Merge pull request #2428 from tssurya/net-seg-feature-gate

SDN-4934: Network Segmentation Feature Gate Vendoring from API

go.mod

@@ -1,14 +1,16 @@
 module github.com/openshift/cluster-network-operator
 
-go 1.22
+go 1.22.0
+
+toolchain go1.22.4
 
 require (
 	github.com/Masterminds/semver v1.5.0
 	github.com/Masterminds/sprig/v3 v3.2.3
 	github.com/containernetworking/cni v0.8.0
 	github.com/ghodss/yaml v1.0.1-0.20190212211648-25d852aebe32
 	github.com/go-bindata/go-bindata v3.1.2+incompatible
-	github.com/onsi/gomega v1.29.0
+	github.com/onsi/gomega v1.31.0
 	github.com/openshift/build-machinery-go v0.0.0-20220913142420-e25cf57ea46d
 	github.com/pkg/errors v0.9.1
 	github.com/prometheus/client_golang v1.16.0
@@ -17,13 +19,13 @@ require (
 	github.com/stretchr/testify v1.8.4
 	github.com/vishvananda/netlink v1.1.0
 	github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae // indirect
-	golang.org/x/net v0.17.0
+	golang.org/x/net v0.23.0
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	k8s.io/api v0.29.0
-	k8s.io/apimachinery v0.29.0
+	k8s.io/api v0.30.1
+	k8s.io/apimachinery v0.30.1
 	k8s.io/code-generator v0.29.0
 	k8s.io/component-base v0.29.0
-	k8s.io/klog/v2 v2.110.1
+	k8s.io/klog/v2 v2.120.1
 	k8s.io/kube-proxy v0.29.0
 	k8s.io/utils v0.0.0-20230726121419-3b25d923346b
 	sigs.k8s.io/controller-runtime v0.16.0
@@ -41,13 +43,13 @@ require (
 	github.com/evanphx/json-patch v5.6.0+incompatible // indirect
 	github.com/felixge/httpsnoop v1.0.3 // indirect
 	github.com/fsnotify/fsnotify v1.7.0 // indirect
-	github.com/go-logr/logr v1.3.0 // indirect
+	github.com/go-logr/logr v1.4.1 // indirect
 	github.com/go-openapi/jsonpointer v0.19.6 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
 	github.com/go-openapi/swag v0.22.3 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/uuid v1.3.0 // indirect
@@ -83,25 +85,25 @@ require (
 	go.opentelemetry.io/proto/otlp v1.0.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.25.0 // indirect
-	golang.org/x/crypto v0.14.0 // indirect
-	golang.org/x/mod v0.12.0 // indirect
+	golang.org/x/crypto v0.21.0 // indirect
+	golang.org/x/mod v0.15.0 // indirect
 	golang.org/x/oauth2 v0.10.0 // indirect
-	golang.org/x/sync v0.3.0 // indirect
-	golang.org/x/sys v0.13.0 // indirect
-	golang.org/x/term v0.13.0 // indirect
-	golang.org/x/text v0.13.0 // indirect
+	golang.org/x/sync v0.6.0 // indirect
+	golang.org/x/sys v0.18.0 // indirect
+	golang.org/x/term v0.18.0 // indirect
+	golang.org/x/text v0.14.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
-	golang.org/x/tools v0.12.0 // indirect
+	golang.org/x/tools v0.18.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20230803162519-f966b187b2e5 // indirect
 	google.golang.org/grpc v1.58.3 // indirect
-	google.golang.org/protobuf v1.31.0 // indirect
+	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/gengo v0.0.0-20230829151522-9cce18d56c01 // indirect
-	k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect
+	k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.28.0 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
 	sigs.k8s.io/kube-storage-version-migrator v0.0.6-0.20230721195810-5c8923c5ff96 // indirect
@@ -110,7 +112,7 @@ require (
 )
 
 require (
-	github.com/openshift/api v0.0.0-20240416170644-3efee4252217
+	github.com/openshift/api v0.0.0-20240701145226-44d00ee80f5e
 	github.com/openshift/client-go v0.0.0-20240415214935-be70f772f157
 	github.com/openshift/library-go v0.0.0-20231128230659-785a9313da6c
 	github.com/openshift/machine-config-operator v0.0.1-0.20231002195040-a2469941c0dc
@@ -152,6 +154,7 @@ require (
 	google.golang.org/genproto/googleapis/api v0.0.0-20230726155614-23370e0ffb3e // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d // indirect
 	k8s.io/apiserver v0.29.0 // indirect
+	k8s.io/gengo/v2 v2.0.0-20240228010128-51d4e06bde70 // indirect
 	k8s.io/kms v0.29.0 // indirect
 	k8s.io/kube-aggregator v0.28.2 // indirect
 )

pkg/controller/operconfig/cluster.go

@@ -7,6 +7,7 @@ import (
 	"reflect"
 
 	configv1 "github.com/openshift/api/config/v1"
+	apifeatures "github.com/openshift/api/features"
 	operv1 "github.com/openshift/api/operator/v1"
 	"github.com/openshift/cluster-network-operator/pkg/apply"
 	"github.com/openshift/cluster-network-operator/pkg/bootstrap"
@@ -24,7 +25,7 @@ import (
 // MergeClusterConfig merges in the existing cluster config in to the
 // operator config, overwriting any changes to the managed fields.
 func (r *ReconcileOperConfig) MergeClusterConfig(ctx context.Context, operConfig *operv1.Network, clusterConfig *configv1.Network) error {
-	if _, ok := clusterConfig.Annotations[names.NetworkTypeMigrationAnnotation]; ok && r.featureGates.Enabled(configv1.FeatureGateNetworkLiveMigration) {
+	if _, ok := clusterConfig.Annotations[names.NetworkTypeMigrationAnnotation]; ok && r.featureGates.Enabled(apifeatures.FeatureGateNetworkLiveMigration) {
 		// During network type live migration, all the update to network.operator shall only be handled by the clusterconfig controller
 		return nil
 	}
@@ -93,7 +94,7 @@ func (r *ReconcileOperConfig) ClusterNetworkStatus(ctx context.Context, operConf
 	// Sync status.conditions when live migration is processing
 	clusterConfigWithConditions := clusterConfig.DeepCopy()
 	nowTimestamp := metav1.Now()
-	if _, ok := clusterConfig.Annotations[names.NetworkTypeMigrationAnnotation]; ok && r.featureGates.Enabled(configv1.FeatureGateNetworkLiveMigration) {
+	if _, ok := clusterConfig.Annotations[names.NetworkTypeMigrationAnnotation]; ok && r.featureGates.Enabled(apifeatures.FeatureGateNetworkLiveMigration) {
 		if meta.IsStatusConditionPresentAndEqual(clusterConfig.Status.Conditions, names.NetworkTypeMigrationInProgress, metav1.ConditionTrue) {
 			err = r.syncNetworkTypeMigrationConditions(ctx, operConfig, clusterConfigWithConditions)
 			if err != nil {

pkg/network/ovn_kubernetes.go

@@ -19,6 +19,7 @@ import (
 
 	yaml "github.com/ghodss/yaml"
 	configv1 "github.com/openshift/api/config/v1"
+	apifeatures "github.com/openshift/api/features"
 	operv1 "github.com/openshift/api/operator/v1"
 	"github.com/openshift/cluster-network-operator/pkg/bootstrap"
 	cnoclient "github.com/openshift/cluster-network-operator/pkg/client"
@@ -304,8 +305,8 @@ func renderOVNKubernetes(conf *operv1.NetworkSpec, bootstrapResult *bootstrap.Bo
 	}
 
 	// leverage feature gates
-	data.Data["OVN_ADMIN_NETWORK_POLICY_ENABLE"] = featureGates.Enabled(configv1.FeatureGateAdminNetworkPolicy)
-	data.Data["DNS_NAME_RESOLVER_ENABLE"] = featureGates.Enabled(configv1.FeatureGateDNSNameResolver)
+	data.Data["OVN_ADMIN_NETWORK_POLICY_ENABLE"] = featureGates.Enabled(apifeatures.FeatureGateAdminNetworkPolicy)
+	data.Data["DNS_NAME_RESOLVER_ENABLE"] = featureGates.Enabled(apifeatures.FeatureGateDNSNameResolver)
 
 	data.Data["ReachabilityTotalTimeoutSeconds"] = c.EgressIPConfig.ReachabilityTotalTimeoutSeconds
 

pkg/network/ovn_kubernetes_test.go

@@ -24,6 +24,7 @@ import (
 	crclient "sigs.k8s.io/controller-runtime/pkg/client"
 
 	configv1 "github.com/openshift/api/config/v1"
+	apifeatures "github.com/openshift/api/features"
 	operv1 "github.com/openshift/api/operator/v1"
 	"github.com/openshift/cluster-network-operator/pkg/bootstrap"
 	cnofake "github.com/openshift/cluster-network-operator/pkg/client/fake"
@@ -93,7 +94,7 @@ func TestRenderOVNKubernetes(t *testing.T) {
 		},
 	}
 	featureGatesCNO := featuregates.NewFeatureGate(
-		[]configv1.FeatureGateName{configv1.FeatureGateAdminNetworkPolicy, configv1.FeatureGateDNSNameResolver},
+		[]configv1.FeatureGateName{apifeatures.FeatureGateAdminNetworkPolicy, apifeatures.FeatureGateDNSNameResolver},
 		[]configv1.FeatureGateName{},
 	)
 	fakeClient := cnofake.NewFakeClient()
@@ -155,7 +156,7 @@ func TestRenderOVNKubernetesIPv6(t *testing.T) {
 		},
 	}
 	featureGatesCNO := featuregates.NewFeatureGate(
-		[]configv1.FeatureGateName{configv1.FeatureGateAdminNetworkPolicy, configv1.FeatureGateDNSNameResolver},
+		[]configv1.FeatureGateName{apifeatures.FeatureGateAdminNetworkPolicy, apifeatures.FeatureGateDNSNameResolver},
 		[]configv1.FeatureGateName{},
 	)
 	fakeClient := cnofake.NewFakeClient()
@@ -742,7 +743,7 @@ logfile-maxage=0`,
 			controlPlaneReplicaCount: 2,
 
 			enableMultiNetPolicies: true,
-			enabledFeatureGates:    []configv1.FeatureGateName{configv1.FeatureGateAdminNetworkPolicy},
+			enabledFeatureGates:    []configv1.FeatureGateName{apifeatures.FeatureGateAdminNetworkPolicy},
 		},
 		{
 			desc: "enable multi-network policies without multi-network support",
@@ -786,7 +787,7 @@ logfile-maxage=0`,
 			controlPlaneReplicaCount: 2,
 			disableMultiNet:          true,
 			enableMultiNetPolicies:   true,
-			enabledFeatureGates:      []configv1.FeatureGateName{configv1.FeatureGateAdminNetworkPolicy},
+			enabledFeatureGates:      []configv1.FeatureGateName{apifeatures.FeatureGateAdminNetworkPolicy},
 		},
 		{
 			desc: "enable dns-name resolver feature",
@@ -829,7 +830,7 @@ logfile-maxsize=100
 logfile-maxbackups=5
 logfile-maxage=0`,
 			controlPlaneReplicaCount: 2,
-			enabledFeatureGates:      []configv1.FeatureGateName{configv1.FeatureGateDNSNameResolver},
+			enabledFeatureGates:      []configv1.FeatureGateName{apifeatures.FeatureGateDNSNameResolver},
 		},
 	}
 	g := NewGomegaWithT(t)
@@ -882,8 +883,8 @@ logfile-maxage=0`,
 			}
 
 			knownFeatureGates := []configv1.FeatureGateName{
-				configv1.FeatureGateAdminNetworkPolicy,
-				configv1.FeatureGateDNSNameResolver,
+				apifeatures.FeatureGateAdminNetworkPolicy,
+				apifeatures.FeatureGateDNSNameResolver,
 			}
 			s := sets.New[configv1.FeatureGateName](tc.enabledFeatureGates...)
 			enabled := []configv1.FeatureGateName{}
@@ -2042,7 +2043,7 @@ metadata:
 				PrePullerUpdateStatus: prepullerStatus,
 			}
 			featureGatesCNO := featuregates.NewFeatureGate(
-				[]configv1.FeatureGateName{configv1.FeatureGateAdminNetworkPolicy, configv1.FeatureGateDNSNameResolver},
+				[]configv1.FeatureGateName{apifeatures.FeatureGateAdminNetworkPolicy, apifeatures.FeatureGateDNSNameResolver},
 				[]configv1.FeatureGateName{},
 			)
 			fakeClient := cnofake.NewFakeClient()
@@ -2353,7 +2354,7 @@ func TestRenderOVNKubernetesEnableIPsec(t *testing.T) {
 
 	// At the 1st pass, ensure IPsec MachineConfigs are not rolled out until MCO is ready.
 	featureGatesCNO := featuregates.NewFeatureGate(
-		[]configv1.FeatureGateName{configv1.FeatureGateAdminNetworkPolicy, configv1.FeatureGateDNSNameResolver},
+		[]configv1.FeatureGateName{apifeatures.FeatureGateAdminNetworkPolicy, apifeatures.FeatureGateDNSNameResolver},
 		[]configv1.FeatureGateName{},
 	)
 	fakeClient := cnofake.NewFakeClient()
@@ -2580,7 +2581,7 @@ func TestRenderOVNKubernetesEnableIPsecForHostedControlPlane(t *testing.T) {
 	}
 
 	featureGatesCNO := featuregates.NewFeatureGate(
-		[]configv1.FeatureGateName{configv1.FeatureGateAdminNetworkPolicy, configv1.FeatureGateDNSNameResolver},
+		[]configv1.FeatureGateName{apifeatures.FeatureGateAdminNetworkPolicy, apifeatures.FeatureGateDNSNameResolver},
 		[]configv1.FeatureGateName{},
 	)
 	fakeClient := cnofake.NewFakeClient()
@@ -2702,7 +2703,7 @@ func TestRenderOVNKubernetesIPsecUpgradeWithMachineConfig(t *testing.T) {
 	bootstrapResult.Infra.WorkerMCPStatuses = []mcfgv1.MachineConfigPoolStatus{{MachineCount: 1, ReadyMachineCount: 1, UpdatedMachineCount: 1,
 		Configuration: mcfgv1.MachineConfigPoolStatusConfiguration{Source: []v1.ObjectReference{{Name: workerMachineConfigIPsecExtName}}}}}
 	featureGatesCNO := featuregates.NewFeatureGate(
-		[]configv1.FeatureGateName{configv1.FeatureGateAdminNetworkPolicy, configv1.FeatureGateDNSNameResolver},
+		[]configv1.FeatureGateName{apifeatures.FeatureGateAdminNetworkPolicy, apifeatures.FeatureGateDNSNameResolver},
 		[]configv1.FeatureGateName{},
 	)
 	fakeClient := cnofake.NewFakeClient()
@@ -2814,7 +2815,7 @@ func TestRenderOVNKubernetesIPsecUpgradeWithNoMachineConfig(t *testing.T) {
 
 	// Upgrade starts and it's going to rollout IPsec Machine Configs without making any changes into existing IPsec configs.
 	featureGatesCNO := featuregates.NewFeatureGate(
-		[]configv1.FeatureGateName{configv1.FeatureGateAdminNetworkPolicy, configv1.FeatureGateDNSNameResolver},
+		[]configv1.FeatureGateName{apifeatures.FeatureGateAdminNetworkPolicy, apifeatures.FeatureGateDNSNameResolver},
 		[]configv1.FeatureGateName{},
 	)
 	fakeClient := cnofake.NewFakeClient()
@@ -2982,7 +2983,7 @@ func TestRenderOVNKubernetesIPsecUpgradeWithHypershiftHostedCluster(t *testing.T
 	bootstrapResult.Infra.HostedControlPlane = &hypershift.HostedControlPlane{}
 	// Upgrade starts and it's going to get only ovn-ipsec-containerized DS.
 	featureGatesCNO := featuregates.NewFeatureGate(
-		[]configv1.FeatureGateName{configv1.FeatureGateAdminNetworkPolicy, configv1.FeatureGateDNSNameResolver},
+		[]configv1.FeatureGateName{apifeatures.FeatureGateAdminNetworkPolicy, apifeatures.FeatureGateDNSNameResolver},
 		[]configv1.FeatureGateName{},
 	)
 	fakeClient := cnofake.NewFakeClient()
@@ -3089,7 +3090,7 @@ func TestRenderOVNKubernetesDisableIPsec(t *testing.T) {
 		},
 	}
 	featureGatesCNO := featuregates.NewFeatureGate(
-		[]configv1.FeatureGateName{configv1.FeatureGateAdminNetworkPolicy, configv1.FeatureGateDNSNameResolver},
+		[]configv1.FeatureGateName{apifeatures.FeatureGateAdminNetworkPolicy, apifeatures.FeatureGateDNSNameResolver},
 		[]configv1.FeatureGateName{},
 	)
 
@@ -3229,7 +3230,7 @@ func TestRenderOVNKubernetesDisableIPsecWithUserInstalledIPsecMachineConfigs(t *
 		},
 	}
 	featureGatesCNO := featuregates.NewFeatureGate(
-		[]configv1.FeatureGateName{configv1.FeatureGateAdminNetworkPolicy, configv1.FeatureGateDNSNameResolver},
+		[]configv1.FeatureGateName{apifeatures.FeatureGateAdminNetworkPolicy, apifeatures.FeatureGateDNSNameResolver},
 		[]configv1.FeatureGateName{},
 	)
 
@@ -3364,7 +3365,7 @@ func TestRenderOVNKubernetesDualStackPrecedenceOverUpgrade(t *testing.T) {
 		},
 	}
 	featureGatesCNO := featuregates.NewFeatureGate(
-		[]configv1.FeatureGateName{configv1.FeatureGateAdminNetworkPolicy, configv1.FeatureGateDNSNameResolver},
+		[]configv1.FeatureGateName{apifeatures.FeatureGateAdminNetworkPolicy, apifeatures.FeatureGateDNSNameResolver},
 		[]configv1.FeatureGateName{},
 	)
 
@@ -3466,7 +3467,7 @@ func TestRenderOVNKubernetesOVSFlowsConfigMap(t *testing.T) {
 				FlowsConfig: tc.FlowsConfig,
 			}
 			featureGatesCNO := featuregates.NewFeatureGate(
-				[]configv1.FeatureGateName{configv1.FeatureGateAdminNetworkPolicy, configv1.FeatureGateDNSNameResolver},
+				[]configv1.FeatureGateName{apifeatures.FeatureGateAdminNetworkPolicy, apifeatures.FeatureGateDNSNameResolver},
 				[]configv1.FeatureGateName{},
 			)
 			fakeClient := cnofake.NewFakeClient()

pkg/network/render.go

@@ -15,6 +15,7 @@ import (
 	"github.com/pkg/errors"
 
 	configv1 "github.com/openshift/api/config/v1"
+	apifeatures "github.com/openshift/api/features"
 	operv1 "github.com/openshift/api/operator/v1"
 	"github.com/openshift/cluster-network-operator/pkg/bootstrap"
 	cnoclient "github.com/openshift/cluster-network-operator/pkg/client"
@@ -623,7 +624,7 @@ func renderCRDForMigration(conf *operv1.NetworkSpec, manifestDir string, feature
 		// the CRD installation can happen according to whether the feature gate is enabled or not
 		// in the cluster
 		data := render.MakeRenderData()
-		data.Data["OVN_ADMIN_NETWORK_POLICY_ENABLE"] = featureGates.Enabled(configv1.FeatureGateAdminNetworkPolicy)
+		data.Data["OVN_ADMIN_NETWORK_POLICY_ENABLE"] = featureGates.Enabled(apifeatures.FeatureGateAdminNetworkPolicy)
 		manifests, err := render.RenderTemplate(filepath.Join(manifestDir, "network/ovn-kubernetes/common/001-crd.yaml"), &data)
 		if err != nil {
 			return nil, errors.Wrap(err, "failed to render OVNKubernetes CRDs")

pkg/util/validation/network.go

@@ -10,6 +10,7 @@ import (
 
 	k8serrors "k8s.io/apimachinery/pkg/util/errors"
 	"k8s.io/apimachinery/pkg/util/validation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
 )
 
 // DomainName checks if the given string is a valid domain name.
@@ -40,7 +41,7 @@ func Subdomain(v string) error {
 // Host validates if host is a valid IP address or subdomain in DNS (RFC 1123).
 func Host(host string) error {
 	errDomain := DomainName(host, false)
-	errIP := validation.IsValidIP(host)
+	errIP := validation.IsValidIP(field.NewPath(""), host)
 	if errDomain != nil && errIP != nil {
 		return fmt.Errorf("invalid host: %s", host)
 	}