Skip to content

CNTRLPLANE-2916: conditionally create openshift-ingress network policy based on route labeling - #7872

Merged
openshift-merge-bot[bot] merged 2 commits into
openshift:mainfrom
enxebre:fix-CNTRLPLANE-2916
Mar 14, 2026
Merged

CNTRLPLANE-2916: conditionally create openshift-ingress network policy based on route labeling#7872
openshift-merge-bot[bot] merged 2 commits into
openshift:mainfrom
enxebre:fix-CNTRLPLANE-2916

Conversation

@enxebre

@enxebre enxebre commented Mar 6, 2026 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown
Member

What this PR does / why we need it:

The openshift-ingress NetworkPolicy was previously created unconditionally for every hosted cluster. This policy allows traffic from the management cluster's default ingress controller into the HCP namespace, but it is only needed when routes are actually served by the management cluster's default router.

When routes are labeled for the HCP router (LabelHCPRoutes(hcp) returns true), the management cluster's default ingress controller does not serve them. This includes:

  • AWS/GCP private clusters
  • Clusters using KAS Route with dedicated DNS hostname
  • ARO HCP (which uses shared ingress with its own shared-ingress network policy)

This change:

  1. Guards the policy creation behind !hyperutil.LabelHCPRoutes(hcp)
  2. Deletes the policy via DeleteIfNeeded when LabelHCPRoutes returns true (handles existing clusters transitioning to private endpoints)
  3. Adds a comprehensive table-driven test with 10 scenarios covering AWS, GCP, IBM Cloud, Agent, and KubeVirt platforms

Which issue(s) this PR fixes:

Fixes CNTRLPLANE-2916

Special notes for your reviewer:

  • DeleteIfNeeded is safe for non-existent resources (returns (false, nil) — no error, no-op)
  • The existing TestReconcileNetworkPolicies_GCP_PrivateRouter test continues to pass without modification
  • make lint-fix passes clean, make test passes (exit code 2 is from pre-existing covdata tool issue unrelated to this change)

Checklist:

  • Subject and description added to both, commit and PR.
  • Relevant issues have been referenced.
  • This change includes docs.
  • This change includes unit tests.

🤖 Generated with Claude Code via /jira:solve [CNTRLPLANE-2916](https://issues.redhat.com/browse/CNTRLPLANE-2916) enxebre

enxebre added 2 commits March 6, 2026 12:24
@enxebre
feat(operator): conditionally create openshift-ingress network policy…
27f49d7 
… based on route labeling

The openshift-ingress NetworkPolicy was previously created unconditionally
for every hosted cluster. This policy allows traffic from the management
cluster's default ingress controller into the HCP namespace.

However, when routes are labeled for the HCP router (LabelHCPRoutes=true),
the management cluster's default ingress controller does not serve them,
making the policy unnecessary. This includes:
- AWS/GCP private or PublicAndPrivate clusters
- Clusters using KAS Route with dedicated DNS hostname
- ARO HCP (which uses shared ingress with its own policy)

This change guards the policy creation behind !LabelHCPRoutes(hcp) and
deletes the policy when it is no longer needed (e.g., a cluster
transitioning from public to private endpoints).

Ref: CNTRLPLANE-2916
@enxebre
test: add tests for conditional openshift-ingress network policy
675cfc1 
Add TestReconcileNetworkPolicies_OpenshiftIngressPolicy with 10 table-
driven test cases covering the conditional creation/deletion of the
openshift-ingress NetworkPolicy across platforms:

- AWS public (create), private (delete), PublicAndPrivate (create)
- AWS public with KAS Route+hostname (delete)
- GCP PublicAndPrivate (create), private (delete)
- IBM Cloud (create - always uses management ingress)
- Agent with KAS LB (create), with KAS Route+hostname (delete)
- KubeVirt with KAS LB (create)

Deletion tests pre-create the policy in the fake client and verify it is
removed after reconciliation.

Ref: CNTRLPLANE-2916
@openshift-ci-robot

openshift-ci-robot commented Mar 6, 2026

Copy link
Copy Markdown

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Mar 6, 2026
@openshift-ci-robot

openshift-ci-robot commented Mar 6, 2026 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown

@enxebre: This pull request references CNTRLPLANE-2916 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

What this PR does / why we need it:

The openshift-ingress NetworkPolicy was previously created unconditionally for every hosted cluster. This policy allows traffic from the management cluster's default ingress controller into the HCP namespace, but it is only needed when routes are actually served by the management cluster's default router.

When routes are labeled for the HCP router (LabelHCPRoutes(hcp) returns true), the management cluster's default ingress controller does not serve them. This includes:

  • AWS/GCP private clusters
  • Clusters using KAS Route with dedicated DNS hostname
  • ARO HCP (which uses shared ingress with its own shared-ingress network policy)

This change:

  1. Guards the policy creation behind !hyperutil.LabelHCPRoutes(hcp)
  2. Deletes the policy via DeleteIfNeeded when LabelHCPRoutes returns true (handles existing clusters transitioning to private endpoints)
  3. Adds a comprehensive table-driven test with 10 scenarios covering AWS, GCP, IBM Cloud, Agent, and KubeVirt platforms

Which issue(s) this PR fixes:

Fixes CNTRLPLANE-2916

Special notes for your reviewer:

  • DeleteIfNeeded is safe for non-existent resources (returns (false, nil) — no error, no-op)
  • The existing TestReconcileNetworkPolicies_GCP_PrivateRouter test continues to pass without modification
  • make lint-fix passes clean, make test passes (exit code 2 is from pre-existing covdata tool issue unrelated to this change)

Checklist:

  • Subject and description added to both, commit and PR.
  • Relevant issues have been referenced.
  • This change includes docs.
  • This change includes unit tests.

🤖 Generated with Claude Code via /jira:solve [CNTRLPLANE-2916](https://issues.redhat.com/browse/CNTRLPLANE-2916) enxebre

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci Bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. do-not-merge/needs-area labels Mar 6, 2026
@openshift-ci

openshift-ci Bot commented Mar 6, 2026

Copy link
Copy Markdown
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@openshift-ci-robot

openshift-ci-robot commented Mar 6, 2026 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown

@enxebre: This pull request references CNTRLPLANE-2916 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

What this PR does / why we need it:

The openshift-ingress NetworkPolicy was previously created unconditionally for every hosted cluster. This policy allows traffic from the management cluster's default ingress controller into the HCP namespace, but it is only needed when routes are actually served by the management cluster's default router.

When routes are labeled for the HCP router (LabelHCPRoutes(hcp) returns true), the management cluster's default ingress controller does not serve them. This includes:

  • AWS/GCP private clusters
  • Clusters using KAS Route with dedicated DNS hostname
  • ARO HCP (which uses shared ingress with its own shared-ingress network policy)

This change:

  1. Guards the policy creation behind !hyperutil.LabelHCPRoutes(hcp)
  2. Deletes the policy via DeleteIfNeeded when LabelHCPRoutes returns true (handles existing clusters transitioning to private endpoints)
  3. Adds a comprehensive table-driven test with 10 scenarios covering AWS, GCP, IBM Cloud, Agent, and KubeVirt platforms

Which issue(s) this PR fixes:

Fixes CNTRLPLANE-2916

Special notes for your reviewer:

  • DeleteIfNeeded is safe for non-existent resources (returns (false, nil) — no error, no-op)
  • The existing TestReconcileNetworkPolicies_GCP_PrivateRouter test continues to pass without modification
  • make lint-fix passes clean, make test passes (exit code 2 is from pre-existing covdata tool issue unrelated to this change)

Checklist:

  • Subject and description added to both, commit and PR.
  • Relevant issues have been referenced.
  • This change includes docs.
  • This change includes unit tests.

🤖 Generated with Claude Code via /jira:solve [CNTRLPLANE-2916](https://issues.redhat.com/browse/CNTRLPLANE-2916) enxebre

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci Bot added area/hypershift-operator Indicates the PR includes changes for the hypershift operator and API - outside an OCP release and removed do-not-merge/needs-area labels Mar 6, 2026
@openshift-ci

openshift-ci Bot commented Mar 6, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: enxebre

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 6, 2026
@enxebre

enxebre commented Mar 6, 2026

Copy link
Copy Markdown
Member Author

/auto-cc

@openshift-ci
openshift-ci Bot requested review from muraee and sjenning March 6, 2026 12:00
@enxebre
enxebre marked this pull request as ready for review March 6, 2026 12:25
@openshift-ci openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 6, 2026
@enxebre

enxebre commented Mar 6, 2026

Copy link
Copy Markdown
Member Author

/test verify
/test unit

@devguyio

devguyio commented Mar 6, 2026

Copy link
Copy Markdown
Contributor

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Mar 6, 2026
@openshift-ci-robot

openshift-ci-robot commented Mar 6, 2026

Copy link
Copy Markdown

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks-4-21
/test e2e-aws-4-21
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws

@enxebre

enxebre commented Mar 6, 2026

Copy link
Copy Markdown
Member Author

/verified by units @enxebre

@openshift-ci-robot openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Mar 6, 2026
@openshift-ci-robot

openshift-ci-robot commented Mar 6, 2026

Copy link
Copy Markdown

@enxebre: This PR has been marked as verified by units @enxebre.

Details

In response to this:

/verified by units @enxebre

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@cwbotbot

cwbotbot commented Mar 6, 2026 •
edited
Loading

Copy link
Copy Markdown

Test Results

e2e-aws

e2e-aks

@jparrill

jparrill commented Mar 9, 2026

Copy link
Copy Markdown
Contributor

/retest-required

@openshift-ci-robot

openshift-ci-robot commented Mar 13, 2026

Copy link
Copy Markdown

/retest-required

Remaining retests: 0 against base HEAD 259cead and 2 for PR HEAD 675cfc1 in total

@openshift-ci-robot

openshift-ci-robot commented Mar 13, 2026

Copy link
Copy Markdown

/retest-required

Remaining retests: 0 against base HEAD 2172048 and 1 for PR HEAD 675cfc1 in total

@openshift-merge-bot
openshift-merge-bot Bot merged commit ac2f829 into openshift:main Mar 14, 2026
22 of 23 checks passed
@csrwng csrwng mentioned this pull request Jun 3, 2026
Merged
4 tasks
@Ajpantuso Ajpantuso mentioned this pull request Jun 4, 2026
Merged
3 tasks
@csrwng csrwng mentioned this pull request Jun 17, 2026
Merged
2 tasks
csrwng added a commit to csrwng/hypershift-1 that referenced this pull request Jun 17, 2026
@csrwng @claude
revert: CNTRLPLANE-2916: restore conditional deletion of openshift-in…
a156efb 
…gress NetworkPolicy

Reverts the revert PR openshift#8662 to re-apply the original PR openshift#7872 behavior:
conditionally create or delete the openshift-ingress NetworkPolicy based
on whether routes are labeled for the HCP router (LabelHCPRoutes).

The OVN-Kubernetes port group race that prompted the revert is being
addressed via PR openshift#8689 (--hcp-egress-block-cidrs flag), making the
blanket always-create workaround unnecessary.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@muraee muraee Awaiting requested review from muraee
@sjenning sjenning Awaiting requested review from sjenning

Assignees

@devguyio devguyio

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. area/hypershift-operator Indicates the PR includes changes for the hypershift operator and API - outside an OCP release jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. verified Signifies that the PR passed pre-merge verification criteria

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@enxebre @openshift-ci-robot @devguyio @cwbotbot @jparrill