fix: add Redis egress NP and allow metrics from openshift-user-workload-monitoring [RHDHBUGS-3724] - #3481

• Permit Backstage egress to user-provided Redis services over TCP port 6379.
• Allow user-workload Prometheus to scrape metrics through default-deny policies.
• Regenerate distribution manifests and update NetworkPolicy test expectations.

graph TD
  SRC["Base NP Config"] --> GEN["Generated Manifests"] --> MODEL["Operator Model"] --> PODS["Backstage Pods"] -->|TCP 6379| REDIS["Redis Endpoint"]
  MON["User Monitoring"] -->|TCP 9464| PODS

Loading

The following are alternative approaches to this PR:

1. Configurable Redis destinations

• ➕ Supports namespace, pod, or CIDR restrictions for stronger least-privilege enforcement.
• ➕ Lets administrators tailor access to known Redis deployments.
• ➖ Requires new configuration or CR API surface.
• ➖ Cannot provide a useful universal default for arbitrary managed Redis endpoints.
• ➖ Adds validation, documentation, and upgrade complexity.

2. Require user-created policies

• ➕ Keeps the operator defaults narrower.
• ➕ Allows each administrator to define exact Redis destinations.
• ➖ Leaves recommended production Redis configurations blocked by default.
• ➖ Increases deployment complexity and repeats policy configuration across installations.

Recommendation: Keep the PR’s port-only Redis rule because Redis endpoints may be local, cross-namespace, or externally managed, making a universal destination selector impractical. A future opt-in destination configuration could provide additional hardening, but requiring it now would undermine the intended production-ready defaults.

Bug fix (2) +50 / -0

rhdh-default-config_v1_configmap.yamlPackage Redis and user-monitoring NetworkPolicy fixes +25/-0

Package Redis and user-monitoring NetworkPolicy fixes

• Adds unrestricted-destination TCP 6379 egress for Backstage pods. It also permits metrics ingress from the openshift-user-workload-monitoring namespace in the bundled default configuration.

bundle/rhdh/manifests/rhdh-default-config_v1_configmap.yaml

networkpolicy.yamlAdd Redis egress and user-workload monitoring ingress +25/-0

Add Redis egress and user-workload monitoring ingress

• Defines the canonical allow-redis-egress policy for TCP port 6379 without destination selectors. Extends metrics ingress to Prometheus running in openshift-user-workload-monitoring.

config/profile/rhdh/default-config/networkpolicy.yaml

Tests (3) +40 / -4

networkpolicy_test.goAdjust expected backend NetworkPolicy counts +4/-4

Adjust expected backend NetworkPolicy counts

• Increases default, external-database, and flavour-merge policy counts to account for the new Redis egress policy.

pkg/model/networkpolicy_test.go

networkpolicy.yamlExtend default NetworkPolicy test fixture +18/-0

Extend default NetworkPolicy test fixture

• Adds the Redis egress policy and openshift-user-workload-monitoring metrics source to the standard model test fixture.

pkg/model/testdata/default-config/networkpolicy.yaml

networkpolicy.yamlExtend flavour NetworkPolicy test fixture +18/-0

Extend flavour NetworkPolicy test fixture

• Adds the Redis egress policy and user-workload monitoring namespace to the flavour-merge test configuration.

pkg/model/testdata/testflavours/default-config/networkpolicy.yaml

Other (3) +27 / -2

backstage-operator.clusterserviceversion.yamlRefresh Backstage bundle creation timestamp +1/-1

Refresh Backstage bundle creation timestamp

• Updates the generated ClusterServiceVersion creation timestamp to reflect bundle regeneration.

bundle/backstage.io/manifests/backstage-operator.clusterserviceversion.yaml

backstage-operator.clusterserviceversion.yamlRefresh RHDH bundle creation timestamp +1/-1

Refresh RHDH bundle creation timestamp

• Updates the generated RHDH ClusterServiceVersion creation timestamp during bundle regeneration.

bundle/rhdh/manifests/backstage-operator.clusterserviceversion.yaml

install.yamlPropagate NetworkPolicy fixes into installation manifest +25/-0

Propagate NetworkPolicy fixes into installation manifest

• Regenerates the distributable installation manifest with Redis egress and OpenShift user-workload metrics ingress rules.

dist/rhdh/install.yaml

Description

allow-redis-egress is added to the default configuration, but the network-policy documentation
never states that setMetaInfo assigns backstage.Namespace to every generated policy. When Redis
is in another namespace or external, the surrounding comments discuss that destination placement
while leaving the policy's own namespace implicit, so administrators can search or troubleshoot in
the wrong namespace.

Code

config/profile/rhdh/default-config/networkpolicy.yaml[65]

+  name: allow-redis-egress

Relevance

●● Moderate

Namespace documentation is reasonable, but historical evidence for similar NetworkPolicy
documentation additions is mixed.

PR-#3394

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

Compliance rule 5 requires documentation to state the creation namespace when it affects
namespaced-resource behavior. The PR adds the Redis policy, the model assigns every generated policy
to the Backstage custom resource namespace, and the existing network-policy documentation describes
selector and destination behavior without documenting that creation namespace.

Rule 5: Document resource creation namespace when behaviorally relevant
config/profile/rhdh/default-config/networkpolicy.yaml[57-75]
pkg/model/runtime.go[223-227]
docs/configuration.md[226-232]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Document that generated NetworkPolicy resources, including `allow-redis-egress`, are created in the same namespace as the Backstage custom resource.

## Issue Context
The controller assigns `backstage.Namespace` to each generated policy. This distinction is behaviorally important because the Redis destination may be in another namespace or outside the cluster, while the NetworkPolicy itself remains in the Backstage namespace.

## Fix Focus Areas
- docs/configuration.md[226-232]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Description

allow-redis-egress permits only TCP 6379, while the rhdh Redis setup accepts redis://...:PORT
and says any Redis deployment is valid. An operator-managed instance configured from that guide with
another port remains blocked by the default-deny policy unless the user independently creates an
additional policy.

Code

config/profile/rhdh/default-config/networkpolicy.yaml[R73-75]

+    - ports:
+        - port: 6379
+          protocol: TCP

Relevance

● Weak

Recent precedent rejected documenting non-default database ports; fixed default port is intentional
and users can add policies.

PR-#3394

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The PR policy explicitly restricts Redis traffic to TCP 6379, whereas the related RHDH repository
tells users that any Redis instance is suitable and shows a connection string with a user-selected
PORT.

config/profile/rhdh/default-config/networkpolicy.yaml[57-75]
External repo: redhat-developer/rhdh, docs/redis-setup.md [1-12]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The default network policy permits Redis egress only on TCP 6379, but the RHDH setup guide supports an arbitrary Redis port without explaining the need for another NetworkPolicy.

## Issue Context
Either make Redis egress configurable for the documented connection port, or coordinate an update to the RHDH guide stating that non-6379 deployments require an additive NetworkPolicy.

## Fix Focus Areas
- config/profile/rhdh/default-config/networkpolicy.yaml[57-75]
- docs/redis-setup.md[1-12]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

💡 Did you know, you can ask Qodo to dismiss a finding you disagree with, with your reason on record

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗