Skip to content

feat(operator): deploy network policies with LokiStack - #19099

Merged
JoaoBraveCoding merged 18 commits into
grafana:mainfrom
JoaoBraveCoding:LOG-7198
Oct 18, 2025
Merged

feat(operator): deploy network policies with LokiStack#19099
JoaoBraveCoding merged 18 commits into
grafana:mainfrom
JoaoBraveCoding:LOG-7198

Conversation

@JoaoBraveCoding

@JoaoBraveCoding JoaoBraveCoding commented Sep 3, 2025 •
edited
Loading

Copy link
Copy Markdown
Collaborator

What this PR does / why we need it:
This PR introduces the ability to enable network policies. By enabling network policies the operator will deploy a set of policies with the goal of restricting the allowed communications to&by LokiStack components to only the ones strictly necessary

Which issue(s) this PR fixes:
https://issues.redhat.com/browse/LOG-7198

Special notes for your reviewer:
In this PR we have introduced the struck of FeatureValidator which goal is to tell the code if a certain feature should be enabled or not. This was introduced as for the first time instead of adding NetworkPolicies to the feature gate we are instead adding them to the LokiStack API since they are something that should be enabled per LokiStack deployment.

Checklist

  • Reviewed the CONTRIBUTING.md guide (required)
  • Documentation added
  • Tests updated
  • Title matches the required conventional commits format, see here
    • Note that Promtail is considered to be feature complete, and future development for logs collection will be in Grafana Alloy. As such, feat PRs are unlikely to be accepted unless a case can be made for the feature actually being a bug fix to existing behavior.
  • Changes that require user attention or interaction to upgrade are documented in docs/sources/setup/upgrade/_index.md
  • If the change is deprecating or removing a configuration option, update the deprecated-config.yaml and deleted-config.yaml files respectively in the tools/deprecated-config-checker directory. Example PR
@JoaoBraveCoding
JoaoBraveCoding force-pushed the LOG-7198 branch 12 times, most recently from 3949cf1 to 1226c1f Compare September 8, 2025 11:14
@JoaoBraveCoding
feat(operator): deploy network policies with LokiStack
e9b1d33 
**What this PR does / why we need it:**
This PR introduces the ability to enable network policies. By enabling network policies the operator will deploy a set of policies with the goal of restricting the allowed communications to&by LokiStack components to only the ones strictly necessary

**Which issue(s) this PR fixes**:
https://issues.redhat.com/browse/LOG-7198

**Special notes for your reviewer**:
In this PR we have introduced the struck of `FeatureGate` which
goal is to tell the code if a certain feature should be enabled or not.
This was introduced as for the first time instead of adding
NetworkPolicies to the feature gate we are instead adding them to the
LokiStack API since they are something that should be enabled per
LokiStack deployment.
@JoaoBraveCoding
JoaoBraveCoding marked this pull request as ready for review September 9, 2025 10:43
JoaoBraveCoding
JoaoBraveCoding commented Sep 24, 2025
View reviewed changes
Comment thread operator/api/loki/v1/lokistack_types.go Outdated
xperimental
xperimental reviewed Oct 13, 2025
View reviewed changes

@xperimental xperimental left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Quick first pass. Worked fine in a cluster, but I have not looked at the actual policies yet. 🙂
Comment thread operator/api/loki/v1/lokistack_types.go Outdated
Comment thread operator/api/loki/v1/lokistack_types.go Outdated
xperimental
xperimental reviewed Oct 15, 2025
View reviewed changes
Comment thread operator/api/loki/v1/lokistack_types.go Outdated
Comment thread operator/api/loki/v1/lokistack_types.go Outdated
Comment thread operator/internal/handlers/internal/openshift/version.go
Comment thread operator/internal/handlers/internal/openshift/version.go Outdated
Comment thread operator/internal/handlers/lokistack_create_or_update.go Outdated
Comment thread operator/internal/manifests/build.go Outdated
Comment thread operator/internal/manifests/features.go Outdated
Comment thread operator/internal/manifests/networkpolicy.go Outdated
Comment thread operator/internal/manifests/networkpolicy.go
Comment thread operator/internal/manifests/networkpolicy.go
Ports: []networkingv1.NetworkPolicyPort{
{
Protocol: ptr.To(corev1.ProtocolTCP),
Port: &intstr.IntOrString{Type: intstr.Int, IntVal: 6443},

@xperimental xperimental Oct 15, 2025

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Interesting. I would have guessed that we need the service port here and not the container port (kubernetes.default.svc has port 443 in my testcluster).

Is it maybe possible to specify "egress to the kubernetes.default.svc" instead of just listing the port here?

@JoaoBraveCoding JoaoBraveCoding Oct 16, 2025

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This one did it like so because of https://docs.google.com/document/d/1CDoGSRd-h8VT4PMrK_83Ro0YzYPjORbkxtfTJU1sN6Q/edit?tab=t.0#heading=h.r5za8itrk0hm
@JoaoBraveCoding
JoaoBraveCoding force-pushed the LOG-7198 branch 2 times, most recently from fd8c0da to 068fa2f Compare October 16, 2025 16:08
xperimental
xperimental reviewed Oct 17, 2025
View reviewed changes
Comment thread operator/docs/user-guides/network_policies.md Outdated
Comment thread operator/docs/user-guides/network_policies.md Outdated
Comment thread operator/docs/user-guides/network_policies.md Outdated
Comment thread operator/docs/user-guides/network_policies.md Outdated
Comment thread operator/internal/status/status.go
Comment thread operator/internal/handlers/internal/openshift/version.go
Comment thread operator/internal/manifests/openshift/version_test.go Outdated
Comment thread operator/internal/handlers/lokistack_create_or_update.go Outdated
JoaoBraveCoding and others added 5 commits October 17, 2025 13:42
@JoaoBraveCoding @xperimental
Apply suggestions from code review
dba687d 
Co-authored-by: Robert Jacob <rojacob@redhat.com>
Signed-off-by: Joao Marcal <jmarcal@redhat.com>
@JoaoBraveCoding @xperimental
Update operator/docs/user-guides/network_policies.md
98db74c 
Co-authored-by: Robert Jacob <rojacob@redhat.com>
Signed-off-by: Joao Marcal <jmarcal@redhat.com>
@JoaoBraveCoding
address review comments
00b6549
@JoaoBraveCoding
moved metrics rules to their own NP
b72ad53
@JoaoBraveCoding
fix panic on status
e2a331d
xperimental
xperimental approved these changes Oct 17, 2025
View reviewed changes

@xperimental xperimental left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's go 👍
@JoaoBraveCoding
JoaoBraveCoding merged commit 6e6f61f into grafana:main Oct 18, 2025
71 checks passed
This was referenced Dec 2, 2025
Merged
Merged
@loki-gh-app loki-gh-app Bot mentioned this pull request Apr 2, 2026
Merged
This was referenced Jun 23, 2026
Closed
Merged
@JoaoBraveCoding
JoaoBraveCoding deleted the LOG-7198 branch July 10, 2026 10:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

sig/operator size/XXL

2 participants

@JoaoBraveCoding @xperimental