OCPBUGS-88063: Add ovn-k8s-cni-overlay to multus-networkpolicy allowed plugins by weliang1 · Pull Request #3025 · openshift/cluster-network-operator

weliang1 · 2026-06-10T14:35:58Z

Problem

MultiNetworkPolicy is not enforced on UDN (User Defined Network) secondary interfaces in OCP 5.0.

This is a regression from OCP 4.22 where MultiNetworkPolicy worked natively with UDN.

Jira: OCPBUGS-88063

Root Cause

OCP 5.0 separated MultiNetworkPolicy from ovnkube-controller into a standalone daemonset that validates CNI types against an allowlist.

UDN networks use CNI type ovn-k8s-cni-overlay which is missing from the --network-plugins list, causing UDN networks to be silently rejected and policies to never be enforced.

Architectural Change

OCP 4.22:

MultiNetworkPolicy integrated into ovnkube-controller with --enable-multi-networkpolicy=true
Native UDN support without CNI type validation
No separate multus-networkpolicy daemonset

OCP 5.0:

MultiNetworkPolicy separated into standalone daemonset in openshift-multus namespace
Validates CNI types against --network-plugins allowlist
Requires ovn-k8s-cni-overlay to support UDN networks

Solution

Add ovn-k8s-cni-overlay to the allowed network-plugins list in multus-networkpolicy daemonset configuration.

Testing

Test Results - OCP 4.22 (Baseline)

✅ OCP-78259: UDN Layer3 + Egress ipBlock policy - PASSED (6m55s)
- MultiNetworkPolicy correctly enforced via native ovnkube-controller integration
- Traffic blocked as expected by policy rules

Test Results - OCP 5.0 (Before Fix)

❌ OCP-77656: UDN Layer2 + Ingress ipBlock policy - FAILED
❌ OCP-78125: UDN Layer2 + Egress ipBlock policy - FAILED
❌ OCP-78259: UDN Layer3 + Egress ipBlock policy - FAILED
❌ OCP-77657: UDN Layer3 + Ingress ipBlock policy - FAILED

All tests showed traffic allowed when it should be blocked by policy, confirming zero policy enforcement on UDN networks.

Failure Pattern:

Expected: curl from pod0 to pod2 should FAIL (blocked by policy)
Actual:   curl SUCCESS - "Hello OpenShift!" returned
Result:   Policy created successfully but never enforced

Test Results - OCP 5.0 (After Fix)

Validated on test cluster with this fix applied:

✅ OCP-77656: UDN Layer2 + Ingress ipBlock policy - PASSED
✅ OCP-78125: UDN Layer2 + Egress ipBlock policy - PASSED
✅ OCP-78259: UDN Layer3 + Egress ipBlock policy - PASSED
✅ OCP-77657: UDN Layer3 + Ingress ipBlock policy - PASSED
✅ OCP-75624: UDN Layer3 basic connectivity - PASSED

All tests show proper policy enforcement with traffic blocked as expected.

Impact

Severity: Critical
Scope: All users attempting to use MultiNetworkPolicy on UDN Layer2/Layer3 secondary networks
Behavior: Complete loss of policy enforcement (silent failure - policies appear to be created successfully but have no effect)

User Impact:

Network microsegmentation using MultiNetworkPolicy on UDN networks has zero enforcement
Security policies intended to block traffic are silently ignored
No error messages or warnings visible to users

Files Changed

bindata/network/multus-networkpolicy/multus-networkpolicy.yaml (1 line)

Verification

After applying this change:

The multus-networkpolicy daemonset will accept UDN networks with CNI type ovn-k8s-cni-overlay
Policies targeting UDN networks will be processed and enforced
All five failing tests (77656, 78125, 78259, 77657, 75624) should pass

# Verify configuration after fix
oc get daemonset multus-networkpolicy -n openshift-multus -o yaml | grep network-plugins
# Expected: --network-plugins=macvlan,sriov,ipvlan,bond,ovn-k8s-cni-overlay

MultiNetworkPolicy is not enforced on UDN (User Defined Network) secondary interfaces in OCP 5.0 due to architectural changes from 4.22. In OCP 4.22, MultiNetworkPolicy was integrated into ovnkube-controller with native UDN support. In OCP 5.0, it was separated into a standalone multus-networkpolicy daemonset that validates CNI types against an allowlist. UDN networks use CNI type "ovn-k8s-cni-overlay" which is missing from the --network-plugins allowlist, causing UDN networks to be silently rejected and policies to never be enforced. Test Results: - OCP 4.22: Test 78259 PASSES (native OVN-K integration) - OCP 5.0: Test 78259 FAILS (missing ovn-k8s-cni-overlay in allowlist) Affected tests: - OCP-77656: UDN Layer2 Secondary + Ingress ipBlock policy - OCP-78125: UDN Layer2 Secondary + Egress ipBlock policy - OCP-78259: UDN Layer3 Secondary + Egress ipBlock policy This fix restores UDN MultiNetworkPolicy functionality in the new 5.0 separated architecture by adding ovn-k8s-cni-overlay to the allowed network plugins list. Follows same pattern as PR openshift#1443 which added sriov support. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

coderabbitai · 2026-06-10T14:36:09Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 9b146437-bc68-4f5c-9e31-bc3bcfda704a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

openshift-ci · 2026-06-10T14:40:03Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: weliang1
Once this PR has been reviewed and has the lgtm label, please assign tssurya for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2026-06-10T19:07:01Z

@weliang1: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-azure-ovn-upgrade	`3f56cb0`	link	true	`/test e2e-azure-ovn-upgrade`
ci/prow/e2e-gcp-ovn-upgrade	`3f56cb0`	link	true	`/test e2e-gcp-ovn-upgrade`
ci/prow/security	`3f56cb0`	link	false	`/test security`
ci/prow/hypershift-e2e-aks	`3f56cb0`	link	true	`/test hypershift-e2e-aks`
ci/prow/e2e-aws-ovn-rhcos10-techpreview	`3f56cb0`	link	false	`/test e2e-aws-ovn-rhcos10-techpreview`
ci/prow/e2e-aws-ovn-fdp-qe	`3f56cb0`	link	true	`/test e2e-aws-ovn-fdp-qe`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot · 2026-06-10T19:28:37Z

@weliang1: This pull request references Jira Issue OCPBUGS-88063, which is invalid:

expected the bug to target the "5.0.0" version, but no target version was set
release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.
expected Jira Issue OCPBUGS-88063 to depend on a bug targeting a version in 5.1.0 and in one of the following states: MODIFIED, ON_QA, VERIFIED, but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Problem

MultiNetworkPolicy is not enforced on UDN (User Defined Network) secondary interfaces in OCP 5.0.

This is a regression from OCP 4.22 where MultiNetworkPolicy worked natively with UDN.

Root Cause

OCP 5.0 separated MultiNetworkPolicy from ovnkube-controller into a standalone daemonset that validates CNI types against an allowlist.

UDN networks use CNI type ovn-k8s-cni-overlay which is missing from the --network-plugins list, causing UDN networks to be silently rejected and policies to never be enforced.

Architectural Change

OCP 4.22:

MultiNetworkPolicy integrated into ovnkube-controller with --enable-multi-networkpolicy=true

Native UDN support without CNI type validation

No separate multus-networkpolicy daemonset

OCP 5.0:

MultiNetworkPolicy separated into standalone daemonset in openshift-multus namespace

Validates CNI types against --network-plugins allowlist

Requires ovn-k8s-cni-overlay to support UDN networks

Solution

Add ovn-k8s-cni-overlay to the allowed network-plugins list in multus-networkpolicy daemonset configuration.

Testing

Test Results - OCP 4.22 (Baseline)

✅ OCP-78259: UDN Layer3 + Egress ipBlock policy - PASSED (6m55s)

MultiNetworkPolicy correctly enforced via native ovnkube-controller integration

Traffic blocked as expected by policy rules

Test Results - OCP 5.0 (Before Fix)

❌ OCP-77656: UDN Layer2 + Ingress ipBlock policy - FAILED

❌ OCP-78125: UDN Layer2 + Egress ipBlock policy - FAILED

❌ OCP-78259: UDN Layer3 + Egress ipBlock policy - FAILED

All tests showed traffic allowed when it should be blocked by policy, confirming zero policy enforcement on UDN networks.

Failure Pattern:
Expected: curl from pod0 to pod2 should FAIL (blocked by policy)
Actual:   curl SUCCESS - "Hello OpenShift!" returned
Result:   Policy created successfully but never enforced
Expected After Fix

All three tests should pass with policies correctly enforced on UDN secondary interfaces.

Impact

Severity: Critical
Scope: All users attempting to use MultiNetworkPolicy on UDN Layer2/Layer3 secondary networks
Behavior: Complete loss of policy enforcement (silent failure - policies appear to be created successfully but have no effect)

User Impact:

Network microsegmentation using MultiNetworkPolicy on UDN networks has zero enforcement

Security policies intended to block traffic are silently ignored

No error messages or warnings visible to users

Files Changed

bindata/network/multus-networkpolicy/multus-networkpolicy.yaml (1 line)

Related

Follows same pattern as PR multi-networkpolicy: Enable on SR-IOV networks #1443 which added sriov support

Test logs available upon request

Detailed RCA documentation available

Verification

After applying this change:

The multus-networkpolicy daemonset will accept UDN networks with CNI type ovn-k8s-cni-overlay

Policies targeting UDN networks will be processed and enforced

All three failing tests (77656, 78125, 78259) should pass
# Verify configuration after fix
oc get daemonset multus-networkpolicy -n openshift-multus -o yaml | grep network-plugins
# Expected: --network-plugins=macvlan,sriov,ipvlan,bond,ovn-k8s-cni-overlay

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-06-10T19:30:10Z

@weliang1: This pull request references Jira Issue OCPBUGS-88063, which is invalid:

release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.
expected Jira Issue OCPBUGS-88063 to depend on a bug targeting a version in 5.1.0 and in one of the following states: MODIFIED, ON_QA, VERIFIED, but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

Problem

MultiNetworkPolicy is not enforced on UDN (User Defined Network) secondary interfaces in OCP 5.0.

This is a regression from OCP 4.22 where MultiNetworkPolicy worked natively with UDN.

Jira: OCPBUGS-88063

Root Cause

OCP 5.0 separated MultiNetworkPolicy from ovnkube-controller into a standalone daemonset that validates CNI types against an allowlist.

UDN networks use CNI type ovn-k8s-cni-overlay which is missing from the --network-plugins list, causing UDN networks to be silently rejected and policies to never be enforced.

Architectural Change

OCP 4.22:

MultiNetworkPolicy integrated into ovnkube-controller with --enable-multi-networkpolicy=true

Native UDN support without CNI type validation

No separate multus-networkpolicy daemonset

OCP 5.0:

MultiNetworkPolicy separated into standalone daemonset in openshift-multus namespace

Validates CNI types against --network-plugins allowlist

Requires ovn-k8s-cni-overlay to support UDN networks

Solution

Add ovn-k8s-cni-overlay to the allowed network-plugins list in multus-networkpolicy daemonset configuration.

Testing

Test Results - OCP 4.22 (Baseline)

✅ OCP-78259: UDN Layer3 + Egress ipBlock policy - PASSED (6m55s)

MultiNetworkPolicy correctly enforced via native ovnkube-controller integration

Traffic blocked as expected by policy rules

Test Results - OCP 5.0 (Before Fix)

❌ OCP-77656: UDN Layer2 + Ingress ipBlock policy - FAILED

❌ OCP-78125: UDN Layer2 + Egress ipBlock policy - FAILED

❌ OCP-78259: UDN Layer3 + Egress ipBlock policy - FAILED

❌ OCP-77657: UDN Layer3 + Ingress ipBlock policy - FAILED

All tests showed traffic allowed when it should be blocked by policy, confirming zero policy enforcement on UDN networks.

Failure Pattern:
Expected: curl from pod0 to pod2 should FAIL (blocked by policy)
Actual:   curl SUCCESS - "Hello OpenShift!" returned
Result:   Policy created successfully but never enforced
Test Results - OCP 5.0 (After Fix)

Validated on test cluster with this fix applied:

✅ OCP-77656: UDN Layer2 + Ingress ipBlock policy - PASSED

✅ OCP-78125: UDN Layer2 + Egress ipBlock policy - PASSED

✅ OCP-78259: UDN Layer3 + Egress ipBlock policy - PASSED

✅ OCP-77657: UDN Layer3 + Ingress ipBlock policy - PASSED

✅ OCP-75624: UDN Layer3 basic connectivity - PASSED

All tests show proper policy enforcement with traffic blocked as expected.

Impact

Severity: Critical
Scope: All users attempting to use MultiNetworkPolicy on UDN Layer2/Layer3 secondary networks
Behavior: Complete loss of policy enforcement (silent failure - policies appear to be created successfully but have no effect)

User Impact:

Network microsegmentation using MultiNetworkPolicy on UDN networks has zero enforcement

Security policies intended to block traffic are silently ignored

No error messages or warnings visible to users

Files Changed

bindata/network/multus-networkpolicy/multus-networkpolicy.yaml (1 line)

Related

Jira Bug: OCPBUGS-88063

Test Fixes: openshift/openshift-tests-private#30013

Follows same pattern as PR multi-networkpolicy: Enable on SR-IOV networks #1443 which added sriov support

Verification

After applying this change:

The multus-networkpolicy daemonset will accept UDN networks with CNI type ovn-k8s-cni-overlay

Policies targeting UDN networks will be processed and enforced

All five failing tests (77656, 78125, 78259, 77657, 75624) should pass
# Verify configuration after fix
oc get daemonset multus-networkpolicy -n openshift-multus -o yaml | grep network-plugins
# Expected: --network-plugins=macvlan,sriov,ipvlan,bond,ovn-k8s-cni-overlay

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

weliang1 · 2026-06-10T19:34:46Z

/jira refresh

openshift-ci-robot · 2026-06-10T19:34:51Z

@weliang1: This pull request references Jira Issue OCPBUGS-88063, which is invalid:

release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.
expected Jira Issue OCPBUGS-88063 to depend on a bug targeting a version in 5.1.0 and in one of the following states: MODIFIED, ON_QA, VERIFIED, but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

weliang1 · 2026-06-10T19:37:28Z

/jira refresh

openshift-ci-robot · 2026-06-10T19:37:32Z

@weliang1: This pull request references Jira Issue OCPBUGS-88063, which is invalid:

expected Jira Issue OCPBUGS-88063 to depend on a bug targeting a version in 5.1.0 and in one of the following states: MODIFIED, ON_QA, VERIFIED, but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

weliang1 · 2026-06-10T19:38:57Z

/jira refresh

openshift-ci-robot · 2026-06-10T19:39:01Z

@weliang1: This pull request references Jira Issue OCPBUGS-88063, which is invalid:

expected Jira Issue OCPBUGS-88063 to depend on a bug targeting a version in 5.1.0 and in one of the following states: MODIFIED, ON_QA, VERIFIED, but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

weliang1 · 2026-06-10T19:46:53Z

Update: This PR is currently blocked due to release-5.0 branch freeze (issue #3012).

The same fix has been submitted to master in PR #3026. Once that merges:

The fix will automatically flow to release-5.0 when the branch is fast-forwarded from master
This PR can be closed if the fix arrives via fast-forward
This PR can be used as a cherry-pick if release-5.0 diverges from master

For now, please review and merge #3026 first.

openshift-ci Bot requested review from marty-power and taanyas June 10, 2026 14:39

weliang1 changed the title ~~Add ovn-k8s-cni-overlay to multus-networkpolicy allowed plugins~~ OCPBUGS-88063: Add ovn-k8s-cni-overlay to multus-networkpolicy allowed plugins Jun 10, 2026

openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Jun 10, 2026

weliang1 mentioned this pull request Jun 10, 2026

OCPBUGS-88063: Add ovn-k8s-cni-overlay to multus-networkpolicy allowed plugins #3026

Open

weliang1 marked this pull request as draft June 10, 2026 19:47

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 10, 2026

Conversation

weliang1 commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Root Cause

Architectural Change

Solution

Testing

Test Results - OCP 4.22 (Baseline)

Test Results - OCP 5.0 (Before Fix)

Test Results - OCP 5.0 (After Fix)

Impact

Files Changed

Related

Verification

Uh oh!

coderabbitai Bot commented Jun 10, 2026

Review skipped

Uh oh!

openshift-ci Bot commented Jun 10, 2026

Uh oh!

openshift-ci Bot commented Jun 10, 2026

Uh oh!

openshift-ci-robot commented Jun 10, 2026

Problem

Root Cause

Architectural Change

Solution

Testing

Test Results - OCP 4.22 (Baseline)

Test Results - OCP 5.0 (Before Fix)

Expected After Fix

Impact

Files Changed

Related

Verification

Uh oh!

openshift-ci-robot commented Jun 10, 2026

Problem

Root Cause

Architectural Change

Solution

Testing

Test Results - OCP 4.22 (Baseline)

Test Results - OCP 5.0 (Before Fix)

Test Results - OCP 5.0 (After Fix)

Impact

Files Changed

Related

Verification

Uh oh!

weliang1 commented Jun 10, 2026

Uh oh!

openshift-ci-robot commented Jun 10, 2026

Uh oh!

weliang1 commented Jun 10, 2026

Uh oh!

openshift-ci-robot commented Jun 10, 2026

Uh oh!

weliang1 commented Jun 10, 2026

Uh oh!

openshift-ci-robot commented Jun 10, 2026

Uh oh!

weliang1 commented Jun 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

weliang1 commented Jun 10, 2026 •

edited

Loading