OCPBUGS-65631: Use dedicated service accounts for multus pods#2961
Conversation
openshift-ci-robot
added
jira/severity-critical
|
@ehearne-redhat: This pull request references Jira Issue OCPBUGS-65631, which is valid. 3 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (weliang@redhat.com), skipping review request. The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
🚧 Files skipped from review as they are similar to previous changes (2)
WalkthroughAdds a new Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 10 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (10 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.11.4)level=error msg="Running error: context loading failed: failed to load packages: failed to load packages: failed to load with go/packages: err: exit status 1: stderr: go: inconsistent vendoring in :\n\tgithub.com/Masterminds/semver@v1.5.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt\n\tgithub.com/Masterminds/sprig/v3@v3.2.3: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt\n\tgithub.com/containernetworking/cni@v0.8.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt\n\tgithub.com/ghodss/yaml@v1.0.1-0.20190212211648-25d852aebe32: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt\n\tgithub.com/go-bindata/go-bindata@v3.1.2+incompatible: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt\n\tgithub.com/onsi/gomega@v1.39.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt\n\tgithub.com/ope ... [truncated 17356 characters] ... ired in go.mod, but not marked as explicit in vendor/modules.txt\n\tk8s.io/gengo/v2@v2.0.0-20251215205346-5ee0d033ba5b: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt\n\tk8s.io/kms@v0.35.2: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt\n\tk8s.io/kube-aggregator@v0.35.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt\n\tsigs.k8s.io/randfill@v1.0.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt\n\tsigs.k8s.io/structured-merge-diff/v6@v6.3.2: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt\n\n\tTo ignore the vendor directory, use -mod=readonly or -mod=mod.\n\tTo sync the vendor directory, run:\n\t\tgo mod vendor\n" Comment |
|
/retest |
1 similar comment
|
/retest |
|
/retest-required |
| {{ if not .NETWORK_NODE_IDENTITY_ENABLE }} | ||
| {{ if .NETWORK_NODE_IDENTITY_ENABLE }} | ||
| serviceAccountName: multus-node-identity | ||
| {{ else }} |
There was a problem hiding this comment.
just a nit:
Consider adding an explanatory comment here for clarity:
{{ if .NETWORK_NODE_IDENTITY_ENABLE }}
serviceAccountName: multus-node-identity
{{ else }}
# Network node identity disabled, use service account with permissions
serviceAccountName: multus
{{ end }}This helps future readers understand why the multus service account is used in this case.
|
/lgtm |
The cni-sysctl-allowlist-ds pod was using the default service account. Add serviceAccountName: multus-ancillary-tools to use a dedicated SA. Also make sure that defaultt SA isn't used when multus network node identity is enabled. This work was taken from yboaron's PR in openshift#2845. yboaron has given me permission to take over his work on this. Signed-off-by: Evan Hearne <ehearne@redhat.com>
ehearne-redhat
force-pushed
the
multus-service-account
branch
from
f65e0ae to
d7eed00
Compare
openshift-ci-robot
added
jira/invalid-bug
|
@ehearne-redhat: This pull request references Jira Issue OCPBUGS-65631, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@ehearne-redhat: This pull request references Jira Issue OCPBUGS-65631, which is valid. 3 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (weliang@redhat.com), skipping review request. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/lgtm |
|
/retest-required |
1 similar comment
|
/retest-required |
|
/cherrypick release-4.22 Back porting to 4.22 as this was meant to be completed in 4.22 . |
|
@ehearne-redhat: once the present PR merges, I will cherry-pick it on top of DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ehearne-redhat, kyrtapz, ShazaAldawamneh The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
/verified by ci/prow/e2e-gcp-ovn, ci/prow/unit ---
apiVersion: v1
kind: Pod
metadata:
annotations:
cluster-autoscaler.kubernetes.io/enable-ds-eviction: "false"
creationTimestamp: "2026-04-23T11:02:40Z"
generateName: multus-
...
serviceAccount: multus-node-identity
serviceAccountName: multus-node-identity
...
phase: Running
...---
apiVersion: v1
kind: Pod
metadata:
annotations:
cluster-autoscaler.kubernetes.io/enable-ds-eviction: "false"
creationTimestamp: "2026-04-23T11:17:12Z"
generateName: multus-additional-cni-plugins-
...
serviceAccount: multus-ancillary-tools
serviceAccountName: multus-ancillary-tools
...
phase: Running
... |
openshift-ci-robot
added
the
verified
|
@ehearne-redhat: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-merge-bot
Bot
merged commit 8dcd0a2
into
openshift:master
|
@ehearne-redhat: Jira Issue Verification Checks: Jira Issue OCPBUGS-65631 Jira Issue OCPBUGS-65631 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@ehearne-redhat: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
@ehearne-redhat: new pull request created: #2985 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
Fix included in release 5.0.0-0.nightly-2026-04-30-154809 |
6 participants
This work was taken/adapted from yboaron's PR in #2845. yboaron has given me permission to take over his work on this.
Service accounts have been added to multus related pods.
openshift-multus/cni-sysctl-allowlist-dspod now usesmultus-ancillary-toolsServiceAccount.openshift-multus/multusnow uses newly createdmultus-node-identityServiceAccount whenNETWORK_NODE_IDENTITY_ENABLE == trueinstead ofdefault. The service account has no bindings attached.The commit message has been kept the same, and the logic has been kept the same from the mentioned PR. Though, line placement does differ for
multus.yaml.Summary by CodeRabbit
Release Notes
Tests
Chores