Update Redis Sentinel NetworkPolicy Rules (#42)

This PR entirely eliminates the redis network policies, retaining only
the sentinel network policy.
Additionally, it introduces an extra `egress` rule for sentinels to
ensure they can connect only within their own namespace.

---------

Co-authored-by: Aaron Kuehler <aaron.kuehler@powerhrg.com>

CHANGELOG.md

@@ -9,6 +9,15 @@ Also check this project's [releases](https://github.com/powerhome/redis-operator
 
 ## Unreleased
 
+## [v2.0.1] - 2024-02-09
+
+### Fixed
+- [Sentinels shoud only be allowed to talk to pods belonging to their RedisFailover Custom Resource](https://github.com/powerhome/redis-operator/pull/42).
+
+Update notes:
+
+This update modifies how the operator generates network policies. In version v2.0.0, there were two separate network policies: one for Redis and another for Redis Sentinels. From version v2.0.1 onwards, the operator will only generate a network policy for Sentinels. It is crucial to be aware that following the upgrade to this version, the existing network policy for Redis instances will persist and must be deleted manually.
+
 ## [v2.0.0] - 2024-01-18
 
 ### Added

Makefile

@@ -1,4 +1,4 @@
-VERSION := v2.0.0
+VERSION := v2.0.1
 
 # Name of this service/application
 SERVICE_NAME := redis-operator

operator/redisfailover/ensurer.go

@@ -20,9 +20,6 @@ func (w *RedisFailoverHandler) Ensure(rf *redisfailoverv1.RedisFailover, labels
 	}
 
 	if !(len(rf.Spec.NetworkPolicyNsList) == 0) {
-		if err := w.rfService.EnsureRedisNetworkPolicy(rf, labels, or); err != nil {
-			return err
-		}
 		if err := w.rfService.EnsureSentinelNetworkPolicy(rf, labels, or); err != nil {
 			return err
 		}

operator/redisfailover/service/client.go

@@ -19,7 +19,6 @@ type RedisFailoverClient interface {
 	EnsureHAProxyRedisMasterConfigmap(rFailover *redisfailoverv1.RedisFailover, labels map[string]string, ownerRefs []metav1.OwnerReference) error
 	EnsureHAProxyRedisMasterService(rFailover *redisfailoverv1.RedisFailover, labels map[string]string, ownerRefs []metav1.OwnerReference) error
 	EnsureRedisHeadlessService(rFailover *redisfailoverv1.RedisFailover, labels map[string]string, ownerRefs []metav1.OwnerReference) error
-	EnsureRedisNetworkPolicy(rFailover *redisfailoverv1.RedisFailover, labels map[string]string, ownerRefs []metav1.OwnerReference) error
 	EnsureSentinelNetworkPolicy(rFailover *redisfailoverv1.RedisFailover, labels map[string]string, ownerRefs []metav1.OwnerReference) error
 	EnsureSentinelService(rFailover *redisfailoverv1.RedisFailover, labels map[string]string, ownerRefs []metav1.OwnerReference) error
 	EnsureSentinelConfigMap(rFailover *redisfailoverv1.RedisFailover, labels map[string]string, ownerRefs []metav1.OwnerReference) error
@@ -87,14 +86,6 @@ func generateComponentLabel(componentType string) map[string]string {
 	}
 }
 
-// EnsureRedisNetworkPolicy makes sure the redis network policy exists
-func (r *RedisFailoverKubeClient) EnsureRedisNetworkPolicy(rf *redisfailoverv1.RedisFailover, labels map[string]string, ownerRefs []metav1.OwnerReference) error {
-	svc := generateRedisNetworkPolicy(rf, labels, ownerRefs)
-	err := r.K8SService.CreateOrUpdateNetworkPolicy(rf.Namespace, svc)
-	r.setEnsureOperationMetrics(svc.Namespace, svc.Name, "EnsureRedisNetworkPolicy", rf.Name, err)
-	return err
-}
-
 // EnsureSentinelNetworkPolicy makes sure the redis network policy exists
 func (r *RedisFailoverKubeClient) EnsureSentinelNetworkPolicy(rf *redisfailoverv1.RedisFailover, labels map[string]string, ownerRefs []metav1.OwnerReference) error {
 	svc := generateSentinelNetworkPolicy(rf, labels, ownerRefs)

operator/redisfailover/service/generator.go

@@ -456,63 +456,6 @@ func generateHAProxyRedisSlaveService(rf *redisfailoverv1.RedisFailover, labels
 	}
 }
 
-func generateRedisNetworkPolicy(rf *redisfailoverv1.RedisFailover, labels map[string]string, ownerRefs []metav1.OwnerReference) *np.NetworkPolicy {
-	name := GetRedisNetworkPolicyName(rf)
-	namespace := rf.Namespace
-
-	networkPolicyNsList := rf.Spec.NetworkPolicyNsList
-
-	selectorLabels := generateSelectorLabels(redisRoleName, rf.Name)
-	labels = util.MergeLabels(labels, selectorLabels)
-
-	metricsTargetPort := intstr.FromInt(9121)
-	redisTargetPort := intstr.FromInt(int(rf.Spec.Redis.Port))
-
-	peers := []np.NetworkPolicyPeer{}
-
-	for _, inputPeer := range networkPolicyNsList {
-
-		labelKey := inputPeer.MatchLabelKey
-		labelValue := inputPeer.MatchLabelValue
-
-		peers = append(peers, np.NetworkPolicyPeer{
-			NamespaceSelector: &metav1.LabelSelector{
-				MatchLabels: map[string]string{labelKey: labelValue},
-			},
-		})
-	}
-
-	ports := make([]np.NetworkPolicyPort, 0)
-	ports = append(ports, np.NetworkPolicyPort{
-		Port: &redisTargetPort,
-	}, np.NetworkPolicyPort{
-		Port: &metricsTargetPort,
-	})
-
-	return &np.NetworkPolicy{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:            name,
-			Namespace:       namespace,
-			Labels:          labels,
-			OwnerReferences: ownerRefs,
-		},
-		Spec: np.NetworkPolicySpec{
-			PodSelector: metav1.LabelSelector{
-				MatchLabels: util.MergeLabels(
-					map[string]string{"redisfailovers.databases.spotahome.com/name": rf.Name},
-					generateComponentLabel("redis"),
-				),
-			},
-			Ingress: []np.NetworkPolicyIngressRule{
-				np.NetworkPolicyIngressRule{
-					From:  peers,
-					Ports: ports,
-				},
-			},
-		},
-	}
-}
-
 func generateSentinelNetworkPolicy(rf *redisfailoverv1.RedisFailover, labels map[string]string, ownerRefs []metav1.OwnerReference) *np.NetworkPolicy {
 	name := GetSentinelNetworkPolicyName(rf)
 	namespace := rf.Namespace
@@ -543,6 +486,8 @@ func generateSentinelNetworkPolicy(rf *redisfailoverv1.RedisFailover, labels map
 		Port: &sentinelTargetPort,
 	})
 
+	redisfailoverLabels := map[string]string{"redisfailovers.databases.spotahome.com/name": rf.Name}
+
 	return &np.NetworkPolicy{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:            name,
@@ -553,7 +498,7 @@ func generateSentinelNetworkPolicy(rf *redisfailoverv1.RedisFailover, labels map
 		Spec: np.NetworkPolicySpec{
 			PodSelector: metav1.LabelSelector{
 				MatchLabels: util.MergeLabels(
-					map[string]string{"redisfailovers.databases.spotahome.com/name": rf.Name},
+					redisfailoverLabels,
 					generateComponentLabel("sentinel"),
 				),
 			},
@@ -563,6 +508,17 @@ func generateSentinelNetworkPolicy(rf *redisfailoverv1.RedisFailover, labels map
 					Ports: ports,
 				},
 			},
+			Egress: []np.NetworkPolicyEgressRule{
+				np.NetworkPolicyEgressRule{
+					To: []np.NetworkPolicyPeer{
+						np.NetworkPolicyPeer{
+							PodSelector: &metav1.LabelSelector{
+								MatchLabels: redisfailoverLabels,
+							},
+						},
+					},
+				},
+			},
 		},
 	}
 }