Skip to content

OCPBUGS-88063: Add ovn-k8s-cni-overlay to multus-networkpolicy allowed plugins#3026

Open
weliang1 wants to merge 1 commit into
openshift:masterfrom
weliang1:fix-multinetworkpolicy-udn-master
Open

OCPBUGS-88063: Add ovn-k8s-cni-overlay to multus-networkpolicy allowed plugins#3026
weliang1 wants to merge 1 commit into
openshift:masterfrom
weliang1:fix-multinetworkpolicy-udn-master

Conversation

@weliang1

@weliang1 weliang1 commented Jun 10, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Problem

MultiNetworkPolicy is not enforced on UDN (User Defined Network) secondary interfaces in OCP 5.0+.

This is a regression from OCP 4.22 where MultiNetworkPolicy worked natively with UDN.

Jira: OCPBUGS-88063

Root Cause

OCP 5.0+ separated MultiNetworkPolicy from ovnkube-controller into a standalone daemonset that validates CNI types against an allowlist.

UDN networks use CNI type ovn-k8s-cni-overlay which is missing from the --network-plugins list, causing UDN networks to be silently rejected and policies to never be enforced.

Architectural Change

OCP 4.22:

  • MultiNetworkPolicy integrated into ovnkube-controller with --enable-multi-networkpolicy=true
  • Native UDN support without CNI type validation
  • No separate multus-networkpolicy daemonset

OCP 5.0+:

  • MultiNetworkPolicy separated into standalone daemonset in openshift-multus namespace
  • Validates CNI types against --network-plugins allowlist
  • Requires ovn-k8s-cni-overlay to support UDN networks

Solution

Add ovn-k8s-cni-overlay to the allowed network-plugins list in multus-networkpolicy daemonset configuration.

Testing

Test Results - OCP 5.0 (Before Fix)

  • ❌ OCP-77656: UDN Layer2 + Ingress ipBlock policy - FAILED
  • ❌ OCP-78125: UDN Layer2 + Egress ipBlock policy - FAILED
  • ❌ OCP-78259: UDN Layer3 + Egress ipBlock policy - FAILED
  • ❌ OCP-77657: UDN Layer3 + Ingress ipBlock policy - FAILED

All tests showed traffic allowed when it should be blocked by policy, confirming zero policy enforcement on UDN networks.

Failure Pattern:

Expected: curl from pod0 to pod2 should FAIL (blocked by policy)
Actual:   curl SUCCESS - "Hello OpenShift!" returned
Result:   Policy created successfully but never enforced

Test Results - OCP 5.0 (After Fix)

Validated on test cluster with this fix applied:

  • ✅ OCP-77656: UDN Layer2 + Ingress ipBlock policy - PASSED
  • ✅ OCP-78125: UDN Layer2 + Egress ipBlock policy - PASSED
  • ✅ OCP-78259: UDN Layer3 + Egress ipBlock policy - PASSED
  • ✅ OCP-77657: UDN Layer3 + Ingress ipBlock policy - PASSED
  • ✅ OCP-75624: UDN Layer3 basic connectivity - PASSED

All tests show proper policy enforcement with traffic blocked as expected.

Impact

Severity: Critical
Scope: All users attempting to use MultiNetworkPolicy on UDN Layer2/Layer3 secondary networks
Behavior: Complete loss of policy enforcement (silent failure - policies appear to be created successfully but have no effect)

User Impact:

  • Network microsegmentation using MultiNetworkPolicy on UDN networks has zero enforcement
  • Security policies intended to block traffic are silently ignored
  • No error messages or warnings visible to users

Files Changed

  • bindata/network/multus-networkpolicy/multus-networkpolicy.yaml (1 line)

Related

Verification

After applying this change:

  1. The multus-networkpolicy daemonset will accept UDN networks with CNI type ovn-k8s-cni-overlay
  2. Policies targeting UDN networks will be processed and enforced
  3. All five failing tests (77656, 78125, 78259, 77657, 75624) should pass
# Verify configuration after fix
oc get daemonset multus-networkpolicy -n openshift-multus -o yaml | grep network-plugins
# Expected: --network-plugins=macvlan,sriov,ipvlan,bond,ovn-k8s-cni-overlay

Summary by CodeRabbit

  • New Features
    • Added OVN-K8s overlay network plugin support to the Multus network policy configuration, extending capabilities alongside existing macvlan, SR-IOV, IPVLAN, and bond plugins.

@weliang1 @claude
Add ovn-k8s-cni-overlay to multus-networkpolicy allowed plugins
7077d25 
MultiNetworkPolicy is not enforced on UDN (User Defined Network) secondary
interfaces in OCP 5.0 due to architectural changes from 4.22.

In OCP 4.22, MultiNetworkPolicy was integrated into ovnkube-controller with
native UDN support. In OCP 5.0, it was separated into a standalone
multus-networkpolicy daemonset that validates CNI types against an allowlist.

UDN networks use CNI type "ovn-k8s-cni-overlay" which is missing from the
--network-plugins allowlist, causing UDN networks to be silently rejected
and policies to never be enforced.

Test Results:
- OCP 4.22: Test 78259 PASSES (native OVN-K integration)
- OCP 5.0: Test 78259 FAILS (missing ovn-k8s-cni-overlay in allowlist)

Affected tests:
- OCP-77656: UDN Layer2 Secondary + Ingress ipBlock policy
- OCP-78125: UDN Layer2 Secondary + Egress ipBlock policy
- OCP-78259: UDN Layer3 Secondary + Egress ipBlock policy

This fix restores UDN MultiNetworkPolicy functionality in the new 5.0
separated architecture by adding ovn-k8s-cni-overlay to the allowed
network plugins list.

Follows same pattern as PR openshift#1443 which added sriov support.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
@openshift-ci-robot openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. labels Jun 10, 2026
@openshift-ci-robot

openshift-ci-robot commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

@weliang1: This pull request references Jira Issue OCPBUGS-88063, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (5.0.0) matches configured target version for branch (5.0.0)
  • bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (weliang@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Problem

MultiNetworkPolicy is not enforced on UDN (User Defined Network) secondary interfaces in OCP 5.0+.

This is a regression from OCP 4.22 where MultiNetworkPolicy worked natively with UDN.

Jira: OCPBUGS-88063

Root Cause

OCP 5.0+ separated MultiNetworkPolicy from ovnkube-controller into a standalone daemonset that validates CNI types against an allowlist.

UDN networks use CNI type ovn-k8s-cni-overlay which is missing from the --network-plugins list, causing UDN networks to be silently rejected and policies to never be enforced.

Architectural Change

OCP 4.22:

  • MultiNetworkPolicy integrated into ovnkube-controller with --enable-multi-networkpolicy=true
  • Native UDN support without CNI type validation
  • No separate multus-networkpolicy daemonset

OCP 5.0+:

  • MultiNetworkPolicy separated into standalone daemonset in openshift-multus namespace
  • Validates CNI types against --network-plugins allowlist
  • Requires ovn-k8s-cni-overlay to support UDN networks

Solution

Add ovn-k8s-cni-overlay to the allowed network-plugins list in multus-networkpolicy daemonset configuration.

Testing

Test Results - OCP 5.0 (Before Fix)

  • ❌ OCP-77656: UDN Layer2 + Ingress ipBlock policy - FAILED
  • ❌ OCP-78125: UDN Layer2 + Egress ipBlock policy - FAILED
  • ❌ OCP-78259: UDN Layer3 + Egress ipBlock policy - FAILED
  • ❌ OCP-77657: UDN Layer3 + Ingress ipBlock policy - FAILED

All tests showed traffic allowed when it should be blocked by policy, confirming zero policy enforcement on UDN networks.

Failure Pattern:

Expected: curl from pod0 to pod2 should FAIL (blocked by policy)
Actual:   curl SUCCESS - "Hello OpenShift!" returned
Result:   Policy created successfully but never enforced

Test Results - OCP 5.0 (After Fix)

Validated on test cluster with this fix applied:

  • ✅ OCP-77656: UDN Layer2 + Ingress ipBlock policy - PASSED
  • ✅ OCP-78125: UDN Layer2 + Egress ipBlock policy - PASSED
  • ✅ OCP-78259: UDN Layer3 + Egress ipBlock policy - PASSED
  • ✅ OCP-77657: UDN Layer3 + Ingress ipBlock policy - PASSED
  • ✅ OCP-75624: UDN Layer3 basic connectivity - PASSED

All tests show proper policy enforcement with traffic blocked as expected.

Impact

Severity: Critical
Scope: All users attempting to use MultiNetworkPolicy on UDN Layer2/Layer3 secondary networks
Behavior: Complete loss of policy enforcement (silent failure - policies appear to be created successfully but have no effect)

User Impact:

  • Network microsegmentation using MultiNetworkPolicy on UDN networks has zero enforcement
  • Security policies intended to block traffic are silently ignored
  • No error messages or warnings visible to users

Files Changed

  • bindata/network/multus-networkpolicy/multus-networkpolicy.yaml (1 line)

Related

Verification

After applying this change:

  1. The multus-networkpolicy daemonset will accept UDN networks with CNI type ovn-k8s-cni-overlay
  2. Policies targeting UDN networks will be processed and enforced
  3. All five failing tests (77656, 78125, 78259, 77657, 75624) should pass
# Verify configuration after fix
oc get daemonset multus-networkpolicy -n openshift-multus -o yaml | grep network-plugins
# Expected: --network-plugins=macvlan,sriov,ipvlan,bond,ovn-k8s-cni-overlay

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai

coderabbitai Bot commented Jun 10, 2026 •
edited
Loading

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d2c6f457-1cea-4293-bb25-cfd22090b40b

📥 Commits

Reviewing files that changed from the base of the PR and between 6dc1804 and 7077d25.

📒 Files selected for processing (1)
  • bindata/network/multus-networkpolicy/multus-networkpolicy.yaml

Walkthrough

The Multus networkpolicy DaemonSet manifest is updated to register the ovn-k8s-cni-overlay plugin by adding it to the --network-plugins argument list alongside the existing plugins (macvlan, sriov, ipvlan, bond).

Changes

Multus Networkpolicy Plugin Configuration

Layer / File(s) Summary
Network plugins argument update
bindata/network/multus-networkpolicy/multus-networkpolicy.yaml		 The --network-plugins container argument is expanded to register ovn-k8s-cni-overlay as an additional supported network plugin in the comma-separated list.

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Test Structure And Quality ⚠️ Warning TestRenderMultiNetworkPolicy tests multiple unrelated behaviors in a single test and lacks meaningful assertion messages for debugging failures. Split test into separate functions per scenario; add descriptive messages to assertions for better diagnostic output on failure.
✅ Passed checks (14 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The pull request title accurately describes the main change: adding ovn-k8s-cni-overlay to the multus-networkpolicy allowed plugins list.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed PR only modifies bindata/network/multus-networkpolicy/multus-networkpolicy.yaml (a YAML configuration file) and contains no test code changes, so the Ginkgo test name stability check does not apply.
Microshift Test Compatibility ✅ Passed No new Ginkgo e2e tests are added in this PR. The only change is to a YAML configuration file (multus-networkpolicy.yaml) that updates container arguments; check is not applicable.
Single Node Openshift (Sno) Test Compatibility ✅ Passed PR modifies only a Kubernetes manifest file (YAML), not test code. No new Ginkgo e2e tests added, so SNO compatibility check is not applicable.
Topology-Aware Scheduling Compatibility ✅ Passed PR only adds a CNI type to an allowlist in DaemonSet args. No scheduling constraints introduced; existing design is topology-aware.
Ote Binary Stdout Contract ✅ Passed PR only modifies Kubernetes YAML manifest files (multus-networkpolicy.yaml), not test binaries or process-level Go code; OTE Binary Stdout Contract check is not applicable to configuration changes.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed No new Ginkgo e2e tests are being added in this PR; only a YAML configuration file is modified. The custom check does not apply when no new tests are introduced.
No-Weak-Crypto ✅ Passed PR only modifies a Kubernetes manifest file to add a CNI plugin name to an allowlist. No cryptographic code, algorithms, or insecure secret comparisons are present.
Container-Privileges ✅ Passed PR only adds plugin name to allowlist; all privilege settings (privileged: true, hostNetwork, SYS_ADMIN) were pre-existing and are justified for network policy enforcement.
No-Sensitive-Data-In-Logs ✅ Passed The PR only adds a CNI plugin name (ovn-k8s-cni-overlay) to a network plugins allowlist. No logging configuration, sensitive data (passwords, tokens, keys, PII), or credentials are introduced.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands and usage tips.

@openshift-ci openshift-ci Bot requested review from martinkennelly and miheer June 10, 2026 19:46
@openshift-ci-robot

openshift-ci-robot commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

@weliang1: This pull request references Jira Issue OCPBUGS-88063, which is valid.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (5.0.0) matches configured target version for branch (5.0.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (weliang@redhat.com), skipping review request.

Details

In response to this:

Problem

MultiNetworkPolicy is not enforced on UDN (User Defined Network) secondary interfaces in OCP 5.0+.

This is a regression from OCP 4.22 where MultiNetworkPolicy worked natively with UDN.

Jira: OCPBUGS-88063

Root Cause

OCP 5.0+ separated MultiNetworkPolicy from ovnkube-controller into a standalone daemonset that validates CNI types against an allowlist.

UDN networks use CNI type ovn-k8s-cni-overlay which is missing from the --network-plugins list, causing UDN networks to be silently rejected and policies to never be enforced.

Architectural Change

OCP 4.22:

  • MultiNetworkPolicy integrated into ovnkube-controller with --enable-multi-networkpolicy=true
  • Native UDN support without CNI type validation
  • No separate multus-networkpolicy daemonset

OCP 5.0+:

  • MultiNetworkPolicy separated into standalone daemonset in openshift-multus namespace
  • Validates CNI types against --network-plugins allowlist
  • Requires ovn-k8s-cni-overlay to support UDN networks

Solution

Add ovn-k8s-cni-overlay to the allowed network-plugins list in multus-networkpolicy daemonset configuration.

Testing

Test Results - OCP 5.0 (Before Fix)

  • ❌ OCP-77656: UDN Layer2 + Ingress ipBlock policy - FAILED
  • ❌ OCP-78125: UDN Layer2 + Egress ipBlock policy - FAILED
  • ❌ OCP-78259: UDN Layer3 + Egress ipBlock policy - FAILED
  • ❌ OCP-77657: UDN Layer3 + Ingress ipBlock policy - FAILED

All tests showed traffic allowed when it should be blocked by policy, confirming zero policy enforcement on UDN networks.

Failure Pattern:

Expected: curl from pod0 to pod2 should FAIL (blocked by policy)
Actual:   curl SUCCESS - "Hello OpenShift!" returned
Result:   Policy created successfully but never enforced

Test Results - OCP 5.0 (After Fix)

Validated on test cluster with this fix applied:

  • ✅ OCP-77656: UDN Layer2 + Ingress ipBlock policy - PASSED
  • ✅ OCP-78125: UDN Layer2 + Egress ipBlock policy - PASSED
  • ✅ OCP-78259: UDN Layer3 + Egress ipBlock policy - PASSED
  • ✅ OCP-77657: UDN Layer3 + Ingress ipBlock policy - PASSED
  • ✅ OCP-75624: UDN Layer3 basic connectivity - PASSED

All tests show proper policy enforcement with traffic blocked as expected.

Impact

Severity: Critical
Scope: All users attempting to use MultiNetworkPolicy on UDN Layer2/Layer3 secondary networks
Behavior: Complete loss of policy enforcement (silent failure - policies appear to be created successfully but have no effect)

User Impact:

  • Network microsegmentation using MultiNetworkPolicy on UDN networks has zero enforcement
  • Security policies intended to block traffic are silently ignored
  • No error messages or warnings visible to users

Files Changed

  • bindata/network/multus-networkpolicy/multus-networkpolicy.yaml (1 line)

Related

Verification

After applying this change:

  1. The multus-networkpolicy daemonset will accept UDN networks with CNI type ovn-k8s-cni-overlay
  2. Policies targeting UDN networks will be processed and enforced
  3. All five failing tests (77656, 78125, 78259, 77657, 75624) should pass
# Verify configuration after fix
oc get daemonset multus-networkpolicy -n openshift-multus -o yaml | grep network-plugins
# Expected: --network-plugins=macvlan,sriov,ipvlan,bond,ovn-k8s-cni-overlay

Summary by CodeRabbit

  • New Features
  • Added OVN-K8s overlay network plugin support to the Multus network policy configuration, extending capabilities alongside existing macvlan, SR-IOV, IPVLAN, and bond plugins.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci

openshift-ci Bot commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: weliang1
Once this PR has been reviewed and has the lgtm label, please assign jacobtanenbaum for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@weliang1 weliang1 mentioned this pull request Jun 10, 2026
Draft
@weliang1

weliang1 commented Jun 11, 2026

Copy link
Copy Markdown
Contributor Author

/retest-required

@openshift-ci

openshift-ci Bot commented Jun 11, 2026

Copy link
Copy Markdown
Contributor

@weliang1: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/5.0-upgrade-from-stable-4.22-e2e-gcp-ovn-upgrade 7077d25 link false /test 5.0-upgrade-from-stable-4.22-e2e-gcp-ovn-upgrade
ci/prow/e2e-metal-ipi-ovn-dualstack-bgp 7077d25 link true /test e2e-metal-ipi-ovn-dualstack-bgp
ci/prow/e2e-aws-ovn-rhcos10-techpreview 7077d25 link false /test e2e-aws-ovn-rhcos10-techpreview
ci/prow/security 7077d25 link false /test security

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@martinkennelly martinkennelly Awaiting requested review from martinkennelly

@miheer miheer Awaiting requested review from miheer

Assignees

No one assigned

Labels

jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@weliang1 @openshift-ci-robot