CORENET-6714: Adding netobserv namespace exception for prometheus endpoint auth by OlivierCazade · Pull Request #31447 · openshift/origin

OlivierCazade · 2026-07-29T13:30:01Z

Network Observability operator is GA itself for some years now and is part of the RH catalog but is not part of the payload.

We have been working on enabling it by default. To do this we have agreed to have the CNO create the ClusterExtension object which will trigger an OLM install.

Having Network observability installed by default triggered a lot of tests and requirements linked to payload elements which Network Observability is not. (We still have to investigate some of them because we are not sure if this is appropriate to annotate the Network Observability component with payload associated annotations.)

For some of them not deploying to an openshift- cluster was enough to not trigger them, and we have aggreed to come back to them before going GA for this feature.

The last ones are linked to the metric endpoints of some of the components, for now this components have network policies and we support enabling TLS but we do not support authentication.

I am asking if we could add exception to this authentication rule while this feature is still in techpreview to no block the release of the techpreview of this feature.

Summary by CodeRabbit

Tests
- Updated Prometheus authentication coverage to account for additional monitoring namespaces during access checks.

…cation

openshift-merge-bot · 2026-07-29T13:30:04Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

openshift-ci-robot · 2026-07-29T13:30:05Z

@OlivierCazade: This pull request references CORENET-6714 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Network Observability operator is GA itself for some years now and is part of the RH catalog but is not part of the payload.

We have been working on enabling it by default. To do this we have agreed to have the CNO create the ClusterExtension object which will trigger an OLM install.

Having Network observability installed by default triggered a lot of tests and requirements linked to payload elements which Network Observability is not. (We still have to investigate some of them because we are not sure if this is appropriate to annotate the Network Observability component with payload associated annotations.)

For some of them not deploying to an openshift- cluster was enough to not trigger them, and we have aggreed to come back to them before going GA for this feature.

The last ones are linked to the metric endpoints of some of the components, for now this components have network policies and we support enabling TLS but we do not support authentication.

I am asking if we could add exception to this authentication rule while this feature is still in techpreview to no block the release of the techpreview of this feature.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-07-29T13:30:53Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: f60e6daa-c9c0-426f-906c-e51fe46d91b2

📥 Commits

Reviewing files that changed from the base of the PR and between 15f2cf2 and 392f541.

📒 Files selected for processing (1)

test/extended/prometheus/prometheus.go

Walkthrough

The Prometheus authorization test now excludes the netobserv and netobserv-privileged namespaces from unauthenticated scrape validation failures.

Changes

Prometheus authorization validation

Layer / File(s)	Summary
Extend namespace exclusions `test/extended/prometheus/prometheus.go`	Adds `netobserv` and `netobserv-privileged` to the namespaces skipped by the authorization validation logic.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: machine424

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and accurately summarizes the main change: adding a netobserv namespace exception for Prometheus endpoint authentication.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR only adds namespace skip entries in test logic; no Ginkgo titles were added or made dynamic, and existing titles are static.
Test Structure And Quality	✅ Passed	PASS: The PR only extends the existing auth-skip list for two namespaces; it doesn't affect setup/cleanup, timeouts, or test scope.
Microshift Test Compatibility	✅ Passed	PASS: The PR only widens a skip list in an existing Prometheus auth test; it adds no new Ginkgo test or MicroShift-incompatible API usage.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The change only extends a skip list in an existing serial auth test; it adds no node-count, topology, affinity, drain, or failover assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR only edits a Prometheus auth test to skip two namespaces; it adds no manifests, controllers, replicas, node selectors, or other scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	Change only extends a test skip list; no main/init/TestMain/suite setup or stdout writes were added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only a Prometheus auth skip list was extended; no new Ginkgo test, IPv4-specific logic, or external connectivity was introduced.
No-Weak-Crypto	✅ Passed	Diff only adds namespace skips in a test; no weak-crypto, custom crypto, or secret-comparison code was introduced.
Container-Privileges	✅ Passed	Only test/extended/prometheus/prometheus.go changed; no container/K8s manifests or privilege settings were modified.
No-Sensitive-Data-In-Logs	✅ Passed	The PR only adds two namespace exceptions; it does not introduce or modify any logging that would expose sensitive data.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci · 2026-07-29T13:32:56Z

@OlivierCazade, testwith: Error processing request. ERROR:

could not determine job runs: invalid format for additional PR: openshift/cluster-network-operator/pull/3087

OlivierCazade · 2026-07-29T13:34:00Z

/testwith openshift/cluster-network-operator/master/e2e-aws-ovn-techpreview-serial openshift/cluster-network-operator/3087

openshift-ci · 2026-07-29T13:34:11Z

@OlivierCazade, testwith: Error processing request. ERROR:

could not determine job runs: invalid format for additional PR: openshift/cluster-network-operator/3087

OlivierCazade · 2026-07-29T13:38:19Z

/testwith openshift/cluster-network-operator/master/e2e-gcp-ovn-techpreview openshift/cluster-network-operator#3087

OlivierCazade · 2026-07-29T13:38:30Z

/testwith openshift/cluster-network-operator/master/e2e-aws-ovn-techpreview-serial openshift/cluster-network-operator#3087

simonpasquier

As I commented on Slack, I'd prefer if we updated netobserv to have a proper TLS setup.
The requirements are defined in https://github.com/openshift/enhancements/blob/master/CONVENTIONS.md#metrics

OlivierCazade · 2026-07-29T13:57:29Z

@simonpasquier And I agree that this would be better with authentication, and to add it before going GA.

But as stated in the requirements you linked, this is not an hard requirement for Network Observability :

The same requirements apply for operands managed by a core operator.
Optional operators are strongly recommended to follow these requirements.

Network Observability is not a core operator, only an optional one and we are asking here to not block the techpreview for it.

openshift-merge-bot · 2026-07-29T14:40:46Z

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

mkowalski · 2026-07-29T18:46:15Z

Based on the message https://redhat-internal.slack.com/archives/C01CQA76KMX/p1785350439143599?thread_ts=1784821612.732699&cid=C01CQA76KMX, I am willing to approve this.

It is optional operator and Tech Preview. Given there are already other operators rolling with this exception active since 4.10 (pointing fingers at cluster image registry with their OCPBUGS-5878 Jira open in January 2023).

I did not manage to find any authoritative resource saying auth is "MUST" and not "SHOULD" at this level and I don't want netobserv folks to be blocked on this unless necessary.

I would propose lazy consensus till end of Friday 31/July.

simonpasquier · 2026-07-30T08:18:34Z

To clarify the monitoring team's position: we have no intent to block the exception if staff engineering is ok with it.
What we would ask for though is a commitment to expedite the removal of the exception. HTH.

openshift-ci · 2026-07-30T16:59:14Z

@OlivierCazade, testwith: Error processing request. ERROR:

could not determine job runs: invalid format for additional PR: openshift/cluster-network-operator/pull#3087

OlivierCazade · 2026-07-30T16:59:32Z

/testwith openshift/cluster-network-operator/master/e2e-aws-ovn-techpreview-serial openshift/cluster-network-operator#3087

openshift-ci · 2026-07-30T17:00:01Z

@OlivierCazade, testwith: Error processing request. ERROR:

could not determine job runs: invalid format for additional PR: openshift/cluster-network-operator/pull#3087

openshift-ci · 2026-07-30T17:00:21Z

@OlivierCazade, testwith: could not generate prow job. ERROR:

BUG: test 'e2e-aws-ovn-techpreview' not found in injected config

OlivierCazade · 2026-07-30T17:06:26Z

/testwith openshift/cluster-network-operator/master/e2e-gcp-ovn-techpreview openshift/cluster-network-operator#3087

OlivierCazade · 2026-07-31T00:00:33Z

/testwith openshift/cluster-network-operator/master/e2e-gcp-ovn-techpreview openshift/cluster-network-operator#3087

stleerh · 2026-07-31T03:59:49Z

To clarify the monitoring team's position: we have no intent to block the exception if staff engineering is ok with it. What we would ask for though is a commitment to expedite the removal of the exception. HTH.

I'm on the staff engineering and I approve.

simonpasquier · 2026-07-31T06:45:36Z

/approve

@stleerh @OlivierCazade please share when you're planning to fix the exception.

openshift-ci · 2026-07-31T06:45:57Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: OlivierCazade, simonpasquier

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~test/extended/prometheus/OWNERS~~ [simonpasquier]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

OlivierCazade · 2026-07-31T09:22:07Z

/testwith openshift/cluster-network-operator/master/e2e-aws-ovn-techpreview-serial openshift/cluster-network-operator#3087

OlivierCazade · 2026-07-31T12:35:51Z

@simonpasquier I created the following task :
https://redhat.atlassian.net/browse/NETOBSERV-2877

I will be in on vacations the two next weeks, but this will by my main focus when I come back.

OlivierCazade · 2026-07-31T15:29:57Z

/testwith openshift/cluster-network-operator/master/e2e-gcp-ovn-techpreview-serial-1of2 openshift/cluster-network-operator#3087

openshift-ci · 2026-07-31T15:30:03Z

@OlivierCazade, testwith: could not generate prow job. ERROR:

BUG: test 'e2e-gcp-ovn-techpreview-serial-1of2' not found in injected config

OlivierCazade · 2026-07-31T15:31:54Z

/testwith openshift/cluster-network-operator/master/e2e-aws-ovn-single-node-techpreview openshift/cluster-network-operator#3087

openshift-ci · 2026-07-31T15:31:58Z

@OlivierCazade, testwith: could not generate prow job. ERROR:

BUG: test 'e2e-aws-ovn-single-node-techpreview' not found in injected config

kapjain-rh · 2026-07-31T15:33:58Z

/testwith e2e-aws-ovn-single-node-techpreview openshift/cluster-network-operator#3087

openshift-ci · 2026-07-31T15:34:09Z

@kapjain-rh, testwith: Error processing request. ERROR:

could not determine job runs: requested job is invalid. needs to be formatted like: <org>/<repo>/<branch>/<variant?>/<job>. instead it was: e2e-aws-ovn-single-node-techpreview

OlivierCazade · 2026-07-31T17:10:45Z

/testwith openshift/cluster-network-operator/master/e2e-aws-ovn-techpreview-serial openshift/cluster-network-operator#3087

openshift-ci · 2026-07-31T19:50:07Z

@OlivierCazade: This PR was included in a payload test run from openshift/cluster-network-operator#3087
trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn-techpreview

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/05ab5790-8d19-11f1-8621-201e42aa651a-0

openshift-ci · 2026-07-31T19:51:03Z

@OlivierCazade: This PR was included in a payload test run from openshift/cluster-network-operator#3087
trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn-techpreview-serial-1of3

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/2705daf0-8d19-11f1-8775-0541fbb3da39-0

openshift-ci · 2026-07-31T19:51:08Z

@OlivierCazade: This PR was included in a payload test run from openshift/cluster-network-operator#3087
trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn-techpreview-serial-2of3

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/2a781e50-8d19-11f1-9239-4816b026a852-0

openshift-ci · 2026-07-31T19:51:13Z

@OlivierCazade: This PR was included in a payload test run from openshift/cluster-network-operator#3087
trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn-techpreview-serial-3of3

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/2d434c40-8d19-11f1-9973-5b6c8c40568f-0

OlivierCazade · 2026-07-31T23:47:08Z

/testwith openshift/cluster-network-operator/master/e2e-aws-ovn-techpreview-serial openshift/cluster-network-operator#3087

Adding netobserv namespace exception for prometheus endpoint authenti…

392f541

…cation

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 29, 2026

openshift-ci Bot requested review from jan--f and slashpai July 29, 2026 13:32

coderabbitai Bot approved these changes Jul 29, 2026

View reviewed changes

openshift-ci Bot added the ready-for-human-review Indicates a PR has been reviewed by automated tools and is ready for human review label Jul 29, 2026

simonpasquier reviewed Jul 29, 2026

View reviewed changes

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 31, 2026

OlivierCazade mentioned this pull request Jul 31, 2026

CORENET-6714: Enable Network Observability on Day 0 openshift/cluster-network-operator#3087

Open

Uh oh!

Conversation

OlivierCazade commented Jul 29, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

openshift-merge-bot Bot commented Jul 29, 2026

Uh oh!

openshift-ci-robot commented Jul 29, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

openshift-ci Bot commented Jul 29, 2026

Uh oh!

OlivierCazade commented Jul 29, 2026

Uh oh!

openshift-ci Bot commented Jul 29, 2026

Uh oh!

OlivierCazade commented Jul 29, 2026

Uh oh!

OlivierCazade commented Jul 29, 2026

Uh oh!

simonpasquier left a comment

Choose a reason for hiding this comment

Uh oh!

OlivierCazade commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-merge-bot Bot commented Jul 29, 2026

Uh oh!

mkowalski commented Jul 29, 2026

Uh oh!

simonpasquier commented Jul 30, 2026

Uh oh!

openshift-ci Bot commented Jul 30, 2026

Uh oh!

OlivierCazade commented Jul 30, 2026

Uh oh!

openshift-ci Bot commented Jul 30, 2026

Uh oh!

openshift-ci Bot commented Jul 30, 2026

Uh oh!

OlivierCazade commented Jul 30, 2026

Uh oh!

OlivierCazade commented Jul 31, 2026

Uh oh!

stleerh commented Jul 31, 2026

Uh oh!

simonpasquier commented Jul 31, 2026

Uh oh!

openshift-ci Bot commented Jul 31, 2026

Uh oh!

OlivierCazade commented Jul 31, 2026

Uh oh!

OlivierCazade commented Jul 31, 2026

Uh oh!

OlivierCazade commented Jul 31, 2026

Uh oh!

openshift-ci Bot commented Jul 31, 2026

Uh oh!

OlivierCazade commented Jul 31, 2026

Uh oh!

openshift-ci Bot commented Jul 31, 2026

Uh oh!

kapjain-rh commented Jul 31, 2026

Uh oh!

openshift-ci Bot commented Jul 31, 2026

Uh oh!

OlivierCazade commented Jul 31, 2026

Uh oh!

openshift-ci Bot commented Jul 31, 2026

Uh oh!

openshift-ci Bot commented Jul 31, 2026

Uh oh!

openshift-ci Bot commented Jul 31, 2026

Uh oh!

OlivierCazade commented Jul 29, 2026 •

edited by coderabbitai Bot

Loading

openshift-ci-robot commented Jul 29, 2026 •

edited by openshift-ci Bot

Loading

coderabbitai Bot commented Jul 29, 2026 •

edited

Loading

OlivierCazade commented Jul 29, 2026 •

edited

Loading