[release-4.20] OCPBUGS-77148: Minimize ACLs by combining ipBlocks into single ACL by pperiyasamy · Pull Request #2981 · openshift/ovn-kubernetes

pperiyasamy · 2026-02-16T12:28:27Z

Manual cherry-pick of 4.21 commit 21ef647 from PR #2995.

Resolved conflicts in go-controller/pkg/ovn/policy_test.go for deriving ACL's action.

pperiyasamy · 2026-02-17T08:14:14Z

/payload 4.20 ci blocking
/payload 4.20 nightly blocking

openshift-ci · 2026-02-17T08:14:18Z

@pperiyasamy: trigger 5 job(s) of type blocking for the ci release of OCP 4.20

periodic-ci-openshift-release-main-ci-4.20-upgrade-from-stable-4.19-e2e-aws-ovn-upgrade
periodic-ci-openshift-release-main-ci-4.20-upgrade-from-stable-4.19-e2e-azure-ovn-upgrade
periodic-ci-openshift-release-main-ci-4.20-e2e-gcp-ovn-upgrade
periodic-ci-openshift-hypershift-release-4.20-periodics-e2e-aks
periodic-ci-openshift-hypershift-release-4.20-periodics-e2e-aws-ovn

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/a6201d40-0bd8-11f1-8e1b-367a91ffcc0d-0

trigger 13 job(s) of type blocking for the nightly release of OCP 4.20

periodic-ci-openshift-release-main-nightly-4.20-e2e-aws-ovn-serial-1of2
periodic-ci-openshift-release-main-nightly-4.20-e2e-aws-ovn-serial-2of2
periodic-ci-openshift-release-main-ci-4.20-e2e-aws-upgrade-ovn-single-node
periodic-ci-openshift-release-main-ci-4.20-e2e-aws-ovn-techpreview
periodic-ci-openshift-release-main-ci-4.20-e2e-aws-ovn-techpreview-serial-1of3
periodic-ci-openshift-release-main-ci-4.20-e2e-aws-ovn-techpreview-serial-2of3
periodic-ci-openshift-release-main-ci-4.20-e2e-aws-ovn-techpreview-serial-3of3
periodic-ci-openshift-release-main-nightly-4.20-e2e-aws-ovn-upgrade-fips
periodic-ci-openshift-release-main-ci-4.20-e2e-azure-ovn-upgrade
periodic-ci-openshift-release-main-ci-4.20-upgrade-from-stable-4.19-e2e-gcp-ovn-rt-upgrade
periodic-ci-openshift-hypershift-release-4.20-periodics-e2e-aws-ovn-conformance
periodic-ci-openshift-release-main-nightly-4.20-e2e-metal-ipi-ovn-bm
periodic-ci-openshift-release-main-nightly-4.20-e2e-metal-ipi-ovn-ipv6

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/a6201d40-0bd8-11f1-8e1b-367a91ffcc0d-1

pperiyasamy · 2026-02-17T08:14:58Z

/retest

mrobson · 2026-02-17T18:27:04Z

/retest ci/prow/images

mrobson · 2026-02-17T18:27:41Z

/test images

Combine all ipBlocks in a NetworkPolicy rule into single ACL instead of creating one ACL per ipBlock. This reduces ACL bloat when policy having multiple ipBlocks for ingress/egress rules. Signed-off-by: Periyasamy Palanisamy <pepalani@redhat.com> (cherry picked from commit fd27015) (cherry picked from commit 14b7309) (cherry picked from commit 21ef647)

openshift-ci-robot · 2026-02-23T08:53:41Z

@pperiyasamy: This pull request references Jira Issue OCPBUGS-77148, which is invalid:

release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.
expected dependent Jira Issue OCPBUGS-77147 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is New instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

pperiyasamy · 2026-02-24T09:14:04Z

/hold

arkadeepsen · 2026-03-03T10:51:32Z

/retest-required

arkadeepsen · 2026-03-03T12:02:14Z

/tide refresh

arkadeepsen · 2026-03-03T13:48:39Z

/retest-required

liqcui · 2026-03-03T16:18:30Z

/verified by @liqcui

openshift-ci-robot · 2026-03-03T16:18:42Z

@liqcui: This PR has been marked as verified by @liqcui.

Details

In response to this:

/verified by @liqcui

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

pperiyasamy · 2026-03-03T16:26:13Z

/hold cancel

arkadeepsen · 2026-03-04T05:03:20Z

/test e2e-metal-ipi-ovn-dualstack-bgp-local-gw

arkadeepsen · 2026-03-04T06:11:16Z

/payload-job periodic-ci-openshift-release-main-ci-4.20-e2e-aws-upgrade-ovn-single-node
/payload-job periodic-ci-openshift-release-main-ci-4.20-e2e-aws-ovn-techpreview
/payload-job periodic-ci-openshift-release-main-ci-4.20-upgrade-from-stable-4.19-e2e-gcp-ovn-rt-upgrade

openshift-ci · 2026-03-04T13:44:22Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jcaamano, pperiyasamy

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [jcaamano]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

jcaamano · 2026-03-04T15:00:16Z

/override ci/prow/e2e-aws-ovn-edge-zones
https://issues.redhat.com/browse/OCPBUGS-77499

jcaamano · 2026-03-04T15:00:50Z

/override ci/prow/qe-perfscale-payload-control-plane-6nodes
associated thread: https://redhat-internal.slack.com/archives/C020CKMP6CT/p1771508205301039?thread_ts=1771101156.062779&cid=C020CKMP6CT and https://redhat-internal.slack.com/archives/GQ0CU2623/p1771848596455029?thread_ts=1771338827.722999&cid=GQ0CU2623
plausible fix: kube-burner/kube-burner-ocp#399

openshift-ci · 2026-03-04T15:01:15Z

@jcaamano: Overrode contexts on behalf of jcaamano: ci/prow/e2e-aws-ovn-edge-zones

Details

In response to this:

/override ci/prow/e2e-aws-ovn-edge-zones
https://issues.redhat.com/browse/OCPBUGS-77499

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2026-03-04T15:01:21Z

@jcaamano: Overrode contexts on behalf of jcaamano: ci/prow/qe-perfscale-payload-control-plane-6nodes

Details

In response to this:

/override ci/prow/qe-perfscale-payload-control-plane-6nodes
associated thread: https://redhat-internal.slack.com/archives/C020CKMP6CT/p1771508205301039?thread_ts=1771101156.062779&cid=C020CKMP6CT and https://redhat-internal.slack.com/archives/GQ0CU2623/p1771848596455029?thread_ts=1771338827.722999&cid=GQ0CU2623
plausible fix: kube-burner/kube-burner-ocp#399

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

arkadeepsen · 2026-03-05T13:30:53Z

/jira refresh

openshift-ci-robot · 2026-03-05T13:31:00Z

@arkadeepsen: This pull request references Jira Issue OCPBUGS-77148, which is valid.

7 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.20.z) matches configured target version for branch (4.20.z)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)
release note type set to "Release Note Not Required"
dependent bug Jira Issue OCPBUGS-77147 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))
dependent Jira Issue OCPBUGS-77147 targets the "4.21.z" version, which is one of the valid target versions: 4.21.0, 4.21.z
bug has dependents

Requesting review from QA contact:
/cc @anuragthehatter

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

arkadeepsen · 2026-03-06T01:11:05Z

/retest-required

arkadeepsen · 2026-03-06T08:47:38Z

/test e2e-metal-ipi-ovn-dualstack-bgp-local-gw

arkadeepsen · 2026-03-06T08:55:43Z

/test e2e-aws-ovn-edge-zones

jcaamano · 2026-03-06T13:32:01Z

/override ci/prow/e2e-aws-ovn-edge-zones
/override ci/prow/qe-perfscale-payload-control-plane-6nodes

openshift-ci · 2026-03-06T13:32:26Z

@jcaamano: Overrode contexts on behalf of jcaamano: ci/prow/e2e-aws-ovn-edge-zones, ci/prow/qe-perfscale-payload-control-plane-6nodes

Details

In response to this:

/override ci/prow/e2e-aws-ovn-edge-zones
/override ci/prow/qe-perfscale-payload-control-plane-6nodes

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2026-03-06T13:32:28Z

@pperiyasamy: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/security	`8336fa0`	link	false	`/test security`
ci/prow/qe-perfscale-payload-control-plane-6nodes	`8336fa0`	link	true	`/test qe-perfscale-payload-control-plane-6nodes`
ci/prow/e2e-aws-ovn-edge-zones	`8336fa0`	link	true	`/test e2e-aws-ovn-edge-zones`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot · 2026-03-06T13:37:35Z

@pperiyasamy: Jira Issue Verification Checks: Jira Issue OCPBUGS-77148
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-77148 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

Manual cherry-pick of 4.21 commit 21ef647 from PR #2995.

Resolved conflicts in go-controller/pkg/ovn/policy_test.go for deriving ACL's action.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci Bot requested review from martinkennelly and tssurya February 16, 2026 12:29

pperiyasamy force-pushed the np_reduce_acl_ipblock_4.20 branch from 853de36 to 8336fa0 Compare February 23, 2026 08:52

pperiyasamy changed the title ~~[DNM] [release-4.20] Minimize ACLs by combining ipBlocks into single ACL~~ [release-4.20] OCPBUGS-77148: Minimize ACLs by combining ipBlocks into single ACL Feb 23, 2026

pperiyasamy mentioned this pull request Feb 23, 2026

[release-4.19] OCPBUGS-77150: Minimize ACLs by combining ipBlocks into single ACL #2996

Closed

openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Feb 24, 2026

ricky-rav mentioned this pull request Feb 24, 2026

OCPBUGS-77081,OCPBUGS-77094: [release-4.20] combined backport PR for 2 escalations #2985

Merged

SachinNinganure mentioned this pull request Feb 24, 2026

ipblock mnp tests openshift/release#75202

Open

ricky-rav mentioned this pull request Feb 24, 2026

OCPBUGS-77082,OCPBUGS-77096: [release-4.19] combined backport PR for 2 escalations #2986

Merged

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Mar 3, 2026

openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 3, 2026

openshift-ci Bot assigned asood-rh, barbora137, huiran0826, jechen0648, meinali566, mffiedler, qiowang721, rbbratta and weliang1 Mar 4, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Mar 4, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 4, 2026

openshift-ci-robot mentioned this pull request Mar 5, 2026

[release-4.20] OCPBUGS-77148: Add config override for openflow-probe openshift/cluster-network-operator#2918

Merged

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Mar 5, 2026

openshift-ci Bot requested a review from anuragthehatter March 5, 2026 13:31

openshift-merge-bot Bot merged commit 304bd93 into openshift:release-4.20 Mar 6, 2026
28 of 29 checks passed

Conversation

pperiyasamy commented Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pperiyasamy commented Feb 17, 2026

Uh oh!

openshift-ci Bot commented Feb 17, 2026

Uh oh!

pperiyasamy commented Feb 17, 2026

Uh oh!

mrobson commented Feb 17, 2026

Uh oh!

mrobson commented Feb 17, 2026

Uh oh!

openshift-ci-robot commented Feb 23, 2026

Uh oh!

pperiyasamy commented Feb 24, 2026

Uh oh!

arkadeepsen commented Mar 3, 2026

Uh oh!

arkadeepsen commented Mar 3, 2026

Uh oh!

arkadeepsen commented Mar 3, 2026

Uh oh!

liqcui commented Mar 3, 2026

Uh oh!

openshift-ci-robot commented Mar 3, 2026

Uh oh!

pperiyasamy commented Mar 3, 2026

Uh oh!

arkadeepsen commented Mar 4, 2026

Uh oh!

arkadeepsen commented Mar 4, 2026

Uh oh!

openshift-ci Bot commented Mar 4, 2026

Uh oh!

jcaamano commented Mar 4, 2026

Uh oh!

jcaamano commented Mar 4, 2026

Uh oh!

openshift-ci Bot commented Mar 4, 2026

Uh oh!

openshift-ci Bot commented Mar 4, 2026

Uh oh!

arkadeepsen commented Mar 5, 2026

Uh oh!

openshift-ci-robot commented Mar 5, 2026

Uh oh!

arkadeepsen commented Mar 6, 2026

Uh oh!

arkadeepsen commented Mar 6, 2026

Uh oh!

arkadeepsen commented Mar 6, 2026

Uh oh!

jcaamano commented Mar 6, 2026

Uh oh!

openshift-ci Bot commented Mar 6, 2026

Uh oh!

openshift-ci Bot commented Mar 6, 2026

Uh oh!

Uh oh!

openshift-ci-robot commented Mar 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

16 participants

pperiyasamy commented Feb 16, 2026 •

edited

Loading