Bug 1811157

+++ This bug was initially created as a clone of Bug #1801096 +++

"managing pod network is only supported for openshift multitenant network plugin" in OpenShift 4.3 when trying to join-projects

-----------------------------

>> [cloud-user@vm]$ /usr/bin/oc adm pod-network join-projects --to=msgbroker db
>> using plugin: "redhat/openshift-ovs-networkpolicy", managing pod network is only supported for openshift multitenant network plugin

Either joining projects in OSC 4 is not possible any more because we are not using the `openshift multitenant network plugin` any longer. In that case, the documentation needs to be updated. Or, the error message is misleading and should be:
"managing pod network is only supported for OpenShift SDN network plug-in with mode: NetworkPolicy and multitenant isolation configured"

- Andreas

Reported by: akaris

https://access.redhat.com/documentation/en-us/openshift_container_platform/4.3/html/networking/openshift-sdn#annotations:09af38e5-9347-43ba-a5c9-91b2ca0f6135

--- Additional comment from Jason Boxman on 2020-02-17 20:32:23 UTC ---

Hi Andreas,

Thanks for reporting this. At installation time[0], was the cluster configured to use the `Multitenant` isolation mode for the OpenShift SDN network provider?

[0] https://docs.openshift.com/container-platform/4.3/installing/installing_aws/installing-aws-network-customizations.html#nw-operator-configuration-parameters-for-openshift-sdn_installing-aws-network-customizations

--- Additional comment from Andreas Karis on 2020-02-19 12:08:42 UTC ---

Hi,

I suppose that this needs to be files against OSC instead:

When running this, users get the following error message:
~~~
[cloud-user@vm]$ /usr/bin/oc adm pod-network join-projects --to=msgbroker db using plugin: "redhat/openshift-ovs-networkpolicy", managing pod network is only supported for openshift multitenant network plugin
~~~

But the multitenant network plugin is not used any more. 

The error message is misleading: we use the OpenShift SDN network plugin and the error message should be: 
>> "managing pod network is only supported for OpenShift SDN network plug-in with mode: `NetworkPolicy` and multitenant isolation configured"
Or:
>> "managing pod network is only supported for OpenShift SDN network plug-in with mode: `Multitenant`"

With regards to the docs, we have instructions in the networking guide for how to configure this with `networkpolicy`:
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.3/html-single/networking/index#nw-networkpolicy-multitenant-isolation_configuring-networkpolicy-plugin

And we have the instructions that you just linked in the AWS installer:
https://docs.openshift.com/container-platform/4.3/installing/installing_aws/installing-aws-network-customizations.html#nw-operator-configuration-parameters-for-openshift-sdn_installing-aws-network-customizations

Shouldn't generic configuration related to network customizations be in the networking guide?

Sorry I'm new to OpenShift but something either in the doc, or in the installer error message, or in both could be improved as far as I see it.

- Andreas

--- Additional comment from Jason Boxman on 2020-03-05 19:29:12 UTC ---

Hi Andreas,

You can't `join-projects` when using OpenShift SDN in network policy mode, which is the default; So the error message looks correct to me.

Configuring multitenant isolation using NetworkPolicy[0] describes an approach for implementing behavior similar to that provided by OpenShift SDN multitenant mode, using NetworkPolicy CR objects.

If you need a cluster that uses multitenant mode (which was called the ovs-multitenant plug-in in 3.x), that can only be configured at the time of cluster installation. Any network customization that can be done only at installation time is covered in the installation guide for each supported platform.

I'd be happy to update the docs in some way to clarify this, but it's not clear to me what that update is.

[0] https://access.redhat.com/documentation/en-us/openshift_container_platform/4.3/html-single/networking/index#nw-networkpolicy-multitenant-isolation_configuring-networkpolicy-plugin

--- Additional comment from Andreas Karis on 2020-03-06 09:28:50 UTC ---

Hi,

I'll file this against OpenShift, then, as the error message:

>> [cloud-user@vm]$ /usr/bin/oc adm pod-network join-projects --to=msgbroker db
>> using plugin: "redhat/openshift-ovs-networkpolicy", managing pod network is only supported for openshift multitenant network plugin

That shows up in OCP  4.3 is misleading.

Thanks!

- Andreas