[WIP] Restore ConfigMap enable-multi-networkpolicy setting for ovn-kubernetes

[weliang1]

Summary

This PR restores the enable-multi-networkpolicy=true ConfigMap setting that was removed by PR #3072, fixing a regression where MultiNetworkPolicy is not enforced on UDN (User Defined Network) Layer2 secondary interfaces.

Problem

PR #3072 attempted to migrate MultiNetworkPolicy enablement from ConfigMap to CLI flags by:

• Adding CLI flag: --enable-multi-networkpolicy
• Removing ConfigMap setting: enable-multi-networkpolicy=true

However, this created a regression because ovn-kubernetes prioritizes ConfigMap settings over CLI flags during config loading. When the ConfigMap doesn't specify the setting, it defaults to false, causing the CLI flag to be ignored.

Evidence

After PR #3072 merged, when useMultiNetworkPolicy: true is enabled:

$ oc -n openshift-ovn-kubernetes get configmap ovnkube-config -o yaml | grep enable-multi-networkpolicy
# No output - setting missing from ConfigMap

$ oc -n openshift-ovn-kubernetes logs deployment/ovnkube-control-plane | grep EnableMultiNetworkPolicy
EnableMultiNetworkPolicy:false  # ❌ False despite CLI flag being set

Result: MultiNetworkPolicy created but not enforced → test 77656 fails (traffic not blocked).

Solution

Restore the ConfigMap setting alongside the CLI flag, ensuring dual coverage:

• CLI flag: --enable-multi-networkpolicy (from PR OCPBUGS-88063: ovn-kubernetes: Move MNP from ConfigMap to CLI flags #3072)
• ConfigMap: enable-multi-networkpolicy=true (restored by this PR)

This ensures ovn-kubernetes loads EnableMultiNetworkPolicy=true regardless of config loading order.

Test Plan

Before this fix:

# Test 77656: Verify ingress-ipblock policy for UDN pod's secondary interface (Layer2)
FAIL: Expected curl to fail (blocked by policy), but connection succeeded

After this fix:

# Manual ConfigMap patch simulating this PR
$ oc patch configmap ovnkube-config --patch 'enable-multi-networkpolicy=true'
$ oc rollout restart deployment/ovnkube-control-plane

# Verify runtime config
$ oc logs deployment/ovnkube-control-plane | grep EnableMultiNetworkPolicy
EnableMultiNetworkPolicy:true  # ✅ Now true

# Re-run test 77656
✅ PASS: Traffic correctly blocked by MultiNetworkPolicy (rc: 28 timeout)

Files Changed

• bindata/network/ovn-kubernetes/managed/004-config.yaml: Restore ConfigMap setting (2 occurrences)
• bindata/network/ovn-kubernetes/self-hosted/004-config.yaml: Restore ConfigMap setting (1 occurrence)

Related

• Fixes test: 77656 - Verify ingress-ipblock policy for UDN pod's secondary interface (Layer2)
• Related PR: OCPBUGS-88063: ovn-kubernetes: Move MNP from ConfigMap to CLI flags #3072 (introduced the regression)
• Related PR: OCPBUGS-88063: Add ovn-k8s-cni-overlay to multus-networkpolicy allowed plugins #3026 (rejected alternative approach)

🤖 Generated with Claude Code

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[coderabbitai]

Summary by CodeRabbit

• New Features
  • Added optional multi-network policy support to OVN configurations.
  • When enabled, network policies can be applied across multiple networks in both managed and self-hosted deployments.

Walkthrough

The OVN managed and self-hosted configuration templates now conditionally set enable-multi-networkpolicy=true when OVN_MULTI_NETWORK_POLICY_ENABLE is enabled.

Changes

OVN multi-network policy

Layer / File(s)	Summary
Conditional OVN configuration bindata/network/ovn-kubernetes/managed/004-config.yaml, bindata/network/ovn-kubernetes/self-hosted/004-config.yaml	The templates conditionally enable multi-network policy for managed node, managed master, and self-hosted OVN configurations.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related PRs

• openshift/cluster-network-operator#3100: Modifies the same OVN templates to conditionally enable enable-multi-networkpolicy=true.

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (4 errors)

Check name	Status	Explanation	Resolution
Pr Quality	❌ Error	The 9-line functional config change is scoped, but the Test Plan lists only manual oc/log checks and names no automated CNO CI job, lane, or platform.	Document the automated CI job or lane that runs this regression test and list its target platform(s); include the test result or explain why an automated test is not required.
Commit Message Quality	❌ Error	The sole commit is focused, has a rationale body, and is non-merge, but its scoped subject does not use the required component prefix: it ends with “for ovn-kubernetes”.	Rename the subject to use the component prefix, for example: “ovn-kubernetes: Restore ConfigMap enable-multi-networkpolicy setting”.
Unit Tests For Go Changes	❌ Error	The PR modifies two bindata YAML templates, but the commit changes no *_test.go files.	Add or modify corresponding *_test.go coverage. If tests are not feasible, document the justification under “How to verify it” and use the specified override after other checks pass.
Title check	❌ Error	The title describes the fix and uses the imperative mood, but it is 77 characters and does not prefix the scoped component.	Shorten the title to 72 characters or fewer and prefix it with the affected component, such as "ovn-kubernetes: Restore multi-networkpolicy ConfigMap setting".

✅ Passed checks (20 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
E2e Tests For Feature Changes	✅ Passed	The PR changes only two bindata YAML templates; no Go files under pkg/ or cmd/ and no test/e2e files changed, so this check is not applicable.
Rbac Least Privilege	✅ Passed	The only changed YAML files are ConfigMaps, and the diff adds configuration data only. No Role, ClusterRole, rules, verbs, or resources changed.
Docs For Feature And Behavior Changes	✅ Passed	The change restores settings removed by PR #3072 to fix a documented MultiNetworkPolicy regression; it is a bug fix, and the check explicitly passes bug fixes without docs changes.
Stale Project Docs And Config	✅ Passed	The PR only restores a conditional ConfigMap key in existing managed/self-hosted templates; the CLI flag remains, and checked docs/config contain no stale paths or removed identifiers.
Go And Test Code Quality	✅ Passed	The pull request modifies only two YAML templates; no new or modified Go production or test code is present, so none of the nine Go/test issues apply.
Ai-Generated Code Smell	✅ Passed	The PR adds only three necessary conditional ConfigMap entries. It adds no comments, tests, verbose logic, or AI-related names, and the duplicate managed entries serve two manifests.
Stable And Deterministic Test Names	✅ Passed	The PR changes only two YAML templates and adds no Ginkgo test titles or test files, so it introduces no unstable test names.
Test Structure And Quality	✅ Passed	The commit changes only two YAML templates and adds no Ginkgo test code, so the listed test-structure checks are not applicable.
Microshift Test Compatibility	✅ Passed	The patch changes only two OVN ConfigMap YAML templates and adds no Ginkgo e2e tests, so MicroShift test compatibility checks do not apply.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The commit changes only two OVN YAML templates and adds no Ginkgo tests or test declarations, so SNO compatibility checks do not apply.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR changes only ConfigMap data in two OVN templates. The added setting introduces no replicas, affinity, topology spread, selectors, tolerations, or disruption constraints.
Ote Binary Stdout Contract	✅ Passed	HEAD changes only two YAML templates, adding ConfigMap data under a conditional; no OTE process code or stdout-writing changes are present.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The patch changes only two YAML templates and adds no Ginkgo tests, IPv4 assumptions, or external connectivity requirements.
No-Weak-Crypto	✅ Passed	The PR only adds conditional enable-multi-networkpolicy=true entries to two YAML templates; no weak crypto, custom crypto, or secret comparisons are introduced.
Container-Privileges	✅ Passed	The commit adds only conditional ConfigMap data entries; its patch contains no additions for privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation.
No-Sensitive-Data-In-Logs	✅ Passed	The HEAD patch adds only conditional ConfigMap settings in two YAML templates. It adds no logging statements or sensitive values such as passwords, tokens, keys, PII, or hostnames.
Description check	✅ Passed	The description clearly explains the regression, the ConfigMap fix, affected files, and test plan.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: weliang1
Once this PR has been reviewed and has the lgtm label, please assign jcaamano for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@bindata/network/ovn-kubernetes/managed/004-config.yaml`:
- Around line 46-48: Add rendering tests for the OVN_MULTI_NETWORK_POLICY_ENABLE
conditional in bindata/network/ovn-kubernetes/managed/004-config.yaml lines
46-48 and 133-135, and
bindata/network/ovn-kubernetes/self-hosted/004-config.yaml lines 49-51. Cover
both enabled and disabled values, verifying that enable-multi-networkpolicy=true
appears only when enabled for the hostedcluster node, hostedcluster master, and
self-hosted configurations.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 13c0ddd0-0108-40f9-acd5-7eeca4832feb

📥 Commits

Reviewing files that changed from the base of the PR and between 1dcce83 and 487ec2b.

📒 Files selected for processing (2)

• bindata/network/ovn-kubernetes/managed/004-config.yaml
• bindata/network/ovn-kubernetes/self-hosted/004-config.yaml

[coderabbitai]

📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win

Add tests for all changed bindata templates.

The repository path instruction requires corresponding *_test.go changes for modified bindata/ YAML templates. Add rendering tests for enabled and disabled OVN_MULTI_NETWORK_POLICY_ENABLE values.

• bindata/network/ovn-kubernetes/managed/004-config.yaml#L46-L48: test the hostedcluster node configuration.
• bindata/network/ovn-kubernetes/managed/004-config.yaml#L133-L135: test the hostedcluster master configuration.
• bindata/network/ovn-kubernetes/self-hosted/004-config.yaml#L49-L51: test the self-hosted configuration.

📍 Affects 2 files

• bindata/network/ovn-kubernetes/managed/004-config.yaml#L46-L48 (this comment)
• bindata/network/ovn-kubernetes/managed/004-config.yaml#L133-L135
• bindata/network/ovn-kubernetes/self-hosted/004-config.yaml#L49-L51

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@bindata/network/ovn-kubernetes/managed/004-config.yaml` around lines 46 - 48,
Add rendering tests for the OVN_MULTI_NETWORK_POLICY_ENABLE conditional in
bindata/network/ovn-kubernetes/managed/004-config.yaml lines 46-48 and 133-135,
and bindata/network/ovn-kubernetes/self-hosted/004-config.yaml lines 49-51.
Cover both enabled and disabled values, verifying that
enable-multi-networkpolicy=true appears only when enabled for the hostedcluster
node, hostedcluster master, and self-hosted configurations.

Source: Path instructions

[openshift-ci]

@weliang1: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/unit	487ec2b	link	true	/test unit
ci/prow/5.0-upgrade-from-stable-4.22-e2e-azure-ovn-upgrade	487ec2b	link	false	/test 5.0-upgrade-from-stable-4.22-e2e-azure-ovn-upgrade

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.