mbp-1126: Network segmentation using UDN

[mlorenzofr]

Implements network segmentation using User Defined Networks (UDNs) for the qtodo multi-tier application. The qtodo frontend (qtodo namespace) and PostgreSQL database (qtodo-db namespace) join a shared Layer2 secondary ClusterUserDefinedNetwork (CUDN) so database traffic is isolated from the default cluster network.

Because secondary UDNs do not support Kubernetes Services, the database pod uses a static UDN IP and qtodo's JDBC URL targets that address when UDN is enabled.

Summary

• Adds a cluster-scoped ClusterUserDefinedNetwork in the qtodo-db chart spanning the qtodo and qtodo-db namespaces
• Lets OVN-Kubernetes create the per-namespace NetworkAttachmentDefinition; pods opt in via the k8s.v1.cni.cncf.io/networks annotation
• Configures MultiNetworkPolicy on the UDN to allow PostgreSQL (5432/tcp) only from app=qtodo to app=qtodo-db
• Tightens cluster-network NetworkPolicy when UDN is enabled:
  • qtodo: router, Vault, OIDC, and DNS on eth0. No cluster-network egress to PostgreSQL
  • qtodo-db: CoreDNS only on eth0. No PostgreSQL ingress on eth0
• Updates qtodo deployment and PostgreSQL StatefulSet to attach to the shared UDN
• Points qtodo JDBC at the static UDN IP (10.100.0.10) when UDN is enabled
• Adds/updates documentation in docs/user-defined-networks.md and related docs
• Extends the udn feature flag to enable both qtodo-db (udn.enabled) and qtodo (app.udn.enabled)

Prerequisites

• spec.useMultiNetworkPolicy: true on network.operator.openshift.io/cluster (required for UDN MultiNetworkPolicy. Can be disabled via chart values if needed)

Test plan

• Enable useMultiNetworkPolicy on the Cluster Network Operator
• Generate and apply the UDN variant: python3 scripts/gen-feature-variants.py --features udn
• Confirm the feature flag enables/disables CUDN and UDN policy resources in both qtodo and qtodo-db
• Verify ClusterUserDefinedNetwork and NADs exist in both namespaces
• Confirm qtodo and qtodo-db pods attach to the UDN (net1) and qtodo-db has IP 10.100.0.10
• Validate cluster-network NetworkPolicy rules (qtodo-db: DNS egress only; no PostgreSQL on eth0)
• Validate MultiNetworkPolicy rules on the UDN (PostgreSQL allowed qtodo -> qtodo-db only)
• Test connectivity:
  • qtodo -> PostgreSQL via UDN IP succeeds
  • qtodo -> PostgreSQL via qtodo-db.qtodo-db.svc fails when UDN is enabled
  • qtodo -> Vault/OIDC/DNS via cluster network succeeds
  • qtodo-db -> CoreDNS via cluster network succeeds
• Test the qtodo application end-to-end (login, create/delete todos)
• Review updated documentation (docs/user-defined-networks.md, sync-wave inventory, multi-tier guide)

[minmzzhang]

There seems to be a conflict role of the UDN. In udn-user-defined-netowrk.yaml, the layer2 role was set to Primary, however, in app-deployment.yaml, it uses k8s.v1.cni.cocf.io/networks annotations to attach pods to the UDN:

k8s.v1.cni.cncf.io/networks: {{ .Release.Namespace }}/{{ .Values.app.udn.nadName }}

[minmzzhang]

Shall we use Primary or Secondary role for this UDN work? If we use Primary, then no manual NAD should be needed and no pod annotations of k8s.v1.cni.cncf.io/networks

[sabre1041]

This looks really good @mlorenzofr. Tested and confirmed successfully. Only potential enhancement would be to provide the ability to enable/disable the enable-multi-network-policy job in the event that this configuration is already managed by another component

[mlorenzofr]

enhancement would be to provide the ability to enable/disable the enable-multi-network-policy job in the event that this configuration is already managed by another component

thanks for the suggestion! I'm adding the functionality