OCPBUGS-92080: Adds rendering of enable-multi-network-policy in ovnkube-node

[raphaelvrosa]

Sets the flag --enable-multi-networkpolicy to be properly rendered in ovnkube-node config flags when updated by CNO.

Modifies unit test to evaluate the rendering of multiple Flags to ovnkube cluster-manager and node.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[coderabbitai]

Walkthrough

Changes

OVN policy flag forwarding

Layer / File(s)	Summary
Wire policy enablement into ovnkube-node bindata/network/ovn-kubernetes/common/008-script-lib.yaml, bindata/network/ovn-kubernetes/managed/004-config.yaml, bindata/network/ovn-kubernetes/self-hosted/004-config.yaml	The policy setting is removed from ovnkube.conf templates and conditionally passed as --enable-multi-networkpolicy to ovnkube-node.
Validate rendered policy and reachability flags pkg/network/ovn_kubernetes_test.go	Rendering tests remove the configuration-key expectations and verify policy-flag inclusion or exclusion alongside reachability timeout behavior.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant OVNKubernetesConfig
  participant ovnkubeNodeScript
  participant ovnkube
  OVNKubernetesConfig->>ovnkubeNodeScript: render OVN_MULTI_NETWORK_POLICY_ENABLE
  ovnkubeNodeScript->>ovnkube: pass --enable-multi-networkpolicy when enabled

Loading

Suggested reviewers: taanyas, tssurya

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (5 errors)

Check name	Status	Explanation	Resolution
Pr Quality	❌ Error	PR is small (4 files, 66 lines) but the description lacks required Why/What/Testing sections and has no bug/issue link for this feature change.	Add clear Why/What/Testing sections, list the CI jobs/platforms that verify it, and include a bug/issue link in the title or description.
Commit Message Quality	❌ Error	Single commit is logical and has a body, but the subject lacks the required component prefix (e.g. ovn-kubernetes: ...).	Rewrite the commit subject with a component prefix, e.g. ovn-kubernetes: Add rendering of enable-multi-network-policy in ovnkube-node.
E2e Tests For Feature Changes	❌ Error	User-facing flag rendering changed, but no test/e2e files were added and the PR description lacks a Testing/How to verify it section.	Add test/e2e coverage for the new flag rendering, or document why E2E isn't feasible in a Testing/How to verify it section with CI lanes/platforms/results, then rerun pre-merge checks.
Stale Project Docs And Config	❌ Error	docs/ovn_node_mode.md still says feature enablement is managed via 004-config.yaml, but this PR moves enable-multi-networkpolicy to --enable-multi-networkpolicy in 008-script-lib.yaml and r...	Update the affected docs (at least docs/ovn_node_mode.md) to describe the new CLI-flag rendering, or comment why this is a false positive and add @coderabbitai ignore pre-merge checks.
Title check	❌ Error	The title is related but violates the format rules: it exceeds 72 characters and uses non-imperative wording.	Rewrite it in imperative mood and shorten it to 72 characters or less, e.g. "ovn-kubernetes: Add enable-multi-networkpolicy rendering".

✅ Passed checks (19 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Unit Tests For Go Changes	✅ Passed	Bindata templates changed and pkg/network/ovn_kubernetes_test.go was modified in the same PR, satisfying the test-coverage requirement.
Rbac Least Privilege	✅ Passed	Changed YAMLs are ConfigMaps only; no Role/ClusterRole objects or RBAC rules/verbs were added or modified.
Docs For Feature And Behavior Changes	✅ Passed	Bug fix: it renders existing UseMultiNetworkPolicy support in templates/tests, not a new CNO feature; no docs files were changed.
Go And Test Code Quality	✅ Passed	Changed Go/test code only adds flag-rendering assertions and uses t.Setenv; no new bare t.Fatal/fatalf, Sleep, Setenv, shadowing, or logging issues found.
Ai-Generated Code Smell	✅ Passed	No AI/tool references, comment slop, or disproportionate test churn; changes are focused and proportional to the flag-rendering fix.
Stable And Deterministic Test Names	✅ Passed	The PR only adds static subtest titles like "Enable Multi Network Policy" and rewrites other names to static descriptions; no dynamic or generated values appear in changed titles.
Test Structure And Quality	✅ Passed	The updated tests stay unit-only, follow existing t.Run/Gomega style, add messages on new flag assertions, and introduce no cluster waits or cleanup gaps.
Microshift Test Compatibility	✅ Passed	Only Go unit tests and config templates changed; no new Ginkgo e2e tests, MicroShift-unsupported APIs, or MicroShift-specific assumptions were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the PR only changes YAML templates and a Go unit test with no multi-node/HA assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	Only OVN flag-rendering ConfigMap/script and unit tests changed; no nodeSelector, affinity, spread, toleration, or replica logic was added.
Ote Binary Stdout Contract	✅ Passed	No added fmt/log/klog stdout writes in init, main, or suite setup; the new test function and YAML templates only change config rendering.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The change only adds/updates unit tests in pkg/network/ovn_kubernetes_test.go; no new Ginkgo e2e tests or external connectivity assumptions were introduced.
No-Weak-Crypto	✅ Passed	Touched files only change ovnkube flag rendering/tests; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons found.
Container-Privileges	✅ Passed	Touched files only adjust ovnkube flags/tests; no added privileged, hostPID/hostNetwork/hostIPC, SYS_ADMIN, root, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	Diff only adds/removes ovnkube feature flags and test expectations; no new logging of passwords, tokens, PII, or hostnames was introduced.
Description check	✅ Passed	The description clearly matches the changes to render the multi-network policy flag and update unit tests.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci-robot]

@raphaelvrosa: This pull request references Jira Issue OCPBUGS-92080, which is invalid:

• expected the bug to target only the "5.0.0" version, but multiple target versions were set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Sets the flag --enable-multi-networkpolicy to be properly rendered in ovnkube-node config flags when updated by CNO.

Modifies unit test to evaluate the rendering of multiple Flags to ovnkube cluster-manager and node.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: raphaelvrosa
Once this PR has been reviewed and has the lgtm label, please assign tssurya for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[raphaelvrosa]

/jira refresh

[openshift-ci-robot]

@raphaelvrosa: This pull request references Jira Issue OCPBUGS-92080, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (core-networking-bot@redhat.com), skipping review request.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[raphaelvrosa]

/assign @arghosh93

[coderabbitai]

🧹 Nitpick comments (1)

pkg/network/ovn_kubernetes_test.go (1)

4038-4078: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Cover the combined flag case.

The table tests multi-network policy only when reachability is nil, while every reachability case leaves it disabled. Add one case with both enabled so the test verifies that both arguments survive together in the rendered node command.

Proposed test case

 		{
 			name:                                "Enable Multi Network Policy",
 			reachabilityTimeout:                 nil,
 			expectKubernetesFeatureReachability: false,
 			enableMultiNetworkPolicy:            true,
 		},
+		{
+			name:                                "Enable Multi Network Policy with reachability timeout",
+			reachabilityTimeout:                 ptrToUint32(10),
+			expectKubernetesFeatureReachability: true,
+			enableMultiNetworkPolicy:            true,
+		},

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/network/ovn_kubernetes_test.go` around lines 4038 - 4078, Add a table
entry in the testCases for the combined configuration, setting both
reachabilityTimeout to a non-nil value and enableMultiNetworkPolicy to true,
with expectKubernetesFeatureReachability true. Ensure the test execution and
assertions verify both flags are preserved together in the rendered node
command.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@pkg/network/ovn_kubernetes_test.go`:
- Around line 4038-4078: Add a table entry in the testCases for the combined
configuration, setting both reachabilityTimeout to a non-nil value and
enableMultiNetworkPolicy to true, with expectKubernetesFeatureReachability true.
Ensure the test execution and assertions verify both flags are preserved
together in the rendered node command.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: ba0b9006-3af9-4a8b-be50-163c03be5c83

📥 Commits

Reviewing files that changed from the base of the PR and between a23a977 and 3819910.

📒 Files selected for processing (4)

• bindata/network/ovn-kubernetes/common/008-script-lib.yaml
• bindata/network/ovn-kubernetes/managed/004-config.yaml
• bindata/network/ovn-kubernetes/self-hosted/004-config.yaml
• pkg/network/ovn_kubernetes_test.go

💤 Files with no reviewable changes (2)

• bindata/network/ovn-kubernetes/self-hosted/004-config.yaml
• bindata/network/ovn-kubernetes/managed/004-config.yaml

[raphaelvrosa]

/retest-required

[openshift-ci]

@raphaelvrosa: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/5.0-upgrade-from-stable-4.22-e2e-azure-ovn-upgrade	4b46cf0	link	false	/test 5.0-upgrade-from-stable-4.22-e2e-azure-ovn-upgrade
ci/prow/5.0-upgrade-from-stable-4.22-e2e-gcp-ovn-upgrade	4b46cf0	link	false	/test 5.0-upgrade-from-stable-4.22-e2e-gcp-ovn-upgrade
ci/prow/5.0-upgrade-from-stable-4.22-e2e-aws-ovn-upgrade	4b46cf0	link	false	/test 5.0-upgrade-from-stable-4.22-e2e-aws-ovn-upgrade

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.