From 1abbcf07fc0efe8dd5f7b0a438353579bfdf7dc2 Mon Sep 17 00:00:00 2001 From: Przemyslaw Roguski Date: Thu, 23 Jul 2026 18:47:10 +0200 Subject: [PATCH 1/2] fix: add egress NetworkPolicy for CA extractor on OCP 4.22 OCP 4.22 introduces platform-managed default-deny NetworkPolicies in openshift-config namespace. This blocks the ztvp-certificates CA extractor Job from reaching the Kubernetes API server and CoreDNS, causing cascading deployment failures (no trusted CA ConfigMap, qtodo stuck in Init, ACS Central unconfigured). Add an egress NetworkPolicy that allows the CA extractor pods to reach the k8s API (port 6443) and CoreDNS (port 5353). The policy is harmless on OCP 4.21 and earlier where no default-deny exists. Also update DEVELOPMENT.md with supported OCP versions table and add 4.22 to the recommended provisioning options. Verified on OCP 4.22.4: cert extractor completes in 13s (vs 7+ min timeout without the policy), all ArgoCD apps recover to Synced/Healthy. Co-authored-by: Cursor --- .../templates/ca-extractor-netpol.yaml | 38 +++++++++++++++++++ docs/DEVELOPMENT.md | 14 ++++++- 2 files changed, 51 insertions(+), 1 deletion(-) create mode 100644 charts/ztvp-certificates/templates/ca-extractor-netpol.yaml diff --git a/charts/ztvp-certificates/templates/ca-extractor-netpol.yaml b/charts/ztvp-certificates/templates/ca-extractor-netpol.yaml new file mode 100644 index 00000000..466541ce --- /dev/null +++ b/charts/ztvp-certificates/templates/ca-extractor-netpol.yaml @@ -0,0 +1,38 @@ +{{- if .Values.enabled }} +--- +# Egress NetworkPolicy for the CA extractor Job/CronJob. +# Required on OCP 4.22+ where platform-managed default-deny-all +# NetworkPolicies block all egress from pods in openshift-config. +# On OCP 4.21 and earlier this policy is harmless (no default-deny exists). +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "ztvp-certificates.fullname" . }}-ca-extractor-allow-egress + namespace: {{ .Values.global.namespace }} + annotations: + argocd.argoproj.io/sync-wave: "22" + labels: + {{- include "ztvp-certificates.labels" . | nindent 4 }} +spec: + podSelector: + matchLabels: + {{- include "ztvp-certificates.selectorLabels" . | nindent 6 }} + policyTypes: + - Egress + egress: + # Kubernetes API server — port-only rule because API endpoints + # are node IPs after DNAT and cannot be matched by podSelector + - ports: + - protocol: TCP + port: 6443 + # CoreDNS — OCP uses port 5353 (not 53) + - ports: + - protocol: TCP + port: 5353 + - protocol: UDP + port: 5353 + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: openshift-dns +{{- end }} diff --git a/docs/DEVELOPMENT.md b/docs/DEVELOPMENT.md index ee3fbc55..979396c7 100644 --- a/docs/DEVELOPMENT.md +++ b/docs/DEVELOPMENT.md @@ -2,6 +2,18 @@ This document describes recommended practices for developing and testing against this pattern. +## Supported OCP Versions + +This pattern is tested and supported on the following OpenShift Container Platform versions: + +| OCP Stream | Status | Notes | +|---|---|---| +| **4.20** | Supported | Tested and verified | +| **4.21** | Supported | Tested and verified | +| **4.22** | Supported | Tested and verified | + +Running the pattern on untested OCP versions may result in operator subscription failures or NetworkPolicy-related deployment issues. + ## Testing Environments While you may bring your own (BYO) OpenShift cluster, Red Hat associates and partners may utilize [Red Hat Demo Platform (RHDP)](https://catalog.demo.redhat.com) to provision OpenShift environments for use as targets for pattern development and testing. @@ -18,7 +30,7 @@ The following options should be selected: * Purpose: Trying out a technical solution * Salesforce ID: Can be omitted (See note below) * Cloud Provider: AWS -* OpenShift Version: 4.20, 4.21 +* OpenShift Version: 4.20, 4.21, 4.22 * Cluster Size: multinode * OpenShift Worker count: 5 * OpenShift Worker instance type: m5a.4xlarge From 847445d874dcf8faf8bc12a001ad6cd3286d614c Mon Sep 17 00:00:00 2001 From: Przemyslaw Roguski Date: Fri, 24 Jul 2026 20:18:22 +0200 Subject: [PATCH 2/2] docs corrections about 4.22 --- docs/DEVELOPMENT.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/DEVELOPMENT.md b/docs/DEVELOPMENT.md index 979396c7..7e046a60 100644 --- a/docs/DEVELOPMENT.md +++ b/docs/DEVELOPMENT.md @@ -8,9 +8,9 @@ This pattern is tested and supported on the following OpenShift Container Platfo | OCP Stream | Status | Notes | |---|---|---| +| **< 4.20** | Usupported | | | **4.20** | Supported | Tested and verified | | **4.21** | Supported | Tested and verified | -| **4.22** | Supported | Tested and verified | Running the pattern on untested OCP versions may result in operator subscription failures or NetworkPolicy-related deployment issues. @@ -30,7 +30,7 @@ The following options should be selected: * Purpose: Trying out a technical solution * Salesforce ID: Can be omitted (See note below) * Cloud Provider: AWS -* OpenShift Version: 4.20, 4.21, 4.22 +* OpenShift Version: 4.20, 4.21 * Cluster Size: multinode * OpenShift Worker count: 5 * OpenShift Worker instance type: m5a.4xlarge