From 9fe736eafd5030dd43d32b5c4ec84174aa4167bd Mon Sep 17 00:00:00 2001
From: Mateusz Kowalski <mko@redhat.com>
Date: Tue, 7 Jul 2026 17:22:59 +0200
Subject: [PATCH] Bug 94072: add startup probes and DNS egress to network
 policies

Add startupProbe to nmstate-webhook and nmstate-metrics containers to
allow sufficient time for initialization before liveness/readiness
probes begin checking. Without a startupProbe, pods that take longer
than ~30s to start are killed by the liveness probe and enter
CrashLoopBackOff.

The startupProbe uses TCP socket checks with initialDelaySeconds=10,
periodSeconds=10, and failureThreshold=18, giving containers up to
3 minutes to start. Once the startupProbe succeeds, regular
liveness/readiness probes take over (no initialDelaySeconds needed
since startup was already verified).

Additionally, add DNS egress network policies (UDP/TCP 53) for
webhook, metrics, and operator pods. The existing default-deny
policies block all egress except TCP 6443 (API server), which
prevents DNS resolution. While in-cluster API server access uses the
KUBERNETES_SERVICE_HOST IP directly, various libraries may attempt
DNS lookups during initialization, causing startup delays that
compound with aggressive probe timing.

Signed-off-by: Mateusz Kowalski <mko@redhat.com>
Generated-by: AI
Signed-off-by: Mateusz Kowalski <mko@redhat.com>
---
 deploy/handler/network_policy.yaml | 56 ++++++++++++++++++++++++++++++
 deploy/handler/operator.yaml       | 16 ++++++---
 2 files changed, 68 insertions(+), 4 deletions(-)

diff --git a/deploy/handler/network_policy.yaml b/deploy/handler/network_policy.yaml
index 47cc0e8fb6..edfbd68a83 100644
--- a/deploy/handler/network_policy.yaml
+++ b/deploy/handler/network_policy.yaml
@@ -121,6 +121,25 @@ spec:
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
+metadata:
+  name: allow-webhook-egress-dns
+  namespace: {{ .HandlerNamespace }}
+spec:
+  podSelector:
+    matchLabels:
+      app: kubernetes-nmstate
+      component: kubernetes-nmstate-webhook
+  egress:
+    - ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+  policyTypes:
+    - Egress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: allow-metrics-egress-api-6443
   namespace: {{ .HandlerNamespace }}
@@ -138,6 +157,43 @@ spec:
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
+metadata:
+  name: allow-metrics-egress-dns
+  namespace: {{ .HandlerNamespace }}
+spec:
+  podSelector:
+    matchLabels:
+      app: kubernetes-nmstate
+      component: kubernetes-nmstate-metrics
+  egress:
+    - ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+  policyTypes:
+    - Egress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-operator-egress-dns
+  namespace: {{ .OperatorNamespace }}
+spec:
+  podSelector:
+    matchLabels:
+      app: kubernetes-nmstate-operator
+  egress:
+    - ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+  policyTypes:
+    - Egress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: default-deny-labelled-operator
   namespace: {{ .OperatorNamespace }}
diff --git a/deploy/handler/operator.yaml b/deploy/handler/operator.yaml
index 3fbe3cf2c7..86f5f31ee0 100644
--- a/deploy/handler/operator.yaml
+++ b/deploy/handler/operator.yaml
@@ -82,15 +82,19 @@ spec:
           - containerPort: 8443
             name: metrics
             protocol: TCP
-          readinessProbe:
+          startupProbe:
             tcpSocket:
               port: metrics
             initialDelaySeconds: 10
             periodSeconds: 10
+            failureThreshold: 18
+          readinessProbe:
+            tcpSocket:
+              port: metrics
+            periodSeconds: 10
           livenessProbe:
             tcpSocket:
               port: metrics
-            initialDelaySeconds: 10
             periodSeconds: 10
             timeoutSeconds: 1
             successThreshold: 1
@@ -184,6 +188,12 @@ spec:
           - containerPort: 9443
             name: webhook-server
             protocol: TCP
+          startupProbe:
+            tcpSocket:
+              port: webhook-server
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            failureThreshold: 18
           readinessProbe:
             httpGet:
               path: /readyz
@@ -192,7 +202,6 @@ spec:
               httpHeaders:
               - name: Content-Type
                 value: application/json
-            initialDelaySeconds: 10
             periodSeconds: 10
           livenessProbe:
             httpGet:
@@ -202,7 +211,6 @@ spec:
               httpHeaders:
                 - name: Content-Type
                   value: application/json
-            initialDelaySeconds: 10
             periodSeconds: 10
             timeoutSeconds: 1
             successThreshold: 1