generate network policy per operand

[frzifus]

Downside of this approach is that we need to manually align the mapping when we change e.g. a service. But we could generate services based on this too. wdyt?

NAME                                      TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                                                                     AGE
tempo-simplest-compactor                  ClusterIP   10.96.115.23    <none>        7946/TCP,3200/TCP                                                           2m8s
tempo-simplest-distributor                ClusterIP   10.96.122.122   <none>        4318/TCP,4317/TCP,3200/TCP,14268/TCP,6831/UDP,6832/UDP,14250/TCP,9411/TCP   2m8s
tempo-simplest-gossip-ring                ClusterIP   None            <none>        7946/TCP                                                                    2m8s
tempo-simplest-ingester                   ClusterIP   10.96.76.66     <none>        3200/TCP,9095/TCP                                                           2m8s
tempo-simplest-querier                    ClusterIP   10.96.206.87    <none>        7946/TCP,3200/TCP,9095/TCP                                                  2m8s
tempo-simplest-query-frontend             ClusterIP   10.96.117.99    <none>        3200/TCP,9095/TCP,16685/TCP,16686/TCP,16687/TCP                             2m8s
tempo-simplest-query-frontend-discovery   ClusterIP   None            <none>        3200/TCP,9095/TCP,9096/TCP,16685/TCP,16686/TCP,16687/TCP                    2m8s


NAME                         POD-SELECTOR                                                                                                                                           AGE
tempo-simplest-distributor   app.kubernetes.io/component=distributor,app.kubernetes.io/instance=simplest,app.kubernetes.io/managed-by=tempo-operator,app.kubernetes.io/name=tempo   17s

[frzifus]

That should only be done on OpenShift 4.20+.

[andreasgerstmayr]

depending on how tight we want to make the policy, the distributor should only be reachable from the gateway if the gateway is enabled

[andreasgerstmayr]

can you add unit tests with the generated policy? ideally in yaml format (to be less verbose than Golang), like here: https://github.com/grafana/tempo-operator/blob/main/internal/manifests/config/build_test.go#L23-L26

[frzifus]

y, I will do once its working.
I will pause this until #1248 is complete.