CORENET-6958: add remaining CNO NetworkPolicies

bindata/cloud-network-config-controller/managed/networkpolicy.yaml

@@ -0,0 +1,15 @@
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: cloud-network-config-controller
+  namespace: {{.HostedClusterNamespace}}
+spec:
+  podSelector:
+    matchLabels:
+      app: cloud-network-config-controller
+  policyTypes:
+    - Egress
+  egress:
+    # CNCC needs access to apiserver and cloud APIs, possibly via a proxy... for now we
+    # just allow all egress.
+    - {}

bindata/cloud-network-config-controller/self-hosted/networkpolicy.yaml

@@ -0,0 +1,15 @@
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: cloud-network-config-controller
+  namespace: openshift-cloud-network-config-controller
+spec:
+  podSelector:
+    matchLabels:
+      app: cloud-network-config-controller
+  policyTypes:
+    - Egress
+  egress:
+    # CNCC needs access to apiserver and cloud APIs, possibly via a proxy... for now we
+    # just allow all egress.
+    - {}

bindata/network/node-identity/managed/node-identity-networkpolicy.yaml

@@ -0,0 +1,19 @@
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: network-node-identity
+  namespace: {{.HostedClusterNamespace}}
+spec:
+  podSelector:
+    matchLabels:
+      app: network-node-identity
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    # Allow to webhook
+    - ports:
+      - port: {{.NetworkNodeIdentityPort}}
+  egress:
+    # Allow to apiserver
+    - {}

bindata/network/ovn-kubernetes/managed/networkpolicy.yaml

@@ -0,0 +1,19 @@
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: ovn-kubernetes
+  namespace: {{.HostedClusterNamespace}}
+spec:
+  podSelector:
+    matchLabels:
+      app: ovnkube-control-plane
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    # Allow ingress to metrics
+    - ports:
+        - port: 9108
+  egress:
+    # Allow egress to apiserver, and to ovnkube-node's egressip-node-healthcheck-port
+    - {}

manifests/01-cncc-namespace.yaml

@@ -14,3 +14,16 @@ metadata:
     openshift.io/node-selector: ""
     openshift.io/description: "OpenShift cloud network config controller namespace - a controller used to manage cloud-level network configuration"
     workload.openshift.io/allowed: "management"
+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: default-deny
+  namespace: openshift-cloud-network-config-controller
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress: []
+  egress: []