Installation Manual - 78 Hub NetworkPolicy namespace classification

Read-only classification of hub-dc-v7 namespace ownership and NetworkPolicy coverage for the remaining CIS finding.

This chapter records the read-only hub-dc-v7 NetworkPolicy namespace classification gate.

The gate did not apply NetworkPolicies. It classified namespace ownership and risk before any remediation for the remaining hub CIS finding:

ocp4-cis-configure-network-policies-namespaces

Governance

FieldValue
IssueOP-GF-COMPLIANCE-7 / #399
MilestoneWorkspace Governance
Governing ADRADR 0016
PredecessorOP-GF-COMPLIANCE-6 / #398

Access Path

All live checks used the established path:

local workspace -> dl385-2 -> gf-ocp-bootstrap-01 -> hub-dc-v7 kubeconfig

No Secret values, kubeconfigs, tokens, pull secrets, PAT values, MinIO keys, or full Secret manifests were printed.

Live Health

Read-only validation at 2026-05-19T11:23:33Z:

CheckResult
OpenShift4.20.18
ClusterVersionAvailable, not Progressing, not Failing
Nodes3/3 Ready
ClusterOperatorssteady
MachineConfigPoolssteady
Hub Argo CDSynced/Healthy at d6688ad
Target CIS checkFAIL

Current all-object ComplianceCheckResult counts:

StatusCount
PASS161
FAIL1
MANUAL21

Coverage Snapshot

MetricCount
Total namespaces99
Total NetworkPolicies84
Namespaces with NetworkPolicy18
Namespaces without NetworkPolicy81

Namespaces already covered:

assisted-installer
external-secrets
openshift-catalogd
openshift-cloud-controller-manager
openshift-cloud-controller-manager-operator
openshift-cloud-credential-operator
openshift-cluster-csi-drivers
openshift-cluster-olm-operator
openshift-cluster-storage-operator
openshift-cluster-version
openshift-gitops
openshift-machine-api
openshift-marketplace
openshift-operator-controller
openshift-operator-lifecycle-manager
openshift-operators
platform-bootstrap
stackrox

Non-System Focus Set

The live inventory found 16 non-kube-* and non-openshift* namespaces without NetworkPolicy:

NamespaceClassification
cert-managerproduct-specific policy design
cert-manager-operatorplatform-owned operator namespace
defaultlow-risk default-deny candidate
external-secrets-operatorplatform-owned operator namespace
hiveACM/Hive product-specific policy design
hypershiftACM/Hypershift product-specific policy design
local-clusterlow-risk placeholder policy candidate
multicluster-engineACM/MCE product-specific policy design
open-cluster-managementACM hub product-specific policy design
open-cluster-management-agentACM agent product-specific policy design
open-cluster-management-agent-addonACM addon product-specific policy design
open-cluster-management-global-setlow-risk placeholder policy candidate
open-cluster-management-hubACM hub product-specific policy design
open-cluster-management-policieslow-risk placeholder policy candidate
rhacs-operatorplatform-owned operator namespace
spoke-dc-v7low-risk placeholder policy candidate

Decision

Do not bulk-apply generated or default NetworkPolicies across all uncovered namespaces.

Use a staged remediation path:

  1. Start with no-workload placeholder/default namespaces: default, local-cluster, open-cluster-management-global-set, open-cluster-management-policies, and spoke-dc-v7.
  2. Then review explicit manifests for platform-owned operator namespaces: cert-manager-operator, external-secrets-operator, and rhacs-operator.
  3. Defer ACM/MCE/Hive/Hypershift and OpenShift core namespaces until their product traffic expectations are reviewed.

Avoid allow-all policies as the default pattern. They may satisfy a scanner, but they do not materially improve isolation.

Next Gate

Recommended next gate:

OP-GF-COMPLIANCE-8: preflight hub NetworkPolicy remediation set

Suggested scope:

  • propose GitOps manifests for the five low-risk placeholder/default namespaces;
  • inspect services, routes, webhooks, and endpoints in the three platform-owned operator namespaces;
  • keep ACM/MCE/Hive/Hypershift and OpenShift core namespaces out of the first remediation set.

Last reviewed: 2026-05-19