generate network policy per operand

[frzifus]

Downside of this approach is that we need to manually align the mapping when we change e.g. a service. But we could generate services based on this too. wdyt?

NAME                                      TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                                                                     AGE
tempo-simplest-compactor                  ClusterIP   10.96.115.23    <none>        7946/TCP,3200/TCP                                                           2m8s
tempo-simplest-distributor                ClusterIP   10.96.122.122   <none>        4318/TCP,4317/TCP,3200/TCP,14268/TCP,6831/UDP,6832/UDP,14250/TCP,9411/TCP   2m8s
tempo-simplest-gossip-ring                ClusterIP   None            <none>        7946/TCP                                                                    2m8s
tempo-simplest-ingester                   ClusterIP   10.96.76.66     <none>        3200/TCP,9095/TCP                                                           2m8s
tempo-simplest-querier                    ClusterIP   10.96.206.87    <none>        7946/TCP,3200/TCP,9095/TCP                                                  2m8s
tempo-simplest-query-frontend             ClusterIP   10.96.117.99    <none>        3200/TCP,9095/TCP,16685/TCP,16686/TCP,16687/TCP                             2m8s
tempo-simplest-query-frontend-discovery   ClusterIP   None            <none>        3200/TCP,9095/TCP,9096/TCP,16685/TCP,16686/TCP,16687/TCP                    2m8s


NAME                         POD-SELECTOR                                                                                                                                           AGE
tempo-simplest-distributor   app.kubernetes.io/component=distributor,app.kubernetes.io/instance=simplest,app.kubernetes.io/managed-by=tempo-operator,app.kubernetes.io/name=tempo   17s

[andreasgerstmayr]

can you add unit tests with the generated policy? ideally in yaml format (to be less verbose than Golang), like here: https://github.com/grafana/tempo-operator/blob/main/internal/manifests/config/build_test.go#L23-L26

[frzifus]

y, I will do once its working.
I will pause this until #1248 is complete.

[pavolloffay]

It seems like it is missing the policy for the gateway

[pavolloffay]

a similar comment as the previous one. I would be more specific and rename it to networkpolicies

[pavolloffay]

So If I am not mistaken this creates 3+5policies(per component).

We might need to have percomponent policy, but those 3 generic one can be embeded into the policy per component, which would make it easier to understand what policy applies to a component.

[Copilot]

Pull Request Overview

This PR introduces network policy generation for Tempo operands to limit network access between components. The implementation adds a new networking configuration option to the TempoStack spec and generates NetworkPolicy resources for each component based on defined communication relationships.

• Adds NetworkingSpec to the TempoStack CRD with an enabled flag
• Implements per-component network policy generation with ingress/egress rules
• Defines component communication relationships and port mappings

Reviewed Changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
api/tempo/v1alpha1/tempostack_types.go	Adds NetworkingSpec struct and networking field to TempoStackSpec
internal/manifests/networking/operands.go	Main function to generate network policies for all operands
internal/manifests/networking/components.go	Core logic for generating per-component policies and defining relationships
internal/manifests/networking/components_test.go	Test cases for network policy generation and relation reversal
config/crd/bases/tempo.grafana.com_tempostacks.yaml	CRD definition update for networking spec
bundle//manifests/	Generated bundle files with CRD and CSV updates

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

Hardcoded ports 443 and 9000 for S3 connections should be configurable or derived from the storage configuration. The TODO comments indicate this is a known issue that should be addressed.