Having deployed the operator (openshift 4.2 / k8s 1.14), and injected a couple sample CommonNetworkPolicy objects, I do not see any NetworkPolicy being created.
$ oc logs controller-manager-fb57584dc-s7xdv
2019/10/18 14:04:40 Registering Components.
2019/10/18 14:04:40 Starting the Cmd.
2019/10/18 14:11:29 Creating Network Policy egress-test/common-do-something
2019/10/18 14:11:30 Creating Network Policy egress-test/common-do-something
2019/10/18 14:11:31 Creating Network Policy egress-test/common-allow-from-same-namespace
2019/10/18 14:11:32 Creating Network Policy egress-test/common-do-something
2019/10/18 14:11:33 Creating Network Policy egress-test/common-allow-from-same-namespace
2019/10/18 14:11:34 Creating Network Policy egress-test/common-do-something
2019/10/18 14:11:35 Creating Network Policy egress-test/common-allow-from-same-namespace
2019/10/18 14:11:36 Creating Network Policy egress-test/common-allow-from-same-namespace
Note: I changed the operator StatefulSet into a Deployment (as I'm not sure this was meant to be running on all nodes, correct me if I'm wrong).
Here are the sample CommonNetworkPolicies I'm trying to setup (excluding all ocp default namespaces)
apiVersion: commonnetworkpolicies.bells17.io/v1alpha1
kind: CommonNetworkPolicy
metadata:
labels:
controller-tools.k8s.io: "1.0"
name: do-something
spec:
namePrefix: common
excludeNamespaces:
- default
- kube-node-lease
- kube-public
- kube-system
- networkpolicy-operator
- openshift
- openshift-apiserver
- openshift-apiserver-operator
- openshift-authentication
- openshift-authentication-operator
- openshift-cloud-credential-operator
- openshift-cluster-machine-approver
- openshift-cluster-node-tuning-operator
- openshift-cluster-samples-operator
- openshift-cluster-storage-operator
- openshift-cluster-version
- openshift-config
- openshift-config-managed
- openshift-console
- openshift-console-operator
- openshift-controller-manager
- openshift-controller-manager-operator
- openshift-dns
- openshift-dns-operator
- openshift-etcd
- openshift-image-registry
- openshift-infra
- openshift-ingress
- openshift-ingress-operator
- openshift-insights
- openshift-kni-infra
- openshift-kube-apiserver
- openshift-kube-apiserver-operator
- openshift-kube-controller-manager
- openshift-kube-controller-manager-operator
- openshift-kube-scheduler
- openshift-kube-scheduler-operator
- openshift-machine-api
- openshift-machine-config-operator
- openshift-marketplace
- openshift-metering
- openshift-monitoring
- openshift-multus
- openshift-network-operator
- openshift-node
- openshift-openstack-infra
- openshift-operator-lifecycle-manager
- openshift-operators
- openshift-sdn
- openshift-service-ca
- openshift-service-ca-operator
- openshift-service-catalog-apiserver-operator
- openshift-service-catalog-controller-manager-operator
policySpec:
podSelector: {}
policyTypes:
- Egress
---
apiVersion: commonnetworkpolicies.bells17.io/v1alpha1
kind: CommonNetworkPolicy
metadata:
labels:
controller-tools.k8s.io: "1.0"
name: allow-from-same-namespace
spec:
namePrefix: common
excludeNamespaces:
- default
- kube-node-lease
- kube-public
- kube-system
- networkpolicy-operator
- openshift
- openshift-apiserver
- openshift-apiserver-operator
- openshift-authentication
- openshift-authentication-operator
- openshift-cloud-credential-operator
- openshift-cluster-machine-approver
- openshift-cluster-node-tuning-operator
- openshift-cluster-samples-operator
- openshift-cluster-storage-operator
- openshift-cluster-version
- openshift-config
- openshift-config-managed
- openshift-console
- openshift-console-operator
- openshift-controller-manager
- openshift-controller-manager-operator
- openshift-dns
- openshift-dns-operator
- openshift-etcd
- openshift-image-registry
- openshift-infra
- openshift-ingress
- openshift-ingress-operator
- openshift-insights
- openshift-kni-infra
- openshift-kube-apiserver
- openshift-kube-apiserver-operator
- openshift-kube-controller-manager
- openshift-kube-controller-manager-operator
- openshift-kube-scheduler
- openshift-kube-scheduler-operator
- openshift-machine-api
- openshift-machine-config-operator
- openshift-marketplace
- openshift-metering
- openshift-monitoring
- openshift-multus
- openshift-network-operator
- openshift-node
- openshift-openstack-infra
- openshift-operator-lifecycle-manager
- openshift-operators
- openshift-sdn
- openshift-service-ca
- openshift-service-ca-operator
- openshift-service-catalog-apiserver-operator
- openshift-service-catalog-controller-manager-operator
policySpec:
podSelector: {}
ingress:
- from:
- podSelector: {}
$ oc get networkpolicy,egressnetworkpolicy --all-namespaces
No resources found.
Regards.