io/networkpolicies with verbs create, delete, and update (or patch).

Test plan

Prerequisites

• Access to an OpenShift cluster
• podman installed and logged into registry (e.g.,quay.io)
• A quay.io org with repos for compliance-operator, compliance-operator-bundle, and compliance-operator-catalog

1. Build and push images

# Set your quay org
export IMAGE_REPO=quay.io/<your-quay-org>

# Generate bundle (regenerates bundle/manifests/compliance-operator.clusterserviceversion.yaml)
make bundle VERSION=1.8.0-dev

# Build operator image
make image

# Push operator image
podman tag ghcr.io/complianceascode/compliance-operator:latest ${IMAGE_REPO}/compliance-operator:latest
podman push ${IMAGE_REPO}/compliance-operator:latest

# Build and push bundle image
make bundle-image VERSION=1.8.0-dev
make bundle-push

# Build and push catalog image
make catalog

2. Deploy via OLM

# Deploy CatalogSource, OperatorGroup, and Subscription
make catalog-deploy
oc get csv -n openshift-compliance
NAME                             DISPLAY               VERSION     REPLACES   PHASE
compliance-operator.v1.8.0-dev   Compliance Operator   1.8.0-dev              Succeeded

3.Verify OLM installation is complete

# CSV is Succeeded
oc get csv -n openshift-compliance
# NAME                             DISPLAY               VERSION     PHASE
# compliance-operator.v1.8.0-dev   Compliance Operator   1.8.0-dev   Succeeded

# Subscription exists
oc get subscription -n openshift-compliance
# NAME                      PACKAGE               SOURCE                CHANNEL
# compliance-operator-sub   compliance-operator   compliance-operator   alpha

# InstallPlan completed
oc get installplan -n openshift-compliance
# NAME            CSV                              APPROVAL    APPROVED
# install-cdt2v   compliance-operator.v1.8.0-dev   Automatic   true

# Operator pod is running
oc get pods -n openshift-compliance
# NAME                                   READY   STATUS    RESTARTS   AGE
# compliance-operator-7d8b6779b6-mn7gs   1/1     Running   0          4m

4. Verify NetworkPolicy RBAC in the OLM-created Role

Check the OLM-created Role contains the networkpolicies rule

oc get roles -n openshift-compliance -o yaml | grep -B 2 -A 6 networkpolicies
Expected output:

 - networking.k8s.io
 resources:
 - networkpolicies
 verbs:
 - create
 - delete
 - get
 - update

###5. Verify the CSV permissions section
Expected output should show networkpolicies with verbs create, delete, get, update under the permissions (namespace-scoped) section.

6. Verify SA has the permissions

oc auth can-i create networkpolicies --as=system:serviceaccount:openshift-compliance:compliance-operator -n openshift-compliance
yes

oc auth can-i delete networkpolicies --as=system:serviceaccount:openshift-compliance:compliance-operator -n openshift-compliance
yes

oc auth can-i get networkpolicies --as=system:serviceaccount:openshift-compliance:compliance-operator -n openshift-compliance
yes

oc auth can-i update networkpolicies --as=system:serviceaccount:openshift-compliance:compliance-operator -n openshift-compliance
yes

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: taimurhafeez

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [taimurhafeez]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[taimurhafeez]

/retest-required

[taimurhafeez]

/retest-required

[github-actions]

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:1313-529958f799d867a1b9b88e1b6e1ac78c74f9498d