Feat: detect and warn when OVN routingViaHost is not enabled#386
Conversation
github-project-automation
Bot
moved this to New /:ToDo
in Rossoctl Issue Prioritization
7fba2b7 to
4db79bb
Compare
ChristianZaccaria
left a comment
ChristianZaccaria
left a comment
There was a problem hiding this comment.
Thanks for tackling this, we may need to reconsider the approach, please see comments below for more info.
4db79bb to
8d864c9
Compare
|
Addressed both review comments:
RBAC narrowed to just |
ChristianZaccaria
left a comment
ChristianZaccaria
left a comment
There was a problem hiding this comment.
Please rebase when you have a chance, then should be good to merge!
cwiklik
left a comment
cwiklik
left a comment
There was a problem hiding this comment.
Clean, low-risk, well-tested startup check: detects OVN-Kubernetes without routingViaHost (which silently breaks ambient mTLS) and logs an actionable warning with the exact remediation patch. Correctly OCP-gated via NetworkOperatorCRDExists, so it no-ops on non-OpenShift clusters. The read-only operator.openshift.io/networks get permission is added in all three places — the kubebuilder marker, config/rbac/role.yaml, and the chart role.yaml, kept in sync (the hygiene that avoids RBAC drift). Five unit tests cover OVN-unset/false/true, non-OVN, and missing-resource paths.
CI — E2E is red, but the failure is unrelated: Manager … should ensure the metrics endpoint is serving metrics timed out (300s) at test/e2e/e2e_test.go:249; 31/32 specs passed. The OVN code can't affect it — it no-ops on the Kind E2E cluster, and the only other changes are a gofmt whitespace fix and an RBAC marker. Recommend re-running E2E so branch protection goes green before merge; not a code blocker.
Security: read-only get; no secrets; the check hardens a silent mTLS-bypass condition.
Commits: signed-off. Nit: feat: subject lacks the emoji prefix Kagenti's convention favors (style only).
|
@Bobbins228 need rebase |
Add a reconcile-time check to the AgentRuntime controller that reads network.operator.openshift.io/cluster on OpenShift clusters and surfaces a NetworkReady status condition when OVN-Kubernetes is present but routingViaHost is not configured. Without this setting, Istio ambient mode's ztunnel cannot intercept pod-to-pod traffic, silently bypassing mTLS and authorization policies. The check is automatically enabled via CRD discovery at startup (same pattern as TektonConfig) and only requires read-only RBAC on operator.openshift.io/networks. No cluster infrastructure is mutated. Closes: RHAIENG-5326 Spike: RHAIENG-4900 Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Bobbins228 <mcampbel@redhat.com>
8d864c9 to
5103a61
Compare
pdettori
changed the title
github-project-automation
Bot
moved this from New /:ToDo
to Done
in Rossoctl Issue Prioritization
5 participants
Summary
Adds a startup-time network configuration check that detects when OVN-Kubernetes
routingViaHostis not enabled on OpenShift clusters. Without this setting, Istio ambient mode's ztunnel cannot intercept pod-to-pod traffic and mTLS/authorization policies are silently bypassed. The operator logs a warning at startup — no per-CR conditions, no per-reconcile overhead.Changes
network_check.go—NetworkOperatorCRDExists(CRD discovery at startup) andCheckOVNNetworkConfig(readsnetwork.operator.openshift.io/cluster, returns a warning string if misconfigured)cmd/main.go— runs the check once at startup after CRD discovery, logs warning if misconfiguredgetonoperator.openshift.io/networksinconfig/rbac/role.yamland Helm chartnetwork_check_test.go— 5 unit tests covering misconfigured OVN, correct config, non-OVN clusters, and missing resource