OCPBUGS-49368, OCPBUGS-62895, OCPBUGS-70130, OCPBUGS-74164, OCPBUGS-66267, OCPBUGS-65114: DownStream Merge [02-12-2026] by openshift-pr-manager[bot] · Pull Request #2980 · openshift/ovn-kubernetes

openshift-pr-manager · 2026-02-12T17:01:56Z

Automated merge of upstream/master → master.

Remove the temporary migration code that was added in 2023 to support the transition to OVN Interconnect (IC) architecture. This HACK code tracked whether remote zone nodes had completed migration using the "k8s.ovn.org/remote-zone-migrated" annotation. This code is no longer needed. Changes: - Remove OvnNodeMigratedZoneName constant and helper functions (SetNodeZoneMigrated, HasNodeMigratedZone, NodeMigratedZoneAnnotationChanged) - Remove migrated field from nodeInfo struct in node_tracker.go - Simplify isLocalZoneNode() in base_network_controller.go and egressip.go - Remove HACK helper functions (checkOVNSBNodeLRSR, fetchLBNames, lbExists, portExists) and migration sync flow from default_node_network_controller.go - Remove remote-zone-migrated annotation from webhook allowed annotations - Update tests to remove references to the migration annotation Assisted by Claude Opus 4.5 <noreply@anthropic.com> Signed-off-by: Riccardo Ravaioli <rravaiol@redhat.com>

Signed-off-by: Soli0222 <github@str08.net>

Signed-off-by: Jean Chen <jechen@redhat.com>

Add PodSecurity compliance to util.go

Remove IC zone migration HACK code

The layer2 UDN cleanup tests for IC clusters were failing because of a zone mismatch between the controller and the test node: - Controller zone: read from NBGlobal.Name ("global") - Node zone: set via annotation ("test" when IC enabled) This mismatch was previously masked in two spots: 1. The HACK in isLocalZoneNode() (removed by commit 7d408c1): When the controller's zone was "global" (the default), the HACK bypassed the zone comparison entirely and instead checked whether the node had a migration annotation. Since the test node had no migration annotation, it was treated as local despite the zone mismatch. 2. Unconditional gateway cleanup in deleteNodeEvent (changed by commit 8725a93 to only cleanup nodes tracked in localZoneNodes) With both items above removed/changed, the test correctly fails because the node is treated as remote (zones don't match), so it's not added to localZoneNodes, and cleanup is skipped. Fix the test by: - using setupConfig() to set config.Default.Zone to testICZone when IC is enabled - setting NBGlobal.Name to config.Default.Zone (which setupConfig() already configured correctly) This ensures the controller and node are in the same zone, so the node is correctly treated as local and its gateway entities are cleaned up. 🤖 Assisted by [Claude Code](https://claude.com/claude-code) Signed-off-by: Riccardo Ravaioli <rravaiol@redhat.com>

Fix IC cluster cleanup tests zone configuration

When an EndpointSlice for a UDP NodePort or loadbalancer type of service is updated, stale conntrack entries for removed endpoints must be flushed. The existing logic failed to do this correctly if the backend pod was on a different node. This patch fixes the issue by flushing conntrack entries by filtering the nodePort when the node is not hosting the backend pod. In case that the backend pod was on the same node as the service, this issue won't happen. Since all old pod entries are removed from the node by the function deletePodConntrack when the pod is deleted. Signed-off-by: Peng Liu <pliu@redhat.com>

It should be able to preserve UDP traffic when server pod cycles for a NodePort service via a different node. Signed-off-by: Peng Liu <pliu@redhat.com>