[release-5.0] CORS-4308: Enable Network Observability during installation

[openshift-cherrypick-robot]

This is an automated cherry-pick of #10382

/assign stleerh

Summary by CodeRabbit

• New Features

  • Added network observability settings to installation configuration.
  • Supported policies now include installing and enabling network observability or taking no action.

• Bug Fixes

  • Network observability settings are now included in generated network configuration when provided.
  • Added validation for required and supported installation policies, with clear handling of invalid values.

• Tests

  • Added coverage for valid, invalid, missing, blank, and omitted network observability policies.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@openshift-cherrypick-robot: Ignoring requests to cherry-pick non-bug issues: CORS-4308

Details

In response to this:

This is an automated cherry-pick of #10382

/assign stleerh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: aaa26b7e-6d6b-4e7d-957a-086ba050e1d4

📥 Commits

Reviewing files that changed from the base of the PR and between 601907d and 05a6358.

⛔ Files ignored due to path filters (2)

• data/data/install.openshift.io_installconfigs.yaml is excluded by !data/data/install.openshift.io_installconfigs.yaml
• pkg/types/zz_generated.deepcopy.go is excluded by !**/zz_generated*

📒 Files selected for processing (5)

• pkg/asset/manifests/network.go
• pkg/types/defaults/installconfig.go
• pkg/types/installconfig.go
• pkg/types/validation/installconfig.go
• pkg/types/validation/installconfig_test.go

💤 Files with no reviewable changes (1)

• pkg/types/defaults/installconfig.go

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

Changes

Network observability configuration

Layer / File(s)	Summary
Networking configuration contract pkg/types/installconfig.go	Adds optional NetworkObservability configuration and installation policy values: InstallAndEnable and NoAction.
Installation policy validation pkg/types/validation/installconfig.go, pkg/types/validation/installconfig_test.go	Requires installationPolicy when configured and validates supported values. Tests cover valid, invalid, missing, blank, and omitted configurations.
Network manifest propagation pkg/asset/manifests/network.go	Builds networkSpec separately and conditionally passes the installation policy to the generated Network.Spec.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 05a63

The current change has no identified merge-blocking risk and is ready to proceed through normal checks and review.

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 4 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: enabling Network Observability during installation. The release branch and issue identifier add useful context.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS: The pull request adds six table-driven Go test names. Each name is a static literal describing a network observability policy case. The names do not include pod names, timestamps, UUIDs, node na…
Test Structure And Quality	✅ Passed	PASS. The PR changes a standard Go testing table in pkg/types/validation/installconfig_test.go; it adds no Ginkgo It blocks, cluster resources, or wait operations. Each added case checks one net…
Microshift Test Compatibility	✅ Passed	PASS: The PR adds only table-driven testing.T cases in pkg/types/validation/installconfig_test.go. The PR diff adds no Ginkgo It, Describe, Context, or When e2e tests. The MicroShift compa…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The PR adds no new Ginkgo e2e tests. The only test changes are table-driven cases in pkg/types/validation/installconfig_test.go, and the changed files contain no new It(), Describe(), `Con…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The pull request does not introduce topology-dependent scheduling constraints. Its manifest change only copies networkObservability.installationPolicy into the cluster Network resource. The …
Ote Binary Stdout Contract	✅ Passed	PASS: The pull request adds no process-level stdout writes. The changed production code only assembles and validates network configuration, and the generated deepcopy code performs data copying. The o…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request adds no Ginkgo e2e tests. The changed test code extends the standard Go TestValidateInstallConfig table and only validates configuration values. It adds no IPv4 assumptions or…
No-Weak-Crypto	✅ Passed	PASS — The complete PR diff adds network observability configuration, validation, manifest propagation, and deepcopy logic. It introduces no MD5, SHA1, DES, RC4, 3DES, Blowfish, or ECB usage, no custo…
Container-Privileges	✅ Passed	PASS: The pull request adds an install-config field and copies its policy into the cluster Network custom resource. The complete diff adds no privileged: true, hostPID, hostNetwork, hostIPC, `…
No-Sensitive-Data-In-Logs	✅ Passed	PASS — The pull request introduces no new logging. The changed implementation only assembles and YAML-marshals a Network manifest, and the new validation returns enum errors for InstallAndEnable and…

Full details: Stable And Deterministic Test Names

Explanation

PASS: The pull request adds six table-driven Go test names. Each name is a static literal describing a network observability policy case. The names do not include pod names, timestamps, UUIDs, node names, namespaces, IP addresses, or generated values. The tests use t.Run, not Ginkgo title expressions, and the test body supplies the policy values separately.

Full details: Test Structure And Quality

Explanation

PASS. The PR changes a standard Go testing table in pkg/types/validation/installconfig_test.go; it adds no Ginkgo It blocks, cluster resources, or wait operations. Each added case checks one network observability validation behavior and follows the package's existing t.Run and testify/assert table-driven pattern. The shared assertion runner predates this PR, so its unchanged message style is not introduced by these changes.

Full details: Microshift Test Compatibility

Explanation

PASS: The PR adds only table-driven testing.T cases in pkg/types/validation/installconfig_test.go. The PR diff adds no Ginkgo It, Describe, Context, or When e2e tests. The MicroShift compatibility check is therefore not applicable.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS: The PR adds no new Ginkgo e2e tests. The only test changes are table-driven cases in pkg/types/validation/installconfig_test.go, and the changed files contain no new It(), Describe(), Context(), or When() declarations. The SNO multi-node compatibility check is therefore not applicable.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS: The pull request does not introduce topology-dependent scheduling constraints. Its manifest change only copies networkObservability.installationPolicy into the cluster Network resource. The remaining changes update install-config types, validation, schema, and deepcopy code. The diff adds no workload, replica, affinity, topology spread, node selector, toleration, or PDB configuration.

Full details: Ote Binary Stdout Contract

Explanation

PASS: The pull request adds no process-level stdout writes. The changed production code only assembles and validates network configuration, and the generated deepcopy code performs data copying. The only fmt.Println found in a changed file is pre-existing and runs inside a TestValidateInstallConfig test-case initializer, not main or suite setup. No added fmt.Print*, klog, Ginkgo setup output, or logging configuration was found in the diff.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS: The pull request adds no Ginkgo e2e tests. The changed test code extends the standard Go TestValidateInstallConfig table and only validates configuration values. It adds no IPv4 assumptions or external connectivity requirements. Existing IPv4 literals in shared test fixtures are outside the added hunks.

Full details: No-Weak-Crypto

Explanation

PASS — The complete PR diff adds network observability configuration, validation, manifest propagation, and deepcopy logic. It introduces no MD5, SHA1, DES, RC4, 3DES, Blowfish, or ECB usage, no custom cryptography, and no secret or token comparisons. The crypto-related code found in the changed files is pre-existing and unchanged.

Full details: Container-Privileges

Explanation

PASS: The pull request adds an install-config field and copies its policy into the cluster Network custom resource. The complete diff adds no privileged: true, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation: true, or root execution setting. The changed YAML is an install-config schema and contains only networkObservability.installationPolicy; no container or pod manifest changes are present.

Full details: No-Sensitive-Data-In-Logs

Explanation

PASS — The pull request introduces no new logging. The changed implementation only assembles and YAML-marshals a Network manifest, and the new validation returns enum errors for InstallAndEnable and NoAction. Searches across the complete diff and changed implementation found no added log, print, or logger call and no password, token, API key, PII, session ID, hostname, or customer-data value emitted to logs. Existing logging calls are unchanged.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Some tools did not complete. Review the errors below.

🔧 golangci-lint (2.12.2)

Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions
The command is terminated due to an error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign mtulio for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@openshift-cherrypick-robot: This pull request references CORS-4308 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

This is an automated cherry-pick of #10382

/assign stleerh

Summary by CodeRabbit

• New Features

• Added network observability settings to installation configuration.

• Supported policies now include installing and enabling network observability or taking no action.

• Bug Fixes

• Network observability settings are now included in generated network configuration when provided.

• Added validation for required and supported installation policies, with clear handling of invalid values.

• Tests

• Added coverage for valid, invalid, missing, blank, and omitted network observability policies.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@openshift-cherrypick-robot: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[stleerh]

Ignore