Skip to content

OSAC-2068: Make fabricManager optional on NetworkClass and support k8s-only deployments - #146

Merged
openshift-merge-bot[bot] merged 1 commit into
osac-project:mainfrom
SiddarthR56:OSAC-2068
Aug 8, 2026
Merged

OSAC-2068: Make fabricManager optional on NetworkClass and support k8s-only deployments#146
openshift-merge-bot[bot] merged 1 commit into
osac-project:mainfrom
SiddarthR56:OSAC-2068

Conversation

@SiddarthR56

@SiddarthR56 SiddarthR56 commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Summary by CodeRabbit

  • New Features

    • Added support for Kubernetes-only network classes without requiring a fabric manager.
    • Added Kubernetes fallback dispatch for supported resources.
    • Prevented duplicate dispatch targets when both manager types are configured.
  • Bug Fixes

    • Prevented bare-metal instances and NAT gateways from using networks without a fabric manager.
    • Improved manager configuration validation and update behavior.
    • Clarified network class requirements for VM and Kubernetes deployments.
    • Improved errors when no usable manager is configured.

@openshift-ci-robot

openshift-ci-robot commented Aug 5, 2026

Copy link
Copy Markdown

@SiddarthR56: This pull request references OSAC-2068 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 5b81ab8a-e7ff-43aa-a897-921611dd1dc7

📥 Commits

Reviewing files that changed from the base of the PR and between 557e405 and 0b5be5b.

📒 Files selected for processing (2)
  • fulfillment-service/it/it_baremetal_instance_lifecycle_test.go
  • fulfillment-service/it/it_nat_gateway_test.go
🚧 Files skipped from review as they are similar to previous changes (2)
  • fulfillment-service/it/it_nat_gateway_test.go
  • fulfillment-service/it/it_baremetal_instance_lifecycle_test.go

Walkthrough

The change makes fabric_manager optional, permits Kubernetes-only NetworkClass resources, adds Kubernetes fallback dispatch, and validates fabric-manager availability for NAT gateway and bare-metal instance attachments.

Changes

NetworkClass manager contract

Layer / File(s) Summary
NetworkClass manager contract
fulfillment-service/proto/private/osac/private/v1/network_class_type.proto, fulfillment-service/internal/servers/private_network_classes_server.go, fulfillment-service/internal/servers/*network_classes*_test.go, fulfillment-service/internal/servers/default_networking_provisioner_test.go, fulfillment-service/internal/servers/private_tenants_server_test.go, fulfillment-service/it/*
fabric_manager is optional. Network classes require at least one non-empty manager. First-time fabric-manager assignment is allowed. Fixtures use pointer-valued manager fields.

Manager resolution and dispatch

Layer / File(s) Summary
Manager resolution and Kubernetes fallback
osac-operator/pkg/dispatcher/*, osac-operator/internal/controller/*
Resolution supports fabric-only, Kubernetes-only, and combined configurations. Dispatch selects available managers, applies resource-specific Kubernetes fallback, deduplicates targets, and reports missing-manager errors. Capability synchronization skips configurations without a fabric manager.

NAT gateway validation

Layer / File(s) Summary
NAT gateway network validation
fulfillment-service/internal/servers/private_nat_gateways_server.go, fulfillment-service/internal/servers/private_nat_gateways_server_test.go, fulfillment-service/internal/servers/nat_gateways_server_test.go, fulfillment-service/it/it_nat_gateway_test.go
NAT gateway creation resolves the referenced virtual network and network class. It rejects missing references with invalid-argument errors and rejects network classes without a fabric manager with FailedPrecondition.

Bare-metal attachment validation

Layer / File(s) Summary
Bare-metal network attachment validation
fulfillment-service/internal/servers/private_baremetal_instances_server.go, fulfillment-service/internal/servers/private_baremetal_instances_server_test.go, fulfillment-service/it/it_baremetal_instance_lifecycle_test.go
Bare-metal instance creation resolves subnet, virtual network, and network class attachments. It rejects resolved network classes without a fabric manager and permits creation without network attachments.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant NetworkClass
  participant Resolver
  participant Dispatcher
  participant Controller
  NetworkClass->>Resolver: provide manager identifiers
  Resolver-->>Dispatcher: return optional managers
  Dispatcher->>Dispatcher: select fallback and deduplicate targets
  Dispatcher-->>Controller: return dispatch result
  Controller->>Controller: skip sync when no fabric manager is resolved
Loading

Possibly related PRs

Suggested reviewers: larsks, trewest

🚥 Pre-merge checks | ✅ 10 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (10 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the main changes: optional fabricManager support and Kubernetes-only deployments.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets ✅ Passed No added API keys, tokens, passwords, private keys, credential URLs, or base64 blobs were found; added literals are manager names, test data, messages, and identifiers.
No-Weak-Crypto ✅ Passed The changed lines contain no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, crypto APIs, or custom crypto cues; comparisons only validate manager and reference presence.
No-Injection-Vectors ✅ Passed Diff inspection found no added shell execution, eval/exec, unsafe YAML, pickle, or DOM injection. Existing SQL is unchanged and uses $1 parameters; new IDs use DAO setters.
Container-Privileges ✅ Passed The PR changes no container/Kubernetes manifest and adds no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or runAsUser settings.
No-Sensitive-Data-In-Logs ✅ Passed Changed logs emit resource IDs, lookup errors, and boolean capabilities only; no passwords, tokens, API keys, PII, hostnames, or customer payloads are logged.
Ai-Attribution ✅ Passed AI use is documented by the PR and commit; the PR commit has Assisted-by: Cursor/Claude and no AI Co-Authored-By trailer.
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@SiddarthR56

Copy link
Copy Markdown
Contributor Author

@coderabbitai

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown

@SiddarthR56 I will review pull request #146 with focus on the optional fabricManager behavior, k8s-only deployment paths, and tests.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@fulfillment-service/internal/servers/private_network_classes_server.go`:
- Around line 378-381: Update hasAnyManager to require at least one non-empty
fabric_manager or k8s_manager value, rather than relying on protobuf presence
helpers. Preserve the existing validation error for requests where both
identifiers are empty or absent, and add create and update coverage for
explicitly empty optional manager fields.

In `@fulfillment-service/it/it_nat_gateway_test.go`:
- Around line 365-387: Update the deferred cleanup handlers for k8sOnlyNC and
k8sOnlyVNId to check the errors returned by networkClassesClient.Delete and
virtualNetworksClient.Delete instead of discarding them. Use assertions or
DeferCleanup so cleanup failures are reported while preserving cleanup
execution.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 80913a7a-5b0c-476c-8ba8-f373a6912290

📥 Commits

Reviewing files that changed from the base of the PR and between 45b4742 and 8be8308.

⛔ Files ignored due to path filters (2)
  • fulfillment-service/internal/api/osac/private/v1/network_class_type.pb.go is excluded by !**/*.pb.go
  • fulfillment-service/internal/api/osac/private/v1/network_class_type_protoopaque.pb.go is excluded by !**/*.pb.go
📒 Files selected for processing (20)
  • fulfillment-service/internal/servers/default_networking_provisioner_test.go
  • fulfillment-service/internal/servers/nat_gateways_server_test.go
  • fulfillment-service/internal/servers/network_classes_server_test.go
  • fulfillment-service/internal/servers/private_baremetal_instances_server.go
  • fulfillment-service/internal/servers/private_baremetal_instances_server_test.go
  • fulfillment-service/internal/servers/private_nat_gateways_server.go
  • fulfillment-service/internal/servers/private_nat_gateways_server_test.go
  • fulfillment-service/internal/servers/private_network_classes_server.go
  • fulfillment-service/internal/servers/private_tenants_server_test.go
  • fulfillment-service/it/it_baremetal_instance_lifecycle_test.go
  • fulfillment-service/it/it_compute_subnet_test.go
  • fulfillment-service/it/it_nat_gateway_test.go
  • fulfillment-service/it/it_tenant_lifecycle_test.go
  • fulfillment-service/proto/private/osac/private/v1/network_class_type.proto
  • osac-aap/collections/ansible_collections/osac/service/roles/enumerate_templates/tests/test.yml
  • osac-operator/pkg/dispatcher/dispatch.go
  • osac-operator/pkg/dispatcher/dispatch_test.go
  • osac-operator/pkg/dispatcher/dispatcher.go
  • osac-operator/pkg/dispatcher/resolver.go
  • osac-operator/pkg/dispatcher/resolver_test.go

Comment thread fulfillment-service/it/it_nat_gateway_test.go Outdated
@openshift-ci

openshift-ci Bot commented Aug 5, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: danmanor, SiddarthR56

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved label Aug 5, 2026
@danmanor

danmanor commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

/retest

@github-actions

github-actions Bot commented Aug 5, 2026

Copy link
Copy Markdown

Re-triggered failed runs:

  • E2E CaaS Full Install (#31006832097)

@openshift-ci

openshift-ci Bot commented Aug 6, 2026

Copy link
Copy Markdown

New changes are detected. LGTM label has been removed.

@coderabbitai

coderabbitai Bot commented Aug 6, 2026

Copy link
Copy Markdown

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
osac-operator/internal/controller/networkclass_capabilities_controller.go (1)

185-204: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Clear stale capabilities before the early return.

When a NetworkClass changes from fabric-backed to Kubernetes-only, nc can still contain capabilities from the previous reconciliation. The resolved.FabricManager == nil path at Lines 199-203 returns without clearing or persisting the field, so clients can continue to see stale fabric capabilities.

Clear the controller-owned capabilities to the canonical empty representation and persist that state before returning. Add a regression test for a fabric-to-Kubernetes-only transition. Apply the same cleanup to the no-manager path if that state can retain old capabilities.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@osac-operator/internal/controller/networkclass_capabilities_controller.go`
around lines 185 - 204, Update the resolved.FabricManager == nil early-return
path to clear controller-owned capabilities using the canonical empty
representation, persist the updated NetworkClass, then return. Apply the same
cleanup to the ErrNoManagerConfigured path if it can retain stale capabilities,
and add a regression test covering a fabric-backed to Kubernetes-only
transition.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@osac-operator/internal/controller/networkclass_capabilities_controller.go`:
- Around line 185-204: Update the resolved.FabricManager == nil early-return
path to clear controller-owned capabilities using the canonical empty
representation, persist the updated NetworkClass, then return. Apply the same
cleanup to the ErrNoManagerConfigured path if it can retain stale capabilities,
and add a regression test covering a fabric-backed to Kubernetes-only
transition.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 905d66a0-fd59-4c44-bc58-f6a1b1be2cf9

📥 Commits

Reviewing files that changed from the base of the PR and between 946697d and a2599be.

⛔ Files ignored due to path filters (2)
  • fulfillment-service/internal/api/osac/private/v1/network_class_type.pb.go is excluded by !**/*.pb.go
  • fulfillment-service/internal/api/osac/private/v1/network_class_type_protoopaque.pb.go is excluded by !**/*.pb.go
📒 Files selected for processing (22)
  • fulfillment-service/internal/servers/default_networking_provisioner_test.go
  • fulfillment-service/internal/servers/nat_gateways_server_test.go
  • fulfillment-service/internal/servers/network_classes_server_test.go
  • fulfillment-service/internal/servers/private_baremetal_instances_server.go
  • fulfillment-service/internal/servers/private_baremetal_instances_server_test.go
  • fulfillment-service/internal/servers/private_nat_gateways_server.go
  • fulfillment-service/internal/servers/private_nat_gateways_server_test.go
  • fulfillment-service/internal/servers/private_network_classes_server.go
  • fulfillment-service/internal/servers/private_tenants_server_test.go
  • fulfillment-service/it/it_baremetal_instance_lifecycle_test.go
  • fulfillment-service/it/it_compute_subnet_test.go
  • fulfillment-service/it/it_nat_gateway_test.go
  • fulfillment-service/it/it_tenant_lifecycle_test.go
  • fulfillment-service/proto/private/osac/private/v1/network_class_type.proto
  • osac-aap/collections/ansible_collections/osac/service/roles/enumerate_templates/tests/test.yml
  • osac-operator/internal/controller/networkclass_capabilities_controller.go
  • osac-operator/internal/controller/networkclass_capabilities_controller_test.go
  • osac-operator/pkg/dispatcher/dispatch.go
  • osac-operator/pkg/dispatcher/dispatch_test.go
  • osac-operator/pkg/dispatcher/dispatcher.go
  • osac-operator/pkg/dispatcher/resolver.go
  • osac-operator/pkg/dispatcher/resolver_test.go
🚧 Files skipped from review as they are similar to previous changes (19)
  • fulfillment-service/it/it_tenant_lifecycle_test.go
  • fulfillment-service/it/it_compute_subnet_test.go
  • fulfillment-service/internal/servers/private_network_classes_server.go
  • fulfillment-service/internal/servers/private_tenants_server_test.go
  • osac-aap/collections/ansible_collections/osac/service/roles/enumerate_templates/tests/test.yml
  • fulfillment-service/internal/servers/nat_gateways_server_test.go
  • fulfillment-service/internal/servers/private_nat_gateways_server_test.go
  • fulfillment-service/internal/servers/default_networking_provisioner_test.go
  • fulfillment-service/proto/private/osac/private/v1/network_class_type.proto
  • osac-operator/pkg/dispatcher/dispatch.go
  • fulfillment-service/it/it_nat_gateway_test.go
  • osac-operator/pkg/dispatcher/resolver_test.go
  • osac-operator/pkg/dispatcher/dispatcher.go
  • fulfillment-service/it/it_baremetal_instance_lifecycle_test.go
  • fulfillment-service/internal/servers/private_nat_gateways_server.go
  • fulfillment-service/internal/servers/private_baremetal_instances_server_test.go
  • fulfillment-service/internal/servers/private_baremetal_instances_server.go
  • osac-operator/pkg/dispatcher/dispatch_test.go
  • fulfillment-service/internal/servers/network_classes_server_test.go

…s-only deployments

Assisted-by: Cursor/Claude
@openshift-merge-bot
openshift-merge-bot Bot merged commit 4956560 into osac-project:main Aug 8, 2026
38 of 39 checks passed
omer-vishlitzky added a commit to omer-vishlitzky/osac that referenced this pull request Aug 9, 2026
…kClass)

A rebase mishap on this branch pulled in a full revert of already-merged
PR osac-project#146 (OSAC-2068: make fabricManager optional on NetworkClass, support
k8s-only deployments) across 24 files spanning fulfillment-service,
osac-operator, and osac-aap. It has no relation to this PR's single-chart
Kind deployment work -- Kind's own values even disable the networking
subsystem the reverted dispatcher code operates under.

Left as-is, the revert would have made any NetworkClass created with an
empty fabric_manager permanently stuck: the reinstated validation rejects
an empty fabric_manager on Update, and the reinstated immutability check
rejects setting it for the first time, with no path between the two.

Restore all 24 files to main's state (git checkout main -- <paths>),
re-verified against origin/main:
- fulfillment-service: go build ./... and go test ./internal/servers/...
  both pass; buf generate against the restored proto produces zero diff
  (generated code already in sync)
- osac-operator: go build ./... and go test ./pkg/dispatcher/... pass

Assisted-by: Claude Code <noreply@anthropic.com>
Signed-off-by: omer-vishlitzky <omer.vishlitzky@gmail.com>
omer-vishlitzky added a commit to omer-vishlitzky/osac that referenced this pull request Aug 9, 2026
…kClass)

A rebase mishap on this branch pulled in a full revert of already-merged
PR osac-project#146 (OSAC-2068: make fabricManager optional on NetworkClass, support
k8s-only deployments) across 24 files spanning fulfillment-service,
osac-operator, and osac-aap. It has no relation to this PR's single-chart
Kind deployment work -- Kind's own values even disable the networking
subsystem the reverted dispatcher code operates under.

Left as-is, the revert would have made any NetworkClass created with an
empty fabric_manager permanently stuck: the reinstated validation rejects
an empty fabric_manager on Update, and the reinstated immutability check
rejects setting it for the first time, with no path between the two.

Restore all 24 files to main's state (git checkout main -- <paths>),
re-verified against origin/main:
- fulfillment-service: go build ./... and go test ./internal/servers/...
  both pass; buf generate against the restored proto produces zero diff
  (generated code already in sync)
- osac-operator: go build ./... and go test ./pkg/dispatcher/... pass

Assisted-by: Claude Code <noreply@anthropic.com>
Signed-off-by: omer-vishlitzky <omer.vishlitzky@gmail.com>
omer-vishlitzky added a commit to omer-vishlitzky/osac that referenced this pull request Aug 10, 2026
…kClass)

A rebase mishap on this branch pulled in a full revert of already-merged
PR osac-project#146 (OSAC-2068: make fabricManager optional on NetworkClass, support
k8s-only deployments) across 24 files spanning fulfillment-service,
osac-operator, and osac-aap. It has no relation to this PR's single-chart
Kind deployment work -- Kind's own values even disable the networking
subsystem the reverted dispatcher code operates under.

Left as-is, the revert would have made any NetworkClass created with an
empty fabric_manager permanently stuck: the reinstated validation rejects
an empty fabric_manager on Update, and the reinstated immutability check
rejects setting it for the first time, with no path between the two.

Restore all 24 files to main's state (git checkout main -- <paths>),
re-verified against origin/main:
- fulfillment-service: go build ./... and go test ./internal/servers/...
  both pass; buf generate against the restored proto produces zero diff
  (generated code already in sync)
- osac-operator: go build ./... and go test ./pkg/dispatcher/... pass

Assisted-by: Claude Code <noreply@anthropic.com>
Signed-off-by: omer-vishlitzky <omer.vishlitzky@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants