feat(netpol): ODCN router-pod selector ipv namespace-naam

Per ODCN docs (docs/knowledge/odcn-ingress-controller.md): de aanbevolen
NetworkPolicy match is pod-selector op
ingresscontroller.operator.openshift.io/deployment-ingresscontroller naast
namespaceSelector. Daarmee alleen de 'rig' router-pods, niet eventuele
andere customer-routers in dezelfde namespace.

cluster_config heeft nu ingress_controller_selector (dict met namespace +
pod_labels). Sandbox/local laten pod_labels leeg (nginx geen OpenShift-
specifieke labels).

Plus: test_internet_egress_is_permissive — geen 169.254 exception meer
(eerder verwijderd want IP is op ODCN niet bereikbaar).

Author: uittenbroekrobbert

operations-manager/python/manifests/tenant-baseline-network-policy.yaml.jinja

@@ -38,10 +38,19 @@ spec:
         - podSelector: {}
 {% endif %}
     # Ingress controller: published web apps stay reachable from outside.
+    # Op odcn matchen we pod-specifiek (alleen 'rig' router pods, niet
+    # eventuele andere customer-routers in dezelfde namespace).
     - from:
         - namespaceSelector:
             matchLabels:
-              kubernetes.io/metadata.name: "{{ ingress_controller_namespace }}"
+              kubernetes.io/metadata.name: "{{ ingress_controller_selector.namespace }}"
+{% if ingress_controller_selector.pod_labels %}
+          podSelector:
+            matchLabels:
+{% for k, v in ingress_controller_selector.pod_labels.items() %}
+              {{ k }}: "{{ v }}"
+{% endfor %}
+{% endif %}
     # Operations / platform namespace (OPI, shared datastores, Keycloak).
     - from:
         - namespaceSelector:

operations-manager/python/opi/core/cluster_config.py

@@ -20,7 +20,10 @@
         "minio_port": 9000,
         "redis_server": "rig-redis.rig-system.svc.cluster.local",
         "backup_namespace": "rig-backup-destination",
-        "ingress_controller_namespace": "ingress-nginx",
+        "ingress_controller_selector": {
+            "namespace": "ingress-nginx",
+            "pod_labels": {},
+        },
         "ingress": {
             "enable_tls": True,
             "cluster_issuer": "kind-ca-issuer",
@@ -69,7 +72,10 @@
         "minio_port": 9000,
         "redis_server": "rig-redis.rig-system.svc.cluster.local",
         "backup_namespace": "rig-backup-destination",
-        "ingress_controller_namespace": "ingress-nginx",
+        "ingress_controller_selector": {
+            "namespace": "ingress-nginx",
+            "pod_labels": {},
+        },
         "ingress": {
             "enable_tls": True,
             "ip_whitelist": "0.0.0.0/0,::/0",
@@ -112,7 +118,12 @@
         "minio_port": 9000,
         "redis_server": "rig-redis.rig-prd-operations.svc.cluster.local",
         "backup_namespace": "rig-prd-backup",
-        "ingress_controller_namespace": "openshift-ingress",
+        "ingress_controller_selector": {
+            "namespace": "openshift-ingress",
+            "pod_labels": {
+                "ingresscontroller.operator.openshift.io/deployment-ingresscontroller": "rig",
+            },
+        },
         "ingress": {
             "enable_tls": True,
             # "cluster_issuer": "letsencrypt-production",  # TODO: verify correct issuer name
@@ -543,22 +554,21 @@ def get_backup_namespace(cluster_name: str) -> str:
     return cluster_config["backup_namespace"]
 
 
-def get_ingress_controller_namespace(cluster_name: str) -> str:
+def get_ingress_controller_selector(cluster_name: str) -> dict:
     """
-    Get the namespace where the cluster's ingress controller pods run.
+    Return de selector voor de ingress-controller pods van een cluster.
 
-    On local/sandbox this is ``ingress-nginx``; on odcn-production it is
-    ``openshift-ingress``. NetworkPolicies use this to allow ingress from
-    the controller so published web apps stay reachable.
+    Format::
 
-    Args:
-        cluster_name: Name of the cluster
+        {"namespace": "<ns>", "pod_labels": {<key>: <val>, ...}}
 
-    Returns:
-        Ingress controller namespace name
+    pod_labels is leeg voor nginx-clusters; voor odcn (OpenShift Router) bevat
+    het de ``ingresscontroller.operator.openshift.io/deployment-ingresscontroller``
+    label zodat NetworkPolicy alleen de juiste customer-router toelaat.
+    Zie docs/knowledge/odcn-ingress-controller.md.
     """
     cluster_config = get_cluster_config(cluster_name)
-    return cluster_config["ingress_controller_namespace"]
+    return cluster_config["ingress_controller_selector"]
 
 
 def get_redis_server(cluster_name: str) -> str:

operations-manager/python/tests/test_tenant_baseline_netpol.py

@@ -37,7 +37,10 @@ def _render_baseline(**overrides):
         "deployment_selector": "myapp",
         "ops_namespace": "rig-system",
         "backup_namespace": "rig-backup-destination",
-        "ingress_controller_namespace": "ingress-nginx",
+        "ingress_controller_selector": {
+            "namespace": "ingress-nginx",
+            "pod_labels": {},
+        },
         "project_infra_namespace": "rig-myproject-infrastructure",
     }
     values.update(overrides)
@@ -159,7 +162,12 @@ def test_platform_namespaces_are_allow_listed(self):
         _, doc = _render_baseline(
             ops_namespace="rig-prd-operations",
             backup_namespace="rig-prd-backup",
-            ingress_controller_namespace="openshift-ingress",
+            ingress_controller_selector={
+                "namespace": "openshift-ingress",
+                "pod_labels": {
+                    "ingresscontroller.operator.openshift.io/deployment-ingresscontroller": "rig",
+                },
+            },
         )
         ingress_targets = {
             peer["namespaceSelector"]["matchLabels"]["kubernetes.io/metadata.name"]
@@ -176,10 +184,9 @@ def test_platform_namespaces_are_allow_listed(self):
         assert {"rig-prd-operations", "openshift-ingress", "rig-prd-backup"} <= ingress_targets
         assert {"rig-prd-operations", "rig-prd-backup"} <= egress_targets
 
-    def test_internet_egress_is_permissive_except_metadata(self):
-        """The baseline does not constrain internet egress (HTTP/HTTPS) on
-        purpose — tightening that is a separate, later step. The cloud-metadata
-        IP (169.254.169.254) is excluded to block SSRF-style probes.
+    def test_internet_egress_is_permissive(self):
+        """De baseline laat HTTP/HTTPS egress open zodat tenant-apps externe
+        APIs kunnen aanroepen. Strikter beleid is een latere stap.
         """
         _, doc = _render_baseline()
         ip_rules = [
@@ -189,8 +196,6 @@ def test_internet_egress_is_permissive_except_metadata(self):
         flat_ports = {p["port"] for rule in ip_rules for p in rule.get("ports", [])}
         assert 443 in flat_ports
         assert 80 in flat_ports
-        excepts = {x for rule in ip_rules for peer in rule["to"] for x in peer.get("ipBlock", {}).get("except", [])}
-        assert "169.254.169.254/32" in excepts, "cloud-metadata IP must be excluded from the internet egress rule"
 
     def test_project_infra_namespace_included_when_distinct(self):
         """When the project has its own infrastructure namespace (dedicated