OCPBUGS-99461: Add missing annotations to NetworkPolicy manifests by jmencak · Pull Request #1569 · openshift/cluster-node-tuning-operator

jmencak · 2026-07-22T19:14:07Z

NTO NetworkPolicy manifests that were added as part of #1323 were missing Cluster Profile (https://github.com/openshift/enhancements/blob/master/enhancements/update/cluster-profiles.md) annotations.

Add the missing Cluster Profile annotations, so that CVO does not ignore the NetworkPolicy manifests.

include.release.openshift.io/self-managed-high-availability: "true"
include.release.openshift.io/single-node-developer: "true"

Resolves: OCPBUGS-99461

Summary by CodeRabbit

Configuration
- Updated network policy metadata with OpenShift NodeTuning annotations.
- Opted the affected network policies into self-managed-high-availability and single-node-developer release streams.
- Network traffic rules, ports, and security behavior remain unchanged.

openshift-ci · 2026-07-22T19:14:10Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

openshift-ci-robot · 2026-07-22T19:14:14Z

@jmencak: This pull request references Jira Issue OCPBUGS-99461, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.0.0) matches configured target version for branch (5.0.0)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

NTO NetworkPolicy manifests that were added as part of #1323 were missing Cluster Profile (https://github.com/openshift/enhancements/blob/master/enhancements/update/cluster-profiles.md) annotations.

Add the missing Cluster Profile annotations, so that CVO does not ignore the NetworkPolicy manifests.

include.release.openshift.io/self-managed-high-availability: "true"
include.release.openshift.io/single-node-developer: "true"

Resolves: OCPBUGS-99461

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-07-22T19:14:28Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jmencak

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [jmencak]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

coderabbitai · 2026-07-22T19:14:33Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 035c9840-4317-4081-b164-1bcbad20d9a0

📥 Commits

Reviewing files that changed from the base of the PR and between 86f0013 and b6818a6.

📒 Files selected for processing (1)

manifests/55-network-policy.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

manifests/55-network-policy.yaml

Walkthrough

Four existing NetworkPolicy resources gained OpenShift capability and release-stream metadata annotations. Their selectors, traffic rules, ports, and policy types remain unchanged.

Changes

NetworkPolicy annotations

Layer / File(s)	Summary
Annotate NetworkPolicy resources `manifests/55-network-policy.yaml`	The default-deny, API-server egress, metrics, and webhook NetworkPolicies now include NodeTuning capability and two OpenShift release-stream annotations.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding missing annotations to NetworkPolicy manifests.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Only a YAML manifest changed; no Ginkgo tests or test titles were added or modified.
Test Structure And Quality	✅ Passed	Only manifests/55-network-policy.yaml changed; no Ginkgo test code was added or modified, so the test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	Only a NetworkPolicy manifest changed; no Ginkgo tests or MicroShift-unsupported OpenShift APIs/features were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only a NetworkPolicy manifest changed; no new Ginkgo tests or SNO-sensitive node assumptions were added.
Topology-Aware Scheduling Compatibility	✅ Passed	Only NetworkPolicy release annotations were added; no affinity, node selectors, replicas, or topology-spread constraints appear.
Ote Binary Stdout Contract	✅ Passed	PR only adds YAML annotations in a manifest; no process-level Go code or stdout writes were changed.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No Ginkgo/e2e tests were added; the PR only updates a NetworkPolicy manifest with annotations.
No-Weak-Crypto	✅ Passed	The only changed file is a NetworkPolicy YAML; its added annotations contain no weak-crypto primitives, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	The changed manifest only adds annotations to NetworkPolicy objects; no privileged, hostNetwork/PID/IPC, root, or allowPrivilegeEscalation fields are present.
No-Sensitive-Data-In-Logs	✅ Passed	Only NetworkPolicy annotations were added; no logging code or sensitive-data exposure appears in the changed file.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

manifests/55-network-policy.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci-robot · 2026-07-22T19:14:52Z

@jmencak: This pull request references Jira Issue OCPBUGS-99461, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.0.0) matches configured target version for branch (5.0.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

NTO NetworkPolicy manifests that were added as part of #1323 were missing Cluster Profile (https://github.com/openshift/enhancements/blob/master/enhancements/update/cluster-profiles.md) annotations.

Add the missing Cluster Profile annotations, so that CVO does not ignore the NetworkPolicy manifests.

include.release.openshift.io/self-managed-high-availability: "true"
include.release.openshift.io/single-node-developer: "true"

Resolves: OCPBUGS-99461

Summary by CodeRabbit

Configuration

Updated network policy metadata to support OpenShift NodeTuning capabilities.

Enabled compatibility with self-managed high-availability and single-node developer release streams.

Network traffic rules and security behavior remain unchanged.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

jmencak · 2026-07-22T19:17:00Z

/test all

qodo-for-rh-openshift · 2026-07-22T19:17:11Z

Unsupported PR languages

NTO NetworkPolicy manifests that were added as part of openshift#1323 were missing Cluster Profile (https://github.com/openshift/enhancements/blob/master/enhancements/update/cluster-profiles.md) annotations. Add the missing Cluster Profile annotations, so that CVO does not ignore the NetworkPolicy manifests. include.release.openshift.io/self-managed-high-availability: "true" include.release.openshift.io/single-node-developer: "true" Also add NTO namespace to the "default-deny-all" policy. Resolves: OCPBUGS-99461

jmencak · 2026-07-23T09:34:44Z

/test e2e-aws-operator

qodo-for-rh-openshift · 2026-07-23T09:34:52Z

Unsupported PR languages

qodo-for-rh-openshift · 2026-07-23T12:38:13Z

Unsupported PR languages

jmencak · 2026-07-23T17:20:10Z

/retest-required

openshift-ci · 2026-07-23T20:16:04Z

@jmencak: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-hypershift-pao	`b6818a6`	link	true	`/test e2e-hypershift-pao`
ci/prow/e2e-gcp-pao	`b6818a6`	link	true	`/test e2e-gcp-pao`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 22, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 22, 2026

jmencak force-pushed the 5.0-OCPBUGS-99461-network-policy branch from 86f0013 to b6818a6 Compare July 23, 2026 09:34

Uh oh!

Conversation

jmencak commented Jul 22, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

openshift-ci Bot commented Jul 22, 2026

Uh oh!

openshift-ci-robot commented Jul 22, 2026

Uh oh!

openshift-ci Bot commented Jul 22, 2026

Uh oh!

coderabbitai Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

openshift-ci-robot commented Jul 22, 2026

Summary by CodeRabbit

Uh oh!

jmencak commented Jul 22, 2026

Uh oh!

qodo-for-rh-openshift Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jmencak commented Jul 23, 2026

Uh oh!

qodo-for-rh-openshift Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qodo-for-rh-openshift Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jmencak commented Jul 23, 2026

Uh oh!

openshift-ci Bot commented Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jmencak commented Jul 22, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 22, 2026 •

edited

Loading

qodo-for-rh-openshift Bot commented Jul 22, 2026 •

edited

Loading

qodo-for-rh-openshift Bot commented Jul 23, 2026 •

edited

Loading

qodo-for-rh-openshift Bot commented Jul 23, 2026 •

edited

Loading