From 4ed7b6c7a69f8cb282abf3cafc1bbe2e4e95cdfa Mon Sep 17 00:00:00 2001 From: Kevin Tsai Date: Tue, 8 Sep 2026 15:12:11 -0700 Subject: [PATCH 1/6] CNF-25757: Disable iptables-alerter in RDS configurations Add iptables-alerter-config ConfigMap to RAN, Core, and Hub RDS reference CRs to disable the iptables-alerter component by default. The iptables-alerter causes high CPU usage and cluster instability in production Telco environments. Partners tightly control their workloads, making runtime iptables detection unnecessary. Partners remain responsible for: - Testing for iptables use in pre-production environments - Migrating workloads to nftables before RHEL10-based releases References: - KCS: https://access.redhat.com/solutions/7134521 - OCPBUGS-87026: NF Pod Readiness Probe Failures - OCPBUGS-73767: High CPU usage for iptables-alerter pods Co-Authored-By: Claude Sonnet 4.5 Signed-off-by: Kevin Tsai --- .../required/networking/IptablesAlerterConfig.yaml | 7 +++++++ .../required/networking/IptablesAlerterConfig.yaml | 7 +++++++ .../iptables-alerter/IptablesAlerterConfig.yaml | 9 +++++++++ 3 files changed, 23 insertions(+) create mode 100644 telco-core/configuration/reference-crs-kube-compare/required/networking/IptablesAlerterConfig.yaml create mode 100644 telco-hub/configuration/reference-crs-kube-compare/required/networking/IptablesAlerterConfig.yaml create mode 100644 telco-ran/configuration/kube-compare-reference/cluster-tuning/iptables-alerter/IptablesAlerterConfig.yaml diff --git a/telco-core/configuration/reference-crs-kube-compare/required/networking/IptablesAlerterConfig.yaml b/telco-core/configuration/reference-crs-kube-compare/required/networking/IptablesAlerterConfig.yaml new file mode 100644 index 000000000..a57487a73 --- /dev/null +++ b/telco-core/configuration/reference-crs-kube-compare/required/networking/IptablesAlerterConfig.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: iptables-alerter-config + namespace: openshift-network-operator +data: + enabled: "false" diff --git a/telco-hub/configuration/reference-crs-kube-compare/required/networking/IptablesAlerterConfig.yaml b/telco-hub/configuration/reference-crs-kube-compare/required/networking/IptablesAlerterConfig.yaml new file mode 100644 index 000000000..a57487a73 --- /dev/null +++ b/telco-hub/configuration/reference-crs-kube-compare/required/networking/IptablesAlerterConfig.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: iptables-alerter-config + namespace: openshift-network-operator +data: + enabled: "false" diff --git a/telco-ran/configuration/kube-compare-reference/cluster-tuning/iptables-alerter/IptablesAlerterConfig.yaml b/telco-ran/configuration/kube-compare-reference/cluster-tuning/iptables-alerter/IptablesAlerterConfig.yaml new file mode 100644 index 000000000..efbade453 --- /dev/null +++ b/telco-ran/configuration/kube-compare-reference/cluster-tuning/iptables-alerter/IptablesAlerterConfig.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: iptables-alerter-config + namespace: openshift-network-operator + annotations: + ran.openshift.io/ztp-deploy-wave: "10" +data: + enabled: "false" From b1a010f31c1de7cca09b557fc9552370e04d41f5 Mon Sep 17 00:00:00 2001 From: Kevin Tsai Date: Tue, 8 Sep 2026 16:35:34 -0700 Subject: [PATCH 2/6] CNF-25757: Wire iptables-alerter ConfigMap into automated deployment Add iptables-alerter disable ConfigMap to deployment mechanisms for automatic inclusion in new RDS deployments. Deployment Mechanisms: - RAN: Added to source-crs and PolicyGenerators (ran-common, ran-common-mno, ran-group-du-sno) Deploys via ZTP/GitOps using ClusterInstance and ACM Policies - Core: Added to reference-crs and core-baseline PolicyGenerator Deploys via ACM Policies from GitOps - Hub: Added to reference-crs Deploys via ArgoCD/kustomization directly With these changes, new RDS deployments will automatically include the iptables-alerter disable ConfigMap. Files added: - telco-core/configuration/reference-crs/required/networking/IptablesAlerterConfig.yaml - telco-hub/configuration/reference-crs/required/networking/IptablesAlerterConfig.yaml - telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/IptablesAlerterConfig.yaml PolicyGenerators updated: - telco-core/configuration/core-baseline.yaml - telco-ran/configuration/acmpolicygenerator/ran-common.yaml - telco-ran/configuration/acmpolicygenerator/ran-common-mno.yaml - telco-ran/configuration/acmpolicygenerator/ran-group-du-sno-templated.yaml Co-Authored-By: Claude Sonnet 4.5 Signed-off-by: Kevin Tsai --- telco-core/configuration/core-baseline.yaml | 3 +++ .../required/networking/IptablesAlerterConfig.yaml | 3 +++ .../required/networking/IptablesAlerterConfig.yaml | 12 ++++++++++++ .../required/networking/IptablesAlerterConfig.yaml | 3 +++ .../required/networking/IptablesAlerterConfig.yaml | 12 ++++++++++++ .../acmpolicygenerator/ran-common-mno.yaml | 1 + .../acmpolicygenerator/ran-common.yaml | 1 + .../ran-group-du-sno-templated.yaml | 1 + .../iptables-alerter/IptablesAlerterConfig.yaml | 3 +++ .../iptables-alerter/IptablesAlerterConfig.yaml | 14 ++++++++++++++ 10 files changed, 53 insertions(+) create mode 100644 telco-core/configuration/reference-crs/required/networking/IptablesAlerterConfig.yaml create mode 100644 telco-hub/configuration/reference-crs/required/networking/IptablesAlerterConfig.yaml create mode 100644 telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/IptablesAlerterConfig.yaml diff --git a/telco-core/configuration/core-baseline.yaml b/telco-core/configuration/core-baseline.yaml index 1c3264ee5..dca442ab2 100644 --- a/telco-core/configuration/core-baseline.yaml +++ b/telco-core/configuration/core-baseline.yaml @@ -108,6 +108,9 @@ policies: - path: reference-crs/required/networking/NMState.yaml + # Iptables-alerter disable configuration + - path: reference-crs/required/networking/IptablesAlerterConfig.yaml + # Firewall node disruption policy - path: reference-crs/optional/networking/firewall/node-disruption-policy.yaml diff --git a/telco-core/configuration/reference-crs-kube-compare/required/networking/IptablesAlerterConfig.yaml b/telco-core/configuration/reference-crs-kube-compare/required/networking/IptablesAlerterConfig.yaml index a57487a73..04b1519b9 100644 --- a/telco-core/configuration/reference-crs-kube-compare/required/networking/IptablesAlerterConfig.yaml +++ b/telco-core/configuration/reference-crs-kube-compare/required/networking/IptablesAlerterConfig.yaml @@ -1,3 +1,6 @@ +# required +# Disables iptables-alerter to prevent high CPU usage in production (OCPBUGS-87026, OCPBUGS-73767) +# KCS: https://access.redhat.com/solutions/7134521 apiVersion: v1 kind: ConfigMap metadata: diff --git a/telco-core/configuration/reference-crs/required/networking/IptablesAlerterConfig.yaml b/telco-core/configuration/reference-crs/required/networking/IptablesAlerterConfig.yaml new file mode 100644 index 000000000..0d0d6089e --- /dev/null +++ b/telco-core/configuration/reference-crs/required/networking/IptablesAlerterConfig.yaml @@ -0,0 +1,12 @@ +# required +# Disables iptables-alerter to prevent high CPU usage in production (OCPBUGS-87026, OCPBUGS-73767) +# Partners must test iptables usage in pre-production and migrate to nftables before RHEL10 +# KCS: https://access.redhat.com/solutions/7134521 +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: iptables-alerter-config + namespace: openshift-network-operator +data: + enabled: "false" diff --git a/telco-hub/configuration/reference-crs-kube-compare/required/networking/IptablesAlerterConfig.yaml b/telco-hub/configuration/reference-crs-kube-compare/required/networking/IptablesAlerterConfig.yaml index a57487a73..04b1519b9 100644 --- a/telco-hub/configuration/reference-crs-kube-compare/required/networking/IptablesAlerterConfig.yaml +++ b/telco-hub/configuration/reference-crs-kube-compare/required/networking/IptablesAlerterConfig.yaml @@ -1,3 +1,6 @@ +# required +# Disables iptables-alerter to prevent high CPU usage in production (OCPBUGS-87026, OCPBUGS-73767) +# KCS: https://access.redhat.com/solutions/7134521 apiVersion: v1 kind: ConfigMap metadata: diff --git a/telco-hub/configuration/reference-crs/required/networking/IptablesAlerterConfig.yaml b/telco-hub/configuration/reference-crs/required/networking/IptablesAlerterConfig.yaml new file mode 100644 index 000000000..0d0d6089e --- /dev/null +++ b/telco-hub/configuration/reference-crs/required/networking/IptablesAlerterConfig.yaml @@ -0,0 +1,12 @@ +# required +# Disables iptables-alerter to prevent high CPU usage in production (OCPBUGS-87026, OCPBUGS-73767) +# Partners must test iptables usage in pre-production and migrate to nftables before RHEL10 +# KCS: https://access.redhat.com/solutions/7134521 +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: iptables-alerter-config + namespace: openshift-network-operator +data: + enabled: "false" diff --git a/telco-ran/configuration/acmpolicygenerator/ran-common-mno.yaml b/telco-ran/configuration/acmpolicygenerator/ran-common-mno.yaml index d4d1b1372..5c265f712 100644 --- a/telco-ran/configuration/acmpolicygenerator/ran-common-mno.yaml +++ b/telco-ran/configuration/acmpolicygenerator/ran-common-mno.yaml @@ -34,3 +34,4 @@ policies: ran.openshift.io/ztp-deploy-wave: "1" manifests: - path: source-crs/cluster-tuning/operator-hub/OperatorHub.yaml + - path: source-crs/cluster-tuning/iptables-alerter/IptablesAlerterConfig.yaml diff --git a/telco-ran/configuration/acmpolicygenerator/ran-common.yaml b/telco-ran/configuration/acmpolicygenerator/ran-common.yaml index 055c18f6f..564bfeb15 100644 --- a/telco-ran/configuration/acmpolicygenerator/ran-common.yaml +++ b/telco-ran/configuration/acmpolicygenerator/ran-common.yaml @@ -31,6 +31,7 @@ policies: ran.openshift.io/ztp-deploy-wave: "1" manifests: - path: source-crs/cluster-tuning/monitoring-configuration/ReduceMonitoringFootprint.yaml + - path: source-crs/cluster-tuning/iptables-alerter/IptablesAlerterConfig.yaml - path: source-crs/disconnected-registry/DefaultCatsrc.yaml patches: - metadata: diff --git a/telco-ran/configuration/acmpolicygenerator/ran-group-du-sno-templated.yaml b/telco-ran/configuration/acmpolicygenerator/ran-group-du-sno-templated.yaml index 0782b7705..df445b781 100644 --- a/telco-ran/configuration/acmpolicygenerator/ran-group-du-sno-templated.yaml +++ b/telco-ran/configuration/acmpolicygenerator/ran-group-du-sno-templated.yaml @@ -111,6 +111,7 @@ policies: ## - /dev/disk/by-partlabel/httpevent1 ## - /dev/disk/by-partlabel/httpevent2 - path: source-crs/cluster-tuning/disabling-network-diagnostics/DisableSnoNetworkDiag.yaml + - path: source-crs/cluster-tuning/iptables-alerter/IptablesAlerterConfig.yaml # PerformanceProfile.yaml is architecture-specific. Replace x86_64 with aarch64 for ARM deployments - path: source-crs/node-tuning-operator/x86_64/PerformanceProfile-SetSelector.yaml patches: diff --git a/telco-ran/configuration/kube-compare-reference/cluster-tuning/iptables-alerter/IptablesAlerterConfig.yaml b/telco-ran/configuration/kube-compare-reference/cluster-tuning/iptables-alerter/IptablesAlerterConfig.yaml index efbade453..8a64a931a 100644 --- a/telco-ran/configuration/kube-compare-reference/cluster-tuning/iptables-alerter/IptablesAlerterConfig.yaml +++ b/telco-ran/configuration/kube-compare-reference/cluster-tuning/iptables-alerter/IptablesAlerterConfig.yaml @@ -1,3 +1,6 @@ +# required +# Disables iptables-alerter to prevent high CPU usage in production (OCPBUGS-87026, OCPBUGS-73767) +# KCS: https://access.redhat.com/solutions/7134521 apiVersion: v1 kind: ConfigMap metadata: diff --git a/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/IptablesAlerterConfig.yaml b/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/IptablesAlerterConfig.yaml new file mode 100644 index 000000000..a625d05fb --- /dev/null +++ b/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/IptablesAlerterConfig.yaml @@ -0,0 +1,14 @@ +# required +# Disables iptables-alerter to prevent high CPU usage in production (OCPBUGS-87026, OCPBUGS-73767) +# Partners must test iptables usage in pre-production and migrate to nftables before RHEL10 +# KCS: https://access.redhat.com/solutions/7134521 +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: iptables-alerter-config + namespace: openshift-network-operator + annotations: + ran.openshift.io/ztp-deploy-wave: "10" +data: + enabled: "false" From cdd6bb9ad24eadeafd10e0267fb35847605429e7 Mon Sep 17 00:00:00 2001 From: Kevin Tsai Date: Tue, 8 Sep 2026 17:27:18 -0700 Subject: [PATCH 3/6] CNF-25757: Address PR review comments 1. Add network-operator restart mechanism: - Create Job with ServiceAccount and RBAC to delete network-operator pod - Ensures ConfigMap changes are picked up (wave 100 for RAN, default for Core/Hub) - Prevents iptables-alerter pods from remaining active 2. Fix Hub kustomization: - Add reference-crs/required/networking/ to telco-hub/configuration/kustomization.yaml - Create kustomization.yaml in networking directory - Ensures IptablesAlerterConfig.yaml is deployed on Hub clusters 3. Remove duplicate ConfigMap ownership: - Keep ConfigMap only in ran-common.yaml (applies to all RAN clusters) - Remove from ran-common-mno.yaml and ran-group-du-sno-templated.yaml - Eliminates policy ownership conflicts Co-Authored-By: Claude Sonnet 4.5 Signed-off-by: Kevin Tsai --- telco-core/configuration/core-baseline.yaml | 1 + .../networking/RestartNetworkOperator.yaml | 60 +++++++++++++++++ telco-hub/configuration/kustomization.yaml | 1 + .../networking/RestartNetworkOperator.yaml | 60 +++++++++++++++++ .../required/networking/kustomization.yaml | 6 ++ .../acmpolicygenerator/ran-common-mno.yaml | 1 - .../acmpolicygenerator/ran-common.yaml | 1 + .../ran-group-du-sno-templated.yaml | 1 - .../RestartNetworkOperator.yaml | 67 +++++++++++++++++++ 9 files changed, 196 insertions(+), 2 deletions(-) create mode 100644 telco-core/configuration/reference-crs/required/networking/RestartNetworkOperator.yaml create mode 100644 telco-hub/configuration/reference-crs/required/networking/RestartNetworkOperator.yaml create mode 100644 telco-hub/configuration/reference-crs/required/networking/kustomization.yaml create mode 100644 telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/RestartNetworkOperator.yaml diff --git a/telco-core/configuration/core-baseline.yaml b/telco-core/configuration/core-baseline.yaml index dca442ab2..d4b3c32f4 100644 --- a/telco-core/configuration/core-baseline.yaml +++ b/telco-core/configuration/core-baseline.yaml @@ -110,6 +110,7 @@ policies: # Iptables-alerter disable configuration - path: reference-crs/required/networking/IptablesAlerterConfig.yaml + - path: reference-crs/required/networking/RestartNetworkOperator.yaml # Firewall node disruption policy - path: reference-crs/optional/networking/firewall/node-disruption-policy.yaml diff --git a/telco-core/configuration/reference-crs/required/networking/RestartNetworkOperator.yaml b/telco-core/configuration/reference-crs/required/networking/RestartNetworkOperator.yaml new file mode 100644 index 000000000..db8573fb8 --- /dev/null +++ b/telco-core/configuration/reference-crs/required/networking/RestartNetworkOperator.yaml @@ -0,0 +1,60 @@ +# required +# Job to restart network-operator after iptables-alerter-config ConfigMap is created +# Ensures the network operator picks up the new configuration (OCPBUGS-87026, OCPBUGS-73767) +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: network-operator-restarter + namespace: openshift-network-operator +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: network-operator-restarter + namespace: openshift-network-operator +rules: + - apiGroups: [""] + resources: ["pods"] + verbs: ["list", "delete"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: network-operator-restarter + namespace: openshift-network-operator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: network-operator-restarter +subjects: + - kind: ServiceAccount + name: network-operator-restarter + namespace: openshift-network-operator +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: restart-network-operator + namespace: openshift-network-operator +spec: + template: + spec: + serviceAccountName: network-operator-restarter + restartPolicy: OnFailure + containers: + - name: kubectl + image: image-registry.openshift-image-registry.svc:5000/openshift/cli:latest + command: + - /bin/bash + - -c + - | + # Delete network-operator pod to pick up iptables-alerter-config + oc delete pod -n openshift-network-operator -l name=network-operator --ignore-not-found=true + echo "Network operator pod deleted successfully" + nodeSelector: + node-role.kubernetes.io/master: "" + tolerations: + - effect: NoSchedule + key: node-role.kubernetes.io/master + operator: Exists diff --git a/telco-hub/configuration/kustomization.yaml b/telco-hub/configuration/kustomization.yaml index cecb282b8..b863a9a40 100644 --- a/telco-hub/configuration/kustomization.yaml +++ b/telco-hub/configuration/kustomization.yaml @@ -17,6 +17,7 @@ resources: # mandatory resources not managed by any overlay - reference-crs/required/talm/ + - reference-crs/required/networking/ # include this content if you want to include the argocd # configuration and apps for gitops ztp management of cluster diff --git a/telco-hub/configuration/reference-crs/required/networking/RestartNetworkOperator.yaml b/telco-hub/configuration/reference-crs/required/networking/RestartNetworkOperator.yaml new file mode 100644 index 000000000..db8573fb8 --- /dev/null +++ b/telco-hub/configuration/reference-crs/required/networking/RestartNetworkOperator.yaml @@ -0,0 +1,60 @@ +# required +# Job to restart network-operator after iptables-alerter-config ConfigMap is created +# Ensures the network operator picks up the new configuration (OCPBUGS-87026, OCPBUGS-73767) +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: network-operator-restarter + namespace: openshift-network-operator +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: network-operator-restarter + namespace: openshift-network-operator +rules: + - apiGroups: [""] + resources: ["pods"] + verbs: ["list", "delete"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: network-operator-restarter + namespace: openshift-network-operator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: network-operator-restarter +subjects: + - kind: ServiceAccount + name: network-operator-restarter + namespace: openshift-network-operator +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: restart-network-operator + namespace: openshift-network-operator +spec: + template: + spec: + serviceAccountName: network-operator-restarter + restartPolicy: OnFailure + containers: + - name: kubectl + image: image-registry.openshift-image-registry.svc:5000/openshift/cli:latest + command: + - /bin/bash + - -c + - | + # Delete network-operator pod to pick up iptables-alerter-config + oc delete pod -n openshift-network-operator -l name=network-operator --ignore-not-found=true + echo "Network operator pod deleted successfully" + nodeSelector: + node-role.kubernetes.io/master: "" + tolerations: + - effect: NoSchedule + key: node-role.kubernetes.io/master + operator: Exists diff --git a/telco-hub/configuration/reference-crs/required/networking/kustomization.yaml b/telco-hub/configuration/reference-crs/required/networking/kustomization.yaml new file mode 100644 index 000000000..eb2488e02 --- /dev/null +++ b/telco-hub/configuration/reference-crs/required/networking/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - IptablesAlerterConfig.yaml + - RestartNetworkOperator.yaml diff --git a/telco-ran/configuration/acmpolicygenerator/ran-common-mno.yaml b/telco-ran/configuration/acmpolicygenerator/ran-common-mno.yaml index 5c265f712..d4d1b1372 100644 --- a/telco-ran/configuration/acmpolicygenerator/ran-common-mno.yaml +++ b/telco-ran/configuration/acmpolicygenerator/ran-common-mno.yaml @@ -34,4 +34,3 @@ policies: ran.openshift.io/ztp-deploy-wave: "1" manifests: - path: source-crs/cluster-tuning/operator-hub/OperatorHub.yaml - - path: source-crs/cluster-tuning/iptables-alerter/IptablesAlerterConfig.yaml diff --git a/telco-ran/configuration/acmpolicygenerator/ran-common.yaml b/telco-ran/configuration/acmpolicygenerator/ran-common.yaml index 564bfeb15..e19526e2a 100644 --- a/telco-ran/configuration/acmpolicygenerator/ran-common.yaml +++ b/telco-ran/configuration/acmpolicygenerator/ran-common.yaml @@ -32,6 +32,7 @@ policies: manifests: - path: source-crs/cluster-tuning/monitoring-configuration/ReduceMonitoringFootprint.yaml - path: source-crs/cluster-tuning/iptables-alerter/IptablesAlerterConfig.yaml + - path: source-crs/cluster-tuning/iptables-alerter/RestartNetworkOperator.yaml - path: source-crs/disconnected-registry/DefaultCatsrc.yaml patches: - metadata: diff --git a/telco-ran/configuration/acmpolicygenerator/ran-group-du-sno-templated.yaml b/telco-ran/configuration/acmpolicygenerator/ran-group-du-sno-templated.yaml index df445b781..0782b7705 100644 --- a/telco-ran/configuration/acmpolicygenerator/ran-group-du-sno-templated.yaml +++ b/telco-ran/configuration/acmpolicygenerator/ran-group-du-sno-templated.yaml @@ -111,7 +111,6 @@ policies: ## - /dev/disk/by-partlabel/httpevent1 ## - /dev/disk/by-partlabel/httpevent2 - path: source-crs/cluster-tuning/disabling-network-diagnostics/DisableSnoNetworkDiag.yaml - - path: source-crs/cluster-tuning/iptables-alerter/IptablesAlerterConfig.yaml # PerformanceProfile.yaml is architecture-specific. Replace x86_64 with aarch64 for ARM deployments - path: source-crs/node-tuning-operator/x86_64/PerformanceProfile-SetSelector.yaml patches: diff --git a/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/RestartNetworkOperator.yaml b/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/RestartNetworkOperator.yaml new file mode 100644 index 000000000..f99276acb --- /dev/null +++ b/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/RestartNetworkOperator.yaml @@ -0,0 +1,67 @@ +# Job to restart network-operator after iptables-alerter-config ConfigMap is created +# This ensures the network operator picks up the new configuration +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: network-operator-restarter + namespace: openshift-network-operator + annotations: + ran.openshift.io/ztp-deploy-wave: "100" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: network-operator-restarter + namespace: openshift-network-operator + annotations: + ran.openshift.io/ztp-deploy-wave: "100" +rules: + - apiGroups: [""] + resources: ["pods"] + verbs: ["list", "delete"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: network-operator-restarter + namespace: openshift-network-operator + annotations: + ran.openshift.io/ztp-deploy-wave: "100" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: network-operator-restarter +subjects: + - kind: ServiceAccount + name: network-operator-restarter + namespace: openshift-network-operator +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: restart-network-operator + namespace: openshift-network-operator + annotations: + ran.openshift.io/ztp-deploy-wave: "100" +spec: + template: + spec: + serviceAccountName: network-operator-restarter + restartPolicy: OnFailure + containers: + - name: kubectl + image: image-registry.openshift-image-registry.svc:5000/openshift/cli:latest + command: + - /bin/bash + - -c + - | + # Delete network-operator pod to pick up iptables-alerter-config + oc delete pod -n openshift-network-operator -l name=network-operator --ignore-not-found=true + echo "Network operator pod deleted successfully" + nodeSelector: + node-role.kubernetes.io/master: "" + tolerations: + - effect: NoSchedule + key: node-role.kubernetes.io/master + operator: Exists From 799321547e9bedaf090468d588cb7c091a923783 Mon Sep 17 00:00:00 2001 From: Kevin Tsai Date: Wed, 9 Sep 2026 12:27:06 -0700 Subject: [PATCH 4/6] CNF-25757: Split RestartNetworkOperator into separate files Address PR review feedback: 1. Split into separate files following ClusterLogging pattern: - NetworkOperatorRestarterSA.yaml (ServiceAccount) - NetworkOperatorRestarterRole.yaml (Role) - NetworkOperatorRestarterRoleBinding.yaml (RoleBinding) - RestartNetworkOperatorJob.yaml (Job) 2. Add ConfigMap existence check: - Check once if iptables-alerter-config ConfigMap exists - Exit with error if ConfigMap not found - Check if network-operator pod exists before deleting 3. Image registry: - Using image-registry.openshift-image-registry.svc:5000/openshift/cli:latest - This is the internal OpenShift registry, available in disconnected setups - The cli:latest image is part of the core OpenShift install payload Applied to all deployment paths: - telco-core (Core clusters via ACM PolicyGenerator) - telco-hub (Hub clusters via Kustomize) - telco-ran (RAN clusters via ZTP PolicyGenerator) Co-Authored-By: Claude Sonnet 4.5 Signed-off-by: Kevin Tsai --- telco-core/configuration/core-baseline.yaml | 5 +- .../NetworkOperatorRestarterRole.yaml | 12 ++++ .../NetworkOperatorRestarterRoleBinding.yaml | 16 +++++ .../NetworkOperatorRestarterSA.yaml | 8 +++ ...or.yaml => RestartNetworkOperatorJob.yaml} | 46 ++++--------- .../NetworkOperatorRestarterRole.yaml | 12 ++++ .../NetworkOperatorRestarterRoleBinding.yaml | 16 +++++ .../NetworkOperatorRestarterSA.yaml | 8 +++ ...or.yaml => RestartNetworkOperatorJob.yaml} | 46 ++++--------- .../required/networking/kustomization.yaml | 5 +- .../acmpolicygenerator/ran-common.yaml | 5 +- .../NetworkOperatorRestarterRole.yaml | 13 ++++ .../NetworkOperatorRestarterRoleBinding.yaml | 17 +++++ .../NetworkOperatorRestarterSA.yaml | 9 +++ .../RestartNetworkOperator.yaml | 67 ------------------- .../RestartNetworkOperatorJob.yaml | 43 ++++++++++++ 16 files changed, 194 insertions(+), 134 deletions(-) create mode 100644 telco-core/configuration/reference-crs/required/networking/NetworkOperatorRestarterRole.yaml create mode 100644 telco-core/configuration/reference-crs/required/networking/NetworkOperatorRestarterRoleBinding.yaml create mode 100644 telco-core/configuration/reference-crs/required/networking/NetworkOperatorRestarterSA.yaml rename telco-core/configuration/reference-crs/required/networking/{RestartNetworkOperator.yaml => RestartNetworkOperatorJob.yaml} (50%) create mode 100644 telco-hub/configuration/reference-crs/required/networking/NetworkOperatorRestarterRole.yaml create mode 100644 telco-hub/configuration/reference-crs/required/networking/NetworkOperatorRestarterRoleBinding.yaml create mode 100644 telco-hub/configuration/reference-crs/required/networking/NetworkOperatorRestarterSA.yaml rename telco-hub/configuration/reference-crs/required/networking/{RestartNetworkOperator.yaml => RestartNetworkOperatorJob.yaml} (50%) create mode 100644 telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/NetworkOperatorRestarterRole.yaml create mode 100644 telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/NetworkOperatorRestarterRoleBinding.yaml create mode 100644 telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/NetworkOperatorRestarterSA.yaml delete mode 100644 telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/RestartNetworkOperator.yaml create mode 100644 telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/RestartNetworkOperatorJob.yaml diff --git a/telco-core/configuration/core-baseline.yaml b/telco-core/configuration/core-baseline.yaml index d4b3c32f4..2daf97f4f 100644 --- a/telco-core/configuration/core-baseline.yaml +++ b/telco-core/configuration/core-baseline.yaml @@ -110,7 +110,10 @@ policies: # Iptables-alerter disable configuration - path: reference-crs/required/networking/IptablesAlerterConfig.yaml - - path: reference-crs/required/networking/RestartNetworkOperator.yaml + - path: reference-crs/required/networking/NetworkOperatorRestarterSA.yaml + - path: reference-crs/required/networking/NetworkOperatorRestarterRole.yaml + - path: reference-crs/required/networking/NetworkOperatorRestarterRoleBinding.yaml + - path: reference-crs/required/networking/RestartNetworkOperatorJob.yaml # Firewall node disruption policy - path: reference-crs/optional/networking/firewall/node-disruption-policy.yaml diff --git a/telco-core/configuration/reference-crs/required/networking/NetworkOperatorRestarterRole.yaml b/telco-core/configuration/reference-crs/required/networking/NetworkOperatorRestarterRole.yaml new file mode 100644 index 000000000..92433e0aa --- /dev/null +++ b/telco-core/configuration/reference-crs/required/networking/NetworkOperatorRestarterRole.yaml @@ -0,0 +1,12 @@ +# required +# Role for network-operator restart Job (OCPBUGS-87026, OCPBUGS-73767) +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: network-operator-restarter + namespace: openshift-network-operator +rules: + - apiGroups: [""] + resources: ["pods"] + verbs: ["list", "delete"] diff --git a/telco-core/configuration/reference-crs/required/networking/NetworkOperatorRestarterRoleBinding.yaml b/telco-core/configuration/reference-crs/required/networking/NetworkOperatorRestarterRoleBinding.yaml new file mode 100644 index 000000000..dde95a446 --- /dev/null +++ b/telco-core/configuration/reference-crs/required/networking/NetworkOperatorRestarterRoleBinding.yaml @@ -0,0 +1,16 @@ +# required +# RoleBinding for network-operator restart Job (OCPBUGS-87026, OCPBUGS-73767) +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: network-operator-restarter + namespace: openshift-network-operator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: network-operator-restarter +subjects: + - kind: ServiceAccount + name: network-operator-restarter + namespace: openshift-network-operator diff --git a/telco-core/configuration/reference-crs/required/networking/NetworkOperatorRestarterSA.yaml b/telco-core/configuration/reference-crs/required/networking/NetworkOperatorRestarterSA.yaml new file mode 100644 index 000000000..99be66ed7 --- /dev/null +++ b/telco-core/configuration/reference-crs/required/networking/NetworkOperatorRestarterSA.yaml @@ -0,0 +1,8 @@ +# required +# ServiceAccount for network-operator restart Job (OCPBUGS-87026, OCPBUGS-73767) +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: network-operator-restarter + namespace: openshift-network-operator diff --git a/telco-core/configuration/reference-crs/required/networking/RestartNetworkOperator.yaml b/telco-core/configuration/reference-crs/required/networking/RestartNetworkOperatorJob.yaml similarity index 50% rename from telco-core/configuration/reference-crs/required/networking/RestartNetworkOperator.yaml rename to telco-core/configuration/reference-crs/required/networking/RestartNetworkOperatorJob.yaml index db8573fb8..6907b4384 100644 --- a/telco-core/configuration/reference-crs/required/networking/RestartNetworkOperator.yaml +++ b/telco-core/configuration/reference-crs/required/networking/RestartNetworkOperatorJob.yaml @@ -2,36 +2,6 @@ # Job to restart network-operator after iptables-alerter-config ConfigMap is created # Ensures the network operator picks up the new configuration (OCPBUGS-87026, OCPBUGS-73767) --- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: network-operator-restarter - namespace: openshift-network-operator ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: network-operator-restarter - namespace: openshift-network-operator -rules: - - apiGroups: [""] - resources: ["pods"] - verbs: ["list", "delete"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: network-operator-restarter - namespace: openshift-network-operator -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: network-operator-restarter -subjects: - - kind: ServiceAccount - name: network-operator-restarter - namespace: openshift-network-operator ---- apiVersion: batch/v1 kind: Job metadata: @@ -49,9 +19,21 @@ spec: - /bin/bash - -c - | + # Check if iptables-alerter-config ConfigMap exists + if ! oc get configmap iptables-alerter-config -n openshift-network-operator &>/dev/null; then + echo "ERROR: iptables-alerter-config ConfigMap not found" + exit 1 + fi + echo "ConfigMap iptables-alerter-config found" + # Delete network-operator pod to pick up iptables-alerter-config - oc delete pod -n openshift-network-operator -l name=network-operator --ignore-not-found=true - echo "Network operator pod deleted successfully" + # Check if pod exists before deleting + if oc get pod -n openshift-network-operator -l name=network-operator --no-headers 2>/dev/null | grep -q .; then + oc delete pod -n openshift-network-operator -l name=network-operator --ignore-not-found=true + echo "Network operator pod deleted successfully" + else + echo "No network-operator pods found, nothing to delete" + fi nodeSelector: node-role.kubernetes.io/master: "" tolerations: diff --git a/telco-hub/configuration/reference-crs/required/networking/NetworkOperatorRestarterRole.yaml b/telco-hub/configuration/reference-crs/required/networking/NetworkOperatorRestarterRole.yaml new file mode 100644 index 000000000..92433e0aa --- /dev/null +++ b/telco-hub/configuration/reference-crs/required/networking/NetworkOperatorRestarterRole.yaml @@ -0,0 +1,12 @@ +# required +# Role for network-operator restart Job (OCPBUGS-87026, OCPBUGS-73767) +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: network-operator-restarter + namespace: openshift-network-operator +rules: + - apiGroups: [""] + resources: ["pods"] + verbs: ["list", "delete"] diff --git a/telco-hub/configuration/reference-crs/required/networking/NetworkOperatorRestarterRoleBinding.yaml b/telco-hub/configuration/reference-crs/required/networking/NetworkOperatorRestarterRoleBinding.yaml new file mode 100644 index 000000000..dde95a446 --- /dev/null +++ b/telco-hub/configuration/reference-crs/required/networking/NetworkOperatorRestarterRoleBinding.yaml @@ -0,0 +1,16 @@ +# required +# RoleBinding for network-operator restart Job (OCPBUGS-87026, OCPBUGS-73767) +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: network-operator-restarter + namespace: openshift-network-operator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: network-operator-restarter +subjects: + - kind: ServiceAccount + name: network-operator-restarter + namespace: openshift-network-operator diff --git a/telco-hub/configuration/reference-crs/required/networking/NetworkOperatorRestarterSA.yaml b/telco-hub/configuration/reference-crs/required/networking/NetworkOperatorRestarterSA.yaml new file mode 100644 index 000000000..99be66ed7 --- /dev/null +++ b/telco-hub/configuration/reference-crs/required/networking/NetworkOperatorRestarterSA.yaml @@ -0,0 +1,8 @@ +# required +# ServiceAccount for network-operator restart Job (OCPBUGS-87026, OCPBUGS-73767) +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: network-operator-restarter + namespace: openshift-network-operator diff --git a/telco-hub/configuration/reference-crs/required/networking/RestartNetworkOperator.yaml b/telco-hub/configuration/reference-crs/required/networking/RestartNetworkOperatorJob.yaml similarity index 50% rename from telco-hub/configuration/reference-crs/required/networking/RestartNetworkOperator.yaml rename to telco-hub/configuration/reference-crs/required/networking/RestartNetworkOperatorJob.yaml index db8573fb8..6907b4384 100644 --- a/telco-hub/configuration/reference-crs/required/networking/RestartNetworkOperator.yaml +++ b/telco-hub/configuration/reference-crs/required/networking/RestartNetworkOperatorJob.yaml @@ -2,36 +2,6 @@ # Job to restart network-operator after iptables-alerter-config ConfigMap is created # Ensures the network operator picks up the new configuration (OCPBUGS-87026, OCPBUGS-73767) --- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: network-operator-restarter - namespace: openshift-network-operator ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: network-operator-restarter - namespace: openshift-network-operator -rules: - - apiGroups: [""] - resources: ["pods"] - verbs: ["list", "delete"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: network-operator-restarter - namespace: openshift-network-operator -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: network-operator-restarter -subjects: - - kind: ServiceAccount - name: network-operator-restarter - namespace: openshift-network-operator ---- apiVersion: batch/v1 kind: Job metadata: @@ -49,9 +19,21 @@ spec: - /bin/bash - -c - | + # Check if iptables-alerter-config ConfigMap exists + if ! oc get configmap iptables-alerter-config -n openshift-network-operator &>/dev/null; then + echo "ERROR: iptables-alerter-config ConfigMap not found" + exit 1 + fi + echo "ConfigMap iptables-alerter-config found" + # Delete network-operator pod to pick up iptables-alerter-config - oc delete pod -n openshift-network-operator -l name=network-operator --ignore-not-found=true - echo "Network operator pod deleted successfully" + # Check if pod exists before deleting + if oc get pod -n openshift-network-operator -l name=network-operator --no-headers 2>/dev/null | grep -q .; then + oc delete pod -n openshift-network-operator -l name=network-operator --ignore-not-found=true + echo "Network operator pod deleted successfully" + else + echo "No network-operator pods found, nothing to delete" + fi nodeSelector: node-role.kubernetes.io/master: "" tolerations: diff --git a/telco-hub/configuration/reference-crs/required/networking/kustomization.yaml b/telco-hub/configuration/reference-crs/required/networking/kustomization.yaml index eb2488e02..434a4a994 100644 --- a/telco-hub/configuration/reference-crs/required/networking/kustomization.yaml +++ b/telco-hub/configuration/reference-crs/required/networking/kustomization.yaml @@ -3,4 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - IptablesAlerterConfig.yaml - - RestartNetworkOperator.yaml + - NetworkOperatorRestarterSA.yaml + - NetworkOperatorRestarterRole.yaml + - NetworkOperatorRestarterRoleBinding.yaml + - RestartNetworkOperatorJob.yaml diff --git a/telco-ran/configuration/acmpolicygenerator/ran-common.yaml b/telco-ran/configuration/acmpolicygenerator/ran-common.yaml index e19526e2a..474e6c8f5 100644 --- a/telco-ran/configuration/acmpolicygenerator/ran-common.yaml +++ b/telco-ran/configuration/acmpolicygenerator/ran-common.yaml @@ -32,7 +32,10 @@ policies: manifests: - path: source-crs/cluster-tuning/monitoring-configuration/ReduceMonitoringFootprint.yaml - path: source-crs/cluster-tuning/iptables-alerter/IptablesAlerterConfig.yaml - - path: source-crs/cluster-tuning/iptables-alerter/RestartNetworkOperator.yaml + - path: source-crs/cluster-tuning/iptables-alerter/NetworkOperatorRestarterSA.yaml + - path: source-crs/cluster-tuning/iptables-alerter/NetworkOperatorRestarterRole.yaml + - path: source-crs/cluster-tuning/iptables-alerter/NetworkOperatorRestarterRoleBinding.yaml + - path: source-crs/cluster-tuning/iptables-alerter/RestartNetworkOperatorJob.yaml - path: source-crs/disconnected-registry/DefaultCatsrc.yaml patches: - metadata: diff --git a/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/NetworkOperatorRestarterRole.yaml b/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/NetworkOperatorRestarterRole.yaml new file mode 100644 index 000000000..70968ea58 --- /dev/null +++ b/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/NetworkOperatorRestarterRole.yaml @@ -0,0 +1,13 @@ +# Role for network-operator restart Job (OCPBUGS-87026, OCPBUGS-73767) +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: network-operator-restarter + namespace: openshift-network-operator + annotations: + ran.openshift.io/ztp-deploy-wave: "10" +rules: + - apiGroups: [""] + resources: ["pods"] + verbs: ["list", "delete"] diff --git a/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/NetworkOperatorRestarterRoleBinding.yaml b/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/NetworkOperatorRestarterRoleBinding.yaml new file mode 100644 index 000000000..62e9abd2c --- /dev/null +++ b/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/NetworkOperatorRestarterRoleBinding.yaml @@ -0,0 +1,17 @@ +# RoleBinding for network-operator restart Job (OCPBUGS-87026, OCPBUGS-73767) +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: network-operator-restarter + namespace: openshift-network-operator + annotations: + ran.openshift.io/ztp-deploy-wave: "10" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: network-operator-restarter +subjects: + - kind: ServiceAccount + name: network-operator-restarter + namespace: openshift-network-operator diff --git a/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/NetworkOperatorRestarterSA.yaml b/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/NetworkOperatorRestarterSA.yaml new file mode 100644 index 000000000..9836d5bf9 --- /dev/null +++ b/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/NetworkOperatorRestarterSA.yaml @@ -0,0 +1,9 @@ +# ServiceAccount for network-operator restart Job (OCPBUGS-87026, OCPBUGS-73767) +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: network-operator-restarter + namespace: openshift-network-operator + annotations: + ran.openshift.io/ztp-deploy-wave: "10" diff --git a/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/RestartNetworkOperator.yaml b/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/RestartNetworkOperator.yaml deleted file mode 100644 index f99276acb..000000000 --- a/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/RestartNetworkOperator.yaml +++ /dev/null @@ -1,67 +0,0 @@ -# Job to restart network-operator after iptables-alerter-config ConfigMap is created -# This ensures the network operator picks up the new configuration ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: network-operator-restarter - namespace: openshift-network-operator - annotations: - ran.openshift.io/ztp-deploy-wave: "100" ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: network-operator-restarter - namespace: openshift-network-operator - annotations: - ran.openshift.io/ztp-deploy-wave: "100" -rules: - - apiGroups: [""] - resources: ["pods"] - verbs: ["list", "delete"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: network-operator-restarter - namespace: openshift-network-operator - annotations: - ran.openshift.io/ztp-deploy-wave: "100" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: network-operator-restarter -subjects: - - kind: ServiceAccount - name: network-operator-restarter - namespace: openshift-network-operator ---- -apiVersion: batch/v1 -kind: Job -metadata: - name: restart-network-operator - namespace: openshift-network-operator - annotations: - ran.openshift.io/ztp-deploy-wave: "100" -spec: - template: - spec: - serviceAccountName: network-operator-restarter - restartPolicy: OnFailure - containers: - - name: kubectl - image: image-registry.openshift-image-registry.svc:5000/openshift/cli:latest - command: - - /bin/bash - - -c - - | - # Delete network-operator pod to pick up iptables-alerter-config - oc delete pod -n openshift-network-operator -l name=network-operator --ignore-not-found=true - echo "Network operator pod deleted successfully" - nodeSelector: - node-role.kubernetes.io/master: "" - tolerations: - - effect: NoSchedule - key: node-role.kubernetes.io/master - operator: Exists diff --git a/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/RestartNetworkOperatorJob.yaml b/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/RestartNetworkOperatorJob.yaml new file mode 100644 index 000000000..be78f1fce --- /dev/null +++ b/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/RestartNetworkOperatorJob.yaml @@ -0,0 +1,43 @@ +# Job to restart network-operator after iptables-alerter-config ConfigMap is created +# Ensures the network operator picks up the new configuration (OCPBUGS-87026, OCPBUGS-73767) +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: restart-network-operator + namespace: openshift-network-operator + annotations: + ran.openshift.io/ztp-deploy-wave: "100" +spec: + template: + spec: + serviceAccountName: network-operator-restarter + restartPolicy: OnFailure + containers: + - name: kubectl + image: image-registry.openshift-image-registry.svc:5000/openshift/cli:latest + command: + - /bin/bash + - -c + - | + # Check if iptables-alerter-config ConfigMap exists + if ! oc get configmap iptables-alerter-config -n openshift-network-operator &>/dev/null; then + echo "ERROR: iptables-alerter-config ConfigMap not found" + exit 1 + fi + echo "ConfigMap iptables-alerter-config found" + + # Delete network-operator pod to pick up iptables-alerter-config + # Check if pod exists before deleting + if oc get pod -n openshift-network-operator -l name=network-operator --no-headers 2>/dev/null | grep -q .; then + oc delete pod -n openshift-network-operator -l name=network-operator --ignore-not-found=true + echo "Network operator pod deleted successfully" + else + echo "No network-operator pods found, nothing to delete" + fi + nodeSelector: + node-role.kubernetes.io/master: "" + tolerations: + - effect: NoSchedule + key: node-role.kubernetes.io/master + operator: Exists From fbc36b94ac1db063bbe133e8466f50f2d423136d Mon Sep 17 00:00:00 2001 From: Kevin Tsai Date: Wed, 9 Sep 2026 13:44:19 -0700 Subject: [PATCH 5/6] CNF-25757: Use registry.redhat.io image for disconnected support Change image reference from internal registry to registry.redhat.io: - Old: image-registry.openshift-image-registry.svc:5000/openshift/cli:latest - New: registry.redhat.io/openshift4/ose-cli:latest - Added: imagePullPolicy: IfNotPresent Works in both connected and disconnected environments: - Connected: Pulls from registry.redhat.io - Disconnected: ImageDigestMirrorSet auto-redirects to local mirrors The internal registry service doesn't exist when managementState is set to Removed, which is common in telco deployments. Co-Authored-By: Claude Sonnet 4.5 Signed-off-by: Kevin Tsai --- .../required/networking/RestartNetworkOperatorJob.yaml | 3 ++- .../required/networking/RestartNetworkOperatorJob.yaml | 3 ++- .../iptables-alerter/RestartNetworkOperatorJob.yaml | 3 ++- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/telco-core/configuration/reference-crs/required/networking/RestartNetworkOperatorJob.yaml b/telco-core/configuration/reference-crs/required/networking/RestartNetworkOperatorJob.yaml index 6907b4384..7101e2d12 100644 --- a/telco-core/configuration/reference-crs/required/networking/RestartNetworkOperatorJob.yaml +++ b/telco-core/configuration/reference-crs/required/networking/RestartNetworkOperatorJob.yaml @@ -14,7 +14,8 @@ spec: restartPolicy: OnFailure containers: - name: kubectl - image: image-registry.openshift-image-registry.svc:5000/openshift/cli:latest + image: registry.redhat.io/openshift4/ose-cli:latest + imagePullPolicy: IfNotPresent command: - /bin/bash - -c diff --git a/telco-hub/configuration/reference-crs/required/networking/RestartNetworkOperatorJob.yaml b/telco-hub/configuration/reference-crs/required/networking/RestartNetworkOperatorJob.yaml index 6907b4384..7101e2d12 100644 --- a/telco-hub/configuration/reference-crs/required/networking/RestartNetworkOperatorJob.yaml +++ b/telco-hub/configuration/reference-crs/required/networking/RestartNetworkOperatorJob.yaml @@ -14,7 +14,8 @@ spec: restartPolicy: OnFailure containers: - name: kubectl - image: image-registry.openshift-image-registry.svc:5000/openshift/cli:latest + image: registry.redhat.io/openshift4/ose-cli:latest + imagePullPolicy: IfNotPresent command: - /bin/bash - -c diff --git a/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/RestartNetworkOperatorJob.yaml b/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/RestartNetworkOperatorJob.yaml index be78f1fce..c615dd53d 100644 --- a/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/RestartNetworkOperatorJob.yaml +++ b/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/RestartNetworkOperatorJob.yaml @@ -15,7 +15,8 @@ spec: restartPolicy: OnFailure containers: - name: kubectl - image: image-registry.openshift-image-registry.svc:5000/openshift/cli:latest + image: registry.redhat.io/openshift4/ose-cli:latest + imagePullPolicy: IfNotPresent command: - /bin/bash - -c From 70a0940475b58d88904f645612ea170fa26ee5c2 Mon Sep 17 00:00:00 2001 From: Kevin Tsai Date: Fri, 11 Sep 2026 13:28:43 -0700 Subject: [PATCH 6/6] Grant get access to configmaps in all three restarter Roles. --- .../required/networking/NetworkOperatorRestarterRole.yaml | 3 +++ .../required/networking/NetworkOperatorRestarterRole.yaml | 3 +++ .../iptables-alerter/NetworkOperatorRestarterRole.yaml | 3 +++ 3 files changed, 9 insertions(+) diff --git a/telco-core/configuration/reference-crs/required/networking/NetworkOperatorRestarterRole.yaml b/telco-core/configuration/reference-crs/required/networking/NetworkOperatorRestarterRole.yaml index 92433e0aa..a66d00409 100644 --- a/telco-core/configuration/reference-crs/required/networking/NetworkOperatorRestarterRole.yaml +++ b/telco-core/configuration/reference-crs/required/networking/NetworkOperatorRestarterRole.yaml @@ -10,3 +10,6 @@ rules: - apiGroups: [""] resources: ["pods"] verbs: ["list", "delete"] + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["get"] diff --git a/telco-hub/configuration/reference-crs/required/networking/NetworkOperatorRestarterRole.yaml b/telco-hub/configuration/reference-crs/required/networking/NetworkOperatorRestarterRole.yaml index 92433e0aa..a66d00409 100644 --- a/telco-hub/configuration/reference-crs/required/networking/NetworkOperatorRestarterRole.yaml +++ b/telco-hub/configuration/reference-crs/required/networking/NetworkOperatorRestarterRole.yaml @@ -10,3 +10,6 @@ rules: - apiGroups: [""] resources: ["pods"] verbs: ["list", "delete"] + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["get"] diff --git a/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/NetworkOperatorRestarterRole.yaml b/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/NetworkOperatorRestarterRole.yaml index 70968ea58..a9376d644 100644 --- a/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/NetworkOperatorRestarterRole.yaml +++ b/telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/NetworkOperatorRestarterRole.yaml @@ -11,3 +11,6 @@ rules: - apiGroups: [""] resources: ["pods"] verbs: ["list", "delete"] + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["get"]