Add versioned OVS security context defaults

[slawqo]

Propagate the OVN hardened OVS security context annotation from OpenStackVersion service defaults to OVNController. This defers the security context transition until the normal minor update workflow.

Depends-On: openstack-k8s-operators/ovn-operator#616

Related: OSPRH-34172

Assisted-By: GPT-5.6 Terra

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: slawqo
Once this PR has been reviewed and has the lgtm label, please assign stuggi for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[centosinfra-prod-github-app]

Merge Failed.

This change or one of its cross-repo dependencies was unable to be automatically merged with the current state of its repository. Please rebase the change and upload a new patchset.
Warning:
Error merging github.com/openstack-k8s-operators/ovn-operator for 616,ffd669832bb8870a09e4e448ab553cdeb32e9021

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: f8c0e237-06a9-45c1-b04e-da1af602a32c

📥 Commits

Reviewing files that changed from the base of the PR and between e22415e and 45042d7.

📒 Files selected for processing (7)

• api/bases/core.openstack.org_openstackversions.yaml
• api/core/v1beta1/openstackversion_types.go
• api/core/v1beta1/zz_generated.deepcopy.go
• config/crd/bases/core.openstack.org_openstackversions.yaml
• internal/openstack/ovn.go
• internal/openstack/version.go
• test/functional/ctlplane/openstackversion_controller_test.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Summary by CodeRabbit

• New Features
  • Added support for configuring the hardened OVS security context for OVN.
  • New OpenStack version service defaults expose this setting, defaulting to enabled.
  • The setting is automatically applied to the OVN controller during reconciliation.
• Bug Fixes
  • Preserved and updated the OVN security-context setting when transitioning between OpenStack versions.

Walkthrough

The OpenStackVersion API now stores the OVN hardened OVS security-context setting. OVNController reconciliation applies the setting as an annotation. Functional tests verify propagation during version transitions.

Changes

OVN security context propagation

Layer / File(s)	Summary
Service default contract api/core/v1beta1/openstackversion_types.go, api/bases/..., config/crd/bases/..., api/core/v1beta1/zz_generated.deepcopy.go	The API type and CRD schemas add the optional ovnHardenedOVSSecurityContext field. The generated deepcopy method copies the pointer value.
Default and controller wiring internal/openstack/version.go, internal/openstack/ovn.go	Service defaults set the field to "true". OVNController reconciliation sets the hardened security-context annotation to "true" or "false".
Version transition validation test/functional/ctlplane/openstackversion_controller_test.go	Functional tests verify the legacy "false" value and the updated "true" value on both OpenStackVersion and OVNController.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 45042

This change adds versioned security-context defaults and propagates them through the normal update workflow; no actionable merge-blocking risk remains.

Suggested reviewers: abays, rabi

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the addition of versioned OVS security context defaults.
Description check	✅ Passed	The description accurately explains propagation from OpenStackVersion service defaults to OVNController and the deferred transition workflow.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 5 files. (2 skipped: 2 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 5 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

OpenStackControlPlane CRD Size Report

Metric	Value
CRD JSON size	338280 bytes (330KB)
Base branch size	338280 bytes
Change	+0.00%
Status	yellow — growing

Threshold reference

Color	Range	Meaning
🟢 green	< 300KB	Comfortable
🟡 yellow	300–400KB	Growing
🟠 orange	400–750KB	Concerning
🔴 red	> 750KB	Approaching 1.5MB etcd limit (cut in half to allow space for update)

[openshift-ci]

@slawqo: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/functional	45042d7	link	true	/test functional
ci/prow/precommit-check	45042d7	link	true	/test precommit-check
ci/prow/openstack-operator-build-deploy-kuttl-4-20	45042d7	link	true	/test openstack-operator-build-deploy-kuttl-4-20

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.