diff --git a/bindata/network/ovn-kubernetes/common/008-script-lib.yaml b/bindata/network/ovn-kubernetes/common/008-script-lib.yaml index 83ca5e41d5..ebb23cc577 100644 --- a/bindata/network/ovn-kubernetes/common/008-script-lib.yaml +++ b/bindata/network/ovn-kubernetes/common/008-script-lib.yaml @@ -547,6 +547,11 @@ data: echo "I$(date "+%m%d %H:%M:%S.%N") - starting ovnkube-node" + multinetwork_policy_enabled_flag= + {{- if .OVN_MULTI_NETWORK_POLICY_ENABLE }} + multinetwork_policy_enabled_flag="--enable-multi-networkpolicy" + {{ end }} + ovn_eip_reachability_timeout_opt= {{- if .ReachabilityTotalTimeoutSeconds }} ovn_eip_reachability_timeout_opt="--egressip-reachability-total-timeout {{.ReachabilityTotalTimeoutSeconds}}" @@ -738,5 +743,6 @@ data: ${ovn_v4_transit_switch_subnet_opt} \ ${ovn_v6_transit_switch_subnet_opt} \ ${dpu_lease_flags} \ - ${ovn_eip_reachability_timeout_opt} + ${ovn_eip_reachability_timeout_opt} \ + ${multinetwork_policy_enabled_flag} } diff --git a/pkg/network/ovn_kubernetes_test.go b/pkg/network/ovn_kubernetes_test.go index b1f0acf8b6..26c0e283c4 100644 --- a/pkg/network/ovn_kubernetes_test.go +++ b/pkg/network/ovn_kubernetes_test.go @@ -717,7 +717,7 @@ logfile-maxage=0`, disableGRO: true, }, { - desc: "enable multi-network policies and admin network policies", + desc: "enable admin network policies", expected: ` [default] mtu="1500" @@ -760,9 +760,7 @@ logfile-maxsize=100 logfile-maxbackups=5 logfile-maxage=0`, controlPlaneReplicaCount: 2, - - enableMultiNetPolicies: true, - enabledFeatureGates: []configv1.FeatureGateName{}, + enabledFeatureGates: []configv1.FeatureGateName{}, }, { desc: "enable network segmentation and multi-network", @@ -811,7 +809,7 @@ logfile-maxage=0`, enabledFeatureGates: []configv1.FeatureGateName{}, }, { - desc: "enable multi-network policies with DisableMultiNetwork", + desc: "Set DisableMultiNetwork", expected: ` [default] mtu="1500" @@ -855,7 +853,6 @@ logfile-maxbackups=5 logfile-maxage=0`, controlPlaneReplicaCount: 2, disableMultiNet: true, - enableMultiNetPolicies: true, enabledFeatureGates: []configv1.FeatureGateName{}, }, { @@ -4027,51 +4024,53 @@ func TestRenderOVNKubernetesEnablePersistentIPs(t *testing.T) { g.Expect(objs).To(ContainElement(HaveKubernetesID("CustomResourceDefinition", "", "ipamclaims.k8s.cni.cncf.io"))) } -// TestRenderOVNKubernetesReachability tests egress IP reachability timeout rendering -func TestRenderOVNKubernetesReachability(t *testing.T) { +// TestRenderOVNKubernetesFlags tests the rendering of different ovnkube flags +// ReachabilityTotalTimeoutSeconds: --egressip-reachability-total-timeout +// OVN_MULTI_NETWORK_POLICY_ENABLE: --enable-multi-networkpolicy +func TestRenderOVNKubernetesFlags(t *testing.T) { g := NewGomegaWithT(t) testCases := []struct { name string reachabilityTimeout *uint32 + enableMultiNetworkPolicy bool expectKubernetesFeatureReachability bool - expectErr bool }{ { name: "No reachability timeout (nil)", reachabilityTimeout: nil, expectKubernetesFeatureReachability: false, - expectErr: false, }, { name: "Reachability timeout set to 0", reachabilityTimeout: ptrToUint32(0), expectKubernetesFeatureReachability: true, - expectErr: false, }, { name: "Reachability timeout changed to 10", reachabilityTimeout: ptrToUint32(10), expectKubernetesFeatureReachability: true, - expectErr: false, }, { name: "Reachability timeout unchanged to 10", reachabilityTimeout: ptrToUint32(10), expectKubernetesFeatureReachability: true, - expectErr: false, }, { name: "Reachability timeout changed to 5", reachabilityTimeout: ptrToUint32(5), expectKubernetesFeatureReachability: true, - expectErr: false, }, { name: "Reachability timeout disabled", reachabilityTimeout: nil, expectKubernetesFeatureReachability: false, - expectErr: false, + }, + { + name: "Enable Multi Network Policy", + reachabilityTimeout: nil, + expectKubernetesFeatureReachability: false, + enableMultiNetworkPolicy: true, }, } @@ -4080,6 +4079,7 @@ func TestRenderOVNKubernetesReachability(t *testing.T) { crd := OVNKubernetesConfig.DeepCopy() config := &crd.Spec config.DefaultNetwork.OVNKubernetesConfig.EgressIPConfig.ReachabilityTotalTimeoutSeconds = tc.reachabilityTimeout + config.UseMultiNetworkPolicy = &tc.enableMultiNetworkPolicy errs := validateOVNKubernetes(config) g.Expect(errs).To(HaveLen(0)) @@ -4108,10 +4108,6 @@ func TestRenderOVNKubernetesReachability(t *testing.T) { bootstrapResult.Infra = bootstrap.InfraStatus{} bootstrapResult.Infra.HostedControlPlane = &hypershift.HostedControlPlane{} objs, _, err := renderOVNKubernetes(config, bootstrapResult, manifestDirOvn, fakeClient, featureGatesCNO) - if tc.expectErr { - g.Expect(err).To(HaveOccurred()) - return - } g.Expect(err).NotTo(HaveOccurred()) var configMap *uns.Unstructured @@ -4168,6 +4164,19 @@ func TestRenderOVNKubernetesReachability(t *testing.T) { "ovnkube-node pod template should not contain the configured reachability timeout value", ) } + + if tc.enableMultiNetworkPolicy { + g.Expect(scriptNode).To( + ContainSubstring("--enable-multi-networkpolicy"), + "ovnkube-node pod template should contain the flag --enable-multi-networkpolicy", + ) + + } else { + g.Expect(scriptNode).NotTo( + ContainSubstring("--enable-multi-networkpolicy"), + "ovnkube-node pod template should not contain the flag --enable-multi-networkpolicy", + ) + } }) } }