ROSAENG-60641: Allow privileged service accounts to create NetworkPolicies in openshift-ingress

pkg/webhooks/networkpolicies/networkpolicies.go

@@ -96,6 +96,16 @@ func (s *networkpoliciesruleWebhook) authorized(request admissionctl.Request) ad
 	}
 
 	if np.GetNamespace() == "openshift-ingress" {
+		// Allow privileged service accounts (e.g. redhat-*, openshift-*) to
+		// manage NetworkPolicies for non-ingress-controller pods deployed in
+		// this namespace, such as kube-auth-proxy or payload-processing.
+		for _, group := range request.UserInfo.Groups {
+			if privilegedServiceAccountGroupsRe.Match([]byte(group)) {
+				ret = admissionctl.Allowed(fmt.Sprintf("Privileged service accounts in group(s) '%s' can operate on NetworkPolicies in openshift-ingress", strings.Join(request.UserInfo.Groups, ", ")))
+				ret.UID = request.AdmissionRequest.UID
+				return ret
+			}
+		}
 		ingressName, labelFound := np.Spec.PodSelector.MatchLabels["ingresscontroller.operator.openshift.io/deployment-ingresscontroller"]
 		if !labelFound || ingressName == "default" {
 			ret = admissionctl.Denied(fmt.Sprintf("User '%s' prevented from creating network policy that may impact default ingress, which is managed by Red Hat. This is in an effort to prevent harmful actions that may cause unintended consequences or affect the stability of the cluster. If you have any questions about this, please reach out to Red Hat support at https://access.redhat.com/support", request.UserInfo.Username))

pkg/webhooks/networkpolicies/networkpolicies_test.go

@@ -82,6 +82,12 @@ func (t crudTest) redhatServiceAccount() crudTest {
 	return t
 }
 
+func (t crudTest) rhoaiServiceAccount() crudTest {
+	t.testData.username = "system:serviceaccount:redhat-ods-operator:redhat-ods-operator-controller-manager"
+	t.testData.userGroups = []string{"system:serviceaccounts:redhat-ods-operator", "system:authenticated", "system:authenticated:oauth"}
+	return t
+}
+
 func (t crudTest) namespace(namespace string) crudTest {
 	t.testData.targetNamespace = namespace
 	return t
@@ -245,5 +251,23 @@ func TestUsers(t *testing.T) {
 		podSelector("ingresscontroller.operator.openshift.io/deployment-ingresscontroller", "custom").
 		regularUser().shouldBeAllowed())
 
+	// Privileged service accounts (redhat-*, openshift-*) should be allowed
+	// to create NetworkPolicies in openshift-ingress without the ingress
+	// controller label. This is needed for operators like RHOAI that deploy
+	// pods (kube-auth-proxy, payload-processing) into openshift-ingress.
+	tests = append(tests, newCrudTest("rhoai-sa-openshift-ingress-no-ingress-label").
+		namespace("openshift-ingress").
+		podSelector("app", "kube-auth-proxy").
+		rhoaiServiceAccount().shouldBeAllowedCRUD()...)
+	tests = append(tests, newCrudTest("privileged-sa-openshift-ingress-no-ingress-label").
+		namespace("openshift-ingress").
+		podSelector("app", "payload-processing").
+		allowedServiceAccount().shouldBeAllowedCRUD()...)
+	// Unprivileged SAs should still be denied
+	tests = append(tests, newCrudTest("unprivileged-sa-openshift-ingress-no-ingress-label").
+		namespace("openshift-ingress").
+		podSelector("app", "some-pod").
+		unprivilegedServiceAccount().shouldBeDeniedCRUD()...)
+
 	runNetworkPolicyTests(t, tests)
 }