Configuring network policy for the operand¶

The External Secrets Operator for Red Hat OpenShift for OpenShift Container Platform includes pre-defined NetworkPolicies for security that rejects all egress traffic and allows traffic towards services that are required for the operand functionality. You must configure additional custom policies to allow the external-secrets controller to egress traffic towards external providers. These configurable policies are set through the ExternalSecretsConfig custom resource to establish the egress allow policy.

Adding a custom network policy to allow egress to all external providers¶

You must configure custom policies through the ExternalSecretsConfig custom resource to allow all egress to all external providers.

Prerequisites

• An ExternalSecretsConfig must be predefined.
• You must be able to define specific egress rules, including destination ports and protocols.

Procedure

1. Edit the ExternalSecretsConfig CR by running the following command:
   terminal

   $ oc edit externalsecretsconfigs.operator.openshift.io cluster

2. Set the policy by editing the networkPolicies section:
   yaml

   apiVersion: operator.openshift.io/v1alpha1
   kind: ExternalSecretsConfig
   metadata:
     name: cluster
   spec:
     controllerConfig:
       networkPolicies:
         - name: allow-external-secrets-egress
           componentName: CoreController
           egress: # Allow all egress traffic

Adding a custom network policy to allow egress to a specific provider¶

You must configure custom policies through the ExternalSecretsConfig custom resource to allow all egress to a specific provider.

Prerequisites

• An ExternalSecretsConfig must be predefined.
• You must be able to define specific egress rules, including destination ports and protocols

Procedure

1. Edit the ExternalSecretsConfig CR by running the following command:
   terminal

   $ oc edit externalsecretsconfigs.operator.openshift.io cluster

2. Set the policy by editing the networkPolicies section. The following example shows how to allow egress to Amazon Web Services (AWS) endpoints.
   yaml

   apiVersion: operator.openshift.io/v1alpha1
   kind: ExternalSecretsConfig
   metadata:
     name: cluster
   spec:
     controllerConfig:
       networkPolicies:
         - componentName: ExternalSecretsCoreController
           egress:
             # Allow egress to Kubernetes API server, AWS endpoints, and DNS
             - ports:
                 - port: 443   # HTTPS (AWS Secrets Manager)
                   protocol: TCP
         - name: allow-external-secrets-egress

   where:

   componentName

   Specifies the name for the core controller which is ExternalSecretsCoreController. Egress rules must specify the required ports, such as Transmission Control Protocol (TCP) port 443, for services such as the AWS Secrets Manager.

Default ingress and egress rules¶

The ingress and egress rules are necessary to build a secure setup where every component acts with the least amount of privilege necessary. These rules protect your cluster by strictly blocking unnecessary traffic and only allowing the outbound connections needed to fetch secrets. They also permit the specific inbound connections required to validate webhooks and observe system performance.

The following table summarizes the specific ports and protocols used by each component.