OCPBUGS-65633: add network-check-target + networking-console-plugin service accounts by ehearne-redhat · Pull Request #2868 · openshift/cluster-network-operator

ehearne-redhat · 2026-01-07T16:02:49Z

This PR adds a service account to openshift-network-diagnostics/network-check-target- and openshift-network-console/networking-console-plugin- pods. It also includes a change to render_test as the number 14 for number of YAMLs to check for is now 15 due to added RBAC manifest. The ordering of the manifests have been changed to allow for the correct application of manifests.

The reason for this change is that these pods should use their own bespoke service account, not default.

coderabbitai · 2026-01-07T16:02:54Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

Walkthrough

Adds two ServiceAccount manifests and assigns them to existing pod specs: network-check-target in openshift-network-diagnostics and networking-console-plugin in openshift-network-console. Also increments a unit test expectation by one rendered item.

Changes

Cohort / File(s)	Summary
network-diagnostics ServiceAccount & DaemonSet `bindata/network-diagnostics/001-rbac.yaml`, `bindata/network-diagnostics/network-check-target.yaml`	New ServiceAccount `network-check-target` in namespace `openshift-network-diagnostics`; DaemonSet pod spec changed from `serviceAccount: default` to `serviceAccount: network-check-target`.
networking-console-plugin ServiceAccount & Deployment `bindata/networking-console-plugin/001-rbac.yaml`, `bindata/networking-console-plugin/003-deployment.yaml`	New ServiceAccount `networking-console-plugin` in namespace `openshift-network-console`; Deployment pod spec set to `serviceAccount: networking-console-plugin`.
Unit test update `pkg/network/render_test.go`	Test expectation updated: third test case rendered item count increased from 14 to 15.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

openshift-ci-robot · 2026-01-07T16:02:58Z

@ehearne-redhat: This pull request references Jira Issue OCPBUGS-65633, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.22.0) matches configured target version for branch (4.22.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @anuragthehatter

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

ehearne-redhat · 2026-01-07T16:05:57Z

@coderabbitai review

coderabbitai · 2026-01-07T16:06:04Z

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai

Actionable comments posted: 2

🤖 Fix all issues with AI agents

In @bindata/network-diagnostics/001-rbac.yaml:
- Around line 132-138: Change the ServiceAccount manifest to use the correct
core API group by replacing apiVersion: rbac.authorization.k8s.io with
apiVersion: v1 for the ServiceAccount named network-check-target in namespace
openshift-network-diagnostics, and remove the trailing whitespace on the blank
line after namespace (line containing only whitespace) to ensure the YAML is
accepted by Kubernetes.

In @bindata/networking-console-plugin/001-rbac.yaml:
- Around line 1-5: The manifest declares a ServiceAccount with the wrong
apiVersion; change the apiVersion for the ServiceAccount resource from
"rbac.authorization.k8s.io" to "v1" so Kubernetes accepts it; update the
apiVersion field at the top of the ServiceAccount definition (metadata.name:
networking-console-plugin, metadata.namespace: openshift-network-console) to
"v1" and keep the rest of the ServiceAccount spec unchanged.

📜 Review details

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting

📥 Commits

Reviewing files that changed from the base of the PR and between 9d8ab48 and b161b78.

📒 Files selected for processing (6)

bindata/network-diagnostics/001-rbac.yaml
bindata/network-diagnostics/network-check-target.yaml
bindata/networking-console-plugin/001-rbac.yaml
bindata/networking-console-plugin/002-config-map.yaml
bindata/networking-console-plugin/003-deployment.yaml
bindata/networking-console-plugin/005-service.yaml

🧰 Additional context used

📓 Path-based instructions (1)

**

⚙️ CodeRabbit configuration file

-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.

Files:

bindata/networking-console-plugin/001-rbac.yaml
bindata/network-diagnostics/001-rbac.yaml
bindata/network-diagnostics/network-check-target.yaml
bindata/networking-console-plugin/003-deployment.yaml

🔇 Additional comments (2)

bindata/networking-console-plugin/003-deployment.yaml (1)

58-58: LGTM!

The serviceAccount assignment correctly references the networking-console-plugin ServiceAccount defined in 001-rbac.yaml. The namespace alignment is correct, and the configuration with automountServiceAccountToken: false indicates this is used for pod security context rather than API access.

bindata/network-diagnostics/network-check-target.yaml (1)

66-66: LGTM!

The serviceAccount assignment correctly references the network-check-target ServiceAccount defined in bindata/network-diagnostics/001-rbac.yaml. The namespace alignment is correct.

bindata/network-diagnostics/001-rbac.yaml

bindata/networking-console-plugin/001-rbac.yaml

ehearne-redhat · 2026-01-07T16:13:33Z

@coderabbitai review

coderabbitai · 2026-01-07T16:13:41Z

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

ehearne-redhat · 2026-01-08T09:11:02Z

/retest

openshift-ci-robot · 2026-01-09T09:37:54Z

@ehearne-redhat: This pull request references Jira Issue OCPBUGS-65633, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.22.0) matches configured target version for branch (4.22.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @anuragthehatter

Details

In response to this:

This PR adds a service account to openshift-network-diagnostics/network-check-target- and openshift-network-console/networking-console-plugin- pods. It also includes a change to render_test as the number 14 for number of YAMLs to check for is now 15 due to added RBAC manifest. The ordering of the manifests have been changed to allow for the correct application of manifests.

The reason for this change is that these pods should use their own bespoke service account, not default.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

ehearne-redhat · 2026-01-09T09:38:30Z

/test hypershift-e2e-aks
/test e2e-aws-ovn-hypershift-conformance

ehearne-redhat · 2026-01-09T12:22:08Z

/test e2e-aws-ovn-hypershift-conformance

ehearne-redhat · 2026-01-12T12:56:57Z

/retest

ehearne-redhat · 2026-01-13T10:40:45Z

@anuragthehatter @arkadeepsen @kyrtapz can we get an override on the security test? The affected components did not contain any of my code changes, and referenced also some go libraries.

The rest of the tests appear to pass - feel free to review when you have the time. :)

arkadeepsen · 2026-01-16T14:36:47Z

@coderabbitai review

coderabbitai · 2026-01-16T14:36:55Z

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

arkadeepsen · 2026-01-16T14:39:15Z

@ehearne-redhat Can you please squash the commits into a single one?

ehearne-redhat · 2026-01-16T14:41:18Z

@arkadeepsen yeah that's no problem. :)

ehearne-redhat · 2026-01-16T14:52:27Z

@arkadeepsen so that's done now. let me know if you need anything else for this PR :)

arkadeepsen · 2026-01-16T15:18:41Z

@arkadeepsen so that's done now. let me know if you need anything else for this PR :)

Thanks for that. I want to check whether the upgrade jobs are sporadically facing any issues or not. Historically when manifests are updated, sometimes the upgrade jobs face issues due to unpredictable order of component upgrade. So, let's wait for the jobs to pass again.

arkadeepsen · 2026-01-19T05:50:27Z

/retest-required
/test 4.22-upgrade-from-stable-4.21-e2e-azure-ovn-upgrade

ehearne-redhat · 2026-02-23T10:25:45Z

/test hypershift-e2e-aks

This test reports inconsistent errors. No 443 error on latest test run.

ehearne-redhat · 2026-02-23T11:16:50Z

/test e2e-aws-ovn-serial-1of2

ehearne-redhat · 2026-02-23T14:17:21Z

I am seeing in other test runs of e2e-aws-ovn-serial-1of2 such as here that it reports the same error:

{  fail [github.com/openshift/origin/test/extended/networking/commatrix.go:143]: Unexpected error:
    <*errors.errorString | 0xc001c5a470>: 
    the following ports are used but don't have an endpointslice: 
     Ingress,TCP,8080,openshift-multus,multi-networkpo,multus-networkpolicy-49tc2,multus-networkpolicy,worker,false
    
    {
        s: "the following ports are used but don't have an endpointslice: \n Ingress,TCP,8080,openshift-multus,multi-networkpo,multus-networkpolicy-49tc2,multus-networkpolicy,worker,false\n",
    }
occurred}

Therefore, since the two pods have their bespoke service accounts running correctly, I will unhold.

/unhold

ehearne-redhat · 2026-02-23T14:28:10Z

I have also verified that CNO logs look similar in other PRs' runs of e2e-aws-ovn-serial-1of2.

/verified by ehearne-redhat

openshift-ci-robot · 2026-02-23T14:28:22Z

@ehearne-redhat: This PR has been marked as verified by ehearne-redhat.

Details

In response to this:

I have also verified that CNO logs look similar in other PRs' runs of e2e-aws-ovn-serial-1of2.

/verified by ehearne-redhat

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

ehearne-redhat · 2026-02-23T14:28:55Z

/refresh

kyrtapz · 2026-02-24T16:36:58Z

/lgtm
These failure is completely unrelated and occurs on other PRs as well:

: [sig-network][Feature:commatrix][apigroup:config.openshift.io][Serial] should validate the communication matrix ports match the node's listening ports [Suite:openshift/conformance/serial] expand_less 	9s
{  fail [github.com/openshift/origin/test/extended/networking/commatrix.go:143]: Unexpected error:
    <*errors.errorString | 0xc001c5a470>: 
    the following ports are used but don't have an endpointslice: 
     Ingress,TCP,8080,openshift-multus,multi-networkpo,multus-networkpolicy-49tc2,multus-networkpolicy,worker,false
    
    {
        s: "the following ports are used but don't have an endpointslice: \n Ingress,TCP,8080,openshift-multus,multi-networkpo,multus-networkpolicy-49tc2,multus-networkpolicy,worker,false\n",
    }
occurred}

/override ci/prow/e2e-aws-ovn-serial-1of2

openshift-ci · 2026-02-24T16:46:35Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: arkadeepsen, ehearne-redhat, kyrtapz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [kyrtapz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2026-02-24T16:47:50Z

@kyrtapz: Overrode contexts on behalf of kyrtapz: ci/prow/e2e-aws-ovn-serial-1of2

Details

In response to this:

/lgtm
These failure is completely unrelated and occurs on other PRs as well:

: [sig-network][Feature:commatrix][apigroup:config.openshift.io][Serial] should validate the communication matrix ports match the node's listening ports [Suite:openshift/conformance/serial] expand_less 	9s
{  fail [github.com/openshift/origin/test/extended/networking/commatrix.go:143]: Unexpected error:
   <*errors.errorString | 0xc001c5a470>: 
   the following ports are used but don't have an endpointslice: 
    Ingress,TCP,8080,openshift-multus,multi-networkpo,multus-networkpolicy-49tc2,multus-networkpolicy,worker,false
   
   {
       s: "the following ports are used but don't have an endpointslice: \n Ingress,TCP,8080,openshift-multus,multi-networkpo,multus-networkpolicy-49tc2,multus-networkpolicy,worker,false\n",
   }
occurred}

/override ci/prow/e2e-aws-ovn-serial-1of2

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

ehearne-redhat · 2026-02-25T12:45:21Z

/retest

ehearne-redhat · 2026-02-25T18:00:51Z

/retest

openshift-ci · 2026-02-26T09:40:01Z

New changes are detected. LGTM label has been removed.

ehearne-redhat · 2026-02-26T17:19:35Z

/retest

There are a few tests here which are undergoing some PR reverts to fix changes.

openshift/operator-framework-operator-controller#647

Default service account monitor test failing in

https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_cluster-network-operator/2868/pull-ci-openshift-cluster-network-operator-master-4.22-upgrade-from-stable-4.21-e2e-azure-ovn-upgrade/2026955427433943040

Likely due to openshift/origin#30685 being merged. Probably needs a fix.

ehearne-redhat · 2026-03-02T14:32:01Z

/retest

ehearne-redhat · 2026-03-03T10:46:46Z

e2e-metal-ipi-ovn-dualstack-bgp-local-gw is failing due to default service account monitor test. I have a PR open for this to resolve, essentially add an exception to resolve.

ehearne-redhat · 2026-03-04T10:21:55Z

Just waiting for openshift/origin#30815 tests to pass and hopefully get review to resolve e2e-metal-ipi-ovn-dualstack-bgp-local-gw test. Then, I will test and hopefully should pass. :)

ehearne-redhat · 2026-03-05T12:26:56Z

/test e2e-metal-ipi-ovn-dualstack-bgp-local-gw

ehearne-redhat · 2026-03-06T08:44:12Z

/test e2e-metal-ipi-ovn-dualstack-bgp-local-gw

ehearne-redhat · 2026-03-06T10:04:49Z

/test e2e-metal-ipi-ovn-dualstack-bgp-local-gw

openshift-ci · 2026-03-06T14:15:19Z

@ehearne-redhat: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/security	`2ebfbc8`	link	false	`/test security`
ci/prow/e2e-metal-ipi-ovn-dualstack-bgp-local-gw	`2ebfbc8`	link	true	`/test e2e-metal-ipi-ovn-dualstack-bgp-local-gw`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

ehearne-redhat · 2026-03-06T14:25:19Z

From e2e-aws-ovn-serial-1of2:

---
apiVersion: v1
kind: Pod
metadata:
  ...
  generateName: networking-console-plugin-56466947-
  ...
  name: networking-console-plugin-56466947-clvfq
  namespace: openshift-network-console
  ...
    name: networking-console-plugin
    ...
  serviceAccount: networking-console-plugin
  serviceAccountName: networking-console-plugin
  ...
    name: networking-console-plugin
   ...
  phase: Running
...

---
apiVersion: v1
kind: Pod
metadata:
  ...
  generateName: network-check-target-
  ...
  labels:
    app: network-check-target
    ...
    name: network-check-target-container
    ...
  serviceAccount: network-check-target
  serviceAccountName: network-check-target
  ...
    name: network-check-target-container
    ...
  phase: Running
...

/verified by ehearne-redhat

openshift-ci-robot · 2026-03-06T14:25:31Z

@ehearne-redhat: This PR has been marked as verified by ehearne-redhat.

Details

In response to this:

From e2e-aws-ovn-serial-1of2:

---
apiVersion: v1
kind: Pod
metadata:
 ...
 generateName: networking-console-plugin-56466947-
 ...
 name: networking-console-plugin-56466947-clvfq
 namespace: openshift-network-console
 ...
   name: networking-console-plugin
   ...
 serviceAccount: networking-console-plugin
 serviceAccountName: networking-console-plugin
 ...
   name: networking-console-plugin
  ...
 phase: Running
...

---
apiVersion: v1
kind: Pod
metadata:
 ...
 generateName: network-check-target-
 ...
 labels:
   app: network-check-target
   ...
   name: network-check-target-container
   ...
 serviceAccount: network-check-target
 serviceAccountName: network-check-target
 ...
   name: network-check-target-container
   ...
 phase: Running
...

/verified by ehearne-redhat

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

ehearne-redhat · 2026-03-06T14:33:04Z

I believe e2e-metal-ipi-ovn-dualstack-bgp-local-gw has infrastructure issues as it seems to be failing for several people even after the monitor test change got merged.

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jan 7, 2026

openshift-ci bot requested review from anuragthehatter, arkadeepsen and kyrtapz January 7, 2026 16:03

coderabbitai bot reviewed Jan 7, 2026

View reviewed changes

bindata/network-diagnostics/001-rbac.yaml Outdated Show resolved Hide resolved

bindata/networking-console-plugin/001-rbac.yaml Outdated Show resolved Hide resolved

ehearne-redhat changed the title ~~[WIP] OCPBUGS-65633: add network-check-target + networking-console-plugin service accounts~~ OCPBUGS-65633: add network-check-target + networking-console-plugin service accounts Jan 9, 2026

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jan 9, 2026

ehearne-redhat force-pushed the add-service-account-network-check-target-networking-console-plugin branch from b2ea5a2 to 2afeb6e Compare January 16, 2026 14:51

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Feb 23, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Feb 23, 2026

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Feb 24, 2026

openshift-ci-robot removed the verified Signifies that the PR passed pre-merge verification criteria label Feb 26, 2026

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Feb 26, 2026

ehearne-redhat force-pushed the add-service-account-network-check-target-networking-console-plugin branch from 460d0c3 to 2ebfbc8 Compare February 27, 2026 11:20

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Mar 6, 2026

Conversation

ehearne-redhat commented Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai bot commented Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Estimated code review effort

Uh oh!

openshift-ci-robot commented Jan 7, 2026

Uh oh!

ehearne-redhat commented Jan 7, 2026

Uh oh!

coderabbitai bot commented Jan 7, 2026

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ehearne-redhat commented Jan 7, 2026

Uh oh!

coderabbitai bot commented Jan 7, 2026

Uh oh!

ehearne-redhat commented Jan 8, 2026

Uh oh!

openshift-ci-robot commented Jan 9, 2026

Uh oh!

ehearne-redhat commented Jan 9, 2026

Uh oh!

ehearne-redhat commented Jan 9, 2026

Uh oh!

ehearne-redhat commented Jan 12, 2026

Uh oh!

ehearne-redhat commented Jan 13, 2026

Uh oh!

arkadeepsen commented Jan 16, 2026

Uh oh!

coderabbitai bot commented Jan 16, 2026

Uh oh!

arkadeepsen commented Jan 16, 2026

Uh oh!

ehearne-redhat commented Jan 16, 2026

Uh oh!

ehearne-redhat commented Jan 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

arkadeepsen commented Jan 16, 2026

Uh oh!

arkadeepsen commented Jan 19, 2026

Uh oh!

ehearne-redhat commented Feb 23, 2026

Uh oh!

ehearne-redhat commented Feb 23, 2026

Uh oh!

ehearne-redhat commented Feb 23, 2026

Uh oh!

ehearne-redhat commented Feb 23, 2026

Uh oh!

openshift-ci-robot commented Feb 23, 2026

Uh oh!

ehearne-redhat commented Feb 23, 2026

Uh oh!

kyrtapz commented Feb 24, 2026

Uh oh!

openshift-ci bot commented Feb 24, 2026

Uh oh!

openshift-ci bot commented Feb 24, 2026

Uh oh!

ehearne-redhat commented Feb 25, 2026

Uh oh!

ehearne-redhat commented Feb 25, 2026

Uh oh!

openshift-ci bot commented Feb 26, 2026

Uh oh!

ehearne-redhat commented Feb 26, 2026

Uh oh!

ehearne-redhat commented Mar 2, 2026

ehearne-redhat commented Jan 7, 2026 •

edited

Loading

coderabbitai bot commented Jan 7, 2026 •

edited

Loading

ehearne-redhat commented Jan 16, 2026 •

edited

Loading