Skip to content

OCPBUGS-61175: Create NetworkPolicy for Manila CSI driver #424

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

OCPBUGS-61175: Create NetworkPolicy for Manila CSI driver #424

wants to merge 1 commit into from

Conversation

mpatlasov
Copy link
Contributor

Manila csi driver controller pods reside in a custome namespace (openshift-manila-csi-driver). Hence, Manila csi driver operator must create NetworkPolicy for them expicitly.

@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 4, 2025
@openshift-ci-robot openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Sep 4, 2025
@openshift-ci-robot
Copy link

@mpatlasov: This pull request references Jira Issue OCPBUGS-61175, which is invalid:

  • expected the bug to target the "4.21.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Manila csi driver controller pods reside in a custome namespace (openshift-manila-csi-driver). Hence, Manila csi driver operator must create NetworkPolicy for them expicitly.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Sep 4, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mpatlasov

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 4, 2025
@mpatlasov
Copy link
Contributor Author

/jira refresh

@openshift-ci-robot openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Sep 4, 2025
@openshift-ci-robot
Copy link

@mpatlasov: This pull request references Jira Issue OCPBUGS-61175, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.21.0) matches configured target version for branch (4.21.0)
  • bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira ([email protected]), skipping review request.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

mpatlasov added a commit to mpatlasov/cluster-storage-operator that referenced this pull request Sep 4, 2025
@mpatlasov
Add RBAC rule to let manila-csi-driver-operator manage NetworkPolicy
6771b75 
The operator needs permissions to publish and monitor NPs in the custom namespace `openshift-manila-csi-driver`. See openshift/csi-operator#424 for details.
@mpatlasov mpatlasov mentioned this pull request Sep 4, 2025
Merged
@mpatlasov
Copy link
Contributor Author

/testwith openshift/csi-operator/main/e2e-openstack-manila-csi openshift/cluster-storage-operator#615

2 similar comments
@mpatlasov
Copy link
Contributor Author

/testwith openshift/csi-operator/main/e2e-openstack-manila-csi openshift/cluster-storage-operator#615

@mpatlasov
Copy link
Contributor Author

/testwith openshift/csi-operator/main/e2e-openstack-manila-csi openshift/cluster-storage-operator#615

@mpatlasov
Copy link
Contributor Author

/testwith openshift/csi-operator/main/e2e-openstack-manila-csi openshift/cluster-storage-operator#615

mpatlasov added a commit to mpatlasov/cluster-storage-operator that referenced this pull request Sep 10, 2025
@mpatlasov
Add RBAC rule to let manila-csi-driver-operator manage NetworkPolicy
e5c46a2 
The operator needs permissions to publish and monitor NPs in the custom namespace `openshift-manila-csi-driver`. See openshift/csi-operator#424 for details.
@mpatlasov
Copy link
Contributor Author

/testwith openshift/csi-operator/main/e2e-openstack-manila-csi openshift/cluster-storage-operator#615

@mpatlasov
OCPBUGS-61175: Create NetworkPolicy for Manila CSI driver
10f7c82 
Manila csi driver controller pods reside in a custome namespace (`openshift-manila-csi-driver`). Hence, Manila csi driver operator must create NetworkPolicy for them expicitly.
@mpatlasov mpatlasov force-pushed the OCPBUGS-61175-Create-NPs-for-Manila-CSI-driver branch from c558a95 to 10f7c82 Compare September 19, 2025 22:29
@mpatlasov mpatlasov changed the title WIP: OCPBUGS-61175: Create NetworkPolicy for Manila CSI driver OCPBUGS-61175: Create NetworkPolicy for Manila CSI driver Sep 19, 2025
@openshift-ci openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 19, 2025
@mpatlasov
Copy link
Contributor Author

/retest-required

@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Sep 23, 2025

@mpatlasov: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-openstack 10f7c82 link false /test e2e-openstack
ci/prow/hypershift-e2e-openstack-aws-csi-manila 10f7c82 link true /test hypershift-e2e-openstack-aws-csi-manila

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@mpatlasov
Copy link
Contributor Author

ci/prow/hypershift-e2e-openstack-aws-csi-manila fails becasue CI still uses outdated image for CSO:

I0922 23:27:51.347958       1 builder.go:304] cluster-storage-operator version 4.20.0-202509030239.p2.gcdc7ef8.assembly.stream.el9-cdc7ef8-cdc7ef8a7ec6af399c10606037cfb9f631dddc23

and cdc7ef8a7ec6af399c10606037cfb9f631dddc23 corresponds to this commit from Aug 29.

@mpatlasov
Copy link
Contributor Author

/hold

My previous comment about outdated CSO image was red-herring. The latest fail of ci/prow/hypershift-e2e-openstack-aws-csi-manila has explicit perm error in manila csi operator logs:

E0922 23:43:43.289748       1 reflector.go:200] "Failed to watch" err="failed to list *v1.NetworkPolicy: networkpolicies.networking.k8s.io is forbidden: User \"system:serviceaccount:clusters-e349d9e8720c18608195:manila-csi-driver-operator\" cannot list resource \"networkpolicies\" in API group \"networking.k8s.io\" in the namespace \"clusters-e349d9e8720c18608195\"" reflector="k8s.io/[email protected]/tools/cache/reflector.go:285" type="*v1.NetworkPolicy"

(https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/pr-logs/pull/openshift_csi-operator/424/pull-ci-openshift-csi-operator-main-hypershift-e2e-openstack-aws-csi-manila/1970256822195458048/artifacts/hypershift-e2e-openstack-aws-csi-manila/dump/artifacts/namespaces/clusters-e349d9e8720c18608195/core/pods/logs/manila-csi-driver-operator-7c47679fbb-6dq7t-manila-csi-driver-operator.log )

This means that openshift/cluster-storage-operator#615 helped to standalone case, but not to hypershift one. Need to investigate why.

@openshift-ci openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 24, 2025
@mpatlasov
Copy link
Contributor Author

/testwith openshift/csi-operator/main/hypershift-e2e-openstack-aws-csi-manila openshift/cluster-storage-operator#626

@mpatlasov mpatlasov mentioned this pull request Oct 3, 2025
Open
@mpatlasov
Copy link
Contributor Author

/testwith openshift/csi-operator/main/hypershift-e2e-openstack-aws-csi-manila openshift/cluster-storage-operator#626

@mpatlasov
Copy link
Contributor Author

/testwith openshift/csi-operator/main/hypershift-e2e-openstack-aws-csi-manila openshift/hypershift#6930

@mpatlasov
Copy link
Contributor Author

/testwith openshift/csi-operator/main/hypershift-e2e-openstack-aws-csi-manila openshift/hypershift#6930,openshift/cluster-storage-operator#626

@mpatlasov
Copy link
Contributor Author

/testwith openshift/csi-operator/main/hypershift-e2e-openstack-aws-csi-manila openshift/hypershift#6930 openshift/cluster-storage-operator#626

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@RomanBednar RomanBednar Awaiting requested review from RomanBednar

@stephenfin stephenfin Awaiting requested review from stephenfin

Assignees
No one assigned
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@mpatlasov @openshift-ci-robot