Restore ConfigMap enable-multi-networkpolicy setting for ovn-kubernetes

[weliang1]

Summary

This PR restores the enable-multi-networkpolicy=true ConfigMap setting that was removed by PR #3072, fixing a regression where MultiNetworkPolicy is not enforced on UDN (User Defined Network) Layer2 secondary interfaces.

Problem

PR #3072 attempted to migrate MultiNetworkPolicy enablement from ConfigMap to CLI flags by:

• Adding CLI flag: --enable-multi-networkpolicy
• Removing ConfigMap setting: enable-multi-networkpolicy=true

However, this created a regression because ovn-kubernetes prioritizes ConfigMap settings over CLI flags during config loading. When the ConfigMap doesn't specify the setting, it defaults to false, causing the CLI flag to be ignored.

Evidence

After PR #3072 merged, when useMultiNetworkPolicy: true is enabled:

$ oc -n openshift-ovn-kubernetes get configmap ovnkube-config -o yaml | grep enable-multi-networkpolicy
# No output - setting missing from ConfigMap

$ oc -n openshift-ovn-kubernetes logs deployment/ovnkube-control-plane | grep EnableMultiNetworkPolicy
EnableMultiNetworkPolicy:false  # ❌ False despite CLI flag being set

Result: MultiNetworkPolicy created but not enforced → test 77656 fails (traffic not blocked).

Solution

Restore the ConfigMap setting alongside the CLI flag, ensuring dual coverage:

• CLI flag: --enable-multi-networkpolicy (from PR OCPBUGS-88063: ovn-kubernetes: Move MNP from ConfigMap to CLI flags #3072)
• ConfigMap: enable-multi-networkpolicy=true (restored by this PR)

This ensures ovn-kubernetes loads EnableMultiNetworkPolicy=true regardless of config loading order.

Test Plan

Before this fix:

# Test 77656: Verify ingress-ipblock policy for UDN pod's secondary interface (Layer2)
FAIL: Expected curl to fail (blocked by policy), but connection succeeded

After this fix:

# Manual ConfigMap patch simulating this PR
$ oc patch configmap ovnkube-config --patch 'enable-multi-networkpolicy=true'
$ oc rollout restart deployment/ovnkube-control-plane

# Verify runtime config
$ oc logs deployment/ovnkube-control-plane | grep EnableMultiNetworkPolicy
EnableMultiNetworkPolicy:true  # ✅ Now true

# Re-run test 77656
✅ PASS: Traffic correctly blocked by MultiNetworkPolicy (rc: 28 timeout)

Files Changed

• bindata/network/ovn-kubernetes/managed/004-config.yaml: Restore ConfigMap setting (2 occurrences)
• bindata/network/ovn-kubernetes/self-hosted/004-config.yaml: Restore ConfigMap setting (1 occurrence)

Related

• Fixes test: 77656 - Verify ingress-ipblock policy for UDN pod's secondary interface (Layer2)
• Related PR: OCPBUGS-88063: ovn-kubernetes: Move MNP from ConfigMap to CLI flags #3072 (introduced the regression)
• Related PR: OCPBUGS-88063: Add ovn-k8s-cni-overlay to multus-networkpolicy allowed plugins #3026 (rejected alternative approach)

🤖 Generated with Claude Code

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 27d26a25-f51f-4669-867f-4727e2fc640c

📥 Commits

Reviewing files that changed from the base of the PR and between 1dcce83 and 487ec2b.

📒 Files selected for processing (2)

• bindata/network/ovn-kubernetes/managed/004-config.yaml
• bindata/network/ovn-kubernetes/self-hosted/004-config.yaml

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to data retention organization setting

---

Summary by CodeRabbit

• New Features
  • Added optional multi-network policy support to OVN-Kubernetes configurations.
  • When enabled, configurations now activate the required multi-network policy setting for hosted and self-hosted deployments.

Walkthrough

The OVN managed and self-hosted configuration templates now conditionally add enable-multi-networkpolicy=true when OVN_MULTI_NETWORK_POLICY_ENABLE is enabled.

Changes

OVN multi-network policy configuration

Layer / File(s)	Summary
Add conditional policy directives bindata/network/ovn-kubernetes/managed/004-config.yaml, bindata/network/ovn-kubernetes/self-hosted/004-config.yaml	The managed, hostedcluster master, and self-hosted OVN configurations emit enable-multi-networkpolicy=true when OVN_MULTI_NETWORK_POLICY_ENABLE is enabled.

Estimated code review effort: 1 (Trivial) | ~3 minutes

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: weliang1
Once this PR has been reviewed and has the lgtm label, please assign knobunc for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment