Description of problem: When deploying OpenShift on OpenStack, we only need to provide the netFilter to the nicSelector in the SriovNetworkNodePolicy. Until now, we were workarounding by disabling the webhook but this isn't clean as the webhook could really be helpful to us as well. Version-Release number of selected component (if applicable): 4.10 How reproducible: Create a policy like this: apiVersion: sriovnetwork.openshift.io/v1 kind: SriovNetworkNodePolicy metadata: name: sriov1 namespace: openshift-sriov-network-operator spec: deviceType: vfio-pci nicSelector: netFilter: openstack/NetworkID:OPENSTACK_SRIOV_NET_UUID nodeSelector: feature.node.kubernetes.io/network-sriov.capable: 'true' numVfs: 1 priority: 99 resourceName: sriov1 Actual results: The webhook will fail with message "at least one of these parameters (vendor, deviceID, pfNames or rootDevices) has to be defined in nicSelector". Expected results: The webhook should accept netFilter to be enough when the platform is OpenStack.
Verified it in our CI: - Enable the SRIOV worker: https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/origin-ci-test/pr-logs/pull/openshift_release/25388/rehearse-25388-pull-ci-openshift-sriov-network-operator-release-4.10-e2e-openstack-nfv/1484603625756954624/artifacts/e2e-openstack-nfv/openstack-provision-sriov-worker/build-log.txt - Enable the SriovNetworkNodePolicy with the webhook enabled: https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/origin-ci-test/pr-logs/pull/openshift_release/25388/rehearse-25388-pull-ci-openshift-sriov-network-operator-release-4.10-e2e-openstack-nfv/1484603625756954624/artifacts/e2e-openstack-nfv/openstack-provision-sriov-networknodepolicy/build-log.txt Here we can see that the webhook is happy: https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/origin-ci-test/pr-logs/pull/openshift_release/25388/rehearse-25388-pull-ci-openshift-sriov-network-operator-release-4.10-e2e-openstack-nfv/1484603625756954624/artifacts/e2e-openstack-nfv/gather-extra/artifacts/pods/openshift-sriov-network-operator_operator-webhook-6lqd2_webhook-server.log I'll mark it as verified if you don't mind Ziv, to save you time.
Thank you Emilien for verifying this BZ! Ziv
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: OpenShift Container Platform 4.10.3 security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2022:0056