Automation orchestrator operator-managed NetworkPolicies
Review the Kubernetes NetworkPolicy resources that the automation orchestrator operator creates to control pod-to-pod communication within the application namespace.
Review how the operator manages network policies
The automation orchestrator operator creates and manages Kubernetes NetworkPolicy resources during its reconciliation loop. These policies enforce a default-deny and per-component allow model:
- A default-deny NetworkPolicy blocks all ingress and egress traffic for every pod the operator manages.
- Per-component allow NetworkPolicies grant only the specific traffic each component requires.
The operator creates these policies automatically when you deploy an AutomationOrchestrator custom resource. The operator updates the policies whenever it reconciles the custom resource.
Review per-component NetworkPolicy rules
The following table lists the ingress and egress rules that the operator applies to each component. Every component is subject to the default-deny policy first, then the per-component allow rules override it for permitted traffic only.
| Component | Direction | NetworkPolicy resource | Allowed from/to | Ports |
|---|---|---|---|---|
| Backend | Ingress | backend |
UI, Worker, Background Worker, Backend | 8000 |
| Backend | Egress | backend |
Unrestricted | Any |
| Temporal | Ingress | temporal-server |
Backend, Worker, Background Worker, namespace registration Jobs | 7233 |
| Temporal | Ingress | temporal-server |
Temporal pods | Internal |
| Temporal | Ingress (metrics) | metrics-ingress |
Any namespace | 9090 |
| Temporal | Egress | temporal-server |
Temporal pods, DNS, PostgreSQL | Internal, 53/5353, DB port |
| Operator | Ingress (metrics) | metrics-ingress |
Any namespace | 9090 |
| Redis | Ingress | redis |
Backend, Worker, Background Worker | 6379 |
| UI | Ingress | ui |
Ingress controller | 8080 |
| UI | Egress | ui |
Backend, DNS | 8000, 53/5353 |
| Worker | Ingress (metrics) | metrics-ingress |
Any namespace | 9090 |
| Worker | Egress | worker |
Unrestricted | Any |
| Background Worker | Ingress (metrics) | metrics-ingress |
Any namespace | 9090 |
| Background Worker | Egress | background-worker |
Unrestricted | Any |
| Migration Jobs | Egress | migration |
DNS, PostgreSQL | 53/5353, DB port |
| Namespace registration Jobs | Egress | temporal-namespace |
Temporal, DNS | 7233, 53/5353 |
| In-namespace PostgreSQL | Ingress | postgres-{host} |
Backend, Worker, Background Worker, Temporal, Migration Jobs | DB port |
Review egress rule exceptions
- DNS resolution: Every component that has egress rules includes DNS resolution on ports 53 and 5353 (TCP and UDP). The operator uses port-only rules without a namespace selector for DNS, which allows resolution to work across both OpenShift and standard Kubernetes clusters.
- PostgreSQL egress: PostgreSQL egress rules also use port-only selectors because the database host is external (customer-provided) and its network location cannot be determined at policy creation time.
- Unrestricted egress: The backend, worker, and background worker components require unrestricted egress because their outbound traffic destinations, such as LLM providers, S3 endpoints, and the automation gateway, are user-configured and cannot be enumerated at policy creation time.
Review metrics ingress rules
The operator creates a dedicated metrics-ingress NetworkPolicy that allows Prometheus to scrape metrics from the worker, background worker, and temporal components. This policy permits ingress from any namespace so that the OpenShift monitoring stack, which runs in a separate namespace, can reach the metrics endpoints.
The backend component exposes its metrics on the same port (8000) used for API traffic, so it does not require a separate metrics ingress rule.
Manage NetworkPolicies in restricted network environments
If you manage your own NetworkPolicies in the automation orchestrator namespace, verify that your rules do not conflict with the operator-managed policies. The operator reconciles its policies on every cycle, so manual changes to operator-managed NetworkPolicy resources are overwritten.
If your environment applies additional namespace-level deny policies or a cluster-wide network policy controller, ensure that the following traffic is permitted:
- DNS resolution on ports 53 and 5353 (TCP and UDP) to the cluster DNS service.
- Ingress from the OpenShift monitoring namespace to the metrics endpoints on worker, background worker, and temporal components.
- Ingress from the OpenShift router namespace to the UI component on port 8080.
- Egress to your PostgreSQL database host on the port specified in your
AutomationOrchestratorcustom resource. - Egress to external services (LLM providers, S3 storage, automation gateway) from the backend, worker, and background worker components.