fix: add egress NetworkPolicy for CA extractor on OCP 4.22

[p-rog]

Summary

OCP 4.22 introduces platform-managed default-deny-all NetworkPolicies in core openshift-* namespaces, including openshift-config. These are owned by ClusterVersion/version and cannot be removed. This is a breaking change for the ztvp-certificates chart, whose CA extractor Job runs in openshift-config and requires egress to the Kubernetes API server and CoreDNS.

Without this fix, the CA extractor Job times out on every API call (~150s each), fails to create the ztvp-trusted-ca ConfigMap, and causes cascading failures:

• qtodo pods stuck in Init:0/4 (missing CA volume mount)
• ztvp-certificates ArgoCD app: OutOfSync/Degraded
• ACS Central auth provider not configured

Changes

• New: charts/ztvp-certificates/templates/ca-extractor-netpol.yaml — egress NetworkPolicy allowing CA extractor pods to reach:
  • Kubernetes API server (TCP 6443, port-only rule — endpoints are node IPs after DNAT)
  • CoreDNS (TCP/UDP 5353, scoped to openshift-dns namespace)
  • Sync-wave 22 (before Job at 23), gated by .Values.enabled
  • Uses selectorLabels helper — covers both the initial Job and the CronJob pods
• Updated: docs/DEVELOPMENT.md — added supported OCP versions table (4.20, 4.21, 4.22) and updated recommended provisioning options

Verification

Tested on OCP 4.22.4 (live cluster dry-run):

Check	Result
Cert extractor Job completes	PASS — 13 seconds (vs 7+ min timeout without policy)
ztvp-trusted-ca ConfigMap created	PASS — 234,365 bytes
qtodo pods recover from Init:0/4	PASS — 3/3 Running
qtodo route responds	PASS — HTTP 302 → Keycloak
All ArgoCD apps Synced/Healthy	PASS — 12/13 (ztvp-certificates OutOfSync expected since NP was manually applied)
No regression on OCP 4.21	Expected — policy is harmless when no default-deny exists

Why port-only rules

The k8s API server rule has no to selector because API endpoints are node IPs after DNAT — podSelector and namespaceSelector cannot match them. This is standard OVN-Kubernetes behavior on OpenShift.

Made with Cursor

[mlorenzofr]

The change itself works fine, but unfortunately, during validation, I discovered that we have more dependencies that need to be fixed before we can say that the pattern supports version 4.22.

Changes need to be made to the versions of ODF, RHTAS, quay, and pipelines before considering the pattern valid for that version (supply chain).

[mlorenzofr]

we should remove 4.22 for now

[mlorenzofr]

we should remove 4.22 for now

[mlorenzofr]

Suggested change

	| **4.20** | Supported | Tested and verified |
	| **< 4.20** | Unsupported | |
	| **4.20** | Supported | Tested and verified |

[p-rog]

The change itself works fine, but unfortunately, during validation, I discovered that we have more dependencies that need to be fixed before we can say that the pattern supports version 4.22.

Changes need to be made to the versions of ODF, RHTAS, quay, and pipelines before considering the pattern valid for that version (supply chain).

Ah... true. I didn't test other supply chain use case and its components like ODF, RHTAS or quay.
I tested the layer 0 components.

OK, I will remove 4.22 from the support scope for now. I think still fixing qtodo app make sense. One item less to fix for 4.22 support. WDYT?