OCPBUGS-92080: Adds rendering of enable-multi-network-policy in ovnkube-node

bindata/network/ovn-kubernetes/common/008-script-lib.yaml

@@ -547,6 +547,11 @@ data:
 
       echo "I$(date "+%m%d %H:%M:%S.%N") - starting ovnkube-node"
 
+      multinetwork_policy_enabled_flag=
+      {{- if .OVN_MULTI_NETWORK_POLICY_ENABLE }}
+        multinetwork_policy_enabled_flag="--enable-multi-networkpolicy"
+      {{ end }}
+
       ovn_eip_reachability_timeout_opt=
       {{- if .ReachabilityTotalTimeoutSeconds }}        
         ovn_eip_reachability_timeout_opt="--egressip-reachability-total-timeout {{.ReachabilityTotalTimeoutSeconds}}"
@@ -738,5 +743,6 @@ data:
         ${ovn_v4_transit_switch_subnet_opt} \
         ${ovn_v6_transit_switch_subnet_opt} \
         ${dpu_lease_flags} \
-        ${ovn_eip_reachability_timeout_opt}
+        ${ovn_eip_reachability_timeout_opt} \
+        ${multinetwork_policy_enabled_flag}
     }

pkg/network/ovn_kubernetes_test.go

@@ -717,7 +717,7 @@ logfile-maxage=0`,
 			disableGRO:               true,
 		},
 		{
-			desc: "enable multi-network policies and admin network policies",
+			desc: "enable admin network policies",
 			expected: `
 [default]
 mtu="1500"
@@ -760,9 +760,7 @@ logfile-maxsize=100
 logfile-maxbackups=5
 logfile-maxage=0`,
 			controlPlaneReplicaCount: 2,
-
-			enableMultiNetPolicies: true,
-			enabledFeatureGates:    []configv1.FeatureGateName{},
+			enabledFeatureGates:      []configv1.FeatureGateName{},
 		},
 		{
 			desc: "enable network segmentation and multi-network",
@@ -811,7 +809,7 @@ logfile-maxage=0`,
 			enabledFeatureGates:      []configv1.FeatureGateName{},
 		},
 		{
-			desc: "enable multi-network policies with DisableMultiNetwork",
+			desc: "Set DisableMultiNetwork",
 			expected: `
 [default]
 mtu="1500"
@@ -855,7 +853,6 @@ logfile-maxbackups=5
 logfile-maxage=0`,
 			controlPlaneReplicaCount: 2,
 			disableMultiNet:          true,
-			enableMultiNetPolicies:   true,
 			enabledFeatureGates:      []configv1.FeatureGateName{},
 		},
 		{
@@ -4027,51 +4024,53 @@ func TestRenderOVNKubernetesEnablePersistentIPs(t *testing.T) {
 	g.Expect(objs).To(ContainElement(HaveKubernetesID("CustomResourceDefinition", "", "ipamclaims.k8s.cni.cncf.io")))
 }
 
-// TestRenderOVNKubernetesReachability tests egress IP reachability timeout rendering
-func TestRenderOVNKubernetesReachability(t *testing.T) {
+// TestRenderOVNKubernetesFlags tests the rendering of different ovnkube flags
+// ReachabilityTotalTimeoutSeconds: --egressip-reachability-total-timeout
+// OVN_MULTI_NETWORK_POLICY_ENABLE: --enable-multi-networkpolicy
+func TestRenderOVNKubernetesFlags(t *testing.T) {
 	g := NewGomegaWithT(t)
 
 	testCases := []struct {
 		name                                string
 		reachabilityTimeout                 *uint32
+		enableMultiNetworkPolicy            bool
 		expectKubernetesFeatureReachability bool
-		expectErr                           bool
 	}{
 		{
 			name:                                "No reachability timeout (nil)",
 			reachabilityTimeout:                 nil,
 			expectKubernetesFeatureReachability: false,
-			expectErr:                           false,
 		},
 		{
 			name:                                "Reachability timeout set to 0",
 			reachabilityTimeout:                 ptrToUint32(0),
 			expectKubernetesFeatureReachability: true,
-			expectErr:                           false,
 		},
 		{
 			name:                                "Reachability timeout changed to 10",
 			reachabilityTimeout:                 ptrToUint32(10),
 			expectKubernetesFeatureReachability: true,
-			expectErr:                           false,
 		},
 		{
 			name:                                "Reachability timeout unchanged to 10",
 			reachabilityTimeout:                 ptrToUint32(10),
 			expectKubernetesFeatureReachability: true,
-			expectErr:                           false,
 		},
 		{
 			name:                                "Reachability timeout changed to 5",
 			reachabilityTimeout:                 ptrToUint32(5),
 			expectKubernetesFeatureReachability: true,
-			expectErr:                           false,
 		},
 		{
 			name:                                "Reachability timeout disabled",
 			reachabilityTimeout:                 nil,
 			expectKubernetesFeatureReachability: false,
-			expectErr:                           false,
+		},
+		{
+			name:                                "Enable Multi Network Policy",
+			reachabilityTimeout:                 nil,
+			expectKubernetesFeatureReachability: false,
+			enableMultiNetworkPolicy:            true,
 		},
 	}
 
@@ -4080,6 +4079,7 @@ func TestRenderOVNKubernetesReachability(t *testing.T) {
 			crd := OVNKubernetesConfig.DeepCopy()
 			config := &crd.Spec
 			config.DefaultNetwork.OVNKubernetesConfig.EgressIPConfig.ReachabilityTotalTimeoutSeconds = tc.reachabilityTimeout
+			config.UseMultiNetworkPolicy = &tc.enableMultiNetworkPolicy
 
 			errs := validateOVNKubernetes(config)
 			g.Expect(errs).To(HaveLen(0))
@@ -4108,10 +4108,6 @@ func TestRenderOVNKubernetesReachability(t *testing.T) {
 			bootstrapResult.Infra = bootstrap.InfraStatus{}
 			bootstrapResult.Infra.HostedControlPlane = &hypershift.HostedControlPlane{}
 			objs, _, err := renderOVNKubernetes(config, bootstrapResult, manifestDirOvn, fakeClient, featureGatesCNO)
-			if tc.expectErr {
-				g.Expect(err).To(HaveOccurred())
-				return
-			}
 			g.Expect(err).NotTo(HaveOccurred())
 
 			var configMap *uns.Unstructured
@@ -4168,6 +4164,19 @@ func TestRenderOVNKubernetesReachability(t *testing.T) {
 					"ovnkube-node pod template should not contain the configured reachability timeout value",
 				)
 			}
+
+			if tc.enableMultiNetworkPolicy {
+				g.Expect(scriptNode).To(
+					ContainSubstring("--enable-multi-networkpolicy"),
+					"ovnkube-node pod template should contain the flag --enable-multi-networkpolicy",
+				)
+
+			} else {
+				g.Expect(scriptNode).NotTo(
+					ContainSubstring("--enable-multi-networkpolicy"),
+					"ovnkube-node pod template should not contain the flag --enable-multi-networkpolicy",
+				)
+			}
 		})
 	}
 }