Skip to content

CORENET-6613: ClusterNetworkConnect DevPreview FG#2880

Merged
openshift-merge-bot[bot] merged 1 commit intoopenshift:masterfrom
tssurya:cnc-devpreview-featuregate
Mar 29, 2026
Merged

CORENET-6613: ClusterNetworkConnect DevPreview FG#2880
openshift-merge-bot[bot] merged 1 commit intoopenshift:masterfrom
tssurya:cnc-devpreview-featuregate

Conversation

@tssurya
Copy link
Copy Markdown
Contributor

@tssurya tssurya commented Jan 15, 2026

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jan 15, 2026
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

openshift-ci-robot commented Jan 15, 2026

@tssurya: This pull request references CORENET-6613 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Consumes openshift/api#2629

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Jan 15, 2026

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Review skipped — only excluded labels are configured. (1)
  • do-not-merge/work-in-progress

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 57045ff9-bb53-45f6-9ccf-d8b4a8d14391

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

Walkthrough

The PR adds NetworkConnect feature support to OVN Kubernetes by introducing a new ClusterNetworkConnect CustomResourceDefinition, enabling feature flags across common, managed, and self-hosted deployment manifests, and updating tests to validate the feature gate behavior.

Changes

Cohort / File(s) Summary
CRD Definition
bindata/network/ovn-kubernetes/common/001-crd.yaml
Adds comprehensive CustomResourceDefinition for ClusterNetworkConnect with v1 schema including spec properties (connectSubnets, connectivity, networkSelectors) and status conditions.
Common Manifest Scripts
bindata/network/ovn-kubernetes/common/008-script-lib.yaml
Adds network_connect_enabled_flag variable set to "--enable-network-connect" when OVN_NETWORK_CONNECT_ENABLE is true, injected into ovnkube execution command.
Managed Deployment Configs
bindata/network/ovn-kubernetes/managed/004-config.yaml, bindata/network/ovn-kubernetes/managed/ovnkube-control-plane.yaml
Adds conditional enable-network-connect=true configuration in ovnkube.conf templates and network_connect_enabled_flag in control-plane startup command when feature is enabled.
Self-Hosted Deployment Configs
bindata/network/ovn-kubernetes/self-hosted/004-config.yaml, bindata/network/ovn-kubernetes/self-hosted/ovnkube-control-plane.yaml
Adds conditional enable-network-connect=true in ovnkube.conf [ovnkubernetesfeature] section and network_connect_enabled_flag in control-plane startup command.
Core Implementation
pkg/network/ovn_kubernetes.go
Adds OVN_NETWORK_CONNECT_ENABLE render-time data field computed from apifeatures.FeatureGateNetworkConnect enablement state.
Test Updates
pkg/network/cluster_config_test.go, pkg/network/ovn_kubernetes_test.go, pkg/network/render_test.go
Updates feature gate configurations to include FeatureGateNetworkConnect; adds test case validating enable-network-connect rendering; updates default feature gate lists across multiple test functions.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands and usage tips.

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 15, 2026
Comment thread bindata/network/ovn-kubernetes/self-hosted/ovnkube-control-plane.yaml Outdated
fi

network_connect_enabled_flag=
if [[ "{{.OVN_NETWORK_CONNECT_ENABLE}}" == "true" && "${OVN_NODE_MODE}" != "dpu-host" ]]; then
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What's up with "${OVN_NODE_MODE}" != "dpu-host"? I think it's only present here.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hmm it seems the DPF folks added it to all of them?

I see:

multi_network_enabled_flag=
      if [[ "{{.OVN_MULTI_NETWORK_ENABLE}}" == "true" && "${OVN_NODE_MODE}" != "dpu-host" ]]; then
        multi_network_enabled_flag="--enable-multi-network"
      fi

      network_segmentation_enabled_flag=
      if [[ "{{.OVN_NETWORK_SEGMENTATION_ENABLE}}" == "true" && "${OVN_NODE_MODE}" != "dpu-host" ]]; then
        multi_network_enabled_flag="--enable-multi-network"
        network_segmentation_enabled_flag="--enable-network-segmentation"
      fi

multi_network_policy_enabled_flag=
      if [[ "{{.OVN_MULTI_NETWORK_POLICY_ENABLE}}" == "true"&& "${OVN_NODE_MODE}" != "dpu-host" ]]; then
        multi_network_policy_enabled_flag="--enable-multi-networkpolicy"
      fi

      admin_network_policy_enabled_flag=
      if [[ "{{.OVN_ADMIN_NETWORK_POLICY_ENABLE}}" == "true" && "${OVN_NODE_MODE}" != "dpu-host" ]]; then
        admin_network_policy_enabled_flag="--enable-admin-network-policy"
      fi

not sure why some have it some don't?

Comment thread bindata/network/ovn-kubernetes/managed/004-config.yaml Outdated
Comment thread bindata/network/ovn-kubernetes/self-hosted/ovnkube-control-plane.yaml Outdated
Comment thread pkg/network/render.go Outdated
@tssurya tssurya force-pushed the cnc-devpreview-featuregate branch from 94dc54c to db2a8db Compare January 16, 2026 12:32
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Fix all issues with AI agents
In `@bindata/network/ovn-kubernetes/common/001-crd.yaml`:
- Around line 5173-5205: The x-kubernetes-validations rule currently enforces
networkPrefix must be strictly greater than the CIDR prefix, but the description
allows it to be equal; update the validation expression for the CRD so that it
permits equality: locate the x-kubernetes-validations entry that references
self.networkPrefix and cidr(self.cidr).prefixLength() and change the comparison
from ">" to ">=" (or adjust the negated logic accordingly) so networkPrefix can
be equal to the CIDR prefix while still rejecting shorter prefixes.
♻️ Duplicate comments (1)
bindata/network/ovn-kubernetes/managed/004-config.yaml (1)

130-140: Missing {{- end }} makes enable-network-connect incorrectly depend on segmentation.

enable-network-connect=true is currently nested under {{- if .OVN_NETWORK_SEGMENTATION_ENABLE }} because the block is not closed. This will suppress the new flag unless segmentation is enabled.

Suggested fix
 {{- if .OVN_NETWORK_SEGMENTATION_ENABLE }}
     {{- if not .OVN_MULTI_NETWORK_ENABLE }}
     enable-multi-network=true
     {{- end }}
     enable-network-segmentation=true
+{{- end }}
 {{- if .OVN_PRE_CONF_UDN_ADDR_ENABLE }}
     enable-preconfigured-udn-addresses=true
 {{- end }}
📜 Review details

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting

📥 Commits

Reviewing files that changed from the base of the PR and between 94dc54c and db2a8db.

📒 Files selected for processing (9)
  • bindata/network/ovn-kubernetes/common/001-crd.yaml
  • bindata/network/ovn-kubernetes/common/008-script-lib.yaml
  • bindata/network/ovn-kubernetes/managed/004-config.yaml
  • bindata/network/ovn-kubernetes/managed/ovnkube-control-plane.yaml
  • bindata/network/ovn-kubernetes/self-hosted/004-config.yaml
  • bindata/network/ovn-kubernetes/self-hosted/ovnkube-control-plane.yaml
  • pkg/network/cluster_config_test.go
  • pkg/network/ovn_kubernetes.go
  • pkg/network/ovn_kubernetes_test.go
🚧 Files skipped from review as they are similar to previous changes (5)
  • pkg/network/ovn_kubernetes.go
  • bindata/network/ovn-kubernetes/self-hosted/004-config.yaml
  • pkg/network/cluster_config_test.go
  • bindata/network/ovn-kubernetes/common/008-script-lib.yaml
  • pkg/network/ovn_kubernetes_test.go
🧰 Additional context used
📓 Path-based instructions (1)
**

⚙️ CodeRabbit configuration file

-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.

Files:

  • bindata/network/ovn-kubernetes/managed/ovnkube-control-plane.yaml
  • bindata/network/ovn-kubernetes/common/001-crd.yaml
  • bindata/network/ovn-kubernetes/managed/004-config.yaml
  • bindata/network/ovn-kubernetes/self-hosted/ovnkube-control-plane.yaml
🔇 Additional comments (3)
bindata/network/ovn-kubernetes/managed/004-config.yaml (1)

48-50: LGTM: feature-flagged enablement is cleanly scoped.

bindata/network/ovn-kubernetes/managed/ovnkube-control-plane.yaml (1)

207-210: Feature-gated NetworkConnect flag is wired consistently.
Matches the existing flag pattern and cleanly injects the option into the ovnkube command.

Also applies to: 256-256

bindata/network/ovn-kubernetes/self-hosted/ovnkube-control-plane.yaml (1)

158-161: NetworkConnect flag addition is consistent with existing gating.
No issues; the exec wiring is straightforward and aligned with the managed manifest.

Also applies to: 213-213

✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.

Comment thread bindata/network/ovn-kubernetes/common/001-crd.yaml
@tssurya tssurya force-pushed the cnc-devpreview-featuregate branch 2 times, most recently from 7207d29 to fe79b4b Compare January 16, 2026 13:38
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Fix all issues with AI agents
In `@pkg/network/ovn_kubernetes_test.go`:
- Around line 880-920: The test case with desc "enable network connect
(DevPreview)" is missing the controlPlaneReplicaCount field causing it to
default to 0; update that table entry to include controlPlaneReplicaCount (match
other non-SNO tests by setting controlPlaneReplicaCount: 2, or 1 if intended as
SNO) so the cluster config used by the test (and the expected output block)
reflects a valid replica count; locate the test case by its desc string and add
the controlPlaneReplicaCount key alongside enabledFeatureGates and expected.
♻️ Duplicate comments (1)
bindata/network/ovn-kubernetes/common/001-crd.yaml (1)

5174-5205: Align networkPrefix validation with the “equal or longer” rule.

The description allows equality, but the validation rule requires networkPrefix to be strictly greater than the CIDR prefix length, rejecting valid configs (e.g., /16 with networkPrefix=16).

Proposed fix
-                  - message: NetworkPrefix must be smaller than CIDR subnet
-                    rule: '!has(self.networkPrefix) || !isCIDR(self.cidr) || self.networkPrefix
-                      > cidr(self.cidr).prefixLength()'
+                  - message: NetworkPrefix must be equal to or longer than the CIDR prefix
+                    rule: '!has(self.networkPrefix) || !isCIDR(self.cidr) || self.networkPrefix
+                      >= cidr(self.cidr).prefixLength()'
📜 Review details

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting

📥 Commits

Reviewing files that changed from the base of the PR and between 7207d29 and fe79b4b.

📒 Files selected for processing (9)
  • bindata/network/ovn-kubernetes/common/001-crd.yaml
  • bindata/network/ovn-kubernetes/common/008-script-lib.yaml
  • bindata/network/ovn-kubernetes/managed/004-config.yaml
  • bindata/network/ovn-kubernetes/managed/ovnkube-control-plane.yaml
  • bindata/network/ovn-kubernetes/self-hosted/004-config.yaml
  • bindata/network/ovn-kubernetes/self-hosted/ovnkube-control-plane.yaml
  • pkg/network/cluster_config_test.go
  • pkg/network/ovn_kubernetes.go
  • pkg/network/ovn_kubernetes_test.go
🚧 Files skipped from review as they are similar to previous changes (2)
  • pkg/network/cluster_config_test.go
  • bindata/network/ovn-kubernetes/managed/004-config.yaml
🧰 Additional context used
📓 Path-based instructions (1)
**

⚙️ CodeRabbit configuration file

-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.

Files:

  • bindata/network/ovn-kubernetes/common/008-script-lib.yaml
  • pkg/network/ovn_kubernetes.go
  • bindata/network/ovn-kubernetes/self-hosted/ovnkube-control-plane.yaml
  • pkg/network/ovn_kubernetes_test.go
  • bindata/network/ovn-kubernetes/common/001-crd.yaml
  • bindata/network/ovn-kubernetes/managed/ovnkube-control-plane.yaml
  • bindata/network/ovn-kubernetes/self-hosted/004-config.yaml
🔇 Additional comments (11)
bindata/network/ovn-kubernetes/common/008-script-lib.yaml (2)

625-629: Network-connect gating matches existing feature flags.


735-735: Flag is correctly wired into the ovnkube invocation.

bindata/network/ovn-kubernetes/self-hosted/004-config.yaml (1)

55-57: Config template emits enable-network-connect under the gate.

bindata/network/ovn-kubernetes/self-hosted/ovnkube-control-plane.yaml (2)

158-161: Network-connect flag initialization looks consistent.


213-213: Flag inclusion in ovnkube args is correct.

pkg/network/ovn_kubernetes.go (1)

337-342: Feature gate is correctly surfaced into render data.

bindata/network/ovn-kubernetes/managed/ovnkube-control-plane.yaml (2)

207-210: Network-connect flag definition is consistent with other gates.


256-256: Flag is correctly wired into the command line.

pkg/network/ovn_kubernetes_test.go (3)

76-85: LGTM!

The feature gate is correctly added to the disabled list with an appropriate comment indicating its DevPreview status.


971-978: LGTM!

The feature gate is correctly added to knownFeatureGates in alphabetical order, ensuring proper test coverage for the NetworkConnect feature.


3869-3878: LGTM!

Consistent with the default feature gates configuration, keeping NetworkConnect disabled when testing unrelated features.

✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.

Comment on lines +880 to +920
{
desc: "enable network connect (DevPreview)",
expected: `
[default]
mtu="1500"
cluster-subnets="10.128.0.0/15/23,10.0.0.0/14/24"
encap-port="8061"
enable-lflow-cache=true
lflow-cache-limit-kb=1048576
enable-udp-aggregation=true
udn-allowed-default-services="default/kubernetes,openshift-dns/dns-default"

[kubernetes]
service-cidrs="172.30.0.0/16"
ovn-config-namespace="openshift-ovn-kubernetes"
apiserver="https://testing.test:8443"
host-network-namespace="openshift-host-network"
platform-type="GCP"
healthz-bind-address="0.0.0.0:10256"
dns-service-namespace="openshift-dns"
dns-service-name="dns-default"

[ovnkubernetesfeature]
egressip-node-healthcheck-port=9107
enable-network-segmentation=true
enable-network-connect=true

[gateway]
mode=shared
nodeport=true

[logging]
libovsdblogfile=/var/log/ovnkube/libovsdb.log
logfile-maxsize=100
logfile-maxbackups=5
logfile-maxage=0`,
enabledFeatureGates: []configv1.FeatureGateName{
apifeatures.FeatureGateNetworkSegmentation,
apifeatures.FeatureGateNetworkConnect,
},
},
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Missing controlPlaneReplicaCount field.

All other test cases in this table specify controlPlaneReplicaCount: 2 (or 1 for SNO scenarios). This test case omits it, defaulting to 0, which may not represent a valid cluster configuration.

💡 Proposed fix
 		{
 			desc: "enable network connect (DevPreview)",
 			expected: `
 [default]
 ...
 logfile-maxage=0`,
 			enabledFeatureGates: []configv1.FeatureGateName{
 				apifeatures.FeatureGateNetworkSegmentation,
 				apifeatures.FeatureGateNetworkConnect,
 			},
+			controlPlaneReplicaCount: 2,
 		},
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
{
desc: "enable network connect (DevPreview)",
expected: `
[default]
mtu="1500"
cluster-subnets="10.128.0.0/15/23,10.0.0.0/14/24"
encap-port="8061"
enable-lflow-cache=true
lflow-cache-limit-kb=1048576
enable-udp-aggregation=true
udn-allowed-default-services="default/kubernetes,openshift-dns/dns-default"
[kubernetes]
service-cidrs="172.30.0.0/16"
ovn-config-namespace="openshift-ovn-kubernetes"
apiserver="https://testing.test:8443"
host-network-namespace="openshift-host-network"
platform-type="GCP"
healthz-bind-address="0.0.0.0:10256"
dns-service-namespace="openshift-dns"
dns-service-name="dns-default"
[ovnkubernetesfeature]
egressip-node-healthcheck-port=9107
enable-network-segmentation=true
enable-network-connect=true
[gateway]
mode=shared
nodeport=true
[logging]
libovsdblogfile=/var/log/ovnkube/libovsdb.log
logfile-maxsize=100
logfile-maxbackups=5
logfile-maxage=0`,
enabledFeatureGates: []configv1.FeatureGateName{
apifeatures.FeatureGateNetworkSegmentation,
apifeatures.FeatureGateNetworkConnect,
},
},
{
desc: "enable network connect (DevPreview)",
expected: `
[default]
mtu="1500"
cluster-subnets="10.128.0.0/15/23,10.0.0.0/14/24"
encap-port="8061"
enable-lflow-cache=true
lflow-cache-limit-kb=1048576
enable-udp-aggregation=true
udn-allowed-default-services="default/kubernetes,openshift-dns/dns-default"
[kubernetes]
service-cidrs="172.30.0.0/16"
ovn-config-namespace="openshift-ovn-kubernetes"
apiserver="https://testing.test:8443"
host-network-namespace="openshift-host-network"
platform-type="GCP"
healthz-bind-address="0.0.0.0:10256"
dns-service-namespace="openshift-dns"
dns-service-name="dns-default"
[ovnkubernetesfeature]
egressip-node-healthcheck-port=9107
enable-network-segmentation=true
enable-network-connect=true
[gateway]
mode=shared
nodeport=true
[logging]
libovsdblogfile=/var/log/ovnkube/libovsdb.log
logfile-maxsize=100
logfile-maxbackups=5
logfile-maxage=0`,
enabledFeatureGates: []configv1.FeatureGateName{
apifeatures.FeatureGateNetworkSegmentation,
apifeatures.FeatureGateNetworkConnect,
},
controlPlaneReplicaCount: 2,
},
🤖 Prompt for AI Agents
In `@pkg/network/ovn_kubernetes_test.go` around lines 880 - 920, The test case
with desc "enable network connect (DevPreview)" is missing the
controlPlaneReplicaCount field causing it to default to 0; update that table
entry to include controlPlaneReplicaCount (match other non-SNO tests by setting
controlPlaneReplicaCount: 2, or 1 if intended as SNO) so the cluster config used
by the test (and the expected output block) reflects a valid replica count;
locate the test case by its desc string and add the controlPlaneReplicaCount key
alongside enabledFeatureGates and expected.

@tssurya tssurya force-pushed the cnc-devpreview-featuregate branch from fe79b4b to aeb049c Compare January 16, 2026 13:48
@tssurya
Copy link
Copy Markdown
Contributor Author

tssurya commented Jan 16, 2026

/retest-required

@tssurya
Copy link
Copy Markdown
Contributor Author

tssurya commented Jan 19, 2026

grrrrr huge conflict thanks to #2456 I guess I should be able to drop my first commit hopefully..

@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 19, 2026
@openshift-merge-robot
Copy link
Copy Markdown
Contributor

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@tssurya tssurya force-pushed the cnc-devpreview-featuregate branch from aeb049c to f750d26 Compare March 18, 2026 16:09
@openshift-ci openshift-ci Bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 18, 2026
@tssurya tssurya force-pushed the cnc-devpreview-featuregate branch from f750d26 to 44c906b Compare March 18, 2026 16:13
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

♻️ Duplicate comments (1)
bindata/network/ovn-kubernetes/common/001-crd.yaml (1)

5500-5531: ⚠️ Potential issue | 🟠 Major

Allow networkPrefix == CIDR prefix as documented.

Line 5502 allows equality, but Line 5530 enforces strict >, which rejects documented-valid configs.

Suggested fix
-                  - message: NetworkPrefix must be smaller than CIDR subnet
-                    rule: '!has(self.networkPrefix) || !isCIDR(self.cidr) || self.networkPrefix
-                      > cidr(self.cidr).prefixLength()'
+                  - message: NetworkPrefix must be equal to or longer than the CIDR prefix
+                    rule: '!has(self.networkPrefix) || !isCIDR(self.cidr) || self.networkPrefix
+                      >= cidr(self.cidr).prefixLength()'
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@bindata/network/ovn-kubernetes/common/001-crd.yaml` around lines 5500 - 5531,
The x-kubernetes-validations rule currently rejects configurations where
self.networkPrefix equals the CIDR prefix because it uses a strict '>'
comparison; update the validation expression in the x-kubernetes-validations
rule to allow equality by replacing the strict greater-than check with a
greater-than-or-equal check (i.e., change the comparison involving
self.networkPrefix and cidr(self.cidr).prefixLength() to use >=) so that
self.networkPrefix == cidr(self.cidr).prefixLength() is accepted.
🧹 Nitpick comments (1)
bindata/network/ovn-kubernetes/common/001-crd.yaml (1)

5743-5750: Keep networkSelectionType enum consistent with allowed values.

The enum advertises values (DefaultNetwork, SecondaryUserDefinedNetworks, NetworkAttachmentDefinitions) that are always rejected by the top-level rule. This makes the API contract confusing for clients and users.

As per coding guidelines, "Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity."

Also applies to: 5950-5953

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@bindata/network/ovn-kubernetes/common/001-crd.yaml` around lines 5743 - 5750,
The CRD's networkSelectionType enum includes values (DefaultNetwork,
SecondaryUserDefinedNetworks, NetworkAttachmentDefinitions) that are impossible
under the top-level validation rule; update the enum to only list allowed values
to keep the API contract consistent: locate the networkSelectionType field in
the CRD (search for "networkSelectionType" and the enum block shown) and remove
any enum entries that are rejected by the top-level rule or adjust the top-level
rule to accept those values if intended (ensure the enum and the top-level
validation rule are aligned so only permitted values remain).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@bindata/network/ovn-kubernetes/common/001-crd.yaml`:
- Around line 5500-5531: The x-kubernetes-validations rule currently rejects
configurations where self.networkPrefix equals the CIDR prefix because it uses a
strict '>' comparison; update the validation expression in the
x-kubernetes-validations rule to allow equality by replacing the strict
greater-than check with a greater-than-or-equal check (i.e., change the
comparison involving self.networkPrefix and cidr(self.cidr).prefixLength() to
use >=) so that self.networkPrefix == cidr(self.cidr).prefixLength() is
accepted.

---

Nitpick comments:
In `@bindata/network/ovn-kubernetes/common/001-crd.yaml`:
- Around line 5743-5750: The CRD's networkSelectionType enum includes values
(DefaultNetwork, SecondaryUserDefinedNetworks, NetworkAttachmentDefinitions)
that are impossible under the top-level validation rule; update the enum to only
list allowed values to keep the API contract consistent: locate the
networkSelectionType field in the CRD (search for "networkSelectionType" and the
enum block shown) and remove any enum entries that are rejected by the top-level
rule or adjust the top-level rule to accept those values if intended (ensure the
enum and the top-level validation rule are aligned so only permitted values
remain).

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2be86cdd-8f98-43be-a296-aef0db14e87e

📥 Commits

Reviewing files that changed from the base of the PR and between aeb049c and f750d26.

📒 Files selected for processing (10)
  • bindata/network/ovn-kubernetes/common/001-crd.yaml
  • bindata/network/ovn-kubernetes/common/008-script-lib.yaml
  • bindata/network/ovn-kubernetes/managed/004-config.yaml
  • bindata/network/ovn-kubernetes/managed/ovnkube-control-plane.yaml
  • bindata/network/ovn-kubernetes/self-hosted/004-config.yaml
  • bindata/network/ovn-kubernetes/self-hosted/ovnkube-control-plane.yaml
  • pkg/network/cluster_config_test.go
  • pkg/network/ovn_kubernetes.go
  • pkg/network/ovn_kubernetes_test.go
  • pkg/network/render_test.go
🚧 Files skipped from review as they are similar to previous changes (5)
  • pkg/network/cluster_config_test.go
  • bindata/network/ovn-kubernetes/self-hosted/004-config.yaml
  • bindata/network/ovn-kubernetes/common/008-script-lib.yaml
  • bindata/network/ovn-kubernetes/managed/004-config.yaml
  • pkg/network/ovn_kubernetes_test.go

@kyrtapz
Copy link
Copy Markdown
Contributor

kyrtapz commented Mar 19, 2026

Were you able to do a sanity check on a live cluster? DevPreview is not something we cover in CI.
Other than that it looks good.

@openshift-ci openshift-ci Bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 25, 2026
@tssurya tssurya force-pushed the cnc-devpreview-featuregate branch 2 times, most recently from 5d49430 to aec03ba Compare March 27, 2026 10:26
@openshift-ci openshift-ci Bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 27, 2026
@tssurya tssurya force-pushed the cnc-devpreview-featuregate branch 2 times, most recently from c91a924 to c60357b Compare March 27, 2026 11:05
@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Mar 27, 2026
@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented Mar 27, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kyrtapz, tssurya

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tssurya
Copy link
Copy Markdown
Contributor Author

tssurya commented Mar 27, 2026

/verified
through manual testing
added details above

@openshift-ci-robot
Copy link
Copy Markdown
Contributor

@tssurya: The /verified command must be used with one of the following actions: by, later, remove, or bypass. See https://docs.ci.openshift.org/docs/architecture/jira/#premerge-verification for more information.

Details

In response to this:

/verified
through manual testing
added details above

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@tssurya
Copy link
Copy Markdown
Contributor Author

tssurya commented Mar 27, 2026

/verified by manual testing

@openshift-ci-robot openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Mar 27, 2026
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

@tssurya: This PR has been marked as verified by manual testing.

Details

In response to this:

/verified by manual testing

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@tssurya
Copy link
Copy Markdown
Contributor Author

tssurya commented Mar 27, 2026

/tide refresh

@openshift-ci-robot
Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD f5e61cd and 2 for PR HEAD be6b8e7 in total

@tssurya
Copy link
Copy Markdown
Contributor Author

tssurya commented Mar 28, 2026

/retest-failed

@tssurya
Copy link
Copy Markdown
Contributor Author

tssurya commented Mar 28, 2026

/retest

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented Mar 28, 2026

@tssurya: Overrode contexts on behalf of tssurya: ci/prow/e2e-metal-ipi-ovn-dualstack-bgp

Details

In response to this:

override ci/prow/e2e-metal-ipi-ovn-dualstack-bgp-local-gw
/override ci/prow/e2e-metal-ipi-ovn-dualstack-bgp

https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_cluster-network-operator/2880/pull-ci-openshift-cluster-network-operator-master-e2e-metal-ipi-ovn-dualstack-bgp/2037795043955183616 and https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_cluster-network-operator/2880/pull-ci-openshift-cluster-network-operator-master-e2e-metal-ipi-ovn-dualstack-bgp-local-gw/2037795044001320960 are failing because of

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@tssurya
Copy link
Copy Markdown
Contributor Author

tssurya commented Mar 28, 2026

/override ci/prow/e2e-metal-ipi-ovn-dualstack-bgp-local-gw

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented Mar 28, 2026

@tssurya: Overrode contexts on behalf of tssurya: ci/prow/e2e-metal-ipi-ovn-dualstack-bgp-local-gw

Details

In response to this:

/override ci/prow/e2e-metal-ipi-ovn-dualstack-bgp-local-gw

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@tssurya
Copy link
Copy Markdown
Contributor Author

tssurya commented Mar 28, 2026

/tide refresh

@tssurya
Copy link
Copy Markdown
Contributor Author

tssurya commented Mar 28, 2026

/test hypershift-e2e-aks

@tssurya
Copy link
Copy Markdown
Contributor Author

tssurya commented Mar 28, 2026

/test 4.22-upgrade-from-stable-4.21-e2e-azure-ovn-upgrade

@tssurya
Copy link
Copy Markdown
Contributor Author

tssurya commented Mar 28, 2026

/tide refresh

@tssurya
Copy link
Copy Markdown
Contributor Author

tssurya commented Mar 29, 2026

/test hyoershift-e2e-aks

@tssurya
Copy link
Copy Markdown
Contributor Author

tssurya commented Mar 29, 2026

/test hypershift-e2e-aks

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented Mar 29, 2026

@tssurya: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-aws-ovn-rhcos10-techpreview be6b8e7 link false /test e2e-aws-ovn-rhcos10-techpreview
ci/prow/security be6b8e7 link false /test security

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@tssurya
Copy link
Copy Markdown
Contributor Author

tssurya commented Mar 29, 2026

/override ci/prow/hypershift-e2e-aks

hypershift AKS job has 3 failures so far:

  1. https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_cluster-network-operator/2880/pull-ci-openshift-cluster-network-operator-master-hypershift-e2e-aks/2037795044076818432
  2. https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_cluster-network-operator/2880/pull-ci-openshift-cluster-network-operator-master-hypershift-e2e-aks/2037988017846620160
  3. https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_cluster-network-operator/2880/pull-ci-openshift-cluster-network-operator-master-hypershift-e2e-aks/2038139287756607488

the first two links show:

{Failed  === RUN   TestCreateCluster
=== PAUSE TestCreateCluster
=== CONT  TestCreateCluster
    hypershift_framework.go:513: Successfully created hostedcluster e2e-clusters-ggqqr/create-cluster-5lzh8 in 2m24s
    hypershift_framework.go:179: Summarizing unexpected conditions for HostedCluster create-cluster-5lzh8 
    util.go:3000: Failed to wait for HostedCluster e2e-clusters-ggqqr/create-cluster-5lzh8 to have valid conditions in 2s: context deadline exceeded
    eventually.go:225: observed *v1beta1.HostedCluster e2e-clusters-ggqqr/create-cluster-5lzh8 invalid at RV 61100 after 2s:
    eventually.go:228:  - incorrect condition: wanted ClusterVersionReleaseAccepted=True, got ClusterVersionReleaseAccepted=Unknown: StatusUnknown(Condition not found in the CVO.)
    eventually.go:228:  - incorrect condition: wanted ClusterVersionProgressing=False, got ClusterVersionProgressing=Unknown: StatusUnknown(Condition not found in the CVO.)
    eventually.go:228:  - incorrect condition: wanted DataPlaneConnectionAvailable=True, got DataPlaneConnectionAvailable=Unknown: StatusUnknown(Condition not found in the HCP)
    eventually.go:228:  - incorrect condition: wanted Degraded=False, got Degraded=True: UnavailableReplicas([cluster-network-operator deployment has 1 unavailable replicas, ingress-operator deployment has 1 unavailable replicas])

totally unrelated to a DevPreview FG activation that this PR is doing

the last attempt gets closer:

: TestUpgradeControlPlane/Main/EnsureNoCrashingPods expand_less	0s
{Failed  === RUN   TestUpgradeControlPlane/Main/EnsureNoCrashingPods
    util.go:816: Container cluster-version-operator in pod cluster-version-operator-cc96ddbc-jw4x6 has a restartCount > 0 (1)
        --- FAIL: TestUpgradeControlPlane/Main/EnsureNoCrashingPods (0.09s)
}

https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/pr-logs/pull/openshift_cluster-network-operator/2880/pull-ci-openshift-cluster-network-operator-master-hypershift-e2e-aks/2038139287756607488/artifacts/hypershift-e2e-aks/hypershift-azure-run-e2e/artifacts/TestUpgradeControlPlane/namespaces/e2e-clusters-t4zjl-control-plane-upgrade-ltm5c/core/pods/cluster-version-operator-cc96ddbc-jw4x6.yaml is the yaml for the crashed pod

    restartCount: 1
    started: true
    state:
      running:
        startedAt: "2026-03-29T07:16:02Z"

just had 1 restart but eventually came up.. so that's in CVO land

I have no idea why CVO is crashing?! but regardless my PR has no effect on GA clusters and is purely a DevPreview change. I can't keep retesting this lane since its pencils down time so overriding this

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented Mar 29, 2026

@tssurya: Overrode contexts on behalf of tssurya: ci/prow/hypershift-e2e-aks

Details

In response to this:

/override ci/prow/hypershift-e2e-aks

hypershift AKS job has 3 failures so far:

  1. https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_cluster-network-operator/2880/pull-ci-openshift-cluster-network-operator-master-hypershift-e2e-aks/2037795044076818432
  2. https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_cluster-network-operator/2880/pull-ci-openshift-cluster-network-operator-master-hypershift-e2e-aks/2037988017846620160
  3. https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_cluster-network-operator/2880/pull-ci-openshift-cluster-network-operator-master-hypershift-e2e-aks/2038139287756607488

the first two links show:

{Failed  === RUN   TestCreateCluster
=== PAUSE TestCreateCluster
=== CONT  TestCreateCluster
   hypershift_framework.go:513: Successfully created hostedcluster e2e-clusters-ggqqr/create-cluster-5lzh8 in 2m24s
   hypershift_framework.go:179: Summarizing unexpected conditions for HostedCluster create-cluster-5lzh8 
   util.go:3000: Failed to wait for HostedCluster e2e-clusters-ggqqr/create-cluster-5lzh8 to have valid conditions in 2s: context deadline exceeded
   eventually.go:225: observed *v1beta1.HostedCluster e2e-clusters-ggqqr/create-cluster-5lzh8 invalid at RV 61100 after 2s:
   eventually.go:228:  - incorrect condition: wanted ClusterVersionReleaseAccepted=True, got ClusterVersionReleaseAccepted=Unknown: StatusUnknown(Condition not found in the CVO.)
   eventually.go:228:  - incorrect condition: wanted ClusterVersionProgressing=False, got ClusterVersionProgressing=Unknown: StatusUnknown(Condition not found in the CVO.)
   eventually.go:228:  - incorrect condition: wanted DataPlaneConnectionAvailable=True, got DataPlaneConnectionAvailable=Unknown: StatusUnknown(Condition not found in the HCP)
   eventually.go:228:  - incorrect condition: wanted Degraded=False, got Degraded=True: UnavailableReplicas([cluster-network-operator deployment has 1 unavailable replicas, ingress-operator deployment has 1 unavailable replicas])

totally unrelated to a DevPreview FG activation that this PR is doing

the last attempt gets closer:

: TestUpgradeControlPlane/Main/EnsureNoCrashingPods expand_less	0s
{Failed  === RUN   TestUpgradeControlPlane/Main/EnsureNoCrashingPods
   util.go:816: Container cluster-version-operator in pod cluster-version-operator-cc96ddbc-jw4x6 has a restartCount > 0 (1)
       --- FAIL: TestUpgradeControlPlane/Main/EnsureNoCrashingPods (0.09s)
}

I have no idea why CVO is crashing?! but regardless my PR has no effect on GA clusters and is purely a DevPreview change. I can't keep retesting this lane since its pencils down time so overriding this

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@tssurya
Copy link
Copy Markdown
Contributor Author

tssurya commented Mar 29, 2026

/tide refresh

@tssurya
Copy link
Copy Markdown
Contributor Author

tssurya commented Mar 29, 2026

/shrug

@openshift-ci openshift-ci Bot added the ¯\_(ツ)_/¯ ¯\\\_(ツ)_/¯ label Mar 29, 2026
@tssurya
Copy link
Copy Markdown
Contributor Author

tssurya commented Mar 29, 2026

/skip

@openshift-merge-bot openshift-merge-bot Bot merged commit 5ce0f71 into openshift:master Mar 29, 2026
30 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. verified Signifies that the PR passed pre-merge verification criteria ¯\_(ツ)_/¯ ¯\\\_(ツ)_/¯

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants