Skip to content

CORENET-6714: Enable Network Observability on Day 0 #2925

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
OlivierCazade wants to merge 1 commit into
base: master
Choose a base branch
from
+5,387 −2
Open

CORENET-6714: Enable Network Observability on Day 0 #2925

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
252 changes: 252 additions & 0 deletions bindata/observability/07-observability-operator.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,252 @@
apiVersion: v1
kind: Namespace
metadata:
name: openshift-netobserv-operator
Comment on lines +1 to +4

@coderabbitai coderabbitai Bot Jun 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify whether a NetworkPolicy exists for the new namespace.
# Expected: at least one NetworkPolicy targeting openshift-netobserv-operator, or an intentional documented exception.
rg -n -C3 'kind:\s*NetworkPolicy|namespace:\s*openshift-netobserv-operator' --glob '*.yaml' --glob '*.yml'

Repository: openshift/cluster-network-operator

Length of output: 172

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== files mentioning openshift-netobserv-operator =="
rg -n --hidden --glob '*.yaml' --glob '*.yml' --glob '!**/.git/**' 'openshift-netobserv-operator' .

echo
echo "== NetworkPolicy manifests =="
rg -n --hidden --glob '*.yaml' --glob '*.yml' --glob '!**/.git/**' 'kind:\s*NetworkPolicy' .

echo
echo "== target file excerpt =="
sed -n '1,80p' bindata/observability/07-observability-operator.yaml

Repository: openshift/cluster-network-operator

Length of output: 5247

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== files mentioning openshift-netobserv-operator =="
rg -n --hidden --glob '*.yaml' --glob '*.yml' --glob '!**/.git/**' 'openshift-netobserv-operator' .

echo
echo "== NetworkPolicy manifests =="
rg -n --hidden --glob '*.yaml' --glob '*.yml' --glob '!**/.git/**' 'kind:\s*NetworkPolicy' .

echo
echo "== target file excerpt =="
sed -n '1,80p' bindata/observability/07-observability-operator.yaml

Repository: openshift/cluster-network-operator

Length of output: 5247

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== manifests/0000_70_cluster-network-operator_00_namespace.yaml =="
sed -n '1,120p' manifests/0000_70_cluster-network-operator_00_namespace.yaml

echo
echo "== NetworkPolicy objects in bindata/observability/07-observability-operator.yaml =="
rg -n -C4 'kind:\s*NetworkPolicy|apiVersion:\s*networking.k8s.io/v1|metadata:|namespace:' bindata/observability/07-observability-operator.yaml

echo
echo "== Namespace-scoped policy refs across repo =="
rg -n --hidden --glob '*.yaml' --glob '*.yml' 'namespace:\s*openshift-netobserv-operator|name:\s*openshift-netobserv-operator' .

Repository: openshift/cluster-network-operator

Length of output: 3995

Define a NetworkPolicy for openshift-netobserv-operator. The namespace is created without any ingress/egress isolation, unlike other operator namespaces in this repo.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@bindata/observability/07-observability-operator.yaml` around lines 1 - 4, The
openshift-netobserv-operator Namespace is missing the usual network isolation
resource. Add a NetworkPolicy for this namespace, following the pattern used by
the other operator namespace manifests in this repo, so the operator namespace
is explicitly isolated for ingress and egress; place it alongside the existing
Namespace manifest and ensure it targets openshift-netobserv-operator.

Source: Path instructions

@arkadeepsen arkadeepsen Jun 26, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is actually correct suggestion and we need netpols added for the netobserv namespace.

@coderabbitai coderabbitai Bot Jun 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@arkadeepsen Agreed — this one still stands. Adding NetworkPolicy resources for openshift-netobserv-operator alongside bindata/observability/07-observability-operator.yaml would be the right fix to keep the new operator namespace explicitly isolated for ingress and egress.

✏️ Learnings added 
Learnt from: arkadeepsen
Repo: openshift/cluster-network-operator PR: 2925
File: bindata/observability/07-observability-operator.yaml:1-4
Timestamp: 2026-06-26T14:57:46.466Z
Learning: In the OpenShift Cluster Network Operator repository, when a new operator namespace is introduced in Kubernetes manifests (such as `bindata/observability/07-observability-operator.yaml` for `openshift-netobserv-operator`), the namespace is expected to include NetworkPolicy resources to explicitly isolate ingress and egress traffic, following the existing operator namespace pattern in the repo.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

@OlivierCazade OlivierCazade Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We are working on adding the network policy directly inside the bundle. We do not provide for now a netpol for the operator.

The network policy for the Network Observability stack are deployed by the operator.

@coderabbitai coderabbitai Bot Jun 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems like the humans are having a chat. I'll hop back into my burrow for now. If you need me again, just tag @coderabbitai in a new comment, and I'll come hopping out!

---
apiVersion: v1
kind: ServiceAccount
metadata:
name: netobserv-operator-installer
namespace: openshift-netobserv-operator
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: netobserv-operator-installer
rules:
# Permissions needed by OLM v1 to install the Network Observability operator
# Based on OLM v1 pre-authorization requirements from the operator bundle

# Core resources
- apiGroups: [""]
resources: ["endpoints", "nodes", "pods"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["events"]
verbs: ["create", "patch"]
- apiGroups: [""]
resources: ["namespaces"]
verbs: ["create", "get", "list", "watch", "update", "patch", "delete"]
- apiGroups: [""]
resources: ["serviceaccounts", "services", "configmaps"]
verbs: ["create", "get", "list", "watch", "update", "patch", "delete"]
- apiGroups: [""]
resources: ["secrets", "persistentvolumeclaims"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]

# Webhooks - validating webhook configurations
- apiGroups: ["admissionregistration.k8s.io"]
resources: ["validatingwebhookconfigurations"]
verbs: ["create", "list", "watch"]
- apiGroups: ["admissionregistration.k8s.io"]
resources: ["validatingwebhookconfigurations"]
resourceNames: ["flowcollectorconversionwebhook.netobserv.io", "flowmetricvalidationwebhook.netobserv.io"]
verbs: ["delete", "get", "patch", "update"]

# CRDs and API services
- apiGroups: ["apiextensions.k8s.io"]
resources: ["customresourcedefinitions"]
verbs: ["create", "get", "list", "watch", "update", "patch"]
- apiGroups: ["apiextensions.k8s.io"]
resources: ["customresourcedefinitions/status"]
verbs: ["patch", "update"]
- apiGroups: ["apiextensions.k8s.io"]
resources: ["customresourcedefinitions"]
resourceNames: ["flowcollectors.flows.netobserv.io", "flowcollectorslices.flows.netobserv.io", "flowmetrics.flows.netobserv.io"]
verbs: ["delete"]
- apiGroups: ["apiregistration.k8s.io"]
resources: ["apiservices"]
verbs: ["get", "list", "watch"]

# Workloads
- apiGroups: ["apps"]
resources: ["deployments", "daemonsets"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- apiGroups: ["apps"]
resources: ["replicasets"]
verbs: ["get", "list", "watch"]

# Authentication and authorization
- apiGroups: ["authentication.k8s.io"]
resources: ["tokenreviews"]
verbs: ["create"]
- apiGroups: ["authorization.k8s.io"]
resources: ["subjectaccessreviews"]
verbs: ["create"]

# Autoscaling
- apiGroups: ["autoscaling"]
resources: ["horizontalpodautoscalers"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]

# eBPF (bpfman.io)
- apiGroups: ["bpfman.io"]
resources: ["clusterbpfapplications"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- apiGroups: ["bpfman.io"]
resources: ["clusterbpfapplications/status"]
verbs: ["get", "patch", "update"]

# OpenShift config
- apiGroups: ["config.openshift.io"]
resources: ["clusterversions", "networks"]
verbs: ["get", "list", "watch"]

# Console plugin
- apiGroups: ["console.openshift.io"]
resources: ["consoleplugins"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]

# Coordination (leader election)
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]

# Discovery
- apiGroups: ["discovery.k8s.io"]
resources: ["endpointslices"]
verbs: ["get", "list", "watch"]

# FlowCollector CRs
- apiGroups: ["flows.netobserv.io"]
resources: ["flowcollectors", "flowcollectorslices", "flowmetrics"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- apiGroups: ["flows.netobserv.io"]
resources: ["flowcollectors/finalizers"]
verbs: ["update"]
- apiGroups: ["flows.netobserv.io"]
resources: ["flowcollectors/status", "flowcollectorslices/status", "flowmetrics/status"]
verbs: ["get", "patch", "update"]

# OVN-Kubernetes
- apiGroups: ["k8s.ovn.org"]
resources: ["clusteruserdefinednetworks", "userdefinednetworks"]
verbs: ["get", "list", "watch"]

# Loki integration
- apiGroups: ["loki.grafana.com"]
resources: ["lokistacks"]
verbs: ["get", "list", "watch"]
- apiGroups: ["loki.grafana.com"]
resources: ["network"]
resourceNames: ["logs"]
verbs: ["create", "get"]

# Metrics
- apiGroups: ["metrics.k8s.io"]
resources: ["pods"]
verbs: ["create"]

# Monitoring
- apiGroups: ["monitoring.coreos.com"]
resources: ["prometheusrules", "servicemonitors"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]

# Network policies
- apiGroups: ["networking.k8s.io"]
resources: ["networkpolicies"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]

# OLM ClusterExtension finalizers
- apiGroups: ["olm.operatorframework.io"]
resources: ["clusterextensions/finalizers"]
resourceNames: ["netobserv-operator"]
verbs: ["update"]

# OLM ClusterObjectSet finalizers
- apiGroups: ["olm.operatorframework.io"]
resources: ["clusterobjectsets/finalizers"]
resourceNames: ["netobserv-operator-1"]
verbs: ["update"]

# OpenShift console and network config
- apiGroups: ["operator.openshift.io"]
resources: ["consoles"]
verbs: ["get", "list", "update", "watch"]
- apiGroups: ["operator.openshift.io"]
resources: ["networks"]
verbs: ["get", "list", "watch"]

# RBAC
- apiGroups: ["rbac.authorization.k8s.io"]
resources: ["clusterroles", "clusterrolebindings"]
verbs: ["create", "delete", "get", "list", "update", "watch", "patch"]
- apiGroups: ["rbac.authorization.k8s.io"]
resources: ["roles"]
verbs: ["list", "watch"]
- apiGroups: ["rbac.authorization.k8s.io"]
resources: ["rolebindings"]
verbs: ["create", "delete", "get", "list", "update", "watch"]

# Security context constraints
- apiGroups: ["security.openshift.io"]
resources: ["securitycontextconstraints"]
verbs: ["create", "list", "update", "watch"]
- apiGroups: ["security.openshift.io"]
resources: ["securitycontextconstraints"]
resourceNames: ["hostnetwork"]
verbs: ["use"]
Comment thread
OlivierCazade marked this conversation as resolved.
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: netobserv-operator-installer
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: netobserv-operator-installer
subjects:
- kind: ServiceAccount
name: netobserv-operator-installer
namespace: openshift-netobserv-operator
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: netobserv-operator-installer
namespace: openshift-netobserv-operator
rules:
# Namespace-scoped permissions needed for operator installation
# The operator needs to manage Roles and RoleBindings in its own namespace
- apiGroups: ["rbac.authorization.k8s.io"]
resources: ["roles"]
verbs: ["create"]
- apiGroups: ["rbac.authorization.k8s.io"]
resources: ["roles"]
resourceNames: ["netobserv-openshift-netobserv-operator-prometheus"]
verbs: ["delete", "get", "patch", "update"]
- apiGroups: ["rbac.authorization.k8s.io"]
resources: ["rolebindings"]
resourceNames: ["netobserv-openshift-netobserv-operator-prometheus"]
verbs: ["delete", "get", "patch", "update"]
- apiGroups: ["rbac.authorization.k8s.io"]
resources: ["rolebindings"]
verbs: ["create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: netobserv-operator-installer
namespace: openshift-netobserv-operator
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: netobserv-operator-installer
subjects:
- kind: ServiceAccount
name: netobserv-operator-installer
namespace: openshift-netobserv-operator
---
apiVersion: olm.operatorframework.io/v1
kind: ClusterExtension
metadata:
name: netobserv-operator
spec:
namespace: openshift-netobserv-operator
serviceAccount:
name: netobserv-operator-installer
source:
sourceType: Catalog
catalog:
packageName: netobserv-operator
channels: [stable]
Comment on lines +240 to +252

@coderabbitai coderabbitai Bot Jun 2, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

For olm.operatorframework.io/v1 ClusterExtension using a Catalog source, how can installation be pinned to a specific operator bundle/version or catalog image instead of following the latest channel head?

💡 Result:

To pin the installation of an operator in a ClusterExtension (using the olm.operatorframework.io/v1 API) to a specific version, you use the spec.source.catalog.version field in the ClusterExtension custom resource [1][2]. By specifying an exact version number in this field, you instruct the Operator Controller to install only that specific version and prevent automatic upgrades to newer versions available in the catalog channel [3][4]. ### How to pin to a specific version To pin the operator, set the version field to the exact semantic version string [2][4]. When this field is populated with a concrete version, OLM v1 will not change the target version even if updates are published to the catalog [5][6]. Example: yaml apiVersion: olm.operatorframework.io/v1 kind: ClusterExtension metadata: name: my-operator spec: namespace: my-namespace serviceAccount: name: my-service-account source: sourceType: Catalog catalog: packageName: my-operator channels: [stable] version: "1.2.3" # This pins the version to 1.2.3 ### Important Considerations * Manual Updates: Because pinning stops automatic updates, if you need to upgrade the operator to a new version in the future, you must manually edit the ClusterExtension resource and update the version field to the new target [7][4][6]. * Version Ranges: You can also define a range of acceptable versions (e.g., ">=1.2.0, <1.3.0") using a comma- or space-delimited comparison string [3]. If a range is provided, OLM v1 will automatically perform upgrades within that specified range [3]. * Catalog vs. Version: The ClusterExtension pulls the bundle from the CatalogSource you have configured on your cluster [1][8]. The version field acts as a constraint against the metadata contained within that catalog [3][4]. If you need to switch to a different catalog image entirely, you would typically manage that at the CatalogSource level, though ClusterExtension manages the version resolution from the available sources [8][6]. Pinned versions are a recommended practice for production environments to ensure consistency and prevent unexpected changes when new releases are published to a catalog [2].

Citations:

Pin the operator payload to an explicit version (not the stable channel head)

For olm.operatorframework.io/v1 ClusterExtension with sourceType: Catalog, setting only catalog.channels: [stable] allows OLM to resolve whatever bundle is currently at the channel head, which can change after release. Pin the intended payload by setting spec.source.catalog.version to the exact bundle version (or a constrained range) so upgrades don’t drift.

File: bindata/observability/07-observability-operator.yaml (around lines 240-252)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@bindata/observability/07-observability-operator.yaml` around lines 240 - 252,
The ClusterExtension manifest currently uses spec.source.catalog.channels:
[stable] which allows OLM to track the channel head; update the
netobserv-operator ClusterExtension to pin the payload by adding
spec.source.catalog.version with the exact bundle version (or a constrained
semver range) alongside or instead of the channels entry; locate the
ClusterExtension resource (kind: ClusterExtension, metadata.name:
netobserv-operator) and set spec.source.catalog.version to the intended bundle
version string so OLM will install that specific payload.

@OlivierCazade OlivierCazade Jun 3, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@stleerh can you confirm, but my understanding is that we could point to stable and not pin the version, right ?

@coderabbitai coderabbitai Bot Jun 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems like the humans are having a chat. I'll hop back into my burrow for now. If you need me again, just tag @coderabbitai in a new comment, and I'll come hopping out!

@stleerh stleerh Jun 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@stleerh can you confirm, but my understanding is that we could point to stable and not pin the version, right ?

Yes

15 changes: 15 additions & 0 deletions bindata/observability/08-flowcollector.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
apiVersion: flows.netobserv.io/v1beta2

@arkadeepsen arkadeepsen Apr 9, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Adding this file to the manifests directory means that the CR will be added by default to the cluster. Is this desired behavior?

@OlivierCazade OlivierCazade Apr 10, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Moved the files to a sub-directory in the controller directory.

kind: FlowCollector
metadata:
name: cluster
spec:
agent:
ebpf:
features:
- DNSTracking
sampling: 400
type: eBPF
deploymentModel: Service
loki:
enable: false
namespace: openshift-network-observability
2 changes: 2 additions & 0 deletions pkg/controller/add_networkconfig.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ import (
"github.com/openshift/cluster-network-operator/pkg/controller/egress_router"
"github.com/openshift/cluster-network-operator/pkg/controller/infrastructureconfig"
"github.com/openshift/cluster-network-operator/pkg/controller/ingressconfig"
"github.com/openshift/cluster-network-operator/pkg/controller/observability"
"github.com/openshift/cluster-network-operator/pkg/controller/operconfig"
"github.com/openshift/cluster-network-operator/pkg/controller/pki"
"github.com/openshift/cluster-network-operator/pkg/controller/proxyconfig"
Expand All @@ -28,5 +29,6 @@ func init() {
infrastructureconfig.Add,
allowlist.Add,
dashboards.Add,
observability.Add,
)
}
Loading