Skip to content

[release-4.16] OCPBUGS-60847: Add NetworkPolicy as a supported kind#1050

Merged
openshift-merge-bot[bot] merged 4 commits into
openshift:release-4.16from
anik120:np-backport-4.16
Sep 9, 2025
Merged

[release-4.16] OCPBUGS-60847: Add NetworkPolicy as a supported kind#1050
openshift-merge-bot[bot] merged 4 commits into
openshift:release-4.16from
anik120:np-backport-4.16

Conversation

@anik120

@anik120 anik120 commented Aug 20, 2025

Copy link
Copy Markdown
Contributor

Manual cherry-pick of #1047

rashmigottipati and others added 3 commits August 20, 2025 13:21
Signed-off-by: Anik Bhattacharjee <anbhatta@gmail.com>
Upstream-repository: operator-registry
Upstream-commit: 919aefdce3f4d6b77c3872df249815d20749db94
Signed-off-by: Rashmi Gottipati <chowdary.grashmi@gmail.com>
Upstream-repository: operator-lifecycle-manager
Upstream-commit: d7aaeb11ab80f862fc9c70dfb7865158bb67e28c
@openshift-ci

openshift-ci Bot commented Aug 20, 2025

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: anik120

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 20, 2025
@perdasilva

Copy link
Copy Markdown
Contributor

/retest

1 similar comment
@perdasilva

Copy link
Copy Markdown
Contributor

/retest

@anik120

anik120 commented Aug 21, 2025

Copy link
Copy Markdown
Contributor Author

/retest-required

1 similar comment
@anik120

anik120 commented Aug 21, 2025

Copy link
Copy Markdown
Contributor Author

/retest-required

@perdasilva

Copy link
Copy Markdown
Contributor

/retest

1 similar comment
@perdasilva

Copy link
Copy Markdown
Contributor

/retest

@openshift-ci openshift-ci Bot changed the title [release-4.16] Add NetworkPolicy as a supported kind https://github.com/openshift/operator-framework-olm/pull/1059 Aug 25, 2025
@anik120

anik120 commented Aug 25, 2025

Copy link
Copy Markdown
Contributor Author

/retitle [release-4.16] OCPBUGS-60847: Add NetworkPolicy as a supported kind

@openshift-ci openshift-ci Bot changed the title https://github.com/openshift/operator-framework-olm/pull/1059 [release-4.16] OCPBUGS-60847: Add NetworkPolicy as a supported kind Aug 25, 2025
@openshift-ci-robot openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Aug 25, 2025
@openshift-ci-robot

Copy link
Copy Markdown

@anik120: This pull request references Jira Issue OCPBUGS-60847, which is invalid:

  • expected dependent Jira Issue OCPBUGS-60791 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is ON_QA instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Manual cherry-pick of #1047

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@oceanc80

Copy link
Copy Markdown
Contributor

/label backport-risk-assessed

@openshift-ci openshift-ci Bot added the backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. label Aug 25, 2025
@grokspawn

Copy link
Copy Markdown
Contributor

ci/prow/e2e-gcp-olm last passed on 3 July.
So it does pass, but the frequency is terrible.

@anik120

anik120 commented Aug 28, 2025

Copy link
Copy Markdown
Contributor Author

/test e2e-gcp-olm

1 similar comment
@anik120

anik120 commented Aug 29, 2025

Copy link
Copy Markdown
Contributor Author

/test e2e-gcp-olm

@perdasilva

Copy link
Copy Markdown
Contributor

/retest

1 similar comment
@perdasilva

Copy link
Copy Markdown
Contributor

/retest

@anik120

anik120 commented Aug 29, 2025

Copy link
Copy Markdown
Contributor Author

/test e2e-gcp-olm

@openshift-ci-robot

Copy link
Copy Markdown

/retest-required

Remaining retests: 0 against base HEAD 922674d and 2 for PR HEAD 5fa2213 in total

@anik120

anik120 commented Aug 29, 2025

Copy link
Copy Markdown
Contributor Author

Looked into the test failures, and there's just one common test failure across multiple runs:

[It] Subscription when bundle unpack retries are enabled should retry failing unpack jobs

eg this test, and this test, both ran one after the other.

Ran the test manually with an openshift cluster with the PR on top of it: launch 4.16,openshift/operator-framework-olm#1050 aws, and the test passed:

make e2e/olm TEST="should retry failing unpack jobs"
WHAT=operator-lifecycle-manager \
	E2E_CATALOG_NS=openshift-marketplace \
	E2E_INSTALL_NS=openshift-operator-lifecycle-manager \
	E2E_TEST_NS=openshift-operators \
	E2E_TIMEOUT=135m \
	KUBECTL=oc \
	E2E_GINKGO_OPTS=" --junit-report junit_e2e.xml" \
	E2E_OPTS="-communityOperators=quay.io/olmtest/test-catalog:v1.39.0" \
	/Library/Developer/CommandLineTools/usr/bin/make e2e
scripts/e2e.sh
~/go/src/github.com/openshift/operator-framework-olm/staging/operator-lifecycle-manager ~/go/src/github.com/openshift/operator-framework-olm
Populating nested vendor directory
all modules verified
Running operator-lifecycle-manager e2e tests
CGO_ENABLED=1 GO111MODULE=on GOFLAGS="-mod=vendor -buildvcs=false" go run github.com/onsi/ginkgo/v2/ginkgo -timeout 135m -v -randomize-suites -race -trace   -focus 'should retry failing unpack jobs'   --junit-report junit_e2e.xml ./test/e2e -- -namespace=openshift-operators -olmNamespace=openshift-operator-lifecycle-manager -catalogNamespace=openshift-marketplace -communityOperators=quay.io/olmtest/test-catalog:v1.39.0
# github.com/operator-framework/operator-lifecycle-manager/test/e2e.test
ld: warning: '/private/var/folders/9p/q0l_ddk11jqd05vb098xk9f40000gn/T/go-link-3451194255/000013.o' has malformed LC_DYSYMTAB, expected 98 undefined symbols to start at index 884, found 95 undefined symbols starting at index 884

Running Suite: End-to-end - /Users/anbhatta/go/src/github.com/openshift/operator-framework-olm/staging/operator-lifecycle-manager/test/e2e
==========================================================================================================================================
Random Seed: 1756507836

Will run 1 of 206 specs
------------------------------
[BeforeSuite] 
/Users/anbhatta/go/src/github.com/openshift/operator-framework-olm/staging/operator-lifecycle-manager/test/e2e/e2e_test.go:84
[BeforeSuite] PASSED [0.827 seconds]
------------------------------
SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
------------------------------
Subscription when bundle unpack retries are enabled should retry failing unpack jobs
/Users/anbhatta/go/src/github.com/openshift/operator-framework-olm/staging/operator-lifecycle-manager/test/e2e/subscription_e2e_test.go:2688
  created the subscription-e2e-nj75x testing namespace
  created the subscription-e2e-nj75x/subscription-e2e-nj75x-operatorgroup operator group
  STEP: Ensuring a registry to host bundle images @ 08/29/25 18:51:18.155
  STEP: The remote image to be copied onto the local registry @ 08/29/25 18:51:18.357
  STEP: on-cluster image ref @ 08/29/25 18:51:18.357
  STEP: creating a catalog referencing a non-existent bundle image @ 08/29/25 18:51:18.358
  STEP: patching the OperatorGroup to reduce the bundle unpacking timeout @ 08/29/25 18:51:34.783
  STEP: creating a subscription for the missing bundle @ 08/29/25 18:51:34.854
  STEP: waiting for bundle unpack to fail @ 08/29/25 18:51:34.907
  STEP: pushing missing bundle image @ 08/29/25 18:51:57.3
  STEP: wait for skopeo pod to exit successfully @ 08/29/25 18:51:57.353
  skopeo pod status: Pending (waiting for: Succeeded)
  skopeo pod status: Pending (waiting for: Succeeded)
  skopeo pod status: Pending (waiting for: Succeeded)
  .  
  .
  .
  skopeo pod status: Running (waiting for: Succeeded)
  skopeo pod status: Succeeded (waiting for: Succeeded)
  STEP: patching the OperatorGroup to increase the bundle unpacking timeout @ 08/29/25 18:52:11.349
  STEP: patching operator group to enable unpack retries @ 08/29/25 18:52:11.419
  STEP: waiting until the subscription has an IP reference @ 08/29/25 18:52:11.487
  18:52:26.6365: subscription subscription-e2e-nj75x/subscription-e2e-nj75x-unpack-retry-package-sub state: UpgradePending (csv example-operator.v0.1.0): installPlanRef: &v1.ObjectReference{Kind:"InstallPlan", Namespace:"subscription-e2e-nj75x", Name:"install-x7k55", UID:"c299797f-3502-484e-8c77-b14b0d9aa6ca", APIVersion:"operators.coreos.com/v1alpha1", ResourceVersion:"30266", FieldPath:""}
  18:52:26.6404: subscription subscription-e2e-nj75x/subscription-e2e-nj75x-unpack-retry-package-sub state: UpgradePending (csv example-operator.v0.1.0): status: v1alpha1.SubscriptionStatus{CurrentCSV:"example-operator.v0.1.0", InstalledCSV:"", Install:(*v1alpha1.InstallPlanReference)(0xc00081bf00), State:"UpgradePending", Reason:"", InstallPlanGeneration:1, InstallPlanRef:(*v1.ObjectReference)(0xc000469dc0), CatalogHealth:[]v1alpha1.SubscriptionCatalogHealth{v1alpha1.SubscriptionCatalogHealth{CatalogSourceRef:(*v1.ObjectReference)(0xc000469a40), LastUpdated:time.Date(2025, time.August, 29, 18, 51, 58, 0, time.Local), Healthy:true}, v1alpha1.SubscriptionCatalogHealth{CatalogSourceRef:(*v1.ObjectReference)(0xc000469ab0), LastUpdated:time.Date(2025, time.August, 29, 18, 51, 58, 0, time.Local), Healthy:true}, v1alpha1.SubscriptionCatalogHealth{CatalogSourceRef:(*v1.ObjectReference)(0xc000469b20), LastUpdated:time.Date(2025, time.August, 29, 18, 51, 58, 0, time.Local), Healthy:true}, v1alpha1.SubscriptionCatalogHealth{CatalogSourceRef:(*v1.ObjectReference)(0xc000469c70), LastUpdated:time.Date(2025, time.August, 29, 18, 51, 58, 0, time.Local), Healthy:true}, v1alpha1.SubscriptionCatalogHealth{CatalogSourceRef:(*v1.ObjectReference)(0xc000469d50), LastUpdated:time.Date(2025, time.August, 29, 18, 51, 58, 0, time.Local), Healthy:true}}, Conditions:[]v1alpha1.SubscriptionCondition{v1alpha1.SubscriptionCondition{Type:"CatalogSourcesUnhealthy", Status:"False", Reason:"AllCatalogSourcesHealthy", Message:"all available catalogsources are healthy", LastHeartbeatTime:<nil>, LastTransitionTime:time.Date(2025, time.August, 29, 18, 52, 0, 0, time.Local)}, v1alpha1.SubscriptionCondition{Type:"BundleUnpacking", Status:"True", Reason:"UnpackingInProgress", Message:"", LastHeartbeatTime:<nil>, LastTransitionTime:<nil>}, v1alpha1.SubscriptionCondition{Type:"BundleUnpackFailed", Status:"True", Reason:"BundleUnpackFailed", Message:"bundle unpacking failed. Reason: DeadlineExceeded, and Message: Job was active longer than specified deadline", LastHeartbeatTime:<nil>, LastTransitionTime:<nil>}, v1alpha1.SubscriptionCondition{Type:"InstallPlanPending", Status:"True", Reason:"Installing", Message:"", LastHeartbeatTime:<nil>, LastTransitionTime:time.Date(2025, time.August, 29, 18, 52, 26, 0, time.Local)}}, LastUpdated:time.Date(2025, time.August, 29, 18, 52, 26, 0, time.Local)}
  waiting 15.15281775s for subscription subscription-e2e-nj75x/subscription-e2e-nj75x-unpack-retry-package-sub to have installplan ref: has ref &v1.ObjectReference{Kind:"InstallPlan", Namespace:"subscription-e2e-nj75x", Name:"install-x7k55", UID:"c299797f-3502-484e-8c77-b14b0d9aa6ca", APIVersion:"operators.coreos.com/v1alpha1", ResourceVersion:"30266", FieldPath:""}
  STEP: waiting for the v0.1.0 CSV to report a succeeded phase @ 08/29/25 18:52:26.64
  waiting for CSV subscription-e2e-nj75x/example-operator.v0.1.0 to reach condition
  waited 199.324041ms for csv subscription-e2e-nj75x/example-operator.v0.1.0 - Pending (RequirementsNotMet): one or more requirements couldn't be found
  waited 200.042208ms for CSV subscription-e2e-nj75x/example-operator.v0.1.0: to be in phases [Succeeded], in phase Pending (RequirementsNotMet): one or more requirements couldn't be found
  waited 1.984736417s for csv subscription-e2e-nj75x/example-operator.v0.1.0 - InstallReady (AllRequirementsMet): all requirements found, attempting install
  waited 1.984197625s for CSV subscription-e2e-nj75x/example-operator.v0.1.0: to be in phases [Succeeded], in phase InstallReady (AllRequirementsMet): all requirements found, attempting install
  waited 207.684583ms for csv subscription-e2e-nj75x/example-operator.v0.1.0 - Installing (InstallSucceeded): waiting for install components to report healthy
  waited 207.780208ms for CSV subscription-e2e-nj75x/example-operator.v0.1.0: to be in phases [Succeeded], in phase Installing (InstallSucceeded): waiting for install components to report healthy
  waited 194.908917ms for csv subscription-e2e-nj75x/example-operator.v0.1.0 - Installing (InstallWaiting): installing: waiting for deployment example-operator-controller-manager to become ready: deployment "example-operator-controller-manager" not available: Deployment does not have minimum availability.
  waited 194.956417ms for CSV subscription-e2e-nj75x/example-operator.v0.1.0: to be in phases [Succeeded], in phase Installing (InstallWaiting): installing: waiting for deployment example-operator-controller-manager to become ready: deployment "example-operator-controller-manager" not available: Deployment does not have minimum availability.
  waited 10.408769833s for csv subscription-e2e-nj75x/example-operator.v0.1.0 - Succeeded (InstallSucceeded): install strategy completed with no errors
  waited 10.408886458s for CSV subscription-e2e-nj75x/example-operator.v0.1.0: to be in phases [Succeeded], in phase Succeeded (InstallSucceeded): install strategy completed with no errors
  STEP: checking if old unpack conditions on subscription are removed @ 08/29/25 18:52:39.637
  tearing down the subscription-e2e-nj75x namespace
  resetting e2e kube client
  deleting subscription-e2e-nj75x/subscription-e2e-nj75x-catsrc
  deleting subscription-e2e-nj75x/subscription-e2e-nj75x-catsrc-svc
  deleting subscription-e2e-nj75x/subscription-e2e-nj75x-catsrc-pod
  deleting subscription-e2e-nj75x/subscription-e2e-nj75x-catsrc-configmap
  deleting subscription-e2e-nj75x/subscription-e2e-nj75x-operatorgroup
  deleting <global>/subscription-e2e-nj75x
  garbage collecting CRDs
  deleting crd apps.example.com
• [83.800 seconds]
------------------------------
SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
------------------------------
[AfterSuite] 
/Users/anbhatta/go/src/github.com/openshift/operator-framework-olm/staging/operator-lifecycle-manager/test/e2e/e2e_test.go:130
[AfterSuite] PASSED [0.000 seconds]
------------------------------
[ReportAfterSuite] Autogenerated ReportAfterSuite for --junit-report
autogenerated by Ginkgo
[ReportAfterSuite] PASSED [0.048 seconds]
------------------------------

Ran 1 of 206 Specs in 84.656 seconds
SUCCESS! -- 1 Passed | 0 Failed | 0 Pending | 205 Skipped
PASS | FOCUSED

Ginkgo ran 1 suite in 2m5.833414s
Test Suite Passed
Detected Programmatic Focus - setting exit status to 197
exit status 197
make[2]: *** [e2e] Error 1
make[1]: *** [e2e] Error 2
make: *** [e2e/olm] Error 2

Also verified that the cluster I created had the default-deny-all network policy

$ oc get networkpolicy -n openshift-operators 
NAME                POD-SELECTOR   AGE
default-allow-all   <none>         44m

Unfortunately, the must-gather from CI does not have the test namespace that the test is run in (because of cleanup jobs), so I could not find much evidence to reason for why the test failed in the CI cluster.

Gives us enough confidence for now though to keep letting CI run, especially cause a permissive, all-allow network policy in the openshift-operators namespace (which is what this PR does), is unlikely to cause any issues in a custom test namespace (subscription-e2e-tcf8w in the CI must-gather that I inspected).

Note that 4.16 has no other NetworkPolicies:

$  oc get networkpolicy --all-namespaces 
NAMESPACE             NAME                POD-SELECTOR   AGE
openshift-operators   default-allow-all   <none>         45m

@openshift-ci-robot

Copy link
Copy Markdown

/retest-required

Remaining retests: 0 against base HEAD 922674d and 2 for PR HEAD 5fa2213 in total

@Xia-Zhao-rh

Copy link
Copy Markdown
Contributor

/retest

@openshift-ci-robot

Copy link
Copy Markdown

/retest-required

Remaining retests: 0 against base HEAD 922674d and 2 for PR HEAD 5fa2213 in total

1 similar comment
@openshift-ci-robot

Copy link
Copy Markdown

/retest-required

Remaining retests: 0 against base HEAD 922674d and 2 for PR HEAD 5fa2213 in total

@anik120

anik120 commented Sep 3, 2025

Copy link
Copy Markdown
Contributor Author

/hold

burning CI cycles is not going to help.

Based on the report I wrote above, OCPBUGS-57092 needs to be updated to target 4.16 too, and override the test here for 4.16 instead

cc: @grokspawn @oceanc80 @joelanford

@openshift-ci openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 3, 2025
@anik120

anik120 commented Sep 3, 2025

Copy link
Copy Markdown
Contributor Author

Same test was the problem in 4.15 too #1012 (comment)

@anik120

anik120 commented Sep 4, 2025

Copy link
Copy Markdown
Contributor Author

Looking into test failure here: #1062

@perdasilva

Copy link
Copy Markdown
Contributor

/retest

@perdasilva

Copy link
Copy Markdown
Contributor

/unhold

@openshift-ci openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 9, 2025
@jianzhangbjz

Copy link
Copy Markdown
Contributor

/verified by @Xia-Zhao-rh

@openshift-ci-robot openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Sep 9, 2025
@openshift-ci-robot

Copy link
Copy Markdown

@jianzhangbjz: This PR has been marked as verified by @Xia-Zhao-rh.

Details

In response to this:

/verified by @Xia-Zhao-rh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@perdasilva

Copy link
Copy Markdown
Contributor

/test e2e-gcp-olm

@openshift-ci-robot

Copy link
Copy Markdown

/retest-required

Remaining retests: 0 against base HEAD 558faeb and 2 for PR HEAD 5fa2213 in total

@openshift-ci

openshift-ci Bot commented Sep 9, 2025

Copy link
Copy Markdown
Contributor

@anik120: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-merge-bot openshift-merge-bot Bot merged commit 91a201c into openshift:release-4.16 Sep 9, 2025
14 checks passed
@openshift-ci-robot

Copy link
Copy Markdown

@anik120: Jira Issue Verification Checks: Jira Issue OCPBUGS-60847
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-60847 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

Manual cherry-pick of #1047

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-bot

Copy link
Copy Markdown
Contributor

[ART PR BUILD NOTIFIER]

Distgit: operator-lifecycle-manager
This PR has been included in build operator-lifecycle-manager-container-v4.16.0-202509092105.p0.g91a201c.assembly.stream.el9.
All builds following this will include this PR.

@openshift-bot

Copy link
Copy Markdown
Contributor

[ART PR BUILD NOTIFIER]

Distgit: operator-registry
This PR has been included in build operator-registry-container-v4.16.0-202509092105.p0.g91a201c.assembly.stream.el9.
All builds following this will include this PR.

@openshift-bot

Copy link
Copy Markdown
Contributor

[ART PR BUILD NOTIFIER]

Distgit: ose-operator-framework-tools
This PR has been included in build ose-operator-framework-tools-container-v4.16.0-202509092105.p0.g91a201c.assembly.stream.el9.
All builds following this will include this PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. qe-approved Signifies that QE has signed off on this PR verified Signifies that the PR passed pre-merge verification criteria

Projects

None yet

Development

Successfully merging this pull request may close these issues.