From b6818a6ec1635c1151c1cca25cd6d3ac34f5dcea Mon Sep 17 00:00:00 2001
From: Jiri Mencak <jmencak@users.noreply.github.com>
Date: Wed, 22 Jul 2026 17:55:30 +0200
Subject: [PATCH] Add missing annotations to NetworkPolicy manifests

NTO NetworkPolicy manifests that were added as part of #1323 were missing
Cluster Profile (https://github.com/openshift/enhancements/blob/master/enhancements/update/cluster-profiles.md)
annotations.

Add the missing Cluster Profile annotations, so that CVO does not ignore the
NetworkPolicy manifests.

  include.release.openshift.io/self-managed-high-availability: "true"
  include.release.openshift.io/single-node-developer: "true"

Also add NTO namespace to the "default-deny-all" policy.

Resolves: OCPBUGS-99461
---
 manifests/55-network-policy.yaml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/manifests/55-network-policy.yaml b/manifests/55-network-policy.yaml
index 964a4b20d3..592eea0d5a 100644
--- a/manifests/55-network-policy.yaml
+++ b/manifests/55-network-policy.yaml
@@ -10,7 +10,12 @@
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
+  annotations:
+    capability.openshift.io/name: NodeTuning
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
   name: default-deny-all
+  namespace: openshift-cluster-node-tuning-operator
 spec:
   podSelector: {}
   policyTypes:
@@ -22,6 +27,10 @@ spec:
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
+  annotations:
+    capability.openshift.io/name: NodeTuning
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
   name: allow-egress-to-api-server
   namespace: openshift-cluster-node-tuning-operator
 spec:
@@ -40,6 +49,10 @@ spec:
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
+  annotations:
+    capability.openshift.io/name: NodeTuning
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
   name: allow-metrics-traffic
   namespace: openshift-cluster-node-tuning-operator
 spec:
@@ -64,6 +77,10 @@ spec:
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
+  annotations:
+    capability.openshift.io/name: NodeTuning
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
   name: allow-webhook-traffic
   namespace: openshift-cluster-node-tuning-operator
 spec: