chore(rosaeng-8224): reapply openshift-ingress network policies for HCPs - #2775
Merged
openshift-merge-bot[bot] merged 1 commit intoJun 4, 2026
Merged
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (3)
📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughThis PR adds a network policy deployment targeting canary service clusters. It combines a SelectorSyncSet cluster selector configuration with an OCM Policy that enforces network segmentation in hosted control plane namespaces, selecting traffic sources by namespace labels and binding the policy to management clusters for orchestration. ChangesNetwork Policy Deployment for Canary Service Clusters
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 5 | ❌ 10❌ Failed checks (10 inconclusive)
✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Review ran into problems🔥 ProblemsGit: Failed to clone repository. Please run the Comment |
Contributor
Author
|
/hold |
openshift-ci
Bot
added
the
do-not-merge/hold
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@deploy/rosaeng-8224/config.yaml`:
- Around line 2-11: Update the clusterSelectors.matchExpressions to include the
required selector keys so the policy is scoped to product/platform/FedRAMP;
specifically add expressions for "api.openshift.com/product",
"hive.openshift.io/cluster-platform", and "api.openshift.com/fedramp" (using
operator: In and appropriate allowed values for your deployment), alongside the
existing "hypershift.open-cluster-management.io/management-cluster" and
"ext-hypershift.openshift.io/cluster-sector" entries; ensure these keys are
added within the same matchExpressions array in the config handling
clusterSelectors so the policy only targets clusters that meet all required
selectors.
In `@deploy/rosaeng-8224/rosaeng-8224.Policy.yaml`:
- Around line 10-11: The check using index .metadata.labels
"hypershift.openshift.io/hosted-control-plane" can panic when .metadata.labels
is nil; fix by defaulting the labels map to an empty dict before indexing
(create a local variable, e.g. $labels := .metadata.labels | default dict) and
then use index $labels "hypershift.openshift.io/hosted-control-plane" in the if
condition so the template is nil-safe.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 52c09514-784b-4ebe-9941-3abbbe7f1aa1
⛔ Files ignored due to path filters (3)
hack/00-osd-managed-cluster-config-integration.yaml.tmplis excluded by!hack/**hack/00-osd-managed-cluster-config-production.yaml.tmplis excluded by!hack/**hack/00-osd-managed-cluster-config-stage.yaml.tmplis excluded by!hack/**
📒 Files selected for processing (4)
deploy/acm-policies/50-GENERATED-rosaeng-8224.Policy.yamldeploy/rosaeng-8224/config.yamldeploy/rosaeng-8224/rosaeng-8224.Policy.yamlscripts/generate-policy-config.py
Comment on lines
+2
to
+11
| clusterSelectors: | ||
| matchExpressions: | ||
| - key: hypershift.open-cluster-management.io/management-cluster | ||
| operator: In | ||
| values: | ||
| - "true" | ||
| - key: ext-hypershift.openshift.io/cluster-sector | ||
| operator: In | ||
| values: | ||
| - "canary" |
There was a problem hiding this comment.
Add required platform/compliance selector keys to cluster targeting.
Current matchExpressions omit the mandated selector keys for product/platform/FedRAMP scoping, so this policy can be applied outside intended compliance boundaries.
Suggested selector shape
clusterSelectors:
matchExpressions:
+ - key: api.openshift.com/product
+ operator: In
+ values:
+ - "rosa"
+ - key: hive.openshift.io/cluster-platform
+ operator: In
+ values:
+ - "aws"
+ - "gcp"
+ - "azure"
+ - key: api.openshift.com/fedramp
+ operator: NotIn
+ values:
+ - "true"
- key: hypershift.open-cluster-management.io/management-cluster
operator: In
values:
- "true"
- key: ext-hypershift.openshift.io/cluster-sector
operator: In
values:
- "canary"As per coding guidelines, deploy configs must use selector-based targeting with api.openshift.com/product, hive.openshift.io/cluster-platform, and api.openshift.com/fedramp.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@deploy/rosaeng-8224/config.yaml` around lines 2 - 11, Update the
clusterSelectors.matchExpressions to include the required selector keys so the
policy is scoped to product/platform/FedRAMP; specifically add expressions for
"api.openshift.com/product", "hive.openshift.io/cluster-platform", and
"api.openshift.com/fedramp" (using operator: In and appropriate allowed values
for your deployment), alongside the existing
"hypershift.open-cluster-management.io/management-cluster" and
"ext-hypershift.openshift.io/cluster-sector" entries; ensure these keys are
added within the same matchExpressions array in the config handling
clusterSelectors so the policy only targets clusters that meet all required
selectors.
Ajpantuso
force-pushed
the
apantuso/rosaeng-8224
branch
from
June 4, 2026 13:18
cd82fd0 to
b893563
Compare
Contributor
Author
|
/hold cancel |
openshift-ci
Bot
removed
the
do-not-merge/hold
Ajpantuso
force-pushed
the
apantuso/rosaeng-8224
branch
from
June 4, 2026 13:23
b893563 to
67373c2
Compare
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Ajpantuso, joshbranham The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
Contributor
|
@Ajpantuso: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
chore
What this PR does / why we need it?
Reapplies openshift-ingress network policies for HCPs which were removed in openshift/hypershift#7872.
Which Jira/Github issue(s) this PR fixes?
Fixes # ROSAENG-8224
Special notes for your reviewer:
Pre-checks (if applicable):
Tested latest changes against a cluster
Included documentation changes with PR
If this is a new object that is not intended for the FedRAMP environment (if unsure, please reach out to team FedRAMP), please exclude it with:
Summary by CodeRabbit