OCPBUGS-99461: Add missing annotations to NetworkPolicy manifests by jmencak · Pull Request #1569 · openshift/cluster-node-tuning-operator

jmencak · 2026-07-22T19:14:07Z

NTO NetworkPolicy manifests that were added as part of #1323 were missing Cluster Profile (https://github.com/openshift/enhancements/blob/master/enhancements/update/cluster-profiles.md) annotations.

Add the missing Cluster Profile annotations, so that CVO does not ignore the NetworkPolicy manifests.

include.release.openshift.io/hypershift: "true"
include.release.openshift.io/ibm-cloud-managed: "true"
include.release.openshift.io/self-managed-high-availability: "true"
include.release.openshift.io/single-node-developer: "true"

Resolves: OCPBUGS-99461

Summary by CodeRabbit

Configuration
- Updated network policy metadata to identify the OpenShift NodeTuning capability.
- Enabled the affected policies for hypershift, ibm-cloud-managed, self-managed-high-availability, and single-node-developer release streams.
- Explicitly associated the default deny policy with the Node Tuning Operator namespace.
- Network traffic rules, ports, and security behavior remain unchanged.

openshift-ci · 2026-07-22T19:14:10Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

openshift-ci-robot · 2026-07-22T19:14:14Z

@jmencak: This pull request references Jira Issue OCPBUGS-99461, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.0.0) matches configured target version for branch (5.0.0)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

NTO NetworkPolicy manifests that were added as part of #1323 were missing Cluster Profile (https://github.com/openshift/enhancements/blob/master/enhancements/update/cluster-profiles.md) annotations.

Add the missing Cluster Profile annotations, so that CVO does not ignore the NetworkPolicy manifests.

include.release.openshift.io/self-managed-high-availability: "true"
include.release.openshift.io/single-node-developer: "true"

Resolves: OCPBUGS-99461

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-07-22T19:14:33Z

Walkthrough

Four NetworkPolicy resources gained OpenShift capability and release-stream annotations. The default-deny policy also declares the operator namespace. Selectors, traffic rules, ports, and policy types remain unchanged.

Changes

NetworkPolicy annotations

Layer / File(s)	Summary
Annotate NetworkPolicy resources `manifests/55-network-policy.yaml`	The default-deny, API-server egress, metrics, and webhook NetworkPolicies now include the `NodeTuning` capability and four OpenShift release-stream annotations. The default-deny policy also declares the `openshift-cluster-node-tuning-operator` namespace.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: yanirq, ffromani

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The commit changes only manifests/55-network-policy.yaml; all additions are YAML metadata, with no test-source changes or Ginkgo title calls.
Test Structure And Quality	✅ Passed	The pull request changes only manifests/55-network-policy.yaml; it adds NetworkPolicy annotations and no Ginkgo test code, so the test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	The commit changes only manifests/55-network-policy.yaml metadata; it adds no Ginkgo tests or changed test paths requiring MicroShift compatibility review.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only one YAML manifest and adds no Ginkgo e2e tests, so SNO test compatibility requirements do not apply.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR only adds metadata annotations to four NetworkPolicy objects; their specs contain no replicas, affinity, topology spread, node selectors, tolerations, or other scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The PR changes only manifest metadata in manifests/55-network-policy.yaml; it adds no process-level Go code or stdout writes in the OTE binary or test setup.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The pull request changes only manifests/55-network-policy.yaml; it adds no Ginkgo e2e tests or networking code requiring IPv4 or external connectivity.
No-Weak-Crypto	✅ Passed	The sole changed file adds only Kubernetes annotations and a namespace; added lines contain no weak-crypto terms, crypto APIs, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	The commit changes only NetworkPolicy annotations and one namespace. No added line or manifest document contains privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation fi...
No-Sensitive-Data-In-Logs	✅ Passed	The commit only adds NetworkPolicy annotations and a namespace; no logging configuration or sensitive values appear in the added lines.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the missing annotations added to the NetworkPolicy manifests and matches the main pull request change.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci-robot · 2026-07-22T19:14:52Z

@jmencak: This pull request references Jira Issue OCPBUGS-99461, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.0.0) matches configured target version for branch (5.0.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

NTO NetworkPolicy manifests that were added as part of #1323 were missing Cluster Profile (https://github.com/openshift/enhancements/blob/master/enhancements/update/cluster-profiles.md) annotations.

Add the missing Cluster Profile annotations, so that CVO does not ignore the NetworkPolicy manifests.

include.release.openshift.io/self-managed-high-availability: "true"
include.release.openshift.io/single-node-developer: "true"

Resolves: OCPBUGS-99461

Summary by CodeRabbit

Configuration

Updated network policy metadata to support OpenShift NodeTuning capabilities.

Enabled compatibility with self-managed high-availability and single-node developer release streams.

Network traffic rules and security behavior remain unchanged.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

qodo-for-rh-openshift · 2026-07-22T19:17:11Z

Unsupported PR languages

qodo-for-rh-openshift · 2026-07-23T09:34:52Z

Unsupported PR languages

qodo-for-rh-openshift · 2026-07-23T12:38:13Z

Unsupported PR languages

jmencak · 2026-07-23T17:20:10Z

/retest-required

qodo-for-rh-openshift · 2026-08-03T15:05:23Z

PR Summary by Qodo

Add Cluster Profile annotations to NTO NetworkPolicy manifests

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Add required Cluster Profile annotations so CVO includes NTO NetworkPolicy manifests.
• Scope default-deny policy to the NTO namespace to ensure it is applied.
• No network rules/ports changed; only metadata and targeting were updated.

Diagram

graph TD
  A["55-network-policy.yaml"] --> B["Cluster Profile annotations"] --> C(["CVO"] ) --> D(["Kubernetes API"]) --> E[("NTO namespace")]

  subgraph Legend
    direction LR
    _file["Manifest file"] ~~~ _meta["Metadata/annotations"] ~~~ _svc(["Controller/Service"]) ~~~ _ns[("Namespace")]
  end

High-Level Assessment

Adding the Cluster Profile annotations directly to each NetworkPolicy manifest is the most reliable fix, since CVO’s inclusion behavior depends on per-manifest metadata. Alternatives like templating/overlay tooling (e.g., kustomize) would reduce repetition but typically aren’t available/appropriate in static release payload manifests.

Files changed (1) +17 / -0

Bug fix (1) +17 / -0

55-network-policy.yamlAnnotate NTO NetworkPolicies for Cluster Profile inclusion +17/-0

Annotate NTO NetworkPolicies for Cluster Profile inclusion

• Adds the missing Cluster Profile and capability annotations to each Node Tuning Operator NetworkPolicy so CVO does not ignore them. Also explicitly sets the namespace for the default-deny-all policy to target openshift-cluster-node-tuning-operator.

manifests/55-network-policy.yaml

qodo-for-rh-openshift · 2026-08-03T15:07:34Z

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. ~~Incomplete profile annotations~~ ✓ Resolved 🐞 Bug ≡ Correctness

Description

The updated NetworkPolicy manifests are gated only for self-managed-high-availability and
single-node-developer, while other NodeTuning payload resources are also included for hypershift
and ibm-cloud-managed. If those profiles are intended to ship NTO with the same protections, these
NetworkPolicies will still be excluded there, leaving the NTO namespace without the intended
default-deny/allow rules in those profiles.

Code

manifests/55-network-policy.yaml[R13-16]

+  annotations:
+    capability.openshift.io/name: NodeTuning
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"

Relevance

●● Moderate
No historical review evidence on cluster-profile gating for NetworkPolicy; only prior NetworkPolicy
addition PR exists.
PR-#1323

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
55-network-policy.yaml currently includes only two profile annotations, while the Namespace/RBAC
resources are included for hypershift and ibm-cloud-managed too, and an IBM/Hypershift-specific
operator deployment exists. With no separate NetworkPolicy manifest for those profiles, the current
gating likely omits NetworkPolicies there.
manifests/55-network-policy.yaml[10-18]
manifests/10-namespace.yaml[3-10]
manifests/40-rbac.yaml[3-12]
manifests/50-operator-ibm-cloud-managed.yaml[4-10]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`manifests/55-network-policy.yaml` adds Cluster Profile include annotations, but only for `self-managed-high-availability` and `single-node-developer`. Other NTO manifests indicate the payload also targets `hypershift` and `ibm-cloud-managed`, so the NetworkPolicies may remain excluded in those profiles.

## Issue Context
Other NodeTuning resources (Namespace/RBAC) are annotated for `hypershift` and `ibm-cloud-managed`, and there is an IBM/Hypershift-specific operator deployment manifest. There is no alternate NetworkPolicy manifest for those profiles.

## Fix
Add the missing profile annotations to each NetworkPolicy `metadata.annotations` (or explicitly justify why NetworkPolicy should not be shipped for those profiles).

## Fix Focus Areas
- manifests/55-network-policy.yaml[12-18]
- manifests/55-network-policy.yaml[29-36]
- manifests/55-network-policy.yaml[51-58]
- manifests/55-network-policy.yaml[79-86]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

NTO NetworkPolicy manifests that were added as part of openshift#1323 were missing Cluster Profile (https://github.com/openshift/enhancements/blob/master/enhancements/update/cluster-profiles.md) annotations. Add the missing Cluster Profile annotations, so that CVO does not ignore the NetworkPolicy manifests. include.release.openshift.io/hypershift: "true" include.release.openshift.io/ibm-cloud-managed: "true" include.release.openshift.io/self-managed-high-availability: "true" include.release.openshift.io/single-node-developer: "true" Also add NTO namespace to the "default-deny-all" policy. Resolves: OCPBUGS-99461

jmencak · 2026-08-04T10:11:04Z

/cc @knobunc

yanirq · 2026-08-05T07:16:36Z

/lgtm

jmencak · 2026-08-05T08:05:07Z

/verified later @shyadav10

openshift-ci-robot · 2026-08-05T08:05:20Z

@jmencak: This PR has been marked to be verified later by @shyadav10.

Details

In response to this:

/verified later @shyadav10

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

MarSik

/lgtm

openshift-ci · 2026-08-05T08:49:29Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jmencak, MarSik

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [MarSik,jmencak]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

jmencak · 2026-08-05T12:34:40Z

/retest

jmencak · 2026-08-05T15:41:43Z

/retest

openshift-ci · 2026-08-05T17:33:10Z

@jmencak: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot · 2026-08-05T17:36:44Z

@jmencak: Jira Issue OCPBUGS-99461: All pull requests linked via external trackers have merged:

openshift/cluster-node-tuning-operator#1569

This pull request has the verified-later tag and will need to be manually moved to VERIFIED after testing. Jira Issue OCPBUGS-99461 has been moved to the MODIFIED state.

Details

In response to this:

NTO NetworkPolicy manifests that were added as part of #1323 were missing Cluster Profile (https://github.com/openshift/enhancements/blob/master/enhancements/update/cluster-profiles.md) annotations.

Add the missing Cluster Profile annotations, so that CVO does not ignore the NetworkPolicy manifests.

include.release.openshift.io/hypershift: "true"
include.release.openshift.io/ibm-cloud-managed: "true"
include.release.openshift.io/self-managed-high-availability: "true"
include.release.openshift.io/single-node-developer: "true"

Resolves: OCPBUGS-99461

Summary by CodeRabbit

Configuration

Updated network policy metadata to identify the OpenShift NodeTuning capability.

Enabled the affected policies for hypershift, ibm-cloud-managed, self-managed-high-availability, and single-node-developer release streams.

Explicitly associated the default deny policy with the Node Tuning Operator namespace.

Network traffic rules, ports, and security behavior remain unchanged.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 22, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 22, 2026

jmencak force-pushed the 5.0-OCPBUGS-99461-network-policy branch from 86f0013 to b6818a6 Compare July 23, 2026 09:34

jmencak marked this pull request as ready for review August 3, 2026 15:03

openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 3, 2026

openshift-ci Bot requested review from ffromani and yanirq August 3, 2026 15:05

qodo-for-rh-openshift Bot reviewed Aug 3, 2026

View reviewed changes

Comment thread manifests/55-network-policy.yaml

jmencak force-pushed the 5.0-OCPBUGS-99461-network-policy branch from b6818a6 to 00d52ea Compare August 4, 2026 06:05

openshift-ci Bot requested a review from knobunc August 4, 2026 10:11

openshift-ci Bot assigned yanirq Aug 5, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 5, 2026

openshift-ci-robot added the verified-later label Aug 5, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Aug 5, 2026

MarSik approved these changes Aug 5, 2026

View reviewed changes

openshift-ci Bot assigned MarSik Aug 5, 2026

openshift-merge-bot Bot merged commit 837ae9f into openshift:main Aug 5, 2026
20 checks passed

jmencak deleted the 5.0-OCPBUGS-99461-network-policy branch August 5, 2026 18:31

Uh oh!

Conversation

jmencak commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

openshift-ci Bot commented Jul 22, 2026

Uh oh!

openshift-ci-robot commented Jul 22, 2026

Uh oh!

coderabbitai Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

openshift-ci-robot commented Jul 22, 2026

Summary by CodeRabbit

Uh oh!

qodo-for-rh-openshift Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qodo-for-rh-openshift Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qodo-for-rh-openshift Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jmencak commented Jul 23, 2026

Uh oh!

qodo-for-rh-openshift Bot commented Aug 3, 2026

PR Summary by Qodo

Uh oh!

qodo-for-rh-openshift Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Uh oh!

Uh oh!

jmencak commented Aug 4, 2026

Uh oh!

yanirq commented Aug 5, 2026

Uh oh!

jmencak commented Aug 5, 2026

Uh oh!

openshift-ci-robot commented Aug 5, 2026

Uh oh!

MarSik left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Aug 5, 2026

Uh oh!

jmencak commented Aug 5, 2026

Uh oh!

jmencak commented Aug 5, 2026

Uh oh!

openshift-ci Bot commented Aug 5, 2026

Uh oh!

Uh oh!

openshift-ci-robot commented Aug 5, 2026

Summary by CodeRabbit

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jmencak commented Jul 22, 2026 •

edited

Loading

coderabbitai Bot commented Jul 22, 2026 •

edited

Loading

qodo-for-rh-openshift Bot commented Jul 22, 2026 •

edited

Loading

qodo-for-rh-openshift Bot commented Jul 23, 2026 •

edited

Loading

qodo-for-rh-openshift Bot commented Jul 23, 2026 •

edited

Loading

qodo-for-rh-openshift Bot commented Aug 3, 2026 •

edited

Loading