Skip to content

NVIDIA-314: Support Node CIDR Allocation for networkType=Other Using AllocateNodesCIDRs #7278

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 1 commit into from
Dec 16, 2025
Merged

NVIDIA-314: Support Node CIDR Allocation for networkType=Other Using AllocateNodesCIDRs #7278

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions api/hypershift/v1beta1/hostedcluster_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1041,6 +1041,7 @@ type DNSSpec struct {
// TODO this is available in vanilla kube from 1.31 API servers and in Openshift from 4.16.
// TODO(alberto): Use CEL cidr library for all these validation when all management clusters are >= 1.31.
// +kubebuilder:validation:XValidation:rule="(!has(self.machineNetwork) && self.clusterNetwork.all(c, self.serviceNetwork.all(s, c.cidr != s.cidr)) || (has(self.machineNetwork) && (self.machineNetwork.all(m, self.clusterNetwork.all(c, m.cidr != c.cidr)) && self.machineNetwork.all(m, self.serviceNetwork.all(s, m.cidr != s.cidr)) && self.clusterNetwork.all(c, self.serviceNetwork.all(s, c.cidr != s.cidr)))))",message="CIDR ranges in machineNetwork, clusterNetwork, and serviceNetwork must be unique and non-overlapping"
// +kubebuilder:validation:XValidation:rule="has(self.allocateNodeCIDRs) && self.allocateNodeCIDRs == 'Enabled' ? self.networkType == 'Other' : true",message="allocateNodeCIDRs can only be set to Enabled when networkType is 'Other'"
type ClusterNetworking struct {
// machineNetwork is the list of IP address pools for machines.
// This might be used among other things to generate appropriate networking security groups in some clouds providers.
Expand Down Expand Up @@ -1091,6 +1092,17 @@ type ClusterNetworking struct {
//
// +optional
APIServer *APIServerNetworking `json:"apiServer,omitempty"`

// allocateNodeCIDRs controls whether the kube-controller-manager manages node CIDR allocation.
// When using networkType=Other, it is recommended to set this field to "Enabled"
// if Flannel is used as the CNI, as it relies on this behavior.
// Default is "Disabled".
// This field can only be set to "Enabled" when NetworkType is "Other". Setting it to "Enabled"
// with any other NetworkType will result in a validation error during cluster creation.
//
// +optional
// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="allocateNodeCIDRs is immutable and cannot be modified once set."
AllocateNodeCIDRs *AllocateNodeCIDRsMode `json:"allocateNodeCIDRs,omitempty"`
}

// MachineNetworkEntry is a single IP address block for node IP blocks.
Expand Down Expand Up @@ -1179,6 +1191,18 @@ const (
Other NetworkType = "Other"
)

// AllocateNodeCIDRsMode specifies whether the KCM manages node CIDR allocation.
// +kubebuilder:validation:Enum=Enabled;Disabled
type AllocateNodeCIDRsMode string

const (
// AllocateNodeCIDRsEnabled enables node CIDR allocation by the KCM
AllocateNodeCIDRsEnabled AllocateNodeCIDRsMode = "Enabled"

// AllocateNodeCIDRsDisabled disables node CIDR allocation by the KCM
AllocateNodeCIDRsDisabled AllocateNodeCIDRsMode = "Disabled"
)

// PlatformType is a specific supported infrastructure provider.
// +kubebuilder:validation:MaxLength=100
type PlatformType string
Expand Down
5 changes: 5 additions & 0 deletions api/hypershift/v1beta1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

20 changes: 20 additions & 0 deletions ...erated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2624,6 +2624,22 @@ spec:
networking specifies network configuration for the hosted cluster.
Defaults to OVNKubernetes with a cluster network of cidr: "10.132.0.0/14" and a service network of cidr: "172.31.0.0/16".
properties:
allocateNodeCIDRs:
description: |-
allocateNodeCIDRs controls whether the kube-controller-manager manages node CIDR allocation.
When using networkType=Other, it is recommended to set this field to "Enabled"
if Flannel is used as the CNI, as it relies on this behavior.
Default is "Disabled".
This field can only be set to "Enabled" when NetworkType is "Other". Setting it to "Enabled"
with any other NetworkType will result in a validation error during cluster creation.
enum:
- Enabled
- Disabled
type: string
x-kubernetes-validations:
- message: allocateNodeCIDRs is immutable and cannot be modified
once set.
rule: self == oldSelf
apiServer:
description: |-
apiServer contains advanced network settings for the API server that affect
Expand Down Expand Up @@ -2798,6 +2814,10 @@ spec:
self.clusterNetwork.all(c, m.cidr != c.cidr)) && self.machineNetwork.all(m,
self.serviceNetwork.all(s, m.cidr != s.cidr)) && self.clusterNetwork.all(c,
self.serviceNetwork.all(s, c.cidr != s.cidr)))))
- message: allocateNodeCIDRs can only be set to Enabled when networkType
is 'Other'
rule: 'has(self.allocateNodeCIDRs) && self.allocateNodeCIDRs ==
''Enabled'' ? self.networkType == ''Other'' : true'
nodeSelector:
additionalProperties:
type: string
Expand Down
20 changes: 20 additions & 0 deletions ....featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AutoNodeKarpenter.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2662,6 +2662,22 @@ spec:
networking specifies network configuration for the hosted cluster.
Defaults to OVNKubernetes with a cluster network of cidr: "10.132.0.0/14" and a service network of cidr: "172.31.0.0/16".
properties:
allocateNodeCIDRs:
description: |-
allocateNodeCIDRs controls whether the kube-controller-manager manages node CIDR allocation.
When using networkType=Other, it is recommended to set this field to "Enabled"
if Flannel is used as the CNI, as it relies on this behavior.
Default is "Disabled".
This field can only be set to "Enabled" when NetworkType is "Other". Setting it to "Enabled"
with any other NetworkType will result in a validation error during cluster creation.
enum:
- Enabled
- Disabled
type: string
x-kubernetes-validations:
- message: allocateNodeCIDRs is immutable and cannot be modified
once set.
rule: self == oldSelf
apiServer:
description: |-
apiServer contains advanced network settings for the API server that affect
Expand Down Expand Up @@ -2836,6 +2852,10 @@ spec:
self.clusterNetwork.all(c, m.cidr != c.cidr)) && self.machineNetwork.all(m,
self.serviceNetwork.all(s, m.cidr != s.cidr)) && self.clusterNetwork.all(c,
self.serviceNetwork.all(s, c.cidr != s.cidr)))))
- message: allocateNodeCIDRs can only be set to Enabled when networkType
is 'Other'
rule: 'has(self.allocateNodeCIDRs) && self.allocateNodeCIDRs ==
''Enabled'' ? self.networkType == ''Other'' : true'
nodeSelector:
additionalProperties:
type: string
Expand Down
20 changes: 20 additions & 0 deletions ...manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2615,6 +2615,22 @@ spec:
networking specifies network configuration for the hosted cluster.
Defaults to OVNKubernetes with a cluster network of cidr: "10.132.0.0/14" and a service network of cidr: "172.31.0.0/16".
properties:
allocateNodeCIDRs:
description: |-
allocateNodeCIDRs controls whether the kube-controller-manager manages node CIDR allocation.
When using networkType=Other, it is recommended to set this field to "Enabled"
if Flannel is used as the CNI, as it relies on this behavior.
Default is "Disabled".
This field can only be set to "Enabled" when NetworkType is "Other". Setting it to "Enabled"
with any other NetworkType will result in a validation error during cluster creation.
enum:
- Enabled
- Disabled
type: string
x-kubernetes-validations:
- message: allocateNodeCIDRs is immutable and cannot be modified
once set.
rule: self == oldSelf
apiServer:
description: |-
apiServer contains advanced network settings for the API server that affect
Expand Down Expand Up @@ -2789,6 +2805,10 @@ spec:
self.clusterNetwork.all(c, m.cidr != c.cidr)) && self.machineNetwork.all(m,
self.serviceNetwork.all(s, m.cidr != s.cidr)) && self.clusterNetwork.all(c,
self.serviceNetwork.all(s, c.cidr != s.cidr)))))
- message: allocateNodeCIDRs can only be set to Enabled when networkType
is 'Other'
rule: 'has(self.allocateNodeCIDRs) && self.allocateNodeCIDRs ==
''Enabled'' ? self.networkType == ''Other'' : true'
nodeSelector:
additionalProperties:
type: string
Expand Down
20 changes: 20 additions & 0 deletions ...gated-crd-manifests/hostedclusters.hypershift.openshift.io/DynamicResourceAllocation.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2636,6 +2636,22 @@ spec:
networking specifies network configuration for the hosted cluster.
Defaults to OVNKubernetes with a cluster network of cidr: "10.132.0.0/14" and a service network of cidr: "172.31.0.0/16".
properties:
allocateNodeCIDRs:
description: |-
allocateNodeCIDRs controls whether the kube-controller-manager manages node CIDR allocation.
When using networkType=Other, it is recommended to set this field to "Enabled"
if Flannel is used as the CNI, as it relies on this behavior.
Default is "Disabled".
This field can only be set to "Enabled" when NetworkType is "Other". Setting it to "Enabled"
with any other NetworkType will result in a validation error during cluster creation.
enum:
- Enabled
- Disabled
type: string
x-kubernetes-validations:
- message: allocateNodeCIDRs is immutable and cannot be modified
once set.
rule: self == oldSelf
apiServer:
description: |-
apiServer contains advanced network settings for the API server that affect
Expand Down Expand Up @@ -2810,6 +2826,10 @@ spec:
self.clusterNetwork.all(c, m.cidr != c.cidr)) && self.machineNetwork.all(m,
self.serviceNetwork.all(s, m.cidr != s.cidr)) && self.clusterNetwork.all(c,
self.serviceNetwork.all(s, c.cidr != s.cidr)))))
- message: allocateNodeCIDRs can only be set to Enabled when networkType
is 'Other'
rule: 'has(self.allocateNodeCIDRs) && self.allocateNodeCIDRs ==
''Enabled'' ? self.networkType == ''Other'' : true'
nodeSelector:
additionalProperties:
type: string
Expand Down
20 changes: 20 additions & 0 deletions ...rated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2951,6 +2951,22 @@ spec:
networking specifies network configuration for the hosted cluster.
Defaults to OVNKubernetes with a cluster network of cidr: "10.132.0.0/14" and a service network of cidr: "172.31.0.0/16".
properties:
allocateNodeCIDRs:
description: |-
allocateNodeCIDRs controls whether the kube-controller-manager manages node CIDR allocation.
When using networkType=Other, it is recommended to set this field to "Enabled"
if Flannel is used as the CNI, as it relies on this behavior.
Default is "Disabled".
This field can only be set to "Enabled" when NetworkType is "Other". Setting it to "Enabled"
with any other NetworkType will result in a validation error during cluster creation.
enum:
- Enabled
- Disabled
type: string
x-kubernetes-validations:
- message: allocateNodeCIDRs is immutable and cannot be modified
once set.
rule: self == oldSelf
apiServer:
description: |-
apiServer contains advanced network settings for the API server that affect
Expand Down Expand Up @@ -3125,6 +3141,10 @@ spec:
self.clusterNetwork.all(c, m.cidr != c.cidr)) && self.machineNetwork.all(m,
self.serviceNetwork.all(s, m.cidr != s.cidr)) && self.clusterNetwork.all(c,
self.serviceNetwork.all(s, c.cidr != s.cidr)))))
- message: allocateNodeCIDRs can only be set to Enabled when networkType
is 'Other'
rule: 'has(self.allocateNodeCIDRs) && self.allocateNodeCIDRs ==
''Enabled'' ? self.networkType == ''Other'' : true'
nodeSelector:
additionalProperties:
type: string
Expand Down
20 changes: 20 additions & 0 deletions ...ests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3105,6 +3105,22 @@ spec:
networking specifies network configuration for the hosted cluster.
Defaults to OVNKubernetes with a cluster network of cidr: "10.132.0.0/14" and a service network of cidr: "172.31.0.0/16".
properties:
allocateNodeCIDRs:
description: |-
allocateNodeCIDRs controls whether the kube-controller-manager manages node CIDR allocation.
When using networkType=Other, it is recommended to set this field to "Enabled"
if Flannel is used as the CNI, as it relies on this behavior.
Default is "Disabled".
This field can only be set to "Enabled" when NetworkType is "Other". Setting it to "Enabled"
with any other NetworkType will result in a validation error during cluster creation.
enum:
- Enabled
- Disabled
type: string
x-kubernetes-validations:
- message: allocateNodeCIDRs is immutable and cannot be modified
once set.
rule: self == oldSelf
apiServer:
description: |-
apiServer contains advanced network settings for the API server that affect
Expand Down Expand Up @@ -3279,6 +3295,10 @@ spec:
self.clusterNetwork.all(c, m.cidr != c.cidr)) && self.machineNetwork.all(m,
self.serviceNetwork.all(s, m.cidr != s.cidr)) && self.clusterNetwork.all(c,
self.serviceNetwork.all(s, c.cidr != s.cidr)))))
- message: allocateNodeCIDRs can only be set to Enabled when networkType
is 'Other'
rule: 'has(self.allocateNodeCIDRs) && self.allocateNodeCIDRs ==
''Enabled'' ? self.networkType == ''Other'' : true'
nodeSelector:
Comment on lines +3298 to 3302

@coderabbitai coderabbitai Bot Dec 11, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Search for test mentions of allocateNodeCIDRs and networkType in test files
rg -n --type=go --type=yaml 'allocateNodeCIDRs|networkType.*Other' test/ controllers/ pkg/ 2>/dev/null | head -100

Repository: openshift/hypershift

Length of output: 1695

🏁 Script executed:

#!/bin/bash
# Read the test file to check allocateNodeCIDRs test cases and see if update paths are covered
sed -n '784,820p' test/e2e/create_cluster_test.go

Repository: openshift/hypershift

Length of output: 1407

🏁 Script executed:

#!/bin/bash
# Search for update tests related to allocateNodeCIDRs or validation rules
rg -n -B3 -A3 'update.*allocateNodeCIDRs|PATCH.*allocateNodeCIDRs|allocateNodeCIDRs.*update' test/ --type=go 2>/dev/null | head -50

Repository: openshift/hypershift

Length of output: 46

🏁 Script executed:

#!/bin/bash
# Check the test file structure to see if it tests updates at all
rg -n 'func.*Update|Update.*test|test.*Update' test/e2e/create_cluster_test.go --type=go | head -20

Repository: openshift/hypershift

Length of output: 46

Validation rule is correct, but update path testing is missing.

Create path tests comprehensively cover the allocateNodeCIDRs validation: Disabled passes, Enabled+networkType=Other passes, and Enabled with other networkTypes properly fails with the expected error message. However, explicit test coverage for the update path is not present. Consider adding update tests to ensure the validation rule also applies when patching existing clusters.

🤖 Prompt for AI Agents 
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml
lines 3298-3302: the validation rule for allocateNodeCIDRs is present but lacks
update-path tests; add unit/integration tests that exercise the update
(patch/put) path covering: (1) create/update where allocateNodeCIDRs is Disabled
— should pass, (2) create/update where allocateNodeCIDRs is Enabled and
networkType == "Other" — should pass, and (3) create/update where
allocateNodeCIDRs is Enabled and networkType != "Other" — should fail with the
existing error message "allocateNodeCIDRs can only be set to Enabled when
networkType is 'Other'"; implement assertions that the API returns the same
validation error on PATCH/PUT as on create and include both full-object replace
and strategic merge/JSON patch update variations where applicable.

additionalProperties:
type: string
Expand Down
20 changes: 20 additions & 0 deletions ...erated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2615,6 +2615,22 @@ spec:
networking specifies network configuration for the hosted cluster.
Defaults to OVNKubernetes with a cluster network of cidr: "10.132.0.0/14" and a service network of cidr: "172.31.0.0/16".
properties:
allocateNodeCIDRs:
description: |-
allocateNodeCIDRs controls whether the kube-controller-manager manages node CIDR allocation.
When using networkType=Other, it is recommended to set this field to "Enabled"
if Flannel is used as the CNI, as it relies on this behavior.
Default is "Disabled".
This field can only be set to "Enabled" when NetworkType is "Other". Setting it to "Enabled"
with any other NetworkType will result in a validation error during cluster creation.
enum:
- Enabled
- Disabled
type: string
x-kubernetes-validations:
- message: allocateNodeCIDRs is immutable and cannot be modified
once set.
rule: self == oldSelf
apiServer:
description: |-
apiServer contains advanced network settings for the API server that affect
Expand Down Expand Up @@ -2789,6 +2805,10 @@ spec:
self.clusterNetwork.all(c, m.cidr != c.cidr)) && self.machineNetwork.all(m,
self.serviceNetwork.all(s, m.cidr != s.cidr)) && self.clusterNetwork.all(c,
self.serviceNetwork.all(s, c.cidr != s.cidr)))))
- message: allocateNodeCIDRs can only be set to Enabled when networkType
is 'Other'
rule: 'has(self.allocateNodeCIDRs) && self.allocateNodeCIDRs ==
''Enabled'' ? self.networkType == ''Other'' : true'
nodeSelector:
additionalProperties:
type: string
Expand Down
20 changes: 20 additions & 0 deletions ...turegated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2633,6 +2633,22 @@ spec:
networking specifies network configuration for the hosted cluster.
Defaults to OVNKubernetes with a cluster network of cidr: "10.132.0.0/14" and a service network of cidr: "172.31.0.0/16".
properties:
allocateNodeCIDRs:
description: |-
allocateNodeCIDRs controls whether the kube-controller-manager manages node CIDR allocation.
When using networkType=Other, it is recommended to set this field to "Enabled"
if Flannel is used as the CNI, as it relies on this behavior.
Default is "Disabled".
This field can only be set to "Enabled" when NetworkType is "Other". Setting it to "Enabled"
with any other NetworkType will result in a validation error during cluster creation.
enum:
- Enabled
- Disabled
type: string
x-kubernetes-validations:
- message: allocateNodeCIDRs is immutable and cannot be modified
once set.
rule: self == oldSelf
apiServer:
description: |-
apiServer contains advanced network settings for the API server that affect
Expand Down Expand Up @@ -2807,6 +2823,10 @@ spec:
self.clusterNetwork.all(c, m.cidr != c.cidr)) && self.machineNetwork.all(m,
self.serviceNetwork.all(s, m.cidr != s.cidr)) && self.clusterNetwork.all(c,
self.serviceNetwork.all(s, c.cidr != s.cidr)))))
- message: allocateNodeCIDRs can only be set to Enabled when networkType
is 'Other'
rule: 'has(self.allocateNodeCIDRs) && self.allocateNodeCIDRs ==
''Enabled'' ? self.networkType == ''Other'' : true'
nodeSelector:
additionalProperties:
type: string
Expand Down
Loading