Merge pull request #60 from shruthis4/networkPolicy

Add NetworkPolicy for Spark Operator and update kustomization.yaml

Author: alimaredia

config/overlays/odh/kustomization.yaml

@@ -13,6 +13,7 @@ namespace: opendatahub
 # 2. Import base configuration
 resources:
   - ../../default # Inherits everything from config/default/
+  - networkpolicy.yaml
 
 # 3. Delete the Namespace resource (ODH operator manages it)
 patches:

config/overlays/odh/networkpolicy.yaml

@@ -0,0 +1,26 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+ name: spark-operator-allow-internal
+spec:
+ # This targets the Spark Pods themselves
+ podSelector:
+   matchLabels:
+     sparkoperator.k8s.io/launched-by-spark-operator: "true"
+ policyTypes:
+   - Ingress
+ ingress:
+   - ports:
+       - port: 7078 # driver-rpc
+         protocol: TCP
+       - port: 7079 # blockmanager
+         protocol: TCP
+       - port: 4040 # spark-ui
+         protocol: TCP
+     from:
+       # Allow traffic from ANY pod in the same namespace (matching Dashboard style)
+       - podSelector: {}
+       # OPTIONAL: Add OpenShift Ingress if you want the Spark UI accessible from outside
+       - namespaceSelector:
+           matchLabels:
+             network.openshift.io/policy-group: ingress

config/overlays/rhoai/kustomization.yaml

@@ -13,6 +13,7 @@ namespace: redhat-ods-applications
 # 2. Import base configuration
 resources:
   - ../../default   # Inherits everything from config/default/
+  - networkpolicy.yaml
 
 # 3. Delete the Namespace resource (RHOAI operator manages it)
 patches:

config/overlays/rhoai/networkpolicy.yaml

@@ -0,0 +1,26 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+ name: spark-operator-allow-internal
+spec:
+ # This targets the Spark Pods themselves
+ podSelector:
+   matchLabels:
+     sparkoperator.k8s.io/launched-by-spark-operator: "true"
+ policyTypes:
+   - Ingress
+ ingress:
+   - ports:
+       - port: 7078 # driver-rpc
+         protocol: TCP
+       - port: 7079 # blockmanager
+         protocol: TCP
+       - port: 4040 # spark-ui
+         protocol: TCP
+     from:
+       # Allow traffic from ANY pod in the same namespace (matching Dashboard style)
+       - podSelector: {}
+       # OPTIONAL: Add OpenShift Ingress if you want the Spark UI accessible from outside
+       - namespaceSelector:
+           matchLabels:
+             network.openshift.io/policy-group: ingress