From 7cf25febe2f6bf4b52973e604311b6fcd80a13a8 Mon Sep 17 00:00:00 2001 From: Raphael Rosa Date: Wed, 22 Jul 2026 15:07:38 +0200 Subject: [PATCH] Adds rendering of enable-multi-network-policy in ovnkube-node Sets the flag `--enable-multi-networkpolicy` to be properly rendered in ovnkube-node config flags when updated by CNO. Modifies unit test to evaluate the rendering of multiple Flags to ovnkube cluster-manager and node. Signed-off-by: Raphael Rosa --- .../ovn-kubernetes/common/008-script-lib.yaml | 8 ++- .../ovn-kubernetes/managed/004-config.yaml | 6 --- .../self-hosted/004-config.yaml | 3 -- pkg/network/ovn_kubernetes_test.go | 49 +++++++++++-------- 4 files changed, 35 insertions(+), 31 deletions(-) diff --git a/bindata/network/ovn-kubernetes/common/008-script-lib.yaml b/bindata/network/ovn-kubernetes/common/008-script-lib.yaml index 83ca5e41d5..ebb23cc577 100644 --- a/bindata/network/ovn-kubernetes/common/008-script-lib.yaml +++ b/bindata/network/ovn-kubernetes/common/008-script-lib.yaml @@ -547,6 +547,11 @@ data: echo "I$(date "+%m%d %H:%M:%S.%N") - starting ovnkube-node" + multinetwork_policy_enabled_flag= + {{- if .OVN_MULTI_NETWORK_POLICY_ENABLE }} + multinetwork_policy_enabled_flag="--enable-multi-networkpolicy" + {{ end }} + ovn_eip_reachability_timeout_opt= {{- if .ReachabilityTotalTimeoutSeconds }} ovn_eip_reachability_timeout_opt="--egressip-reachability-total-timeout {{.ReachabilityTotalTimeoutSeconds}}" @@ -738,5 +743,6 @@ data: ${ovn_v4_transit_switch_subnet_opt} \ ${ovn_v6_transit_switch_subnet_opt} \ ${dpu_lease_flags} \ - ${ovn_eip_reachability_timeout_opt} + ${ovn_eip_reachability_timeout_opt} \ + ${multinetwork_policy_enabled_flag} } diff --git a/bindata/network/ovn-kubernetes/managed/004-config.yaml b/bindata/network/ovn-kubernetes/managed/004-config.yaml index 5c790c9c6e..f69ebc66bf 100644 --- a/bindata/network/ovn-kubernetes/managed/004-config.yaml +++ b/bindata/network/ovn-kubernetes/managed/004-config.yaml @@ -44,9 +44,6 @@ data: enable-network-segmentation=true enable-preconfigured-udn-addresses=true -{{- if .OVN_MULTI_NETWORK_POLICY_ENABLE }} - enable-multi-networkpolicy=true -{{- end }} enable-admin-network-policy=true enable-multi-external-gateway=true {{- if .DNS_NAME_RESOLVER_ENABLE }} @@ -131,9 +128,6 @@ data: enable-multi-network=true enable-network-segmentation=true enable-preconfigured-udn-addresses=true -{{- if .OVN_MULTI_NETWORK_POLICY_ENABLE }} - enable-multi-networkpolicy=true -{{- end }} enable-admin-network-policy=true enable-multi-external-gateway=true {{- if .DNS_NAME_RESOLVER_ENABLE }} diff --git a/bindata/network/ovn-kubernetes/self-hosted/004-config.yaml b/bindata/network/ovn-kubernetes/self-hosted/004-config.yaml index 23e3b1c589..e1d029fa95 100644 --- a/bindata/network/ovn-kubernetes/self-hosted/004-config.yaml +++ b/bindata/network/ovn-kubernetes/self-hosted/004-config.yaml @@ -46,9 +46,6 @@ data: enable-multi-network=true enable-network-segmentation=true enable-preconfigured-udn-addresses=true -{{- if .OVN_MULTI_NETWORK_POLICY_ENABLE }} - enable-multi-networkpolicy=true -{{- end }} enable-admin-network-policy=true enable-multi-external-gateway=true {{- if .DNS_NAME_RESOLVER_ENABLE }} diff --git a/pkg/network/ovn_kubernetes_test.go b/pkg/network/ovn_kubernetes_test.go index e768fbbc4d..26c0e283c4 100644 --- a/pkg/network/ovn_kubernetes_test.go +++ b/pkg/network/ovn_kubernetes_test.go @@ -717,7 +717,7 @@ logfile-maxage=0`, disableGRO: true, }, { - desc: "enable multi-network policies and admin network policies", + desc: "enable admin network policies", expected: ` [default] mtu="1500" @@ -747,7 +747,6 @@ egressip-node-healthcheck-port=9107 enable-multi-network=true enable-network-segmentation=true enable-preconfigured-udn-addresses=true -enable-multi-networkpolicy=true enable-admin-network-policy=true enable-multi-external-gateway=true @@ -761,9 +760,7 @@ logfile-maxsize=100 logfile-maxbackups=5 logfile-maxage=0`, controlPlaneReplicaCount: 2, - - enableMultiNetPolicies: true, - enabledFeatureGates: []configv1.FeatureGateName{}, + enabledFeatureGates: []configv1.FeatureGateName{}, }, { desc: "enable network segmentation and multi-network", @@ -812,7 +809,7 @@ logfile-maxage=0`, enabledFeatureGates: []configv1.FeatureGateName{}, }, { - desc: "enable multi-network policies with DisableMultiNetwork", + desc: "Set DisableMultiNetwork", expected: ` [default] mtu="1500" @@ -842,7 +839,6 @@ egressip-node-healthcheck-port=9107 enable-multi-network=true enable-network-segmentation=true enable-preconfigured-udn-addresses=true -enable-multi-networkpolicy=true enable-admin-network-policy=true enable-multi-external-gateway=true @@ -857,7 +853,6 @@ logfile-maxbackups=5 logfile-maxage=0`, controlPlaneReplicaCount: 2, disableMultiNet: true, - enableMultiNetPolicies: true, enabledFeatureGates: []configv1.FeatureGateName{}, }, { @@ -4029,51 +4024,53 @@ func TestRenderOVNKubernetesEnablePersistentIPs(t *testing.T) { g.Expect(objs).To(ContainElement(HaveKubernetesID("CustomResourceDefinition", "", "ipamclaims.k8s.cni.cncf.io"))) } -// TestRenderOVNKubernetesReachability tests egress IP reachability timeout rendering -func TestRenderOVNKubernetesReachability(t *testing.T) { +// TestRenderOVNKubernetesFlags tests the rendering of different ovnkube flags +// ReachabilityTotalTimeoutSeconds: --egressip-reachability-total-timeout +// OVN_MULTI_NETWORK_POLICY_ENABLE: --enable-multi-networkpolicy +func TestRenderOVNKubernetesFlags(t *testing.T) { g := NewGomegaWithT(t) testCases := []struct { name string reachabilityTimeout *uint32 + enableMultiNetworkPolicy bool expectKubernetesFeatureReachability bool - expectErr bool }{ { name: "No reachability timeout (nil)", reachabilityTimeout: nil, expectKubernetesFeatureReachability: false, - expectErr: false, }, { name: "Reachability timeout set to 0", reachabilityTimeout: ptrToUint32(0), expectKubernetesFeatureReachability: true, - expectErr: false, }, { name: "Reachability timeout changed to 10", reachabilityTimeout: ptrToUint32(10), expectKubernetesFeatureReachability: true, - expectErr: false, }, { name: "Reachability timeout unchanged to 10", reachabilityTimeout: ptrToUint32(10), expectKubernetesFeatureReachability: true, - expectErr: false, }, { name: "Reachability timeout changed to 5", reachabilityTimeout: ptrToUint32(5), expectKubernetesFeatureReachability: true, - expectErr: false, }, { name: "Reachability timeout disabled", reachabilityTimeout: nil, expectKubernetesFeatureReachability: false, - expectErr: false, + }, + { + name: "Enable Multi Network Policy", + reachabilityTimeout: nil, + expectKubernetesFeatureReachability: false, + enableMultiNetworkPolicy: true, }, } @@ -4082,6 +4079,7 @@ func TestRenderOVNKubernetesReachability(t *testing.T) { crd := OVNKubernetesConfig.DeepCopy() config := &crd.Spec config.DefaultNetwork.OVNKubernetesConfig.EgressIPConfig.ReachabilityTotalTimeoutSeconds = tc.reachabilityTimeout + config.UseMultiNetworkPolicy = &tc.enableMultiNetworkPolicy errs := validateOVNKubernetes(config) g.Expect(errs).To(HaveLen(0)) @@ -4110,10 +4108,6 @@ func TestRenderOVNKubernetesReachability(t *testing.T) { bootstrapResult.Infra = bootstrap.InfraStatus{} bootstrapResult.Infra.HostedControlPlane = &hypershift.HostedControlPlane{} objs, _, err := renderOVNKubernetes(config, bootstrapResult, manifestDirOvn, fakeClient, featureGatesCNO) - if tc.expectErr { - g.Expect(err).To(HaveOccurred()) - return - } g.Expect(err).NotTo(HaveOccurred()) var configMap *uns.Unstructured @@ -4170,6 +4164,19 @@ func TestRenderOVNKubernetesReachability(t *testing.T) { "ovnkube-node pod template should not contain the configured reachability timeout value", ) } + + if tc.enableMultiNetworkPolicy { + g.Expect(scriptNode).To( + ContainSubstring("--enable-multi-networkpolicy"), + "ovnkube-node pod template should contain the flag --enable-multi-networkpolicy", + ) + + } else { + g.Expect(scriptNode).NotTo( + ContainSubstring("--enable-multi-networkpolicy"), + "ovnkube-node pod template should not contain the flag --enable-multi-networkpolicy", + ) + } }) } }