fix(gateway): [3.4] add egress rules to kube-auth-proxy NetworkPolicy for OCP 4.22#32266
Open
ugiordan wants to merge 1 commit into
Open
fix(gateway): [3.4] add egress rules to kube-auth-proxy NetworkPolicy for OCP 4.22#32266ugiordan wants to merge 1 commit into
ugiordan wants to merge 1 commit into
Conversation
…CP 4.22 OCP 4.22 introduced a deny-all NetworkPolicy (NE-2501) in the openshift-ingress namespace that blocks both ingress and egress by default. The kube-auth-proxy NetworkPolicy only defined ingress rules, so egress was blocked, preventing the oauth-proxy from reaching the Kubernetes API server for OAuth discovery. This caused RHOAI dashboards to return 403 Forbidden on any OCP 4.22 cluster. Add Egress to policyTypes and allow-all egress rule, matching the pattern used by OCP's own components in the same namespace (router-default, data-science-gateway-allow, istiod-allow). Allow-all egress is required because kube-auth-proxy needs to reach the API server, DNS, and in OIDC mode, arbitrary external identity providers. Jira: RHOAIENG-70137 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This was referenced Jun 23, 2026
grdryn
approved these changes
Jun 23, 2026
grdryn
left a comment
grdryn
left a comment
There was a problem hiding this comment.
/lgtm
Approving from core platform team perspective. I guess this can be merged if/when it's an approved blocker in Jira.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Jira: RHOAIENG-70137
Cherry-pick of opendatahub-io/opendatahub-operator#3682 for rhoai-3.4 backport.
OCP 4.22 introduced a default-deny NetworkPolicy in the openshift-ingress namespace (NE-2501). The kube-auth-proxy NetworkPolicy only defined ingress rules, so egress is blocked, preventing oauth-proxy from reaching the Kubernetes API server for OAuth discovery. Every RHOAI deployment from 3.0 onward returns 403 Forbidden on OCP 4.22.
Fix: add Egress to policyTypes and allow-all egress rule to the kube-auth-proxy NetworkPolicy template.
Related PRs