From f6821840536d9ef968f10291031505844f281881 Mon Sep 17 00:00:00 2001 From: dislbenn Date: Thu, 27 Aug 2026 11:51:36 -0400 Subject: [PATCH 1/2] Add missing webhook containerPort declaration The discovery-operator's validating webhook was added without a corresponding containerPort declaration in the deployment manifest. This went unnoticed until a NetworkPolicy enforcing port-based ingress rules was introduced, at which point the webhook became unreachable and all DiscoveredCluster create/update operations began failing with context deadline exceeded timeouts. - Add containerPort: 9443 (name: webhook-server) to the discovery-operator container spec in config/manager/manager.yaml - Regenerate bundle/manifests/discovery.clusterserviceversion.yaml via make manifests && make bundle to reflect the new port declaration Signed-off-by: dislbenn --- bundle/manifests/discovery.clusterserviceversion.yaml | 4 +++- config/manager/manager.yaml | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/bundle/manifests/discovery.clusterserviceversion.yaml b/bundle/manifests/discovery.clusterserviceversion.yaml index 16beda13d..050708ee5 100644 --- a/bundle/manifests/discovery.clusterserviceversion.yaml +++ b/bundle/manifests/discovery.clusterserviceversion.yaml @@ -21,7 +21,7 @@ metadata: ] capabilities: Seamless Upgrades categories: Integration & Delivery - createdAt: "2026-04-30T13:23:41Z" + createdAt: "2026-08-27T15:14:45Z" description: This operator discovers OpenShift Conatiner Platform clusters which are not yet under management by Open Cluster Management. operatorframework.io/suggested-namespace: open-cluster-management @@ -241,6 +241,8 @@ spec: ports: - containerPort: 8080 name: metrics + - containerPort: 9443 + name: webhook-server readinessProbe: httpGet: path: /readyz diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml index 9683a28db..116b9c29b 100644 --- a/config/manager/manager.yaml +++ b/config/manager/manager.yaml @@ -56,6 +56,8 @@ spec: ports: - containerPort: 8080 name: metrics + - containerPort: 9443 + name: webhook-server resources: requests: cpu: 100m From 04b79b86b1ebab9c0c9d012356104377d3a38e68 Mon Sep 17 00:00:00 2001 From: dislbenn Date: Thu, 27 Aug 2026 12:16:01 -0400 Subject: [PATCH 2/2] Remove broken podSelector from webhook NetworkPolicy The discovery-operator-allow-webhook NetworkPolicy combined a namespaceSelector (matching the special openshift-host-network virtual namespace) with a podSelector: {} in the same 'from' entry. Verified on a live OVN-Kubernetes cluster that this combination causes ingress traffic from host-network pods (i.e. kube-apiserver, which performs admission webhook calls for the DiscoveredCluster CRD) to be silently dropped, even though the namespaceSelector alone matches correctly. Removing the redundant podSelector restores connectivity. Without this fix, DiscoveredCluster create/update/delete operations fail with 'context deadline exceeded' calling the webhook, even when containerPort: 9443 is correctly declared on the deployment. Signed-off-by: dislbenn --- ...-webhook_networking.k8s.io_v1_networkpolicy.yaml | 13 ++++++++++--- .../manifests/discovery.clusterserviceversion.yaml | 2 +- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/bundle/manifests/discovery-operator-allow-webhook_networking.k8s.io_v1_networkpolicy.yaml b/bundle/manifests/discovery-operator-allow-webhook_networking.k8s.io_v1_networkpolicy.yaml index 5b1db7082..a38a0fc00 100644 --- a/bundle/manifests/discovery-operator-allow-webhook_networking.k8s.io_v1_networkpolicy.yaml +++ b/bundle/manifests/discovery-operator-allow-webhook_networking.k8s.io_v1_networkpolicy.yaml @@ -1,6 +1,14 @@ # Allow ingress to the discovery-operator webhook server (port 9443). -# Webhook calls originate from the API server which runs on the host network, -# so we use the special host-network namespace selector. +# Webhook calls originate from kube-apiserver, which validates the +# DiscoveredCluster CRD and runs on the host network, so we use the +# special host-network namespace selector. +# +# IMPORTANT: do not combine this namespaceSelector with a podSelector in +# the same "from" entry (even an empty podSelector: {}). OVN-Kubernetes +# does not correctly match host-network-sourced traffic against the +# special "openshift-host-network" virtual namespace when a podSelector +# is present alongside the namespaceSelector, causing all webhook calls +# from kube-apiserver to silently time out. apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: @@ -14,7 +22,6 @@ spec: - namespaceSelector: matchLabels: policy-group.network.openshift.io/host-network: "" - podSelector: {} ports: - protocol: TCP port: 9443 diff --git a/bundle/manifests/discovery.clusterserviceversion.yaml b/bundle/manifests/discovery.clusterserviceversion.yaml index 050708ee5..a8034116b 100644 --- a/bundle/manifests/discovery.clusterserviceversion.yaml +++ b/bundle/manifests/discovery.clusterserviceversion.yaml @@ -21,7 +21,7 @@ metadata: ] capabilities: Seamless Upgrades categories: Integration & Delivery - createdAt: "2026-08-27T15:14:45Z" + createdAt: "2026-08-27T16:15:45Z" description: This operator discovers OpenShift Conatiner Platform clusters which are not yet under management by Open Cluster Management. operatorframework.io/suggested-namespace: open-cluster-management