fix: Add NetworkPolicy to allow Prometheus metrics scraping on port 8383

pkg/consts/ocmagenthandler/ocmagenthandler.go

@@ -20,6 +20,8 @@ const (
 	OCMAgentOBONetworkPolicySuffix = "-allow-obo-alertmanager"
 	// OCMAgentMUONetworkPolicySuffix is the name of the network policy to restrict OA for MUO
 	OCMAgentMUONetworkPolicySuffix = "-allow-muo-communication"
+	// OCMAgentPrometheusNetworkPolicySuffix is the name of the network policy to allow Prometheus metrics scraping
+	OCMAgentPrometheusNetworkPolicySuffix = "-allow-prometheus-metrics"
 	// OCMAgentPortName is the name of the OCM Agent service port used in the OCM Agent Deployment
 	OCMAgentPortName = "ocm-agent"
 	// OCMAgentPort is the container port number used by the agent for exposing its services
@@ -89,6 +91,10 @@ const (
 	// Verified via: oc get ns observatorium-mst-production -> NotFound (on both MC and SC)
 	NamespaceRHOBS = "rhobs-alertmanager"
 	NamespaceOBO   = "openshift-observability-operator"
+	// NamespacePrometheus is a dispatch key, not a literal k8s namespace: Prometheus runs in
+	// NamespaceMonitorng (openshift-monitoring). This key is used to create a separate
+	// NetworkPolicy allowing prometheus-k8s pods to scrape metrics on port 8383.
+	NamespacePrometheus = "prometheus-k8s"
 
 	// AlertmanagerPodLabelKey/Value identifies the Alertmanager StatefulSet pods in openshift-monitoring
 	AlertmanagerPodLabelKey   = "alertmanager"
@@ -105,6 +111,10 @@ const (
 	// Verified via: oc get po -n openshift-observability-operator -l alertmanager=hypershift-monitoring-stack
 	OBOPodLabelKey   = "alertmanager"
 	OBOPodLabelValue = "hypershift-monitoring-stack"
+	// PrometheusPodLabelKey/Value identifies the Prometheus pods in openshift-monitoring.
+	// Verified via: oc get po -n openshift-monitoring -l app.kubernetes.io/name=prometheus
+	PrometheusPodLabelKey   = "app.kubernetes.io/name"
+	PrometheusPodLabelValue = "prometheus"
 )
 
 var (

pkg/ocmagenthandler/ocmagenthandler_networkpolicy.go

@@ -28,6 +28,8 @@ func buildNetworkPolicyName(ocmAgent ocmagentv1alpha1.OcmAgent, namespace string
 		namespacedName = oah.BuildNamespacedName(ocmAgent.Name + oah.OCMAgentMUONetworkPolicySuffix)
 	case oah.NamespaceOBO:
 		namespacedName = oah.BuildNamespacedName(ocmAgent.Name + oah.OCMAgentOBONetworkPolicySuffix)
+	case oah.NamespacePrometheus:
+		namespacedName = oah.BuildNamespacedName(ocmAgent.Name + oah.OCMAgentPrometheusNetworkPolicySuffix)
 	}
 
 	return namespacedName
@@ -57,6 +59,10 @@ func callerPodSelector(namespace string) (*metav1.LabelSelector, error) {
 		return &metav1.LabelSelector{
 			MatchLabels: map[string]string{oah.OBOPodLabelKey: oah.OBOPodLabelValue},
 		}, nil
+	case oah.NamespacePrometheus:
+		return &metav1.LabelSelector{
+			MatchLabels: map[string]string{oah.PrometheusPodLabelKey: oah.PrometheusPodLabelValue},
+		}, nil
 	default:
 		return nil, fmt.Errorf("callerPodSelector: no pod selector defined for namespace %q", namespace)
 	}
@@ -67,10 +73,14 @@ func callerPodSelector(namespace string) (*metav1.LabelSelector, error) {
 // Alertmanager runs in NamespaceOBO alongside the OBO Alertmanager, not in a namespace of its
 // own (oah.NamespaceRHOBS is a dispatch key, not a literal namespace - see its doc comment).
 func callerNamespace(namespace string) string {
-	if namespace == oah.NamespaceRHOBS {
+	switch namespace {
+	case oah.NamespaceRHOBS:
 		return oah.NamespaceOBO
+	case oah.NamespacePrometheus:
+		return oah.NamespaceMonitorng
+	default:
+		return namespace
 	}
-	return namespace
 }
 
 func buildNetworkPolicy(ocmAgent ocmagentv1alpha1.OcmAgent, namespace string) (netv1.NetworkPolicy, error) {
@@ -115,9 +125,9 @@ func buildNetworkPolicy(ocmAgent ocmagentv1alpha1.OcmAgent, namespace string) (n
 func (o *ocmAgentHandler) ensureAllNetworkPolicies(ctx context.Context, ocmAgent ocmagentv1alpha1.OcmAgent) error {
 	var namespaces []string
 	if ocmAgent.Spec.FleetMode {
-		namespaces = append(namespaces, oah.NamespaceMonitorng, oah.NamespaceRHOBS, oah.NamespaceOBO)
+		namespaces = append(namespaces, oah.NamespaceMonitorng, oah.NamespaceRHOBS, oah.NamespaceOBO, oah.NamespacePrometheus)
 	} else {
-		namespaces = append(namespaces, oah.NamespaceMonitorng, oah.NamespaceMUO)
+		namespaces = append(namespaces, oah.NamespaceMonitorng, oah.NamespaceMUO, oah.NamespacePrometheus)
 	}
 	for _, ns := range namespaces {
 		err := o.ensureNetworkPolicy(ctx, ocmAgent, ns)
@@ -184,9 +194,9 @@ func (o *ocmAgentHandler) ensureNetworkPolicy(ctx context.Context, ocmAgent ocma
 func (o *ocmAgentHandler) ensureAllNetworkPoliciesDeleted(ctx context.Context, ocmAgent ocmagentv1alpha1.OcmAgent) error {
 	var namespaces []string
 	if ocmAgent.Spec.FleetMode {
-		namespaces = append(namespaces, oah.NamespaceMonitorng, oah.NamespaceRHOBS, oah.NamespaceOBO)
+		namespaces = append(namespaces, oah.NamespaceMonitorng, oah.NamespaceRHOBS, oah.NamespaceOBO, oah.NamespacePrometheus)
 	} else {
-		namespaces = append(namespaces, oah.NamespaceMonitorng, oah.NamespaceMUO)
+		namespaces = append(namespaces, oah.NamespaceMonitorng, oah.NamespaceMUO, oah.NamespacePrometheus)
 	}
 	for _, ns := range namespaces {
 		err := o.ensureNetworkPolicyDeleted(ctx, ocmAgent, ns)

pkg/ocmagenthandler/ocmagenthandler_networkpolicy_test.go

@@ -129,6 +129,27 @@ var _ = Describe("OCM Agent NetworkPolicy Handler", func() {
 			})
 		})
 
+		Context("for the Prometheus dispatch key", func() {
+			BeforeEach(func() {
+				testNamespace = oah.NamespacePrometheus
+				var err error
+				networkPolicy, err = buildNetworkPolicy(testOcmAgent, testNamespace)
+				Expect(err).To(BeNil())
+			})
+
+			It("Should restrict ingress to Prometheus pods only", func() {
+				podSelector := networkPolicy.Spec.Ingress[0].From[0].PodSelector
+				Expect(podSelector).NotTo(BeNil())
+				Expect(podSelector.MatchLabels).To(HaveKeyWithValue(oah.PrometheusPodLabelKey, oah.PrometheusPodLabelValue))
+			})
+
+			It("Should scope ingress to the monitoring namespace, since NamespacePrometheus is a dispatch key", func() {
+				nsSelector := networkPolicy.Spec.Ingress[0].From[0].NamespaceSelector
+				Expect(nsSelector).NotTo(BeNil())
+				Expect(nsSelector.MatchLabels).To(HaveKeyWithValue("kubernetes.io/metadata.name", oah.NamespaceMonitorng))
+			})
+		})
+
 		Context("for an unrecognized namespace", func() {
 			It("returns an error instead of silently falling back to a namespace-wide policy", func() {
 				_, err := buildNetworkPolicy(testOcmAgent, "some-other-namespace")
@@ -226,17 +247,17 @@ var _ = Describe("OCM Agent NetworkPolicy Handler", func() {
 
 	Context("ensure all the required networkpolicies created", func() {
 		When("creating a non-fleet ocm-agent", func() {
-			It("should have the 2 networkpolicies created", func() {
-				mockClient.EXPECT().Get(gomock.Any(), gomock.Any(), gomock.Any()).Times(2)
-				mockClient.EXPECT().Update(gomock.Any(), gomock.Any(), gomock.Any()).MinTimes(2)
+			It("should have the 3 networkpolicies created", func() {
+				mockClient.EXPECT().Get(gomock.Any(), gomock.Any(), gomock.Any()).Times(3)
+				mockClient.EXPECT().Update(gomock.Any(), gomock.Any(), gomock.Any()).MinTimes(3)
 				err := testOcmAgentHandler.ensureAllNetworkPolicies(testconst.Context, testOcmAgent)
 				Expect(err).To(BeNil())
 			})
 		})
 		When("creating a fleet ocm-agent", func() {
-			It("should have the 3 networkpolicies created", func() {
-				mockClient.EXPECT().Get(gomock.Any(), gomock.Any(), gomock.Any()).Times(3)
-				mockClient.EXPECT().Update(gomock.Any(), gomock.Any(), gomock.Any()).Times(3)
+			It("should have the 4 networkpolicies created", func() {
+				mockClient.EXPECT().Get(gomock.Any(), gomock.Any(), gomock.Any()).Times(4)
+				mockClient.EXPECT().Update(gomock.Any(), gomock.Any(), gomock.Any()).Times(4)
 				err := testOcmAgentHandler.ensureAllNetworkPolicies(testconst.Context, testFleetOcmAgent)
 				Expect(err).To(BeNil())
 			})