Skip to content

CORENET-6714: Enable Network Observability on Day 0 #2925

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
OlivierCazade wants to merge 1 commit into
base: master
Choose a base branch
from
Open

CORENET-6714: Enable Network Observability on Day 0 #2925

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
252 changes: 252 additions & 0 deletions bindata/observability/07-observability-operator.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,252 @@
apiVersion: v1
kind: Namespace
metadata:
name: netobserv-operator
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: netobserv-operator-installer
namespace: netobserv-operator
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: netobserv-operator-installer
rules:
# Permissions needed by OLM v1 to install the Network Observability operator
# Based on OLM v1 pre-authorization requirements from the operator bundle

# Core resources
- apiGroups: [""]
resources: ["endpoints", "nodes", "pods"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["events"]
verbs: ["create", "patch"]
- apiGroups: [""]
resources: ["namespaces"]
verbs: ["create", "get", "list", "watch", "update", "patch", "delete"]
- apiGroups: [""]
resources: ["serviceaccounts", "services", "configmaps"]
verbs: ["create", "get", "list", "watch", "update", "patch", "delete"]
- apiGroups: [""]
resources: ["secrets", "persistentvolumeclaims"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]

# Webhooks - validating webhook configurations
- apiGroups: ["admissionregistration.k8s.io"]
resources: ["validatingwebhookconfigurations"]
verbs: ["create", "list", "watch"]
- apiGroups: ["admissionregistration.k8s.io"]
resources: ["validatingwebhookconfigurations"]
resourceNames: ["flowcollectorconversionwebhook.netobserv.io", "flowmetricvalidationwebhook.netobserv.io"]
verbs: ["delete", "get", "patch", "update"]

# CRDs and API services
- apiGroups: ["apiextensions.k8s.io"]
resources: ["customresourcedefinitions"]
verbs: ["create", "get", "list", "watch", "update", "patch"]
- apiGroups: ["apiextensions.k8s.io"]
resources: ["customresourcedefinitions/status"]
verbs: ["patch", "update"]
- apiGroups: ["apiextensions.k8s.io"]
resources: ["customresourcedefinitions"]
resourceNames: ["flowcollectors.flows.netobserv.io", "flowcollectorslices.flows.netobserv.io", "flowmetrics.flows.netobserv.io"]
verbs: ["delete"]
- apiGroups: ["apiregistration.k8s.io"]
resources: ["apiservices"]
verbs: ["get", "list", "watch"]

# Workloads
- apiGroups: ["apps"]
resources: ["deployments", "daemonsets"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- apiGroups: ["apps"]
resources: ["replicasets"]
verbs: ["get", "list", "watch"]

# Authentication and authorization
- apiGroups: ["authentication.k8s.io"]
resources: ["tokenreviews"]
verbs: ["create"]
- apiGroups: ["authorization.k8s.io"]
resources: ["subjectaccessreviews"]
verbs: ["create"]

# Autoscaling
- apiGroups: ["autoscaling"]
resources: ["horizontalpodautoscalers"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]

# eBPF (bpfman.io)
- apiGroups: ["bpfman.io"]
resources: ["clusterbpfapplications"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- apiGroups: ["bpfman.io"]
resources: ["clusterbpfapplications/status"]
verbs: ["get", "patch", "update"]

# OpenShift config
- apiGroups: ["config.openshift.io"]
resources: ["clusterversions", "networks"]
verbs: ["get", "list", "watch"]

# Console plugin
- apiGroups: ["console.openshift.io"]
resources: ["consoleplugins"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]

# Coordination (leader election)
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]

# Discovery
- apiGroups: ["discovery.k8s.io"]
resources: ["endpointslices"]
verbs: ["get", "list", "watch"]

# FlowCollector CRs
- apiGroups: ["flows.netobserv.io"]
resources: ["flowcollectors", "flowcollectorslices", "flowmetrics"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- apiGroups: ["flows.netobserv.io"]
resources: ["flowcollectors/finalizers"]
verbs: ["update"]
- apiGroups: ["flows.netobserv.io"]
resources: ["flowcollectors/status", "flowcollectorslices/status", "flowmetrics/status"]
verbs: ["get", "patch", "update"]

# OVN-Kubernetes
- apiGroups: ["k8s.ovn.org"]
resources: ["clusteruserdefinednetworks", "userdefinednetworks"]
verbs: ["get", "list", "watch"]

# Loki integration
- apiGroups: ["loki.grafana.com"]
resources: ["lokistacks"]
verbs: ["get", "list", "watch"]
- apiGroups: ["loki.grafana.com"]
resources: ["network"]
resourceNames: ["logs"]
verbs: ["create", "get"]

# Metrics
- apiGroups: ["metrics.k8s.io"]
resources: ["pods"]
verbs: ["create"]

Comment on lines +135 to +139

@coderabbitai coderabbitai Bot Jun 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== metrics.k8s.io RBAC references =="
rg -n -C4 'apiGroups:\s*\["metrics\.k8s\.io"\]|resources:\s*\["pods"\]|verbs:\s*\["create"\]' --glob '*.yaml' --glob '*.yml' .

Repository: openshift/cluster-network-operator

Length of output: 7825

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== surrounding RBAC =="
sed -n '120,145p' bindata/observability/07-observability-operator.yaml

echo
echo "== metrics API usage in repo =="
rg -n 'metrics\.k8s\.io|PodMetrics|pod metrics|metrics client|metrics\.Pods|GetMetrics|ListMetrics' .

Repository: openshift/cluster-network-operator

Length of output: 28672

Use read verbs for metrics.k8s.io pods bindata/observability/07-observability-operator.yaml:135-138

create does not grant pod metrics reads. If this rule is meant to let the operator query metrics, it should use get, list, and watch.

Suggested change 
   # Metrics
   - apiGroups: ["metrics.k8s.io"]
     resources: ["pods"]
-    verbs: ["create"]
+    verbs: ["get", "list", "watch"]
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# Metrics
- apiGroups: ["metrics.k8s.io"]
resources: ["pods"]
verbs: ["create"]
# Metrics
- apiGroups: ["metrics.k8s.io"]
resources: ["pods"]
verbs: ["get", "list", "watch"]
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@bindata/observability/07-observability-operator.yaml` around lines 135 - 139,
The RBAC rule for metrics access is using the wrong verb set for reading pod
metrics. Update the rule in the observability operator manifest so the
`metrics.k8s.io` pods permission grants read-only access via `get`, `list`, and
`watch` instead of `create`. Keep the change scoped to the existing RBAC entry
that defines the pod metrics permissions so the operator can query metrics
correctly.

# Monitoring
- apiGroups: ["monitoring.coreos.com"]
resources: ["prometheusrules", "servicemonitors"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]

# Network policies
- apiGroups: ["networking.k8s.io"]
resources: ["networkpolicies"]
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]

# OLM ClusterExtension finalizers
- apiGroups: ["olm.operatorframework.io"]
resources: ["clusterextensions/finalizers"]
resourceNames: ["netobserv-operator"]
verbs: ["update"]

# OLM ClusterObjectSet finalizers
- apiGroups: ["olm.operatorframework.io"]
resources: ["clusterobjectsets/finalizers"]
resourceNames: ["netobserv-operator-1"]
verbs: ["update"]

# OpenShift console and network config
- apiGroups: ["operator.openshift.io"]
resources: ["consoles"]
verbs: ["get", "list", "update", "watch"]
- apiGroups: ["operator.openshift.io"]
resources: ["networks"]
verbs: ["get", "list", "watch"]

# RBAC
- apiGroups: ["rbac.authorization.k8s.io"]
resources: ["clusterroles", "clusterrolebindings"]
verbs: ["create", "delete", "get", "list", "update", "watch", "patch"]
- apiGroups: ["rbac.authorization.k8s.io"]
resources: ["roles"]
verbs: ["list", "watch"]
- apiGroups: ["rbac.authorization.k8s.io"]
resources: ["rolebindings"]
verbs: ["create", "delete", "get", "list", "update", "watch"]

# Security context constraints
- apiGroups: ["security.openshift.io"]
resources: ["securitycontextconstraints"]
verbs: ["create", "list", "update", "watch"]
- apiGroups: ["security.openshift.io"]
resources: ["securitycontextconstraints"]
resourceNames: ["hostnetwork"]
verbs: ["use"]
Comment thread
OlivierCazade marked this conversation as resolved.
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: netobserv-operator-installer
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: netobserv-operator-installer
subjects:
- kind: ServiceAccount
name: netobserv-operator-installer
namespace: netobserv-operator
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: netobserv-operator-installer
namespace: netobserv-operator
rules:
# Namespace-scoped permissions needed for operator installation
# The operator needs to manage Roles and RoleBindings in its own namespace
- apiGroups: ["rbac.authorization.k8s.io"]
resources: ["roles"]
verbs: ["create"]
- apiGroups: ["rbac.authorization.k8s.io"]
resources: ["roles"]
resourceNames: ["netobserv-openshift-netobserv-operator-prometheus"]
verbs: ["delete", "get", "patch", "update"]
- apiGroups: ["rbac.authorization.k8s.io"]
resources: ["rolebindings"]
resourceNames: ["netobserv-openshift-netobserv-operator-prometheus"]
verbs: ["delete", "get", "patch", "update"]
- apiGroups: ["rbac.authorization.k8s.io"]
resources: ["rolebindings"]
verbs: ["create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: netobserv-operator-installer
namespace: netobserv-operator
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: netobserv-operator-installer
subjects:
- kind: ServiceAccount
name: netobserv-operator-installer
namespace: netobserv-operator
---
apiVersion: olm.operatorframework.io/v1
kind: ClusterExtension
metadata:
name: netobserv-operator
spec:
namespace: netobserv-operator
serviceAccount:
name: netobserv-operator-installer
source:
sourceType: Catalog
catalog:
packageName: netobserv-operator
channels: [stable]
Comment on lines +240 to +252

@coderabbitai coderabbitai Bot Jun 2, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

For olm.operatorframework.io/v1 ClusterExtension using a Catalog source, how can installation be pinned to a specific operator bundle/version or catalog image instead of following the latest channel head?

💡 Result:

To pin the installation of an operator in a ClusterExtension (using the olm.operatorframework.io/v1 API) to a specific version, you use the spec.source.catalog.version field in the ClusterExtension custom resource [1][2]. By specifying an exact version number in this field, you instruct the Operator Controller to install only that specific version and prevent automatic upgrades to newer versions available in the catalog channel [3][4]. ### How to pin to a specific version To pin the operator, set the version field to the exact semantic version string [2][4]. When this field is populated with a concrete version, OLM v1 will not change the target version even if updates are published to the catalog [5][6]. Example: yaml apiVersion: olm.operatorframework.io/v1 kind: ClusterExtension metadata: name: my-operator spec: namespace: my-namespace serviceAccount: name: my-service-account source: sourceType: Catalog catalog: packageName: my-operator channels: [stable] version: "1.2.3" # This pins the version to 1.2.3 ### Important Considerations * Manual Updates: Because pinning stops automatic updates, if you need to upgrade the operator to a new version in the future, you must manually edit the ClusterExtension resource and update the version field to the new target [7][4][6]. * Version Ranges: You can also define a range of acceptable versions (e.g., ">=1.2.0, <1.3.0") using a comma- or space-delimited comparison string [3]. If a range is provided, OLM v1 will automatically perform upgrades within that specified range [3]. * Catalog vs. Version: The ClusterExtension pulls the bundle from the CatalogSource you have configured on your cluster [1][8]. The version field acts as a constraint against the metadata contained within that catalog [3][4]. If you need to switch to a different catalog image entirely, you would typically manage that at the CatalogSource level, though ClusterExtension manages the version resolution from the available sources [8][6]. Pinned versions are a recommended practice for production environments to ensure consistency and prevent unexpected changes when new releases are published to a catalog [2].

Citations:

Pin the operator payload to an explicit version (not the stable channel head)

For olm.operatorframework.io/v1 ClusterExtension with sourceType: Catalog, setting only catalog.channels: [stable] allows OLM to resolve whatever bundle is currently at the channel head, which can change after release. Pin the intended payload by setting spec.source.catalog.version to the exact bundle version (or a constrained range) so upgrades don’t drift.

File: bindata/observability/07-observability-operator.yaml (around lines 240-252)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@bindata/observability/07-observability-operator.yaml` around lines 240 - 252,
The ClusterExtension manifest currently uses spec.source.catalog.channels:
[stable] which allows OLM to track the channel head; update the
netobserv-operator ClusterExtension to pin the payload by adding
spec.source.catalog.version with the exact bundle version (or a constrained
semver range) alongside or instead of the channels entry; locate the
ClusterExtension resource (kind: ClusterExtension, metadata.name:
netobserv-operator) and set spec.source.catalog.version to the intended bundle
version string so OLM will install that specific payload.

@OlivierCazade OlivierCazade Jun 3, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@stleerh can you confirm, but my understanding is that we could point to stable and not pin the version, right ?

@coderabbitai coderabbitai Bot Jun 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems like the humans are having a chat. I'll hop back into my burrow for now. If you need me again, just tag @coderabbitai in a new comment, and I'll come hopping out!

@stleerh stleerh Jun 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@stleerh can you confirm, but my understanding is that we could point to stable and not pin the version, right ?

Yes

15 changes: 15 additions & 0 deletions bindata/observability/08-flowcollector.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
apiVersion: flows.netobserv.io/v1beta2

@arkadeepsen arkadeepsen Apr 9, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Adding this file to the manifests directory means that the CR will be added by default to the cluster. Is this desired behavior?

@OlivierCazade OlivierCazade Apr 10, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Moved the files to a sub-directory in the controller directory.

kind: FlowCollector
metadata:
name: cluster
spec:
agent:
ebpf:
features:
- DNSTracking
sampling: 400
type: eBPF
deploymentModel: Service
loki:
enable: false
Comment on lines +6 to +14

@arkadeepsen arkadeepsen Jun 29, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

According to the EP comments it was mentioned that an empty FlowCollector will be created: openshift/enhancements#1908 (comment)

@stleerh stleerh Jun 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As @dave-tucker said, it was "suggested". It wasn't something we would do today but rather something we would consider. We can open an issue to track this.

namespace: netobserv
2 changes: 2 additions & 0 deletions pkg/controller/add_networkconfig.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ import (
"github.com/openshift/cluster-network-operator/pkg/controller/egress_router"
"github.com/openshift/cluster-network-operator/pkg/controller/infrastructureconfig"
"github.com/openshift/cluster-network-operator/pkg/controller/ingressconfig"
"github.com/openshift/cluster-network-operator/pkg/controller/observability"
"github.com/openshift/cluster-network-operator/pkg/controller/operconfig"
"github.com/openshift/cluster-network-operator/pkg/controller/pki"
"github.com/openshift/cluster-network-operator/pkg/controller/proxyconfig"
Expand All @@ -28,5 +29,6 @@ func init() {
infrastructureconfig.Add,
allowlist.Add,
dashboards.Add,
observability.Add,
)
}
Loading