Configure network policy

The operator renders ingress-and-egress NetworkPolicies for OpenBao workload pods and lifecycle Job pods, then adds the paths required for cluster operation. Other pods in the namespace are not selected by these policies. Enforcement depends on a NetworkPolicy-capable CNI.

Add environment-specific peers and egress explicitly; enabling an edge resource does not silently widen pod access.

Understand the managed baseline

The operator always keeps these baseline rules. spec.network adds, rather than replaces, them.

Development lifecycle Jobs are the exception to the strict default: when no egressRules exist, their policy permits IPv4 and IPv6 HTTPS egress on port 443. Adding any explicit egress rule removes that fallback. Hardened backup and restore paths require explicit, scoped egress.

Configure DNS and Kubernetes API egress

The DNS namespace defaults to kube-system. Set it when the resolver pods live elsewhere. Add endpoint IPs for node-local or host-networked resolvers that namespace selection cannot reach.

spec:
  network:
    dnsNamespace: openshift-dns
    dnsEndpointIPs:
      - 169.254.20.10

dnsEndpointIPs becomes an exact host CIDR and applies to the main workload and operator-managed Jobs.

The operator normally derives the Kubernetes API service address. Some CNIs enforce egress after destination NAT and therefore also need the control-plane endpoint IPs.

spec:
  network:
    apiServerCIDR: 10.43.0.1/32
    apiServerEndpointIPs:
      - 192.168.166.2

Use the smallest correct ranges. The operator does not auto-discover endpoint IPs because that would require broader cluster permissions and environment-specific assumptions.

Allow edge and monitoring peers

Use trustedIngressPeers for Gateway data planes, ingress controllers, passthrough proxies, and monitoring systems. The operator limits these peers to port 8200 and also to the configured metrics-listener port when that listener is enabled.

spec:
  network:
    trustedIngressPeers:
      - namespaceSelector:
          matchLabels:
            kubernetes.io/metadata.name: gateway-system
        podSelector:
          matchLabels:
            app.kubernetes.io/name: traefik
      - namespaceSelector:
          matchLabels:
            kubernetes.io/metadata.name: monitoring

Hardened clusters require explicit, non-wildcard sources. They reject raw spec.network.ingressRules. That raw field is a Development compatibility path; prefer trustedIngressPeers even outside Hardened.

Allow external dependencies

Add egressRules for transit unseal, KMS or PKI endpoints, object storage, plugin registries, and other dependencies. Hardened clusters require every user rule to select explicit peers and ports.

spec:
  network:
    egressRules:
      - to:
          - namespaceSelector:
              matchLabels:
                kubernetes.io/metadata.name: openbao-infra
        ports:
          - protocol: TCP
            port: 8200
      - to:
          - ipBlock:
              cidr: 192.0.2.40/32
        ports:
          - protocol: TCP
            port: 443

Object-store Jobs use a separate operator-managed NetworkPolicy. The same egressRules list is appended to both the OpenBao workload policy and the Job policy; it cannot currently scope a transit rule only to OpenBao or a storage rule only to Jobs. The explicit contract is also used to decide whether Hardened backup and restore configurations are safe.

Read the conditions

Inspect both <cluster>-network-policy and <cluster>-jobs-network-policy, then test DNS, Kubernetes API access, the selected edge path, and every external dependency from the affected pod or Job context. A ready condition proves the configuration shape, not that the CNI, NAT path, or external firewall accepts the traffic.