fix: preserve deny-all NetworkPolicy config and stop mutating defaultConfig

apis/controller/v1alpha1/devworkspaceoperatorconfig_types.go

@@ -351,14 +351,14 @@ type NetworkPolicyConfig struct {
 	// is denied. If this field is specified as a non-empty list, exactly those rules apply
 	// and the default rules no longer apply.
 	// +kubebuilder:validation:Optional
-	Ingress []networkingv1.NetworkPolicyIngressRule `json:"ingress,omitempty"`
+	Ingress []networkingv1.NetworkPolicyIngressRule `json:"ingress"`
 	// Egress defines the egress rules applied to DevWorkspace pods. If this field is not
 	// specified, the default egress rule of the DevWorkspace Operator applies, which allows
 	// all egress traffic. If this field is specified as an empty list, all egress traffic
 	// from DevWorkspace pods is denied. If this field is specified as a non-empty list,
 	// exactly those rules apply and the default rule no longer applies.
 	// +kubebuilder:validation:Optional
-	Egress []networkingv1.NetworkPolicyEgressRule `json:"egress,omitempty"`
+	Egress []networkingv1.NetworkPolicyEgressRule `json:"egress"`
 }
 
 type Proxy struct {

pkg/config/defaults.go

@@ -269,10 +269,5 @@ func GetDefaultNetworkPolicy(operatorNamespace string) (
 		ingressPolicyRules = defaultKubernetesIngressPolicyRules
 	}
 
-	defaultConfig.Workspace.NetworkPolicy = &v1alpha1.NetworkPolicyConfig{
-		Enabled: pointer.Bool(constants.DefaultNetworkPolicyEnabled),
-		Ingress: ingressPolicyRules,
-		Egress:  defaultEgressPolicyRules,
-	}
 	return ingressPolicyRules, defaultEgressPolicyRules, nil
 }

pkg/config/defaults_test.go

@@ -0,0 +1,55 @@
+// Copyright (c) 2019-2026 Red Hat, Inc.
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package config
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/devfile/devworkspace-operator/pkg/infrastructure"
+)
+
+func TestGetDefaultNetworkPolicyDoesNotMutateDefaultConfig(t *testing.T) {
+	setupForTest(t)
+
+	defaultConfig.Workspace.NetworkPolicy = nil
+
+	_, _, err := GetDefaultNetworkPolicy("test-namespace")
+	assert.NoError(t, err)
+
+	assert.Nil(t, defaultConfig.Workspace.NetworkPolicy, "GetDefaultNetworkPolicy should not mutate defaultConfig")
+}
+
+func TestGetDefaultNetworkPolicy(t *testing.T) {
+	t.Run("on Kubernetes", func(t *testing.T) {
+		setupForTest(t)
+		infrastructure.InitializeForTesting(infrastructure.Kubernetes)
+
+		ingress, egress, err := GetDefaultNetworkPolicy("test-namespace")
+		assert.NoError(t, err)
+		assert.Equal(t, defaultKubernetesIngressPolicyRules, ingress)
+		assert.Equal(t, defaultEgressPolicyRules, egress)
+	})
+
+	t.Run("on OpenShift", func(t *testing.T) {
+		setupForTest(t)
+		infrastructure.InitializeForTesting(infrastructure.OpenShiftv4)
+
+		ingress, egress, err := GetDefaultNetworkPolicy("test-namespace")
+		assert.NoError(t, err)
+		assert.Len(t, ingress, len(defaultOpenShiftIngressPolicyRules)+1)
+		assert.Equal(t, defaultEgressPolicyRules, egress)
+	})
+}

pkg/config/sync_test.go

@@ -28,6 +28,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
+	networkingv1 "k8s.io/api/networking/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -615,6 +616,71 @@ func TestMergeConfigMergesRuntimeClassName(t *testing.T) {
 	}
 }
 
+func TestResolveConfigForWorkspaceWithNetworkPolicy(t *testing.T) {
+	setupForTest(t)
+
+	workspace := &dw.DevWorkspace{
+		Spec: dw.DevWorkspaceSpec{
+			Template: dw.DevWorkspaceTemplateSpec{
+				DevWorkspaceTemplateSpecContent: dw.DevWorkspaceTemplateSpecContent{
+					Attributes: attributes.Attributes{},
+				},
+			},
+		},
+	}
+
+	attrs := workspace.Spec.Template.DevWorkspaceTemplateSpecContent.Attributes
+	attrs.Put(
+		constants.ExternalDevWorkspaceConfiguration,
+		types.NamespacedName{
+			Name:      externalConfigName,
+			Namespace: externalConfigNamespace,
+		},
+		nil,
+	)
+
+	t.Run("external config overrides NetworkPolicy with empty ingress and egress (deny all)", func(t *testing.T) {
+		externalDwoc := &v1alpha1.DevWorkspaceOperatorConfig{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      externalConfigName,
+				Namespace: externalConfigNamespace,
+			},
+			Config: &v1alpha1.OperatorConfiguration{
+				Workspace: &v1alpha1.WorkspaceConfig{
+					NetworkPolicy: &v1alpha1.NetworkPolicyConfig{
+						Enabled: pointer.Bool(true),
+						Ingress: []networkingv1.NetworkPolicyIngressRule{},
+						Egress:  []networkingv1.NetworkPolicyEgressRule{},
+					},
+				},
+			},
+		}
+
+		dwoc := &v1alpha1.DevWorkspaceOperatorConfig{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      OperatorConfigName,
+				Namespace: configNamespace,
+			},
+			Config: defaultConfig.DeepCopy(),
+		}
+
+		client := fake.NewClientBuilder().WithScheme(scheme).WithObjects(dwoc, externalDwoc).Build()
+		err := SetupControllerConfig(client)
+		assert.NoError(t, err)
+
+		resolvedConfig, err := ResolveConfigForWorkspace(workspace, client)
+		assert.NoError(t, err)
+		assert.NotNil(t, resolvedConfig.Workspace.NetworkPolicy)
+		assert.Equal(t, pointer.Bool(true), resolvedConfig.Workspace.NetworkPolicy.Enabled)
+
+		assert.NotNil(t, resolvedConfig.Workspace.NetworkPolicy.Ingress)
+		assert.Empty(t, resolvedConfig.Workspace.NetworkPolicy.Ingress)
+
+		assert.NotNil(t, resolvedConfig.Workspace.NetworkPolicy.Egress)
+		assert.Empty(t, resolvedConfig.Workspace.NetworkPolicy.Egress)
+	})
+}
+
 func fuzzQuantity(q *resource.Quantity, c fuzz.Continue) {
 	q.Set(c.Int63n(999))
 	q.Format = resource.DecimalSI