Installation Manual - 80 Hub low-risk NetworkPolicy apply

GitOps apply and validation for the first hub-dc-v7 low-risk NetworkPolicy set.

This chapter records the first hub-dc-v7 NetworkPolicy apply gate.

The gate added ingress-only default-deny policies to the five namespaces that were preflighted as low risk in the previous chapter.

Governance

Access Path

All live checks and the Compliance rescan used the established path:

local workspace -> dl385-2 -> gf-ocp-bootstrap-01 -> hub-dc-v7 kubeconfig

No Secret values, kubeconfigs, tokens, pull secrets, PAT values, MinIO keys, or full Secret manifests were printed.

GitOps Change

Platform GitOps commit:

f4c643e Add hub low-risk NetworkPolicies

The commit added this hub kustomize layer:

clusters/hub-dc-v7/platform/networkpolicy/

It also referenced the layer from:

clusters/hub-dc-v7/kustomization.yaml

Applied Policies

Each namespace received:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: <target-namespace>
  labels:
    app.kubernetes.io/name: hub-networkpolicy-baseline
    app.kubernetes.io/part-of: hub-dc-v7-platform
spec:
  podSelector: {}
  policyTypes:
    - Ingress

Targets:

No egress default-deny was added.

Post-Apply Validation

Validation at 2026-05-19T11:42:45Z and 2026-05-19T11:43:15Z:

The five target namespaces still had no application controller workloads, no pods, and no routes after apply. default still only had the expected kubernetes and openshift services.

Compliance Rescan

A one-off hub ComplianceScan/ocp4-cis rescan was triggered after Argo CD and cluster health were steady.

Post-rescan counts:

The remaining failed check is still:

ocp4-cis-configure-network-policies-namespaces

That is expected because this gate intentionally covered only the low-risk first set.

Residual Namespace Coverage

After the apply, the hub inventory was:

Non-system namespaces still without NetworkPolicy:

cert-manager
cert-manager-operator
external-secrets-operator
hive
hypershift
multicluster-engine
open-cluster-management
open-cluster-management-agent
open-cluster-management-agent-addon
open-cluster-management-hub
rhacs-operator

Next Gate

Recommended next gate:

OP-GF-COMPLIANCE-10: design hub operator/ACM NetworkPolicy coverage or tailoring

Do not blanket-generate policies for these remaining namespaces. The operator namespaces need explicit monitoring/metrics ingress allows, and the ACM/MCE/Hive/Hypershift namespaces need product-aware policy design or a documented Compliance tailoring decision.