MGMT-21694: Request for 3rd Party CNI or NO CNI option for Assisted Installer #8594

rivkyrizel · 2025-12-17T14:41:25Z

Add enhancement proposal for third-party CNI support in Assisted Installer

List all the issues related to this PR

What environments does this code impact?

Automation (CI, tools, etc)
Cloud
Operator Managed Deployments
None

How was this code tested?

assisted-test-infra environment
dev-scripts environment
Reviewer's test appreciated
Waiting for CI to do a full test run
Manual (Elaborate on how it was tested)
No tests needed

Checklist

Title and description added to both, commit and PR.
Relevant issues have been associated (see CONTRIBUTING guide)
This change does not require a documentation update (docstring, docs, README, etc)
Does this change include unit-tests (note that code changes require unit-tests)

Reviewers Checklist

Are the title and description (in both PR and commit) meaningful and clear?
Is there a bug required (and linked) for this change?
Should this PR be backported?

openshift-ci-robot · 2025-12-17T14:41:32Z

coderabbitai · 2025-12-17T14:41:34Z

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Excluded labels (none allowed) (1)

do-not-merge/work-in-progress

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

openshift-ci · 2025-12-17T14:41:40Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

docs/enhancements/third-party-cni-support.md

openshift-ci · 2025-12-18T14:22:32Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: rivkyrizel
Once this PR has been reviewed and has the lgtm label, please ask for approval from crystalchun. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

gamli75 · 2025-12-23T09:39:01Z

docs/enhancements/third-party-cni-support.md

+
+Enterprise customers often require certified third-party CNIs for regulatory compliance, existing infrastructure integration, or advanced networking capabilities. Currently, these customers must install with OVN-K and then manually replace it post-installation—an unsupported, error-prone process that increases deployment time and complexity.
+
+OpenShift supports multiple certified CNI providers through its certification program. IPI and UPI installation methods already enable these CNIs through documented procedures (see [Installing a cluster on bare metal with network customizations](https://docs.openshift.com/container-platform/latest/installing/installing_bare_metal/installing-bare-metal-network-customizations.html) and individual CNI vendor documentation). Assisted Installer should provide the same flexibility, allowing customers to benefit from simplified deployment workflows while using their required networking solution.


The link is not working - I didn't find this section

I wasn’t able to locate the installation instructions for OCP with UPI/IPI, so I’ve removed the link from the document for now.

gamli75 · 2025-12-23T09:42:58Z

docs/enhancements/third-party-cni-support.md

+
+#### API Changes
+
+Extend the cluster creation API to accept CNI selection through a new `network_type` field in `ClusterCreateParams`. The field will support the following values:


network_type is not a new field. We will extend the options

gamli75 · 2025-12-23T09:45:05Z

docs/enhancements/third-party-cni-support.md

+- Third-party CNIs require `user_managed_networking: true` (cluster-managed networking supports OVN-K and OpenShiftSDN only)
+- API validates CNI against support matrix (platform, OCP version, topology)
+- Returns HTTP 400 with descriptive error for unsupported combinations
+- `network_type: None` requires custom manifests to be uploaded via the manifests API


Does only network_type: none require a custom manifest or also Calicoand others?

gamli75 · 2025-12-23T09:47:13Z

docs/enhancements/third-party-cni-support.md

+Add new validation that blocks installation if a third-party CNI is selected but no custom manifests have been uploaded. The validation will check for the presence of manifests and display an error message directing users to upload CNI manifests before proceeding.
+
+**Manifest Generation:**
+Modify install-config generation to skip OVN-K-specific configuration when a third-party CNI is selected. The CNI will be configured via custom manifests provided by the user through the existing manifests API.


Please add the mapping between the network_type enum and the value in the install-config

gamli75 · 2025-12-23T09:48:35Z

docs/enhancements/third-party-cni-support.md

+Basic validation will be performed on uploaded manifests to ensure they are valid YAML/JSON and contain Kubernetes resource definitions. However, CNI-specific semantic validation (e.g., verifying Cilium operator configuration) is out of scope. Invalid manifests will cause installation failures during cluster bootstrapping, which is acceptable as users are responsible for providing correct CNI configurations.
+
+**Feature Support Levels:**
+Update the feature support levels API to expose CNI support per platform and OCP version, enabling the UI to dynamically show or hide CNI options based on cluster configuration.


@eliorerz, please review. I'm not sure we need this if we have a new network Provider Abstraction

gamli75 · 2025-12-23T09:54:02Z

docs/enhancements/third-party-cni-support.md

+## Drawbacks
+
+**Increased Complexity**
+Supporting multiple CNIs increases the testing matrix, documentation scope, and potential support burden.


Also, we will need to maintain CNI versions and test only the latest certified CNI version

eranco74 · 2025-12-23T10:26:28Z

docs/enhancements/third-party-cni-support.md

+
+## Summary
+
+Assisted Installer currently enforces OVN-Kubernetes (OVN-K) as the only supported Container Network Interface (CNI) for all cluster installations. This enhancement enables first-class support for Red Hat certified third-party CNI plugins, allowing customers to install OpenShift clusters with Cisco ACI, Isovalent Cilium, or Tigera Calico without post-installation workarounds.


If the users are required to create and upload the custom manifests for the CNI themselves, I wouldn't call it first-class support.
This is supported today, via install-config override. The support this enhancement is proposing is that now users can set the networkType field directly from the API.

eranco74 · 2025-12-23T10:27:43Z

docs/enhancements/third-party-cni-support.md

+  - Tigera Calico (Calico Core)
+- Validate CNI compatibility with platform, OCP version, and cluster topology
+- Provide clear guidance and documentation links for CNI-specific configuration
+- Support both REST API and Kube-API modes (InfraEnv/Agent CRs)


This configuration belongs in the AgentClusterInstall CR and not in the infraEnv/Agent

eranco74 · 2025-12-23T10:28:17Z

docs/enhancements/third-party-cni-support.md

+
+### Goals
+
+- Enable installation of OpenShift clusters without OVN-Kubernetes


I don't think we can complete the installation without a CNI

eranco74 · 2025-12-23T10:29:08Z

docs/enhancements/third-party-cni-support.md

+- `CiscoACI`
+- `Cilium`
+- `Calico`
+- `None` (no CNI installed, user must provide manifests)


The user will need to provide manifests for all of these

eranco74 · 2025-12-23T10:32:07Z

docs/enhancements/third-party-cni-support.md

+Assisted Installer will not manage specific CNI versions (e.g., Cilium 1.17 vs 1.18). The CNI version is determined by the manifests provided by the user. Assisted Installer only validates that the selected CNI type is compatible with the OCP version and platform. Users obtain version-specific manifests from CNI vendors and upload them via the custom manifests API.
+
+Validation requirements:
+- Third-party CNIs require `user_managed_networking: true` (cluster-managed networking supports OVN-K and OpenShiftSDN only)


I'm not sure why this is related.
cluster managed networking is relevant for the kube-api and ingress VIPs/DNS.
Why it's related to the CNI?

…nstaller

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Dec 17, 2025

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Dec 17, 2025

openshift-ci bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Dec 17, 2025

CrystalChun self-assigned this Dec 17, 2025

CrystalChun reviewed Dec 17, 2025

View reviewed changes

docs/enhancements/third-party-cni-support.md Outdated Show resolved Hide resolved

CrystalChun reviewed Dec 17, 2025

View reviewed changes

docs/enhancements/third-party-cni-support.md Show resolved Hide resolved

CrystalChun reviewed Dec 17, 2025

View reviewed changes

docs/enhancements/third-party-cni-support.md Show resolved Hide resolved

rivkyrizel force-pushed the MGMT-21694 branch from c5a8f28 to 364fe03 Compare December 18, 2025 14:21

rivkyrizel force-pushed the MGMT-21694 branch from 364fe03 to 6f00f68 Compare December 21, 2025 08:49

gamli75 reviewed Dec 23, 2025

View reviewed changes

eranco74 reviewed Dec 23, 2025

View reviewed changes

MGMT-21694: Request for 3rd Party CNI or NO CNI option for Assisted I…

36e2ac7

…nstaller

rivkyrizel force-pushed the MGMT-21694 branch from 6f00f68 to 36e2ac7 Compare December 23, 2025 15:51


		Enterprise customers often require certified third-party CNIs for regulatory compliance, existing infrastructure integration, or advanced networking capabilities. Currently, these customers must install with OVN-K and then manually replace it post-installation—an unsupported, error-prone process that increases deployment time and complexity.

		OpenShift supports multiple certified CNI providers through its certification program. IPI and UPI installation methods already enable these CNIs through documented procedures (see [Installing a cluster on bare metal with network customizations](https://docs.openshift.com/container-platform/latest/installing/installing_bare_metal/installing-bare-metal-network-customizations.html) and individual CNI vendor documentation). Assisted Installer should provide the same flexibility, allowing customers to benefit from simplified deployment workflows while using their required networking solution.


		#### API Changes

		Extend the cluster creation API to accept CNI selection through a new `network_type` field in `ClusterCreateParams`. The field will support the following values:


		## Summary

		Assisted Installer currently enforces OVN-Kubernetes (OVN-K) as the only supported Container Network Interface (CNI) for all cluster installations. This enhancement enables first-class support for Red Hat certified third-party CNI plugins, allowing customers to install OpenShift clusters with Cisco ACI, Isovalent Cilium, or Tigera Calico without post-installation workarounds.


		### Goals

		- Enable installation of OpenShift clusters without OVN-Kubernetes

MGMT-21694: Request for 3rd Party CNI or NO CNI option for Assisted Installer #8594

Are you sure you want to change the base?

MGMT-21694: Request for 3rd Party CNI or NO CNI option for Assisted Installer #8594

Uh oh!

Conversation

rivkyrizel commented Dec 17, 2025

List all the issues related to this PR

What environments does this code impact?

How was this code tested?

Checklist

Reviewers Checklist

Uh oh!

openshift-ci-robot commented Dec 17, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

List all the issues related to this PR

What environments does this code impact?

How was this code tested?

Checklist

Reviewers Checklist

Uh oh!

coderabbitai bot commented Dec 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

openshift-ci bot commented Dec 17, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

openshift-ci bot commented Dec 18, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

openshift-ci-robot commented Dec 17, 2025 •

edited by openshift-ci bot

Loading

coderabbitai bot commented Dec 17, 2025 •

edited

Loading