CORS-4334: konnectivity: remove hostNetwork from konnectivity agent

[tthvo]

The bootstrap konnectivity agent DaemonSet was configured with hostNetwork: true, which requires an SCC that allows host networking.

Since pods can reach the bootstrap node IP from the pod network, hostNetwork is not required. Remove it along with the associated dnsPolicy: Default override.

Follow-up for #10344. See #10659 (comment) for investigation details.

References

• https://kubernetes.io/docs/tasks/extend-kubernetes/setup-konnectivity/
• https://github.com/openshift/hypershift/blob/main/control-plane-operator/controllers/hostedcontrolplane/v2/assets/konnectivity-agent/deployment.yaml

Summary by CodeRabbit

• Bug Fixes
  • Updated the Konnectivity agent deployment configuration by removing explicit host networking and default DNS settings.
  • This may affect how the agent connects and resolves names in the cluster, aligning it with the standard runtime network setup.

[openshift-ci-robot]

@tthvo: This pull request explicitly references no jira issue.

Details

In response to this:

The bootstrap konnectivity agent DaemonSet was configured with hostNetwork: true, which requires an SCC that allows host networking.

Since pods can reach the bootstrap node IP from the pod network, hostNetwork is not required. Remove it along with the associated dnsPolicy: Default override.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

📝 Walkthrough

Walkthrough

The konnectivity-agent DaemonSet manifest removes explicit hostNetwork and dnsPolicy settings from the pod template spec.

Changes

Konnectivity agent pod networking

Layer / File(s)	Summary
DaemonSet pod network settings data/data/bootstrap/files/opt/openshift/konnectivity-agent-daemonset.yaml	The DaemonSet pod template spec no longer sets hostNetwork: true or dnsPolicy: Default.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~5–15 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only changes a DaemonSet YAML; no Ginkgo test titles or test sources were added or modified, so no unstable names were introduced.
Test Structure And Quality	✅ Passed	Manifest-only change; no *_test.go/Ginkgo test code was touched, so the test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	No Ginkgo e2e tests were added; the PR only changes the konnectivity-agent manifest, so MicroShift test compatibility is not implicated.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The commit only edits a YAML manifest to remove hostNetwork/dnsPolicy; no Ginkgo/e2e test files or SNO-sensitive test logic were added.
Topology-Aware Scheduling Compatibility	✅ Passed	Only hostNetwork/dnsPolicy were removed from a bootstrap DaemonSet; no nodeSelector, affinity, spread, replica, or topology-based scheduling constraints were added.
Ote Binary Stdout Contract	✅ Passed	PASS: The PR only edits a DaemonSet YAML manifest; no process-level code, main/init setup, or stdout writes were introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR only edits a bootstrap DaemonSet YAML; no Ginkgo test code or external-connectivity logic was added.
No-Weak-Crypto	✅ Passed	The PR only edits a YAML DaemonSet to remove hostNetwork/dnsPolicy; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret-comparison code is present.
Container-Privileges	✅ Passed	The manifest has no privileged, hostPID/IPC, allowPrivilegeEscalation, or SYS_ADMIN settings, and hostNetwork was removed.
No-Sensitive-Data-In-Logs	✅ Passed	The change only removes hostNetwork/dnsPolicy; no new logging or sensitive fields (tokens, PII, internal hostnames) were added.
Title check	✅ Passed	The title accurately reflects the main change: removing hostNetwork from the konnectivity agent DaemonSet.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[tthvo]

/test e2e-aws-ovn-techpreview
/test e2e-aws-ovn-devpreview

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign pawanpinjarkar for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tthvo]

/test e2e-azure-ovn-techpreview

[openshift-ci-robot]

@tthvo: This pull request references CORS-4334 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

The bootstrap konnectivity agent DaemonSet was configured with hostNetwork: true, which requires an SCC that allows host networking.

Since pods can reach the bootstrap node IP from the pod network, hostNetwork is not required. Remove it along with the associated dnsPolicy: Default override.

References

• https://kubernetes.io/docs/tasks/extend-kubernetes/setup-konnectivity/
• https://github.com/openshift/hypershift/blob/main/control-plane-operator/controllers/hostedcontrolplane/v2/assets/konnectivity-agent/deployment.yaml

Summary by CodeRabbit

• Bug Fixes
• Updated the Konnectivity agent deployment configuration by removing explicit host networking and default DNS settings.
• This may affect how the agent connects and resolves names in the cluster, aligning it with the standard runtime network setup.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[tthvo]

/cc @patrickdillon @mdbooth

[tthvo]

/jira refresh

[openshift-ci-robot]

@tthvo: This pull request references CORS-4334 which is a valid jira issue.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@tthvo: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn-devpreview	3e81820	link	false	/test e2e-aws-ovn-devpreview
ci/prow/e2e-azure-ovn-techpreview	3e81820	link	false	/test e2e-azure-ovn-techpreview

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.