generate network policy per operand #1246

frzifus · 2025-07-22T11:43:56Z

Downside of this approach is that we need to manually align the mapping when we change e.g. a service. But we could generate services based on this too. wdyt?

NAME                                      TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                                                                     AGE
tempo-simplest-compactor                  ClusterIP   10.96.115.23    <none>        7946/TCP,3200/TCP                                                           2m8s
tempo-simplest-distributor                ClusterIP   10.96.122.122   <none>        4318/TCP,4317/TCP,3200/TCP,14268/TCP,6831/UDP,6832/UDP,14250/TCP,9411/TCP   2m8s
tempo-simplest-gossip-ring                ClusterIP   None            <none>        7946/TCP                                                                    2m8s
tempo-simplest-ingester                   ClusterIP   10.96.76.66     <none>        3200/TCP,9095/TCP                                                           2m8s
tempo-simplest-querier                    ClusterIP   10.96.206.87    <none>        7946/TCP,3200/TCP,9095/TCP                                                  2m8s
tempo-simplest-query-frontend             ClusterIP   10.96.117.99    <none>        3200/TCP,9095/TCP,16685/TCP,16686/TCP,16687/TCP                             2m8s
tempo-simplest-query-frontend-discovery   ClusterIP   None            <none>        3200/TCP,9095/TCP,9096/TCP,16685/TCP,16686/TCP,16687/TCP                    2m8s


NAME                         POD-SELECTOR                                                                                                                                           AGE
tempo-simplest-distributor   app.kubernetes.io/component=distributor,app.kubernetes.io/instance=simplest,app.kubernetes.io/managed-by=tempo-operator,app.kubernetes.io/name=tempo   17s

frzifus · 2025-07-23T09:20:18Z

internal/manifests/manifests.go

 	}

 	var manifests []client.Object
+	manifests = append(manifests, networking.GenerateOperandPolicies(params.Tempo)...)


That should only be done on OpenShift 4.20+.

internal/manifests/networking/components.go

andreasgerstmayr

can you add unit tests with the generated policy? ideally in yaml format (to be less verbose than Golang), like here: https://github.com/grafana/tempo-operator/blob/main/internal/manifests/config/build_test.go#L23-L26

frzifus · 2025-07-23T18:26:22Z

y, I will do once its working.
I will pause this until #1248 is complete.

Signed-off-by: Benedikt Bongartz <[email protected]>

pavolloffay

It seems like it is missing the policy for the gateway

pavolloffay · 2025-07-30T15:38:32Z

api/tempo/v1alpha1/tempostack_types.go

+	// +optional
+	// +kubebuilder:validation:Optional
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Networking"
+	Networking NetworkingSpec `json:"networking,omitempty"`


We should re-work the naming, this seems to ambigous

spec: networking: enabled: true

The config does not indicate anything about network policies

pavolloffay · 2025-07-30T15:41:40Z

internal/manifests/networking/components.go

@@ -0,0 +1,171 @@
+package networking


a similar comment as the previous one. I would be more specific and rename it to networkpolicies

pavolloffay · 2025-07-30T15:45:13Z

internal/manifests/networking/operands.go

+	policies = append(policies, generatePolicyFor(tempo, manifestutils.QuerierComponentName))
+	policies = append(policies, generatePolicyFor(tempo, manifestutils.QueryFrontendComponentName))
+
+	return policies


So If I am not mistaken this creates 3+5policies(per component).

We might need to have percomponent policy, but those 3 generic one can be embeded into the policy per component, which would make it easier to understand what policy applies to a component.

Copilot

Pull Request Overview

This PR introduces network policy generation for Tempo operands to limit network access between components. The implementation adds a new networking configuration option to the TempoStack spec and generates NetworkPolicy resources for each component based on defined communication relationships.

Adds NetworkingSpec to the TempoStack CRD with an enabled flag
Implements per-component network policy generation with ingress/egress rules
Defines component communication relationships and port mappings

Reviewed Changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
api/tempo/v1alpha1/tempostack_types.go	Adds NetworkingSpec struct and networking field to TempoStackSpec
internal/manifests/networking/operands.go	Main function to generate network policies for all operands
internal/manifests/networking/components.go	Core logic for generating per-component policies and defining relationships
internal/manifests/networking/components_test.go	Test cases for network policy generation and relation reversal
config/crd/bases/tempo.grafana.com_tempostacks.yaml	CRD definition update for networking spec
bundle//manifests/	Generated bundle files with CRD and CSV updates

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-09-08T11:15:58Z

api/tempo/v1alpha1/tempostack_types.go

 	ExtraConfig *ExtraConfigSpec `json:"extraConfig,omitempty"`
 }

+// ObservabilitySpec defines how networking configs are handled.


The comment incorrectly states 'ObservabilitySpec' when it should be 'NetworkingSpec'.

Suggested change

// ObservabilitySpec defines how networking configs are handled.

// NetworkingSpec defines how networking configs are handled.

Copilot · 2025-09-08T11:15:59Z

internal/manifests/networking/components.go

+		s3Conn = []networkingv1.NetworkPolicyPort{
+			{ // TODO: get this from secret?
+				Protocol: ptr.To(corev1.ProtocolTCP),
+				Port:     ptr.To(intstr.FromInt(443)),
+			},
+			{ // TODO: get this from secret?
+				Protocol: ptr.To(corev1.ProtocolTCP),
+				Port:     ptr.To(intstr.FromInt(9000)),
+			},


Hardcoded ports 443 and 9000 for S3 connections should be configurable or derived from the storage configuration. The TODO comments indicate this is a known issue that should be addressed.

Copilot · 2025-09-08T11:15:59Z

internal/manifests/networking/components.go

+		}
+	)
+	clusterIngress := map[string][]networkingv1.NetworkPolicyPort{}
+	if tempo.Spec.Template.Gateway.Enabled { // TODO: add cluster -> gateway access


Empty port slice assignment should include a comment explaining why no specific ports are defined for gateway access or implement the TODO mentioned in the comment above.

Suggested change

if tempo.Spec.Template.Gateway.Enabled { // TODO: add cluster -> gateway access

if tempo.Spec.Template.Gateway.Enabled { // TODO: add cluster -> gateway access

// No specific ports are defined for gateway access yet; this is intentional and will be updated per the TODO above.

Copilot · 2025-09-08T11:15:59Z

internal/manifests/networking/components.go

+		clusterIngress[manifestutils.GatewayComponentName] = []networkingv1.NetworkPolicyPort{}
+	}
+
+	if tempo.Spec.Template.QueryFrontend.JaegerQuery.Enabled { // TODO: add cluster -> jaegerQuery access


Empty port slice assignment should include a comment explaining why no specific ports are defined for Jaeger frontend access or implement the TODO mentioned in the comment above.

Suggested change

if tempo.Spec.Template.QueryFrontend.JaegerQuery.Enabled { // TODO: add cluster -> jaegerQuery access

if tempo.Spec.Template.QueryFrontend.JaegerQuery.Enabled { // TODO: add cluster -> jaegerQuery access

// No ports defined for Jaeger frontend access as it is not exposed to the cluster by default.

frzifus requested review from rubenvp8510 and andreasgerstmayr July 22, 2025 11:44

frzifus force-pushed the networking branch 2 times, most recently from 7bd6f48 to 1d1cb4b Compare July 23, 2025 09:17

frzifus commented Jul 23, 2025

View reviewed changes

andreasgerstmayr reviewed Jul 23, 2025

View reviewed changes

internal/manifests/networking/components.go Show resolved Hide resolved

andreasgerstmayr reviewed Jul 23, 2025

View reviewed changes

frzifus added 2 commits July 28, 2025 14:32

Add option to recconcile network policies for operands

7b883d8

Signed-off-by: Benedikt Bongartz <[email protected]>

regenerate tempostack api

ae5953c

Signed-off-by: Benedikt Bongartz <[email protected]>

frzifus force-pushed the networking branch from 1d1cb4b to ae5953c Compare July 28, 2025 12:35

pavolloffay reviewed Jul 30, 2025

View reviewed changes

pavolloffay requested a review from Copilot September 8, 2025 11:14

Copilot AI reviewed Sep 8, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

generate network policy per operand #1246

generate network policy per operand #1246

Uh oh!

frzifus commented Jul 22, 2025 •

edited

Loading

Uh oh!

frzifus Jul 23, 2025

Uh oh!

Uh oh!

andreasgerstmayr left a comment

Uh oh!

frzifus commented Jul 23, 2025

Uh oh!

pavolloffay left a comment

Uh oh!

pavolloffay Jul 30, 2025

Uh oh!

pavolloffay Jul 30, 2025

Uh oh!

pavolloffay Jul 30, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Sep 8, 2025

Uh oh!

Copilot AI Sep 8, 2025

Uh oh!

Copilot AI Sep 8, 2025

Uh oh!

Copilot AI Sep 8, 2025

Uh oh!

Uh oh!

	// ObservabilitySpec defines how networking configs are handled.
	// NetworkingSpec defines how networking configs are handled.

	if tempo.Spec.Template.Gateway.Enabled { // TODO: add cluster -> gateway access
	if tempo.Spec.Template.Gateway.Enabled { // TODO: add cluster -> gateway access
	// No specific ports are defined for gateway access yet; this is intentional and will be updated per the TODO above.

	if tempo.Spec.Template.QueryFrontend.JaegerQuery.Enabled { // TODO: add cluster -> jaegerQuery access
	if tempo.Spec.Template.QueryFrontend.JaegerQuery.Enabled { // TODO: add cluster -> jaegerQuery access
	// No ports defined for Jaeger frontend access as it is not exposed to the cluster by default.

generate network policy per operand #1246

Are you sure you want to change the base?

generate network policy per operand #1246

Uh oh!

Conversation

frzifus commented Jul 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

frzifus Jul 23, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

andreasgerstmayr left a comment

Choose a reason for hiding this comment

Uh oh!

frzifus commented Jul 23, 2025

Uh oh!

pavolloffay left a comment

Choose a reason for hiding this comment

Uh oh!

pavolloffay Jul 30, 2025

Choose a reason for hiding this comment

Uh oh!

pavolloffay Jul 30, 2025

Choose a reason for hiding this comment

Uh oh!

pavolloffay Jul 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Sep 8, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 8, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 8, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 8, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

frzifus commented Jul 22, 2025 •

edited

Loading