Implement Mixed Mode State Detection by heypnus · Pull Request #1396 · vmware-tanzu/nsx-operator

heypnus · 2026-03-19T09:32:18Z

Replace the global boolean cf.CoeConfig.EnableVPCNetwork with
namespace-label-driven mixed-mode state: HasT1Namespaces and
HasVPCNamespaces.

New module: pkg/config/mixed_mode.go

Checks SupervisorCapabilities CRD (iaas.vmware.com/v1alpha1) for
supports_per_namespace_network_providers capability.
If supported: scans namespace labels
(iaas.vmware.com/network-provider) to derive HasT1Namespaces
(nsx-t1) and HasVPCNamespaces (nsx-vpc or vsphere-network).
If not supported (legacy/pre-9.2): falls back to EnableVPCNetwork
config flag.
Provides InitializeMixedModeState(), RefreshMixedModeState(),
HasT1Namespaces(), HasVPCNamespaces(),
GetNamespaceNetworkProvider() APIs.

This enables NSX Operator to run in mixed mode where both T1 and VPC
namespaces coexist, as required for VDS->VPC and T1->VPC migration.

NOTE: This patch only ensures that the existing pure T1 or pure VPC envs
preserve existing behaviours. The full functionality will be
implemented in the follow-up patches.

Testing done:

T1 pipeline passed, job number: 5597
VPC pipeline passed, job number: 16168

codecov-commenter · 2026-03-19T09:50:39Z

Codecov Report

❌ Patch coverage is 86.76471% with 18 lines in your changes missing coverage. Please review.
✅ Project coverage is 75.32%. Comparing base (6f7ddad) to head (c0064c0).

Files with missing lines	Patch %	Lines
cmd/main.go	0.00%	14 Missing ⚠️
pkg/nsx/util/license.go	66.66%	0 Missing and 3 partials ⚠️
pkg/nsx/client.go	0.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1396      +/-   ##
==========================================
- Coverage   76.77%   75.32%   -1.45%     
==========================================
  Files         151      152       +1     
  Lines       21315    21441     +126     
==========================================
- Hits        16364    16150     -214     
- Misses       3782     3796      +14     
- Partials     1169     1495     +326

Flag	Coverage Δ
unit-tests	`75.32% <86.76%> (-1.45%)`	⬇️

Files with missing lines	Coverage Δ
pkg/config/mixed_mode.go	`100.00% <100.00%> (ø)`
pkg/nsx/services/securitypolicy/parse.go	`60.78% <100.00%> (-33.34%)`	⬇️
pkg/nsx/client.go	`87.03% <0.00%> (-7.00%)`	⬇️
pkg/nsx/util/license.go	`81.81% <66.66%> (-18.19%)`	⬇️
cmd/main.go	`0.00% <0.00%> (ø)`

... and 5 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Replace the global boolean cf.CoeConfig.EnableVPCNetwork with namespace-label-driven mixed-mode state: HasT1Namespaces and HasVPCNamespaces. New module: pkg/config/mixed_mode.go - Checks SupervisorCapabilities CRD (iaas.vmware.com/v1alpha1) for supports_per_namespace_network_providers capability. - If supported: scans namespace labels (iaas.vmware.com/network-provider) to derive HasT1Namespaces (nsx-t1) and HasVPCNamespaces (nsx-vpc or vsphere-network). - If not supported (legacy/pre-9.2): falls back to EnableVPCNetwork config flag. - Provides InitializeMixedModeState(), RefreshMixedModeState(), HasT1Namespaces(), HasVPCNamespaces(), GetNamespaceNetworkProvider() APIs. This enables NSX Operator to run in mixed mode where both T1 and VPC namespaces coexist, as required for VDS->VPC and T1->VPC migration. NOTE: This patch only ensures that the existing pure T1 or pure VPC envs preserve existing behaviours. The full functionality will be implemented in the follow-up patches.

yanjunz97 · 2026-04-01T05:37:23Z

pkg/config/mixed_mode.go

+
+func init() {
+	zapLogger, _ := zap.NewProduction()
+	stateLog = zapLogger.Sugar()


why not use the existing log like logger.Log as other components?

yanjunz97 · 2026-04-01T05:40:04Z

pkg/config/mixed_mode.go

+		} else {
+			stateLog.Infof("Failed to get SupervisorCapabilities: %v; "+
+				"falling back to legacy config", err)
+		}


Shall we return error or retry for errors other than notfound, like temporally k8s network issue?

yanjunz97 · 2026-04-01T05:46:17Z

pkg/config/mixed_mode.go

+	obj, err := dynClient.Resource(supervisorCapabilitiesGVR).Get(
+		ctx, supervisorCapabilitiesName, metav1.GetOptions{})


Just to mention we may need to update rbac for ncp to get supervisorcapabilities right?

yanjunz97 · 2026-04-01T05:51:34Z

pkg/config/mixed_mode.go

+		case ProviderVSphereNetwork:
+			hasVPC = true


Just to double confirm vsphere-network is also considered as vpc mode?

yanjunz97 · 2026-04-01T05:56:26Z

pkg/config/mixed_mode.go

+	nsList, err := clientset.CoreV1().Namespaces().List(ctx, metav1.ListOptions{})
+	if err != nil {
+		stateLog.Errorf("Failed to list namespaces for mixed-mode state detection: %v", err)
+		return false, false


Shall we return an error here as list ns failure does not mean there is no vpc/t1 namespace?

yanjunz97 · 2026-04-01T06:00:21Z

pkg/config/mixed_mode.go

+
+// RefreshMixedMode re-scans namespace labels and updates state.
+// Returns true if the state changed (caller should consider restarting).
+func RefreshMixedMode(ctx context.Context, clientset kubernetes.Interface) bool {


This function is not called anywhere?

yanjunz97 · 2026-04-01T06:01:42Z

pkg/config/mixed_mode.go

+
+// SetMixedModeStateForTest sets hasT1Namespaces and hasVPCNamespaces for unit tests.
+// Must only be used from test code so production always goes through InitMixedMode.
+func SetMixedModeStateForTest(hasT1, hasVPC bool) {


As this is only for test can we move it to mixed_mode_test.go?

yanjunz97 · 2026-04-01T06:11:05Z

pkg/nsx/util/license.go


+// SetEnableVpcNetwork is deprecated; mixed-mode state is now managed by
+// config.InitMixedMode. Kept for backward compatibility.
 func SetEnableVpcNetwork(vpcNetwork bool) {


By backward compatibility, would you mean there is some consumers outside nsx operator using this function?

yanjunz97 · 2026-04-01T06:14:01Z

pkg/nsx/util/license_test.go

@@ -188,59 +188,55 @@ func TestUpdateFeatureLicense(t *testing.T) {
 }


I see SetEnableVpcNetwork is called TestUpdateFeatureLicense, does it matter?
https://github.com/heypnus/nsx-operator/blob/c0064c0955b24fbbabaf6b41f46fa7b00c916bd3/pkg/nsx/util/license_test.go#L134
https://github.com/heypnus/nsx-operator/blob/c0064c0955b24fbbabaf6b41f46fa7b00c916bd3/pkg/nsx/util/license_test.go#L152
https://github.com/heypnus/nsx-operator/blob/c0064c0955b24fbbabaf6b41f46fa7b00c916bd3/pkg/nsx/util/license_test.go#L171

yanjunz97 · 2026-04-01T06:16:03Z

pkg/nsx/services/securitypolicy/parse.go

+// IsVPCEnabled returns whether VPC namespaces exist. Callers must ensure mixed-mode
+// state has been initialized (InitMixedMode in main; SetMixedModeStateForTest in tests).
+// The "no CR" fallback to config is handled inside InitMixedMode, not here.
 func IsVPCEnabled(service *SecurityPolicyService) bool {


service is not used, maybe we can remove it form the parameter?

heypnus force-pushed the m1 branch 2 times, most recently from c29cf80 to 0fea7b3 Compare March 30, 2026 16:12

heypnus force-pushed the m1 branch from 0fea7b3 to c0064c0 Compare March 30, 2026 17:20

yanjunz97 reviewed Apr 1, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement Mixed Mode State Detection#1396

Implement Mixed Mode State Detection#1396
heypnus wants to merge 1 commit intovmware-tanzu:mainfrom
heypnus:m1

heypnus commented Mar 19, 2026 •

edited

Loading

Uh oh!

codecov-commenter commented Mar 19, 2026 •

edited

Loading

Uh oh!

yanjunz97 Apr 1, 2026

Uh oh!

yanjunz97 Apr 1, 2026

Uh oh!

yanjunz97 Apr 1, 2026

Uh oh!

yanjunz97 Apr 1, 2026

Uh oh!

yanjunz97 Apr 1, 2026

Uh oh!

yanjunz97 Apr 1, 2026

Uh oh!

yanjunz97 Apr 1, 2026

Uh oh!

yanjunz97 Apr 1, 2026

Uh oh!

yanjunz97 Apr 1, 2026

Uh oh!

yanjunz97 Apr 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		obj, err := dynClient.Resource(supervisorCapabilitiesGVR).Get(
		ctx, supervisorCapabilitiesName, metav1.GetOptions{})

		@@ -188,59 +188,55 @@ func TestUpdateFeatureLicense(t *testing.T) {
		}

Conversation

heypnus commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov-commenter commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

heypnus commented Mar 19, 2026 •

edited

Loading

codecov-commenter commented Mar 19, 2026 •

edited

Loading