OCPBUGS-77762: Add an e2e to check the default network polocy by hongkailiu · Pull Request #1334 · openshift/cluster-version-operator

hongkailiu · 2026-03-04T14:14:18Z

/hold

Wait for #1333

Summary by CodeRabbit

Tests
- Added test validation to ensure the Cluster Version Operator has appropriate network policy configurations, with platform-specific exemptions for certain cluster types.

openshift-ci-robot · 2026-03-04T14:14:30Z

@hongkailiu: This pull request references Jira Issue OCPBUGS-77762, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.22.0) matches configured target version for branch (4.22.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @dis016

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

/hold

Wait for #1333

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-03-04T14:14:41Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: fd1af458-61f5-48ae-8fde-162742a45c4c

📥 Commits

Reviewing files that changed from the base of the PR and between 54dc4ef and 5dcd2bc.

📒 Files selected for processing (2)

.openshift-tests-extension/openshift_payload_cluster-version-operator.json
test/cvo/cvo.go

Walkthrough

A new test case is added to verify that the Cluster Version Operator has a default-deny NetworkPolicy. The change includes both a test case entry in the manifest file and the corresponding test implementation in the Go test file.

Changes

Cohort / File(s)	Summary
Cluster Version Operator Network Policy Test `.openshift-tests-extension/openshift_payload_cluster-version-operator.json`, `test/cvo/cvo.go`	Added new test case "should have a network policy" that verifies the existence of a default-deny NetworkPolicy in the CVO namespace. Includes test definition registration and implementation with skip conditions for HyperShift/MicroShift platforms.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Test Structure And Quality	⚠️ Warning	The test uses context.Background() without timeout and makes direct API calls, violating established timeout patterns. Assertion logic is inverted, silently passing without explicit NetworkPolicy verification.	Refactor to use wait.PollUntilContextTimeout with appropriate timeouts matching codebase patterns, or use context.WithTimeout. Fix assertion logic to explicitly verify NetworkPolicy exists.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly references the Jira key (OCPBUGS-77762) and accurately describes the main change: adding an end-to-end test to verify the default network policy exists in the CVO namespace.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Stable And Deterministic Test Names	✅ Passed	The test name 'should have a network policy' is fully static, deterministic, and contains no dynamic information such as generated suffixes, timestamps, UUIDs, or random values.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

wking

Hooray, detection works in `e2e-agnostic-ovn:

: [Jira:"Cluster Version Operator"] cluster-version-operator should have a network policy expand_less	0s
{  fail [github.com/openshift/cluster-version-operator/test/cvo/cvo.go:70]: Failed to get the default network policy
Unexpected error:
    <*errors.StatusError | 0xc000616140>: 
    networkpolicies.networking.k8s.io "default-deny" not found
    {
        ErrStatus: {
            TypeMeta: {Kind: "", APIVersion: ""},
            ListMeta: {
                SelfLink: "",
                ResourceVersion: "",
                Continue: "",
                RemainingItemCount: nil,
            },
            Status: "Failure",
            Message: "networkpolicies.networking.k8s.io \"default-deny\" not found",
            Reason: "NotFound",
            Details: {
                Name: "default-deny",
                Group: "networking.k8s.io",
                Kind: "networkpolicies",
                UID: "",
                Causes: nil,
                RetryAfterSeconds: 0,
            },
            Code: 404,
        },
    }
occurred}

/lgtm
/verified by e2e-agnostic-ovn

openshift-ci · 2026-03-04T19:25:08Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hongkailiu, wking

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [hongkailiu,wking]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

hongkailiu · 2026-03-05T13:14:49Z

/retest-required

/hold cancel

hongkailiu · 2026-03-05T21:35:08Z

/retest-required

hongkailiu · 2026-03-06T03:36:29Z

/test e2e-agnostic-ovn-techpreview-serial

wking · 2026-03-06T05:55:48Z

techpreview-serial job timeout unrelated to this pull:

/override ci/prow/e2e-agnostic-ovn-techpreview-serial

probably needs to be sharded into two jobs.

openshift-ci · 2026-03-06T05:56:28Z

@wking: Overrode contexts on behalf of wking: ci/prow/e2e-agnostic-ovn-techpreview-serial

Details

In response to this:

[techpreview-serial job timeout][1] unrelated to this pull:

/override ci/prow/e2e-agnostic-ovn-techpreview-serial

probably needs to be sharded into two jobs.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

hongkailiu · 2026-03-06T11:49:24Z

It adds a new case.
The risk is low.

/verified by @hongkailiu

openshift-ci-robot · 2026-03-06T11:49:37Z

@hongkailiu: This PR has been marked as verified by @hongkailiu.

Details

In response to this:

It adds a new case.
The risk is low.

/verified by @hongkailiu

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

wking · 2026-03-06T21:58:37Z

Still not worried about that test vs. this pull.

/override ci/prow/e2e-agnostic-ovn-techpreview-serial

openshift-ci · 2026-03-06T21:58:50Z

@wking: Overrode contexts on behalf of wking: ci/prow/e2e-agnostic-ovn-techpreview-serial

Details

In response to this:

Still not worried about that test vs. this pull.

/override ci/prow/e2e-agnostic-ovn-techpreview-serial

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

wking · 2026-03-07T02:13:01Z

HyperShift NodePool timeout is unrelated to this pull's CVO e2e change.

/override ci/prow/e2e-hypershift

openshift-ci · 2026-03-07T02:13:35Z

@wking: Overrode contexts on behalf of wking: ci/prow/e2e-hypershift

Details

In response to this:

HyperShift NodePool timeout is unrelated to this pull's CVO e2e change.

/override ci/prow/e2e-hypershift

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2026-03-07T02:13:36Z

@hongkailiu: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot · 2026-03-07T02:18:24Z

@hongkailiu: Jira Issue Verification Checks: Jira Issue OCPBUGS-77762
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-77762 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

/hold

Wait for #1333

Summary by CodeRabbit

Tests

Added test validation to ensure the Cluster Version Operator has appropriate network policy configurations, with platform-specific exemptions for certain cluster types.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-merge-robot · 2026-03-07T16:10:55Z

Fix included in accepted release 4.22.0-0.nightly-2026-03-07-091925

hongkailiu added 2 commits March 4, 2026 09:11

OCPBUGS-77762: Add an e2e to check the default network polocy

5bd8a74

make update

5dcd2bc

openshift-ci Bot requested a review from dis016 March 4, 2026 14:14

openshift-ci Bot added do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Mar 4, 2026

wking approved these changes Mar 4, 2026

View reviewed changes

openshift-ci Bot assigned wking Mar 4, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Mar 4, 2026

openshift-ci-robot mentioned this pull request Mar 5, 2026

OCPBUGS-77762: install/0000_00_cluster-version-operator_02_networkpolicy: Add inclusion annotations #1333

Merged

openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 5, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Mar 6, 2026

openshift-merge-bot Bot merged commit af5e95e into openshift:main Mar 7, 2026
17 checks passed

Conversation

hongkailiu commented Mar 4, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Mar 4, 2026

Uh oh!

coderabbitai Bot commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

❌ Failed checks (1 warning)

Uh oh!

wking left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Mar 4, 2026

Uh oh!

hongkailiu commented Mar 5, 2026

Uh oh!

hongkailiu commented Mar 5, 2026

Uh oh!

hongkailiu commented Mar 6, 2026

Uh oh!

wking commented Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci Bot commented Mar 6, 2026

Uh oh!

hongkailiu commented Mar 6, 2026

Uh oh!

openshift-ci-robot commented Mar 6, 2026

Uh oh!

wking commented Mar 6, 2026

Uh oh!

openshift-ci Bot commented Mar 6, 2026

Uh oh!

wking commented Mar 7, 2026

Uh oh!

openshift-ci Bot commented Mar 7, 2026

Uh oh!

openshift-ci Bot commented Mar 7, 2026

Uh oh!

Uh oh!

openshift-ci-robot commented Mar 7, 2026

Summary by CodeRabbit

Uh oh!

openshift-merge-robot commented Mar 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

hongkailiu commented Mar 4, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Mar 4, 2026 •

edited

Loading

wking commented Mar 6, 2026 •

edited

Loading