CNV-97774: network: Graduate MACSecurity feature-gate by ormergi · Pull Request #3164 · openshift/api

ormergi · 2026-11-09T08:34:46Z

The MACSecurity feature enable opt-out from OVN-Kubernetes MAC security on layer2 and localnet secondary networks.

Signed-off-by: Or Mergi <ormergi@redhat.com>

ormergi · 2026-11-09T08:43:22Z

/test e2e-metal-ipi-core-networking-dualstack-ote-tp

openshift-merge-bot · 2026-11-09T11:00:49Z

Pipeline controller notification

This PR uses the pipeline controller for second-stage tests. Selection and triggering follow the repository configuration.

Use /test ? to list jobs and /pipeline help for commands.

openshift-ci-robot · 2026-11-09T11:00:50Z

@ormergi: This pull request references CNV-97774 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.1.0" version, but no target version was set.

Details

In response to this:

The MACSecurity feature enable opt-out from OVN-Kubernetes MAC security on layer2 and localnet secondary networks.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-11-09T11:00:54Z

Hello @ormergi! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

coderabbitai · 2026-11-09T11:00:58Z

No actionable comments were generated in the recent review.

Walkthrough

The change adds MACSecurity to the default and OKD feature sets. The listed payload manifests move it from disabled to enabled. The feature matrix reflects its availability in default, OKD, and preview configurations.

Suggested reviewers: redhat-chai-bot, rvanderp3, mdbooth

Merge Risk: Minimal · up to 6d6c3

MACSecurity is enabled in the intended feature sets. No merge-blocking issue was identified; normal checks remain appropriate.

Pre-merge checks: 15

Check name	Status	Explanation
Title check		The title names the ticket and the main change: promoting the MACSecurity feature gate to general availability. The changeset moves MACSecurity from preview to default and enabled feature sets across …
Description check		The description states what the MACSecurity feature does: it lets users opt out of OVN-Kubernetes MAC security on layer2 and localnet secondary networks. The changeset enables this feature gate by def…
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names		The PR changes the MACSecurity feature gate and its generated manifests. It does not add or change Ginkgo test titles.
Test Structure And Quality		The PR changes a feature-gate declaration, documentation, and manifests. It does not add or modify Ginkgo test code, so the check does not apply.
Microshift Test Compatibility		The PR adds no Ginkgo e2e tests. It changes the MACSecurity feature-gate declaration, documentation, and manifests.
Single Node Openshift (Sno) Test Compatibility		The PR adds no Ginkgo e2e tests. The diff changes the MACSecurity feature gate and its generated documentation and manifests, so this check does not apply.
Topology-Aware Scheduling Compatibility		The changes enable the `MACSecurity` feature gate and update its generated feature-gate manifests. They do not add or modify workload scheduling constraints.
Ote Binary Stdout Contract		The PR changes the MACSecurity feature-gate configuration and generated manifests. It does not change OTE process-level code or introduce stdout writes.
Ipv6 And Disconnected Network Test Compatibility		The pull request adds no Ginkgo e2e tests. The diff changes the MACSecurity feature gate, generated manifests, and feature documentation.
No-Weak-Crypto		The PR enables the MACSecurity feature gate and updates its generated manifests. The changes do not introduce a listed weak algorithm, custom cryptography, or a secret comparison.
Container-Privileges		The diff enables the MACSecurity feature gate and updates generated feature-gate manifests. It does not introduce container privilege settings.
No-Sensitive-Data-In-Logs		The changes enable `MACSecurity` in feature sets and update generated manifests and documentation. They do not add or change logging.

Full details: Title check

Explanation

The title names the ticket and the main change: promoting the MACSecurity feature gate to general availability. The changeset moves MACSecurity from preview to default and enabled feature sets across the feature gate manifests and features.go, so the title matches the main change.

Full details: Description check

Explanation

The description states what the MACSecurity feature does: it lets users opt out of OVN-Kubernetes MAC security on layer2 and localnet secondary networks. The changeset enables this feature gate by default, so the description relates to the change. It does not describe the feature-gate promotion itself, which is a minor gap that does not make it off-topic.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files. (7 skipped: 7 unsupported.)

Warning

Some tools did not complete. Review the errors below.

golangci-lint (2.15.0)

golangci-lint (2.15.0) skipped for .golangci.yaml: configuration contains disallowed or uninspectable plugin or linter settings. Use supported built-in linters.

Recent review info

Run configuration

Source mode: Auto

Repository: openshift/api

Branch: master

File: .coderabbit.yaml

Commit: 248dd91

Layers: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: `17c56eec-675d-4faa-95ae-ac56b01bbe05`

Commits

Reviewing files that changed from the base of the PR and between `248dd91` and `6d6c3c9`.

Files selected for processing: 8

`features.md`

`features/features.go`

`payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml`

`payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml`

`payload-manifests/featuregates/featureGate-4-SelfManagedHA-Default.yaml`

`payload-manifests/featuregates/featureGate-4-SelfManagedHA-OKD.yaml`

`payload-manifests/featuregates/featureGate-5-10-SelfManagedHA-Default.yaml`

`payload-manifests/featuregates/featureGate-5-10-SelfManagedHA-OKD.yaml`

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.

ormergi · 2026-11-11T06:02:54Z

/test verify-feature-promotion

saschagrunert · 2026-11-11T06:07:56Z

 				productScope(ocpSpecific).
 				enhancementPR("https://github.com/ovn-kubernetes/ovn-kubernetes/pull/6528").
-				enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()).
+				enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()).


The promotion check can't pass yet. There aren't enough MACSecurity tests, the OTE suite doesn't run on vSphere or AWS single-node, and the localnet tests are disabled. Can you close those gaps, or provide the alternative regression plan from the feature gate dev guide?

This feature support bare-metal setups only, it doesnt make sense or expected to work on other platforms.

Localnet test are disable as for now due to CI issues and complications with implementing the localnet infrastructure needed to test it. Although we are working on it, not sure when it will be available.

We are confident with the existing 4 OTE tests to provide good enough indication for feature works as expected.

The test minimum can be waived per the Slack thread, but only for what we claim to support. Please state the 5.1 scope here: bare metal only, secondary layer2 only, localnet unsupported until its tests run. Single-stack metal is with the approvers.

saschagrunert · 2026-11-11T06:07:56Z

                        "name": "KMSv1"
                    },
+                    {
+                        "name": "MACSecurity"


There are no OTE results for HyperShift jobs. Can you run the MACSecurity tests there, or scope this with inClusterProfile(SelfManaged)?

The feature could work with Hypershift backed by Kubevirt VMs (OCP virtualiztion VMs),
As for Hypershift running on other platforms, such as AWS, it is not expected to work.

Would testing hypershift on bare-metal could satisfy this requirement?

A bare-metal HyperShift lane would not satisfy the check, it looks for HyperShift on AWS. Please scope the gate with inClusterProfile(SelfManaged) for now and widen it once HyperShift results exist.

saschagrunert · 2026-11-11T06:07:56Z

@@ -199,7 +199,7 @@ var (
 				contactPerson("jcaamano").
 				productScope(ocpSpecific).
 				enhancementPR("https://github.com/ovn-kubernetes/ovn-kubernetes/pull/6528").


The OKEP has no OpenShift GA criteria. Can you add a short graduation section?

This is upstream enhancement we usually dont mix in downstream products.
In general this is an upstream feature, this gate is used to for annotating CNO to enable the corresponding gate on ovn-kubernetes.

There was similar discussion about EgressIPNNodeSelector feature [1], it is also gating upstream feature through CNO

The OKEP works as the enhancement, but Default needs the GA plan written down. A short graduation section with the supported scope and the lanes providing signal is enough, and it can follow this PR.

saschagrunert · 2026-11-11T06:07:56Z

 				productScope(ocpSpecific).
 				enhancementPR("https://github.com/ovn-kubernetes/ovn-kubernetes/pull/6528").
-				enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()).
+				enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()).


Once this is in Default, namespace editors can disable MAC spoof protection on their UDNs. Has product security signed off?

Allowing project admins to turn off mac-security protection on a UDN in intentional.
This is safe because the UDN is isolated network, it does not affect cluster network, other UDNs.

The isolation argument is fine. The ask is a pointer to the product security sign-off, since the OKEP lists spoofing on the segment as its first risk. Note the raw NetworkAttachmentDefinition path is not covered by this gate.

saschagrunert · 2026-11-12T08:21:46Z

 				productScope(ocpSpecific).
 				enhancementPR("https://github.com/ovn-kubernetes/ovn-kubernetes/pull/6528").
-				enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()).
+				enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()).


The CNO mac-security doc says rolling back to a schema without the field prunes it on later writes. If this needs a quick revert during stabilization, Default clusters that set macSecurity lose it. Please confirm the CNO owners accept that.

everettraven · 2026-11-12T14:07:06Z

As discussed in Slack, we've deemed this feature in a stable enough state to promote.

/approve
/lgtm

Sippy feature gate results show this passing the required and agreed upon criteria:
/verified by @everettraven

/override ci/prow/verify-feature-promotion

openshift-ci-robot · 2026-11-12T14:07:25Z

@everettraven: This PR has been marked as verified by @everettraven.

Details

In response to this:

As discussed in Slack, we've deemed this feature in a stable enough state to promote.

/approve
/lgtm

Sippy feature gate results show this passing the required and agreed upon criteria:
/verified by @everettraven

/override ci/prow/verify-feature-promotion

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-11-12T14:11:17Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: everettraven

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [everettraven]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2026-11-12T14:12:02Z

@everettraven: Overrode contexts on behalf of everettraven: ci/prow/verify-feature-promotion

Details

In response to this:

As discussed in Slack, we've deemed this feature in a stable enough state to promote.

/approve
/lgtm

Sippy feature gate results show this passing the required and agreed upon criteria:
/verified by @everettraven

/override ci/prow/verify-feature-promotion

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

ormergi · 2026-11-12T14:51:46Z

/tide refresh

everettraven · 2026-11-12T15:04:32Z

/pipeline required

everettraven · 2026-11-12T15:05:10Z

/pipeline mark-pipeline-gate 6d6c3c9

redhat-chai-bot · 2026-11-12T15:09:37Z

Chai test selection for 6d6c3c97ead3d266804a8aac952e75cd9693025d → master

pull-ci-openshift-api-master-e2e-aws-ovn
pull-ci-openshift-api-master-e2e-aws-ovn-hypershift
pull-ci-openshift-api-master-e2e-upgrade

Reason: Feature gate promotion: MACSecurity from TechPreview to Default/OKD. OVN-K test extension has [FeatureGate:MACSecurity] layer2 tests (parallel suite) now newly runnable on Default clusters. e2e-aws-ovn exercises these; e2e-aws-ovn-hypershift covers changed HyperShift Default manifests; e2e-upgrade covers first-enablement-during-upgrade (stable source has gate off in Default → PR payload has gate on).

/test e2e-aws-ovn
/test e2e-aws-ovn-hypershift
/test e2e-upgrade

openshift-merge-bot · 2026-11-13T11:48:01Z

/retest-required

Remaining retests: 0 against base HEAD 79858fb and 2 for PR HEAD 6d6c3c9 in total

openshift-merge-bot · 2026-11-13T20:24:56Z

/retest-required

Remaining retests: 0 against base HEAD 950d0a9 and 1 for PR HEAD 6d6c3c9 in total

openshift-merge-bot · 2026-11-13T22:26:42Z

/retest-required

Remaining retests: 0 against base HEAD fabd153 and 0 for PR HEAD 6d6c3c9 in total

openshift-ci · 2026-11-13T22:34:52Z

@ormergi: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/verify-feature-promotion	`6d6c3c9`	link	true	`/test verify-feature-promotion`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-merge-bot · 2026-11-13T23:25:58Z

/hold

Revision 6d6c3c9 was retested 3 times: holding

ormergi added 2 commits November 9, 2026 10:29

features: graduate MACSecurity

008d7bf

Signed-off-by: Or Mergi <ormergi@redhat.com>

commit products of 'make update'

6d6c3c9

Signed-off-by: Or Mergi <ormergi@redhat.com>

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Nov 9, 2026

openshift-ci Bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Nov 9, 2026

openshift-ci Bot requested review from JoelSpeed and everettraven November 9, 2026 11:02

saschagrunert reviewed Nov 11, 2026

View reviewed changes

saschagrunert reviewed Nov 12, 2026

View reviewed changes

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Nov 12, 2026

openshift-ci Bot assigned everettraven Nov 12, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Nov 12, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 12, 2026

openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 13, 2026

Conversation

ormergi commented Nov 9, 2026

Uh oh!

ormergi commented Nov 9, 2026

Uh oh!

openshift-merge-bot Bot commented Nov 9, 2026

Uh oh!

openshift-ci-robot commented Nov 9, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci Bot commented Nov 9, 2026

Uh oh!

coderabbitai Bot commented Nov 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ormergi commented Nov 11, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ormergi Nov 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

everettraven commented Nov 12, 2026

Uh oh!

openshift-ci-robot commented Nov 12, 2026

Uh oh!

openshift-ci Bot commented Nov 12, 2026

Uh oh!

openshift-ci Bot commented Nov 12, 2026

Uh oh!

ormergi commented Nov 12, 2026

Uh oh!

everettraven commented Nov 12, 2026

Uh oh!

everettraven commented Nov 12, 2026

Uh oh!

redhat-chai-bot commented Nov 12, 2026

Uh oh!

openshift-merge-bot Bot commented Nov 13, 2026

Uh oh!

openshift-merge-bot Bot commented Nov 13, 2026

Uh oh!

openshift-merge-bot Bot commented Nov 13, 2026

Uh oh!

openshift-ci Bot commented Nov 13, 2026

Uh oh!

openshift-merge-bot Bot commented Nov 13, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

openshift-ci-robot commented Nov 9, 2026 •

edited by openshift-ci Bot

Loading

coderabbitai Bot commented Nov 9, 2026 •

edited

Loading

ormergi Nov 11, 2026 •

edited

Loading