ACM-31165: Test and validate network policies for Infrastructure Operator components by shay23bra · Pull Request #10670 · openshift/assisted-service

shay23bra · 2026-07-20T07:30:04Z

Summary

Adds NetworkPolicies for Infrastructure Operator components:

assisted-service and assisted-image-service — created dynamically by the operator via AgentServiceConfig reconciliation, consistent with how it manages other resources (Services, Deployments, Routes)
infrastructure-operator — static YAML in config/manager/, since it's deployed by the backplane-operator

Ingress restricted to known ports, egress to DNS, K8s API, spoke clusters (6443), and HTTPS (443). IPv4 and IPv6 supported.

Test results (kind + Calico)

=== SUMMARY: 17 passed, 0 failed ===

Summary by CodeRabbit

New Features
- Added network policies to secure infrastructure, assisted-service, and image-service components.
- Restricted ingress and egress to required monitoring, DNS, Kubernetes API, webhook, and HTTPS traffic.
- Blocked outbound IPv4 access to the cloud metadata endpoint while allowing other HTTPS destinations.
Bug Fixes
- Improved status reporting with a dedicated reason for network policy failures.

openshift-ci · 2026-07-20T07:30:08Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

openshift-ci-robot · 2026-07-20T07:30:08Z

@shay23bra: This pull request references ACM-31165 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target either version "5.0." or "openshift-5.0.", but it targets "ACM 5.0.0" instead.

Details

In response to this:

Summary

Adds per-component NetworkPolicies for the three Infrastructure Operator components, following the ACM 5.0 DDR pattern (Create-Once + Operand Ownership):

assisted-service — ingress on 8090 (API), 8091 (iPXE HTTP), 9443 (webhook); egress to DNS, K8s API, spoke clusters, external HTTPS, PostgreSQL

assisted-image-service — ingress on 8080 (HTTPS), 8081 (HTTP); egress to DNS, K8s API, assisted-service, external HTTPS (ISO mirrors)

infrastructure-operator — ingress on 8080 (metrics), 9443 (webhook); egress to DNS, K8s API, external HTTPS

Each policy uses podSelector scoped to its component's app / control-plane label so they don't interfere with other components in the shared namespace.

Related

Jira: ACM-31165

Epic: ACM-31152

DDR: ACM-DDR-XXX (Enablement for NetworkPolicies by ACM Operators)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-07-20T07:30:43Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: shay23bra

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [shay23bra]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

coderabbitai · 2026-07-20T07:30:50Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

Walkthrough

The change adds restricted network policies for infrastructure-operator, assisted-service, and image-service pods. The controller gains RBAC permissions, reconciliation wiring, policy constructors, and a diagnostic reason constant. Manager and OLM manifests package the infrastructure-operator policy.

Changes

Network policy controls

Layer / File(s)	Summary
Service policy reconciliation `api/v1beta1/agentserviceconfig_types.go`, `internal/controller/controllers/agentserviceconfig_controller.go`	Adds `ReasonNetworkPolicyFailure`, network policy RBAC, reconciliation wiring, and constructors for assisted-service and image-service policies. The policies define service ingress and shared DNS, Kubernetes API, and HTTPS egress rules.
Infrastructure-operator policy packaging `config/manager/infrastructure-operator-networkpolicy.yaml`, `config/manager/kustomization.yaml`, `deploy/olm-catalog/manifests/infrastructure-operator-networkpolicy.yaml`	Adds the infrastructure-operator `NetworkPolicy` with ingress and egress rules. Includes the policy in manager resources and OLM manifests.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Suggested reviewers: jhernand, eranco74

Sequence Diagram(s)

sequenceDiagram
  participant AgentServiceConfigController
  participant KubernetesAPI
  participant AssistedServicePods
  participant ImageServicePods
  AgentServiceConfigController->>KubernetesAPI: Reconcile assisted-service NetworkPolicy
  KubernetesAPI->>AssistedServicePods: Enforce assisted-service ingress and egress
  AgentServiceConfigController->>KubernetesAPI: Reconcile image-service NetworkPolicy when enabled
  KubernetesAPI->>ImageServicePods: Enforce image-service ingress and egress

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: testing and validating NetworkPolicies for Infrastructure Operator components.
Description check	✅ Passed	The description summarizes the changes, lists related issues and dependencies, and reports successful kind and Calico test results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The pull request changes no test files and adds no Ginkgo declarations or test-title expressions, so no unstable test names are introduced.
Test Structure And Quality	✅ Passed	The pull request changes no *_test.go files and adds no Ginkgo code; therefore the listed test-structure requirements are not applicable.
Microshift Test Compatibility	✅ Passed	The pull request adds manifests, controller logic, and constants only; it adds no Ginkgo e2e tests, so MicroShift test compatibility is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request adds manifests, constants, and controller code only; no new Ginkgo e2e tests or multi-node test assumptions are present.
Topology-Aware Scheduling Compatibility	✅ Passed	The exact PR diff adds only NetworkPolicies, RBAC, component reconciliation, and a reason constant; no affinity, topology spread, node selectors, tolerations, replica, or PDB scheduling constraints...
Ote Binary Stdout Contract	✅ Passed	The PR adds no OTE binary or suite setup; added Go lines contain no stdout APIs, and the repository has no openshift-tests/OTE integration references.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The commit adds no Ginkgo tests. Its IPv4 NetworkPolicy CIDR is production code and is paired with IPv6 CIDRs, so this test-specific check does not apply.
No-Weak-Crypto	✅ Passed	The added code only defines NetworkPolicies and a reason constant; scans found no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	Changed files add NetworkPolicy objects and reconciliation logic; added-line scans found no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or runAs settings.
No-Sensitive-Data-In-Logs	✅ Passed	The PR adds NetworkPolicy definitions and a reason constant only; no new log statements or sensitive values appear in the added lines.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@config/manager/assisted-service-networkpolicy.yaml`:
- Around line 80-87: Update the PostgreSQL egress rule in the NetworkPolicy to
support the documented external database configuration by adding a narrowly
scoped namespaceSelector or ipBlock for the permitted external PostgreSQL
destination, while preserving the existing assisted-service pod access on port
5432.

In `@config/manager/infrastructure-operator-networkpolicy.yaml`:
- Around line 26-29: Constrain the ingress peers for the listed NetworkPolicy
ports by adding explicit from rules: in
config/manager/infrastructure-operator-networkpolicy.yaml lines 26-29, allow
9443 only from kube-apiserver; in
config/manager/assisted-service-networkpolicy.yaml lines 36-43, restrict 8090,
8091, and 9443 to the intended agent, controller, and webhook peers; and in
config/manager/assisted-image-service-networkpolicy.yaml lines 28-33, restrict
8080 and 8081 to the intended node or ingress sources.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 0be4370e-801e-44be-a610-9e65c2d9f3dc

📥 Commits

Reviewing files that changed from the base of the PR and between 5b24d2d and 0306342.

📒 Files selected for processing (4)

config/manager/assisted-image-service-networkpolicy.yaml
config/manager/assisted-service-networkpolicy.yaml
config/manager/infrastructure-operator-networkpolicy.yaml
config/manager/kustomization.yaml

carbonin

Wouldn't it make more sense to deploy these network policy objects when we deploy the workloads from the infrastructure operator code?

codecov · 2026-07-22T16:12:26Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 45.45%. Comparing base (f9cee86) to head (b28cecc).
⚠️ Report is 12 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #10670      +/-   ##
==========================================
+ Coverage   44.61%   45.45%   +0.83%     
==========================================
  Files         423      425       +2     
  Lines       73421    75166    +1745     
==========================================
+ Hits        32755    34164    +1409     
- Misses      37725    38059     +334     
- Partials     2941     2943       +2

Files with missing lines	Coverage Δ
...oller/controllers/agentserviceconfig_controller.go	`89.40% <100.00%> (+5.69%)`	⬆️

... and 7 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@internal/controller/controllers/agentserviceconfig_controller.go`:
- Around line 858-890: Update networkPolicyDefaultEgress in
internal/controller/controllers/agentserviceconfig_controller.go to exclude
fd00:ec2::254/128 from the IPv6 443 IPBlock alongside the existing IPv4 IMDS
exclusion; apply the same IPv6 Except entry in
deploy/olm-catalog/manifests/infrastructure-operator-networkpolicy.yaml lines
51-60. Also update config/manager/infrastructure-operator-networkpolicy.yaml
with the same exclusion so every generated and manifest-defined 443 egress rule
blocks both IMDS addresses.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 1aeb7d1e-9e48-4df8-b9c9-5f09acd379cc

📥 Commits

Reviewing files that changed from the base of the PR and between c0f86bd and 9e399e2.

📒 Files selected for processing (5)

api/v1beta1/agentserviceconfig_types.go
config/manager/infrastructure-operator-networkpolicy.yaml
config/manager/kustomization.yaml
deploy/olm-catalog/manifests/infrastructure-operator-networkpolicy.yaml
internal/controller/controllers/agentserviceconfig_controller.go

🚧 Files skipped from review as they are similar to previous changes (1)

config/manager/infrastructure-operator-networkpolicy.yaml

coderabbitai

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@deploy/olm-catalog/manifests/infrastructure-operator-networkpolicy.yaml`:
- Around line 50-60: Update the HTTPS egress ipBlock rules in the infrastructure
network policy and its regenerated bundle to exclude the IPv6 metadata endpoints
fd00:ec2::254/128 and fd20:ce::254/128 from the ::/0 block, while preserving the
existing IPv4 metadata exclusion and registry HTTPS access.
- Around line 14-17: Remove the all-port same-namespace ingress rule under the
NetworkPolicy’s ingress configuration, or replace it with explicit source and
port allow-list entries limited to the required ports. Regenerate the OLM bundle
so the generated manifest reflects the restricted policy.
- Around line 41-60: The network policy’s Kubernetes API egress rule only
permits pods labeled component: apiserver and does not cover external spoke
APIs. Update the infrastructure operator network policy to allow supported
HyperShift API service endpoints on TCP/6443 and add the approved spoke-cluster
CIDR rules, or place equivalent exceptions in the reconciled policies that own
those endpoints.
- Around line 26-29: Update the webhook ingress rule in the NetworkPolicy to
restrict TCP port 9443 sources using the OpenShift
policy-group.network.openshift.io/host-network namespace selector. Preserve the
existing kube-apiserver webhook port rule while adding the selector under its
from configuration, rather than allowing ingress from all sources.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 89fe1072-2d4a-49c2-ab18-cba34f5064ab

📥 Commits

Reviewing files that changed from the base of the PR and between b2725b0 and 798241d.

📒 Files selected for processing (5)

api/v1beta1/agentserviceconfig_types.go
config/manager/infrastructure-operator-networkpolicy.yaml
config/manager/kustomization.yaml
deploy/olm-catalog/manifests/infrastructure-operator-networkpolicy.yaml
internal/controller/controllers/agentserviceconfig_controller.go

🚧 Files skipped from review as they are similar to previous changes (4)

config/manager/infrastructure-operator-networkpolicy.yaml
config/manager/kustomization.yaml
api/v1beta1/agentserviceconfig_types.go
internal/controller/controllers/agentserviceconfig_controller.go

shay23bra · 2026-08-04T05:53:44Z

/retest

giladravid16 · 2026-08-04T10:30:49Z

@shay23bra The operator also deploys the webhook as a seperate deployment, so we need a network policy for it as well

Create NetworkPolicies for assisted-service and assisted-image-service dynamically via AgentServiceConfig reconciliation, consistent with how the operator manages other resources. The infrastructure-operator's own NetworkPolicy is static YAML in config/manager/ and deploy/olm-catalog/manifests/. Ingress restricted to known ports, egress to DNS, K8s API, spoke clusters, and HTTPS. IPv4 and IPv6 supported.

giladravid16 · 2026-08-04T12:10:41Z

/lgtm

gamli75 · 2026-08-05T08:58:51Z

/override ci/prow/edge-e2e-ai-operator-disconnected-capi

openshift-ci · 2026-08-05T08:59:15Z

@gamli75: Overrode contexts on behalf of gamli75: ci/prow/edge-e2e-ai-operator-disconnected-capi

Details

In response to this:

/override ci/prow/edge-e2e-ai-operator-disconnected-capi

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

shay23bra · 2026-08-05T09:03:28Z

/override ci/prow/edge-e2e-ai-operator-ztp

openshift-ci · 2026-08-05T09:03:49Z

@shay23bra: Overrode contexts on behalf of shay23bra: ci/prow/edge-e2e-ai-operator-ztp

Details

In response to this:

/override ci/prow/edge-e2e-ai-operator-ztp

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

shay23bra · 2026-08-05T09:03:55Z

/override ci/prow/edge-e2e-ai-operator-ztp-capi

openshift-ci · 2026-08-05T09:04:14Z

@shay23bra: Overrode contexts on behalf of shay23bra: ci/prow/edge-e2e-ai-operator-ztp-capi

Details

In response to this:

/override ci/prow/edge-e2e-ai-operator-ztp-capi

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

shay23bra · 2026-08-05T13:03:58Z

/retest

openshift-merge-bot · 2026-08-05T19:05:20Z

/retest-required

Remaining retests: 0 against base HEAD 209e527 and 2 for PR HEAD b28cecc in total

openshift-merge-bot · 2026-08-05T21:18:26Z

/retest-required

Remaining retests: 0 against base HEAD 368458c and 1 for PR HEAD b28cecc in total

shay23bra · 2026-08-06T07:17:23Z

/retest

shay23bra · 2026-08-06T07:18:11Z

/override ci/prow/edge-e2e-ai-operator-disconnected-capi

shay23bra · 2026-08-06T07:18:25Z

/override ci/prow/edge-e2e-ai-operator-ztp

shay23bra · 2026-08-06T07:18:39Z

/override ci/prow/edge-e2e-ai-operator-ztp-capi

openshift-ci · 2026-08-06T07:19:32Z

@shay23bra: Overrode contexts on behalf of shay23bra: ci/prow/edge-e2e-ai-operator-disconnected-capi

Details

In response to this:

/override ci/prow/edge-e2e-ai-operator-disconnected-capi

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2026-08-06T07:19:47Z

@shay23bra: Overrode contexts on behalf of shay23bra: ci/prow/edge-e2e-ai-operator-ztp

Details

In response to this:

/override ci/prow/edge-e2e-ai-operator-ztp

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2026-08-06T07:19:49Z

@shay23bra: Overrode contexts on behalf of shay23bra: ci/prow/edge-e2e-ai-operator-ztp-capi

Details

In response to this:

/override ci/prow/edge-e2e-ai-operator-ztp-capi

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

shay23bra · 2026-08-06T08:39:57Z

/retest ci/prow/edge-subsystem-aws
/retest ci/prow/edge-subsystem-kubeapi-aws

shay23bra · 2026-08-06T11:27:30Z

/override ci/prow/edge-e2e-ai-operator-ztp-capi
/override ci/prow/edge-e2e-ai-operator-ztp
/override ci/prow/edge-e2e-ai-operator-disconnected-capi

openshift-ci · 2026-08-06T11:28:07Z

@shay23bra: Overrode contexts on behalf of shay23bra: ci/prow/edge-e2e-ai-operator-disconnected-capi, ci/prow/edge-e2e-ai-operator-ztp, ci/prow/edge-e2e-ai-operator-ztp-capi

Details

In response to this:

/override ci/prow/edge-e2e-ai-operator-ztp-capi
/override ci/prow/edge-e2e-ai-operator-ztp
/override ci/prow/edge-e2e-ai-operator-disconnected-capi

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

shay23bra · 2026-08-06T11:28:59Z

/test ci/prow/edge-subsystem-aws
/test ci/prow/edge-subsystem-kubeapi-aws

shay23bra · 2026-08-06T11:42:46Z

/test edge-subsystem-aws
/test edge-subsystem-kubeapi-aws

openshift-ci · 2026-08-06T11:56:04Z

@shay23bra: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/edge-subsystem-kubeapi-aws	`b28cecc`	link	true	`/test edge-subsystem-kubeapi-aws`
ci/prow/edge-subsystem-aws	`b28cecc`	link	true	`/test edge-subsystem-aws`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 20, 2026

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 20, 2026

openshift-ci Bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Jul 20, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 20, 2026

shay23bra mentioned this pull request Jul 20, 2026

ACM-31165: Test and validate network policies for Infrastructure Operator components stolostron/backplane-operator#3655

Closed

coderabbitai Bot reviewed Jul 20, 2026

View reviewed changes

Comment thread config/manager/assisted-service-networkpolicy.yaml Outdated

Comment thread config/manager/infrastructure-operator-networkpolicy.yaml

shay23bra marked this pull request as ready for review July 20, 2026 08:34

openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 20, 2026

openshift-ci Bot requested review from eranco74 and jhernand July 20, 2026 08:34

carbonin requested changes Jul 22, 2026

View reviewed changes

openshift-ci Bot assigned carbonin Jul 22, 2026

shay23bra force-pushed the ACM-31165-network-policy branch from c0f86bd to 5d5adce Compare July 22, 2026 12:46

openshift-ci Bot added the api-review Categorizes an issue or PR as actively needing an API review. label Jul 22, 2026

shay23bra force-pushed the ACM-31165-network-policy branch from 5d5adce to 9e399e2 Compare July 23, 2026 11:31

coderabbitai Bot reviewed Jul 23, 2026

View reviewed changes

Comment thread internal/controller/controllers/agentserviceconfig_controller.go

shay23bra force-pushed the ACM-31165-network-policy branch from 9e399e2 to b2725b0 Compare July 26, 2026 08:46

shay23bra force-pushed the ACM-31165-network-policy branch from b2725b0 to 798241d Compare August 3, 2026 11:52

coderabbitai Bot reviewed Aug 3, 2026

View reviewed changes

shay23bra force-pushed the ACM-31165-network-policy branch from 798241d to ea607aa Compare August 3, 2026 13:18

shay23bra force-pushed the ACM-31165-network-policy branch from ea607aa to b28cecc Compare August 4, 2026 10:45

openshift-ci Bot assigned giladravid16 Aug 4, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 4, 2026

Uh oh!

Conversation

shay23bra commented Jul 20, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test results (kind + Calico)

Related

Summary by CodeRabbit

Uh oh!

openshift-ci Bot commented Jul 20, 2026

Uh oh!

openshift-ci-robot commented Jul 20, 2026

Summary

Related

Uh oh!

openshift-ci Bot commented Jul 20, 2026

Uh oh!

coderabbitai Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

carbonin left a comment

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

shay23bra commented Aug 4, 2026

Uh oh!

giladravid16 commented Aug 4, 2026

Uh oh!

giladravid16 commented Aug 4, 2026

Uh oh!

gamli75 commented Aug 5, 2026

Uh oh!

openshift-ci Bot commented Aug 5, 2026

Uh oh!

shay23bra commented Aug 5, 2026

Uh oh!

openshift-ci Bot commented Aug 5, 2026

Uh oh!

shay23bra commented Aug 5, 2026

Uh oh!

openshift-ci Bot commented Aug 5, 2026

Uh oh!

shay23bra commented Aug 5, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 5, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 5, 2026

Uh oh!

shay23bra commented Aug 6, 2026

Uh oh!

shay23bra commented Aug 6, 2026

Uh oh!

shay23bra commented Aug 6, 2026

Uh oh!

shay23bra commented Aug 6, 2026

Uh oh!

openshift-ci Bot commented Aug 6, 2026

shay23bra commented Jul 20, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 20, 2026 •

edited

Loading

codecov Bot commented Jul 22, 2026 •

edited

Loading