revert(operator): remove operator-managed NetworkPolicy

api/v1alpha1/dragonfly_types.go

@@ -189,14 +189,6 @@ type DragonflySpec struct {
 	// +kubebuilder:validation:Optional
 	EnableReplicationReadinessGate bool `json:"enableReplicationReadinessGate,omitempty"`
 
-	// (Optional) Whether to create a NetworkPolicy for this Dragonfly instance.
-	// The NetworkPolicy restricts admin port access to operator and peer pods only.
-	// Defaults to true.
-	// +optional
-	// +kubebuilder:validation:Optional
-	// +kubebuilder:default:=true
-	NetworkPolicyEnabled *bool `json:"networkPolicyEnabled,omitempty"`
-
 	// (Optional) Dragonfly Pod Disruption Budget configuration
 	// +optional
 	// +kubebuilder:validation:Optional

charts/dragonfly-operator/templates/clusterroles.yaml

@@ -82,18 +82,6 @@ rules:
       - patch
       - update
       - watch
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - networkpolicies
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
   - apiGroups:
       - dragonflydb.io
     resources:

charts/dragonfly-operator/templates/crds.yaml

@@ -6099,13 +6099,6 @@ spec:
                 description: (Optional) Dragonfly memcached port
                 format: int32
                 type: integer
-              networkPolicyEnabled:
-                default: true
-                description: |-
-                  (Optional) Whether to create a NetworkPolicy for this Dragonfly instance.
-                  The NetworkPolicy restricts admin port access to operator and peer pods only.
-                  Defaults to true.
-                type: boolean
               nodeSelector:
                 additionalProperties:
                   type: string

charts/dragonfly-operator/templates/deployment.yaml

@@ -67,8 +67,6 @@ spec:
             {{- toYaml .Values.rbacProxy.resources | nindent 12 }}
           {{- end }}
         - name: manager
-          command:
-            - /manager
           args:
             - --leader-elect
             {{- if .Values.dragonflyImage }}
@@ -80,11 +78,8 @@ spec:
             {{- with .Values.manager.extraArgs}}
             {{- toYaml . | nindent 12 }}
             {{- end }}
-          env:
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
+          command:
+            - /manager
           securityContext:
             {{- toYaml .Values.manager.securityContext | nindent 12 }}
           image: "{{ .Values.manager.image.repository }}:{{ .Values.manager.image.tag | default .Chart.AppVersion  }}"

cmd/main.go

@@ -145,20 +145,12 @@ func main() {
 
 	defer eventBroadcaster.Shutdown()
 
-	operatorNamespace := getOperatorNamespace()
-	if operatorNamespace != "" {
-		setupLog.Info(fmt.Sprintf("Operator namespace: %s", operatorNamespace))
-	} else {
-		setupLog.Info("Operator namespace could not be determined; admin port NetworkPolicy will be restricted to same-namespace only")
-	}
-
 	if err = (&controller.DragonflyReconciler{
 		Reconciler: controller.Reconciler{
 			Client:                mgr.GetClient(),
 			Scheme:                mgr.GetScheme(),
 			EventRecorder:         eventRecorder,
 			DefaultDragonflyImage: dragonflyImage,
-			OperatorNamespace:     operatorNamespace,
 		},
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "Dragonfly")
@@ -171,7 +163,6 @@ func main() {
 			Scheme:                mgr.GetScheme(),
 			EventRecorder:         eventRecorder,
 			DefaultDragonflyImage: dragonflyImage,
-			OperatorNamespace:     operatorNamespace,
 		},
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "Health")
@@ -236,21 +227,3 @@ func addNamespacesToOpts(namespaces string, ops *ctrl.Options) error {
 	}
 	return nil
 }
-
-const saNamespaceFile = "/var/run/secrets/kubernetes.io/serviceaccount/namespace"
-
-func getOperatorNamespace() string {
-	return resolveOperatorNamespace(saNamespaceFile)
-}
-
-func resolveOperatorNamespace(saFile string) string {
-	if ns, ok := os.LookupEnv("POD_NAMESPACE"); ok && ns != "" {
-		return ns
-	}
-	if data, err := os.ReadFile(saFile); err == nil {
-		if ns := strings.TrimSpace(string(data)); ns != "" {
-			return ns
-		}
-	}
-	return ""
-}

config/crd/bases/dragonflydb.io_dragonflies.yaml

@@ -6093,13 +6093,6 @@ spec:
                 description: (Optional) Dragonfly memcached port
                 format: int32
                 type: integer
-              networkPolicyEnabled:
-                default: true
-                description: |-
-                  (Optional) Whether to create a NetworkPolicy for this Dragonfly instance.
-                  The NetworkPolicy restricts admin port access to operator and peer pods only.
-                  Defaults to true.
-                type: boolean
               nodeSelector:
                 additionalProperties:
                   type: string

config/manager/manager.yaml

@@ -72,11 +72,6 @@ spec:
         - --leader-elect
         image: controller:latest
         name: manager
-        env:
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:

config/rbac/role.yaml

@@ -71,18 +71,6 @@ rules:
   - get
   - patch
   - update
-- apiGroups:
-  - networking.k8s.io
-  resources:
-  - networkpolicies
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
 - apiGroups:
   - policy
   resources:

e2e/dragonfly_controller_test.go

@@ -620,16 +620,14 @@ user john on >peacepass -@all +@string +hset
 				},
 			})
 			Expect(err).To(BeNil())
-			disabled := false
 			err = k8sClient.Create(ctx, &resourcesv1.Dragonfly{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      name,
 					Namespace: namespace,
 				},
 				Spec: resourcesv1.DragonflySpec{
-					Replicas:             1,
-					Args:                 args,
-					NetworkPolicyEnabled: &disabled,
+					Replicas: 1,
+					Args:     args,
 					AclFromSecret: &corev1.SecretKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
 							Name: "df-acl",

e2e/dragonfly_pod_lifecycle_controller_test.go

@@ -42,15 +42,13 @@ var _ = Describe("DF Pod Lifecycle Reconciler", Ordered, FlakeAttempts(3), func(
 	namespace := "default"
 	replicas := 4
 
-	disabled := false
 	df := dfv1alpha1.Dragonfly{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name,
 			Namespace: namespace,
 		},
 		Spec: dfv1alpha1.DragonflySpec{
-			Replicas:             int32(replicas),
-			NetworkPolicyEnabled: &disabled,
+			Replicas: int32(replicas),
 		},
 	}
 

internal/controller/base_controller.go

@@ -32,7 +32,6 @@ type Reconciler struct {
 	Scheme                *runtime.Scheme
 	EventRecorder         record.EventRecorder
 	DefaultDragonflyImage string
-	OperatorNamespace     string
 }
 
 func (r *Reconciler) getDragonflyInstance(ctx context.Context, namespacedName types.NamespacedName, log logr.Logger) (*DragonflyInstance, error) {
@@ -50,6 +49,5 @@ func (r *Reconciler) getDragonflyInstance(ctx context.Context, namespacedName ty
 		scheme:                r.Scheme,
 		eventRecorder:         r.EventRecorder,
 		defaultDragonflyImage: r.DefaultDragonflyImage,
-		operatorNamespace:     r.OperatorNamespace,
 	}, nil
 }

internal/controller/dragonfly_controller.go

@@ -24,7 +24,6 @@ import (
 	dfv1alpha1 "github.com/dragonflydb/dragonfly-operator/api/v1alpha1"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
-	networkingv1 "k8s.io/api/networking/v1"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/builder"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -46,7 +45,6 @@ type DragonflyReconciler struct {
 //+kubebuilder:rbac:groups="",resources=pods,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups="",resources=events,verbs=create;patch
 //+kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch;create;update;patch;delete
-//+kubebuilder:rbac:groups=networking.k8s.io,resources=networkpolicies,verbs=get;list;watch;create;update;patch;delete
 
 // Reconcile is part of the main kubernetes reconciliation loop which aims to
 // move the current state of the cluster closer to the desired state.
@@ -160,7 +158,6 @@ func (r *DragonflyReconciler) SetupWithManager(mgr ctrl.Manager) error {
 		Owns(&appsv1.StatefulSet{}, builder.MatchEveryOwner).
 		Owns(&corev1.Service{}, builder.MatchEveryOwner).
 		Owns(&corev1.ConfigMap{}, builder.MatchEveryOwner).
-		Owns(&networkingv1.NetworkPolicy{}, builder.MatchEveryOwner).
 		Named("Dragonfly").
 		Complete(r)
 }

internal/controller/dragonfly_instance.go

@@ -33,7 +33,6 @@ import (
 	"github.com/redis/go-redis/v9/maintnotifications"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
-	networkingv1 "k8s.io/api/networking/v1"
 	policyv1 "k8s.io/api/policy/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -54,7 +53,6 @@ type DragonflyInstance struct {
 	scheme                *runtime.Scheme
 	eventRecorder         record.EventRecorder
 	defaultDragonflyImage string
-	operatorNamespace     string
 	redisClients          map[string]*redis.Client
 }
 
@@ -617,7 +615,7 @@ func (dfi *DragonflyInstance) hasMasterRole(ctx context.Context, redisClient *re
 
 // reconcileResources creates or updates the dragonfly resources
 func (dfi *DragonflyInstance) reconcileResources(ctx context.Context) error {
-	dfResources, err := resources.GenerateDragonflyResources(dfi.df, dfi.defaultDragonflyImage, dfi.operatorNamespace)
+	dfResources, err := resources.GenerateDragonflyResources(dfi.df, dfi.defaultDragonflyImage)
 	if err != nil {
 		return fmt.Errorf("failed to generate dragonfly resources")
 	}
@@ -732,16 +730,6 @@ func (dfi *DragonflyInstance) reconcileResources(ctx context.Context) error {
 			return fmt.Errorf("failed to delete pod disruption budget: %w", err)
 		}
 	}
-	if dfi.df.Spec.NetworkPolicyEnabled != nil && !*dfi.df.Spec.NetworkPolicyEnabled {
-		if err = dfi.client.Delete(ctx, &networkingv1.NetworkPolicy{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      dfi.df.Name,
-				Namespace: dfi.df.Namespace,
-			},
-		}); err != nil && !apierrors.IsNotFound(err) {
-			return fmt.Errorf("failed to delete network policy: %w", err)
-		}
-	}
 	status := dfi.getStatus()
 	if status.Phase == "" {
 		status.Phase = PhaseResourcesCreated

internal/resources/const.go

@@ -97,13 +97,6 @@ const (
 
 	ReplicationReadyConditionType = "dragonflydb.io/replication-ready"
 
-	OperatorControlPlaneLabelKey   = "control-plane"
-	OperatorControlPlaneLabelValue = "controller-manager"
-
-	// KubernetesNamespaceLabelKey is the well-known label automatically set on
-	// namespaces by Kubernetes >= 1.21, used to pin NetworkPolicy selectors.
-	KubernetesNamespaceLabelKey = "kubernetes.io/metadata.name"
-
 	// Probe ConfigMap suffixes — appended to df.Name
 	LivenessProbeConfigMapSuffix  = "liveness-probe"
 	ReadinessProbeConfigMapSuffix = "readiness-probe"

internal/resources/image_test.go

@@ -44,7 +44,7 @@ func TestGenerateDragonflyResources_ImageResolution(t *testing.T) {
 				},
 			}
 
-			objs, err := GenerateDragonflyResources(df, tt.defaultImage, "")
+			objs, err := GenerateDragonflyResources(df, tt.defaultImage)
 			assert.NoError(t, err)
 
 			var sts *appsv1.StatefulSet