From dfdc3c0995285c0c8d2a052a77c90a5a772e268c Mon Sep 17 00:00:00 2001
From: dislbenn <dbennett@redhat.com>
Date: Tue, 15 Sep 2026 12:26:01 -0400
Subject: [PATCH] Include Hive operator NetworkPolicy in bundle/chart
 regeneration

Hive's hack/bundle-gen.sh reads config/operator/operator_netpol.yaml
only to populate CSV data in OperatorHub mode; it never emits the
NetworkPolicy as a standalone manifest in the generated bundle. As a
result the Hive operator's NetworkPolicy was never picked up when
regenerating the hive-operator Helm chart via
'make regenerate-charts-from-bundles'.

Update gen-hive-bundle.sh to copy config/operator/operator_netpol.yaml
directly from the cloned Hive repo into the bundle output directory
(renamed to hive-operator-networkpolicy.yaml) so it flows through the
existing bundle-to-chart tooling like any other manifest, picking up
the standard Helm templating (networkPolicies.enabled guard, namespace
substitution) automatically. Fails hard if the file is missing so a
future rename/removal upstream is caught immediately.

Also includes the resulting regenerated chart template.

Signed-off-by: dislbenn <dbennett@redhat.com>
---
 hack/bundle-automation/gen-hive-bundle.sh     | 20 +++++++++++++++++++
 .../hive-operator-networkpolicy.yaml          | 17 ++++++++++++++++
 2 files changed, 37 insertions(+)
 create mode 100644 pkg/templates/charts/toggle/hive-operator/templates/hive-operator-networkpolicy.yaml

diff --git a/hack/bundle-automation/gen-hive-bundle.sh b/hack/bundle-automation/gen-hive-bundle.sh
index 127ab5e99..818b3068b 100755
--- a/hack/bundle-automation/gen-hive-bundle.sh
+++ b/hack/bundle-automation/gen-hive-bundle.sh
@@ -132,6 +132,26 @@ if [[ $rc -ne 0 ]]; then
    exit 3
 fi
 
+# Hive's bundle-gen tool does not include the operator's NetworkPolicy in the
+# generated bundle (it is only read to populate the CSV in OperatorHub mode).
+# Copy it directly from the Hive repo so it gets picked up by the chart
+# generation tooling.
+hive_netpol_source="${hive_repo_spot}/config/operator/operator_netpol.yaml"
+netpol_output="${output_dir}/hive-operator-networkpolicy.yaml"
+
+if [[ -f "$hive_netpol_source" ]]; then
+   echo "Copying Hive NetworkPolicy to output directory."
+   cp -p "$hive_netpol_source" "$netpol_output"
+   rc=$?
+   if [[ $rc -ne 0 ]]; then
+      >&2 echo "Error: Failed to copy Hive NetworkPolicy (rc: $rc)."
+      exit 3
+   fi
+else
+   >&2 echo "Error: Hive NetworkPolicy not found at $hive_netpol_source"
+   exit 3
+fi
+
 echo "Hive bundle copied to $output_dir."
 
 rm -rf "$tmp_dir"
diff --git a/pkg/templates/charts/toggle/hive-operator/templates/hive-operator-networkpolicy.yaml b/pkg/templates/charts/toggle/hive-operator/templates/hive-operator-networkpolicy.yaml
new file mode 100644
index 000000000..db5cd3215
--- /dev/null
+++ b/pkg/templates/charts/toggle/hive-operator/templates/hive-operator-networkpolicy.yaml
@@ -0,0 +1,17 @@
+{{- if .Values.global.networkPolicies.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  annotations:
+    hive.openshift.io/netpol-description: Network policy for hive-operator must allow egress to the APIServer. Since we can't identify hostNetwork pods, we must allow all egress.
+  name: hive-operator
+  namespace: '{{ .Values.global.namespace }}'
+spec:
+  egress:
+  - {}
+  podSelector:
+    matchLabels:
+      hive.openshift.io/component: hive-operator
+  policyTypes:
+  - Egress
+{{- end }}