Skip to content

Commit 6757981

Browse files
OlivierCazadeOlivierCazade
committed
Add Network Observability controller with day-0 installation support
This commit introduces automated installation and management of the Network Observability Operator during cluster deployment (day-0). Key features: - Automatic operator installation via OLM when NetworkObservabilityInstall feature gate is enabled - Opt-out model: installs by default except on SNO clusters - Feature gate support with backward compatibility for older clusters Implementation details: - New observability controller in pkg/controller/observability/ - Manifest-based operator installation (07-observability-operator.yaml) - Default FlowCollector configuration (08-flowcollector.yaml) - RBAC permissions for OLM resource management - namespace creation for operator and observability components
1 parent b8d21fa commit 6757981

44 files changed

Lines changed: 5351 additions & 4 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎go.mod‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -161,3 +161,5 @@ require (
161161
sigs.k8s.io/randfill v1.0.0 // indirect
162162
sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
163163
)
164+
165+
replace github.com/openshift/api v0.0.0-20260320151444-324a1bcb9f55 => github.com/OlivierCazade/api v0.0.0-20260324144412-012c4cdbbb5b

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj
1212
github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
1313
github.com/NYTimes/gziphandler v1.1.1 h1:ZUDjpQae29j0ryrS0u/B8HZfJBtBQHjqw2rQ2cqUQ3I=
1414
github.com/NYTimes/gziphandler v1.1.1/go.mod h1:n/CVRwUEOgIxrgPvAQhUUr9oeUtvrhMomdKFjzJNB0c=
15+
github.com/OlivierCazade/api v0.0.0-20260324144412-012c4cdbbb5b h1:gP0wnvRizYDHlzLptWxAL3BPC1p6iTkqvC9R43Lexn4=
16+
github.com/OlivierCazade/api v0.0.0-20260324144412-012c4cdbbb5b/go.mod h1:pyVjK0nZ4sRs4fuQVQ4rubsJdahI1PB94LnQ8sGdvxo=
1517
github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
1618
github.com/antlr4-go/antlr/v4 v4.13.1/go.mod h1:GKmUxMtwp6ZgGwZSva4eWPC5mS6vUAmOABFgjdkM7Nw=
1719
github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
@@ -209,8 +211,6 @@ github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI
209211
github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
210212
github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
211213
github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
212-
github.com/openshift/api v0.0.0-20260320151444-324a1bcb9f55 h1:2h6bqs9ua3wrsQnxEbzys3/n5IohLC7Dyb/KgaVYC/A=
213-
github.com/openshift/api v0.0.0-20260320151444-324a1bcb9f55/go.mod h1:pyVjK0nZ4sRs4fuQVQ4rubsJdahI1PB94LnQ8sGdvxo=
214214
github.com/openshift/build-machinery-go v0.0.0-20251023084048-5d77c1a5e5af h1:UiYYMi/CCV+kwWrXuXfuUSOY2yNXOpWpNVgHc6aLQlE=
215215
github.com/openshift/build-machinery-go v0.0.0-20251023084048-5d77c1a5e5af/go.mod h1:8jcm8UPtg2mCAsxfqKil1xrmRMI3a+XU2TZ9fF8A7TE=
216216
github.com/openshift/client-go v0.0.0-20260320040014-4b5fc2cdad98 h1:Ssuo/zELWqb7pFCwzB3QGEA4QeLW948hL2AhWq2SWjs=

‎manifests/0000_70_cluster-network-operator_02_rbac_observability.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: cno-observability
5+
rules:
6+
# Manage the netobserv namespace itself
7+
- apiGroups: [""]
8+
resources: ["namespaces"]
9+
verbs: ["get", "create", "list"]
10+
11+
# Manage ServiceAccounts for ClusterExtension installer
12+
- apiGroups: [""]
13+
resources: ["serviceaccounts"]
14+
verbs: ["get", "create", "list"]
15+
16+
# Manage OLM v1 resources for operator installation
17+
- apiGroups: ["olm.operatorframework.io"]
18+
resources: ["clusterextensions"]
19+
verbs: ["get", "list", "create", "update", "patch"]
20+
21+
# Check for FlowCollector CRD to determine if operator is installed
22+
- apiGroups: ["apiextensions.k8s.io"]
23+
resources: ["customresourcedefinitions"]
24+
verbs: ["get"]
25+
26+
# Manage FlowCollector CRs
27+
- apiGroups: ["flows.netobserv.io"]
28+
resources: ["flowcollectors"]
29+
verbs: ["get", "create", "update", "patch", "delete"]
30+
---
31+
apiVersion: rbac.authorization.k8s.io/v1
32+
kind: ClusterRoleBinding
33+
metadata:
34+
name: cno-observability
35+
roleRef:
36+
apiGroup: rbac.authorization.k8s.io
37+
kind: ClusterRole
38+
name: cno-observability
39+
subjects:
40+
- kind: ServiceAccount
41+
name: cluster-network-operator
42+
namespace: openshift-network-operator

‎pkg/controller/add_networkconfig.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import (
88
"github.com/openshift/cluster-network-operator/pkg/controller/egress_router"
99
"github.com/openshift/cluster-network-operator/pkg/controller/infrastructureconfig"
1010
"github.com/openshift/cluster-network-operator/pkg/controller/ingressconfig"
11+
"github.com/openshift/cluster-network-operator/pkg/controller/observability"
1112
"github.com/openshift/cluster-network-operator/pkg/controller/operconfig"
1213
"github.com/openshift/cluster-network-operator/pkg/controller/pki"
1314
"github.com/openshift/cluster-network-operator/pkg/controller/proxyconfig"
@@ -28,5 +29,6 @@ func init() {
2829
infrastructureconfig.Add,
2930
allowlist.Add,
3031
dashboards.Add,
32+
observability.Add,
3133
)
3234
}

‎pkg/controller/observability/manifests/07-observability-operator.yaml‎

Lines changed: 246 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,246 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: openshift-netobserv-operator
5+
---
6+
apiVersion: v1
7+
kind: ServiceAccount
8+
metadata:
9+
name: netobserv-operator-installer
10+
namespace: openshift-netobserv-operator
11+
---
12+
apiVersion: rbac.authorization.k8s.io/v1
13+
kind: ClusterRole
14+
metadata:
15+
name: netobserv-operator-installer
16+
rules:
17+
# Permissions needed by OLM v1 to install the Network Observability operator
18+
# Based on OLM v1 pre-authorization requirements from the operator bundle
19+
20+
# Core resources
21+
- apiGroups: [""]
22+
resources: ["endpoints", "nodes", "pods"]
23+
verbs: ["get", "list", "watch"]
24+
- apiGroups: [""]
25+
resources: ["events"]
26+
verbs: ["create", "patch"]
27+
- apiGroups: [""]
28+
resources: ["namespaces"]
29+
verbs: ["create", "get", "list", "watch", "update", "patch", "delete"]
30+
- apiGroups: [""]
31+
resources: ["serviceaccounts", "services", "configmaps"]
32+
verbs: ["create", "get", "list", "watch", "update", "patch", "delete"]
33+
- apiGroups: [""]
34+
resources: ["secrets", "persistentvolumeclaims"]
35+
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
36+
37+
# Webhooks - validating webhook configurations
38+
- apiGroups: ["admissionregistration.k8s.io"]
39+
resources: ["validatingwebhookconfigurations"]
40+
verbs: ["create", "list", "watch"]
41+
- apiGroups: ["admissionregistration.k8s.io"]
42+
resources: ["validatingwebhookconfigurations"]
43+
resourceNames: ["flowcollectorconversionwebhook.netobserv.io", "flowmetricvalidationwebhook.netobserv.io"]
44+
verbs: ["delete", "get", "patch", "update"]
45+
46+
# CRDs and API services
47+
- apiGroups: ["apiextensions.k8s.io"]
48+
resources: ["customresourcedefinitions"]
49+
verbs: ["create", "get", "list", "watch", "update", "patch"]
50+
- apiGroups: ["apiextensions.k8s.io"]
51+
resources: ["customresourcedefinitions/status"]
52+
verbs: ["patch", "update"]
53+
- apiGroups: ["apiextensions.k8s.io"]
54+
resources: ["customresourcedefinitions"]
55+
resourceNames: ["flowcollectors.flows.netobserv.io", "flowcollectorslices.flows.netobserv.io", "flowmetrics.flows.netobserv.io"]
56+
verbs: ["delete"]
57+
- apiGroups: ["apiregistration.k8s.io"]
58+
resources: ["apiservices"]
59+
verbs: ["get", "list", "watch"]
60+
61+
# Workloads
62+
- apiGroups: ["apps"]
63+
resources: ["deployments", "daemonsets"]
64+
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
65+
- apiGroups: ["apps"]
66+
resources: ["replicasets"]
67+
verbs: ["get", "list", "watch"]
68+
69+
# Authentication and authorization
70+
- apiGroups: ["authentication.k8s.io"]
71+
resources: ["tokenreviews"]
72+
verbs: ["create"]
73+
- apiGroups: ["authorization.k8s.io"]
74+
resources: ["subjectaccessreviews"]
75+
verbs: ["create"]
76+
77+
# Autoscaling
78+
- apiGroups: ["autoscaling"]
79+
resources: ["horizontalpodautoscalers"]
80+
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
81+
82+
# eBPF (bpfman.io)
83+
- apiGroups: ["bpfman.io"]
84+
resources: ["clusterbpfapplications"]
85+
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
86+
- apiGroups: ["bpfman.io"]
87+
resources: ["clusterbpfapplications/status"]
88+
verbs: ["get", "patch", "update"]
89+
90+
# OpenShift config
91+
- apiGroups: ["config.openshift.io"]
92+
resources: ["clusterversions", "networks"]
93+
verbs: ["get", "list", "watch"]
94+
95+
# Console plugin
96+
- apiGroups: ["console.openshift.io"]
97+
resources: ["consoleplugins"]
98+
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
99+
100+
# Coordination (leader election)
101+
- apiGroups: ["coordination.k8s.io"]
102+
resources: ["leases"]
103+
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
104+
105+
# Discovery
106+
- apiGroups: ["discovery.k8s.io"]
107+
resources: ["endpointslices"]
108+
verbs: ["get", "list", "watch"]
109+
110+
# FlowCollector CRs
111+
- apiGroups: ["flows.netobserv.io"]
112+
resources: ["flowcollectors", "flowcollectorslices", "flowmetrics"]
113+
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
114+
- apiGroups: ["flows.netobserv.io"]
115+
resources: ["flowcollectors/finalizers"]
116+
verbs: ["update"]
117+
- apiGroups: ["flows.netobserv.io"]
118+
resources: ["flowcollectors/status", "flowcollectorslices/status", "flowmetrics/status"]
119+
verbs: ["get", "patch", "update"]
120+
121+
# OVN-Kubernetes
122+
- apiGroups: ["k8s.ovn.org"]
123+
resources: ["clusteruserdefinednetworks", "userdefinednetworks"]
124+
verbs: ["get", "list", "watch"]
125+
126+
# Loki integration
127+
- apiGroups: ["loki.grafana.com"]
128+
resources: ["lokistacks"]
129+
verbs: ["get", "list", "watch"]
130+
- apiGroups: ["loki.grafana.com"]
131+
resources: ["network"]
132+
resourceNames: ["logs"]
133+
verbs: ["create", "get"]
134+
135+
# Metrics
136+
- apiGroups: ["metrics.k8s.io"]
137+
resources: ["pods"]
138+
verbs: ["create"]
139+
140+
# Monitoring
141+
- apiGroups: ["monitoring.coreos.com"]
142+
resources: ["prometheusrules", "servicemonitors"]
143+
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
144+
145+
# Network policies
146+
- apiGroups: ["networking.k8s.io"]
147+
resources: ["networkpolicies"]
148+
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
149+
150+
# OLM ClusterExtension finalizers
151+
- apiGroups: ["olm.operatorframework.io"]
152+
resources: ["clusterextensions/finalizers"]
153+
resourceNames: ["netobserv-operator"]
154+
verbs: ["update"]
155+
156+
# OpenShift console and network config
157+
- apiGroups: ["operator.openshift.io"]
158+
resources: ["consoles"]
159+
verbs: ["get", "list", "update", "watch"]
160+
- apiGroups: ["operator.openshift.io"]
161+
resources: ["networks"]
162+
verbs: ["get", "list", "watch"]
163+
164+
# RBAC
165+
- apiGroups: ["rbac.authorization.k8s.io"]
166+
resources: ["clusterroles", "clusterrolebindings"]
167+
verbs: ["create", "delete", "get", "list", "update", "watch", "patch"]
168+
- apiGroups: ["rbac.authorization.k8s.io"]
169+
resources: ["roles"]
170+
verbs: ["list", "watch"]
171+
- apiGroups: ["rbac.authorization.k8s.io"]
172+
resources: ["rolebindings"]
173+
verbs: ["create", "delete", "get", "list", "update", "watch"]
174+
175+
# Security context constraints
176+
- apiGroups: ["security.openshift.io"]
177+
resources: ["securitycontextconstraints"]
178+
verbs: ["create", "list", "update", "watch"]
179+
- apiGroups: ["security.openshift.io"]
180+
resources: ["securitycontextconstraints"]
181+
resourceNames: ["hostnetwork"]
182+
verbs: ["use"]
183+
---
184+
apiVersion: rbac.authorization.k8s.io/v1
185+
kind: ClusterRoleBinding
186+
metadata:
187+
name: netobserv-operator-installer
188+
roleRef:
189+
apiGroup: rbac.authorization.k8s.io
190+
kind: ClusterRole
191+
name: netobserv-operator-installer
192+
subjects:
193+
- kind: ServiceAccount
194+
name: netobserv-operator-installer
195+
namespace: openshift-netobserv-operator
196+
---
197+
apiVersion: rbac.authorization.k8s.io/v1
198+
kind: Role
199+
metadata:
200+
name: netobserv-operator-installer
201+
namespace: openshift-netobserv-operator
202+
rules:
203+
# Namespace-scoped permissions needed for operator installation
204+
# The operator needs to manage Roles and RoleBindings in its own namespace
205+
- apiGroups: ["rbac.authorization.k8s.io"]
206+
resources: ["roles"]
207+
verbs: ["create"]
208+
- apiGroups: ["rbac.authorization.k8s.io"]
209+
resources: ["roles"]
210+
resourceNames: ["netobserv-openshift-netobserv-operator-prometheus"]
211+
verbs: ["delete", "get", "patch", "update"]
212+
- apiGroups: ["rbac.authorization.k8s.io"]
213+
resources: ["rolebindings"]
214+
resourceNames: ["netobserv-openshift-netobserv-operator-prometheus"]
215+
verbs: ["delete", "get", "patch", "update"]
216+
- apiGroups: ["rbac.authorization.k8s.io"]
217+
resources: ["rolebindings"]
218+
verbs: ["create"]
219+
---
220+
apiVersion: rbac.authorization.k8s.io/v1
221+
kind: RoleBinding
222+
metadata:
223+
name: netobserv-operator-installer
224+
namespace: openshift-netobserv-operator
225+
roleRef:
226+
apiGroup: rbac.authorization.k8s.io
227+
kind: Role
228+
name: netobserv-operator-installer
229+
subjects:
230+
- kind: ServiceAccount
231+
name: netobserv-operator-installer
232+
namespace: openshift-netobserv-operator
233+
---
234+
apiVersion: olm.operatorframework.io/v1
235+
kind: ClusterExtension
236+
metadata:
237+
name: netobserv-operator
238+
spec:
239+
namespace: openshift-netobserv-operator
240+
serviceAccount:
241+
name: netobserv-operator-installer
242+
source:
243+
sourceType: Catalog
244+
catalog:
245+
packageName: netobserv-operator
246+
channels: [stable]

‎pkg/controller/observability/manifests/08-flowcollector.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: flows.netobserv.io/v1beta2
2+
kind: FlowCollector
3+
metadata:
4+
name: cluster
5+
spec:
6+
agent:
7+
ebpf:
8+
features:
9+
- DNSTracking
10+
sampling: 400
11+
type: eBPF
12+
deploymentModel: Service
13+
loki:
14+
enable: false
15+
namespace: openshift-network-observability

0 commit comments

Comments
 (0)