feat: add verbosity control for kube-network-policies

Add `kubeNetworkPoliciesVerbose` to the KubeFlannelCNIConfig document,
controlling the `--v` flag passed to the kube-network-policies sidecar
container Flannel deploys when `kubeNetworkPoliciesEnabled` is set.

When true (the default, preserving prior behavior), the container runs
with `--v=2`; when explicitly set to false, it runs with `--v=0`. The
field is a pointer so "unset" can be distinguished from "explicitly
false" and still resolve to the previous always-verbose behavior.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0163WRSUYoVAHZRGXzrgx23S
Signed-off-by: Oliver Gregorius <oliver@gregorius.dev>

Author: olivergregorius

api/resource/definitions/k8s/k8s.proto

@@ -96,6 +96,7 @@ message BootstrapManifestsConfigSpec {
   google.protobuf.Struct proxy_config = 27;
   Resources proxy_resources = 28;
   string proxy_config_checksum = 29;
+  bool flannel_kube_network_policies_verbose = 30;
 }
 
 // ConfigStatusSpec describes status of rendered secrets.

internal/app/machined/pkg/controllers/k8s/control_plane.go

@@ -475,6 +475,7 @@ func NewControlPlaneBootstrapManifestsController() *ControlPlaneBootstrapManifes
 					res.TypedSpec().FlannelKubeServiceHost = flannelKubeServiceHost
 					res.TypedSpec().FlannelKubeServicePort = flannelKubeServicePort
 					res.TypedSpec().FlannelKubeNetworkPoliciesEnabled = k8sFlannelCNIConfig.KubeNetworkPoliciesEnabled()
+					res.TypedSpec().FlannelKubeNetworkPoliciesVerbose = k8sFlannelCNIConfig.KubeNetworkPoliciesVerbose()
 					res.TypedSpec().FlannelKubeNetworkPoliciesImage = images.KubeNetworkPolicies().String()
 					res.TypedSpec().CNIName = constants.FlannelCNI
 				} else {
@@ -489,6 +490,7 @@ func NewControlPlaneBootstrapManifestsController() *ControlPlaneBootstrapManifes
 					res.TypedSpec().FlannelKubeServiceHost = ""
 					res.TypedSpec().FlannelKubeServicePort = ""
 					res.TypedSpec().FlannelKubeNetworkPoliciesEnabled = false
+					res.TypedSpec().FlannelKubeNetworkPoliciesVerbose = true
 					res.TypedSpec().FlannelKubeNetworkPoliciesImage = ""
 					res.TypedSpec().CNIName = constants.NoneCNI
 				}

internal/app/machined/pkg/controllers/k8s/internal/k8stemplates/flannel.go

@@ -311,13 +311,18 @@ func FlannelDaemonSetTemplate(spec *k8s.BootstrapManifestsConfigSpec) (runtime.O
 	}
 
 	if spec.FlannelKubeNetworkPoliciesEnabled {
+		verbosity := "--v=0"
+		if spec.FlannelKubeNetworkPoliciesVerbose {
+			verbosity = "--v=2"
+		}
+
 		containers = append(containers, corev1.Container{
 			Name:  "kube-network-policies",
 			Image: spec.FlannelKubeNetworkPoliciesImage,
 			Command: []string{
 				"/bin/netpol",
 				"--hostname-override=$(MY_NODE_NAME)",
-				"--v=2",
+				verbosity,
 			},
 			Env: []corev1.EnvVar{
 				{

internal/app/machined/pkg/controllers/k8s/internal/k8stemplates/k8stemplates_test.go

@@ -542,6 +542,32 @@ func TestTemplates(t *testing.T) {
 					},
 					FlannelKubeNetworkPoliciesEnabled: true,
 					FlannelKubeNetworkPoliciesImage:   "registry.k8s.io/networking/kube-network-policies:v0.7.0",
+					FlannelKubeNetworkPoliciesVerbose: true,
+				})
+				require.NoError(t, err)
+
+				return spec
+			},
+		},
+		{
+			name: "flannel-daemonset-with-network-policies-non-verbose",
+			obj: func() runtime.Object {
+				spec, err := k8stemplates.FlannelDaemonSetTemplate(&k8s.BootstrapManifestsConfigSpec{
+					FlannelImage:     "quay.io/coreos/flannel:v0.14.0",
+					FlannelExtraArgs: []string{"--foo=bar"},
+					FlannelResources: k8s.Resources{
+						Requests: map[string]string{
+							"cpu":    "100m",
+							"memory": "50Mi",
+						},
+						Limits: map[string]string{
+							"cpu":    "200m",
+							"memory": "100Mi",
+						},
+					},
+					FlannelKubeNetworkPoliciesEnabled: true,
+					FlannelKubeNetworkPoliciesImage:   "registry.k8s.io/networking/kube-network-policies:v0.7.0",
+					FlannelKubeNetworkPoliciesVerbose: false,
 				})
 				require.NoError(t, err)
 

internal/app/machined/pkg/controllers/k8s/internal/k8stemplates/testdata/flannel-daemonset-with-network-policies-non-verbose.yaml

@@ -0,0 +1,136 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  labels:
+    k8s-app: flannel
+    tier: node
+  name: kube-flannel
+  namespace: kube-system
+spec:
+  selector:
+    matchLabels:
+      k8s-app: flannel
+      tier: node
+  template:
+    metadata:
+      labels:
+        k8s-app: flannel
+        tier: node
+    spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: kubernetes.io/os
+                operator: In
+                values:
+                - linux
+      containers:
+      - args:
+        - --ip-masq
+        - --kube-subnet-mgr
+        - --foo=bar
+        command:
+        - /opt/bin/flanneld
+        env:
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: EVENT_QUEUE_DEPTH
+          value: "5000"
+        - name: CONT_WHEN_CACHE_NOT_READY
+          value: "false"
+        - name: GOMEMLIMIT
+          value: "99614720"
+        image: quay.io/coreos/flannel:v0.14.0
+        name: kube-flannel
+        resources:
+          limits:
+            cpu: 200m
+            memory: 100Mi
+          requests:
+            cpu: 100m
+            memory: 50Mi
+        securityContext:
+          capabilities:
+            add:
+            - NET_ADMIN
+            - NET_RAW
+          privileged: false
+        volumeMounts:
+        - mountPath: /run/flannel
+          name: run
+        - mountPath: /etc/kube-flannel/
+          name: flannel-cfg
+      - command:
+        - /bin/netpol
+        - --hostname-override=$(MY_NODE_NAME)
+        - --v=0
+        env:
+        - name: MY_NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        image: registry.k8s.io/networking/kube-network-policies:v0.7.0
+        name: kube-network-policies
+        resources:
+          requests:
+            cpu: 100m
+            memory: 50Mi
+        securityContext:
+          capabilities:
+            add:
+            - NET_ADMIN
+          privileged: true
+        volumeMounts:
+        - mountPath: /lib/modules
+          name: lib-modules
+          readOnly: true
+      hostNetwork: true
+      initContainers:
+      - args:
+        - -f
+        - /etc/kube-flannel/cni-conf.json
+        - /etc/cni/net.d/10-flannel.conflist
+        command:
+        - cp
+        image: quay.io/coreos/flannel:v0.14.0
+        name: install-config
+        resources: {}
+        volumeMounts:
+        - mountPath: /etc/cni/net.d
+          name: cni
+        - mountPath: /etc/kube-flannel/
+          name: flannel-cfg
+      priorityClassName: system-node-critical
+      serviceAccountName: flannel
+      tolerations:
+      - effect: NoSchedule
+        operator: Exists
+      - effect: NoExecute
+        operator: Exists
+      volumes:
+      - hostPath:
+          path: /run/flannel
+        name: run
+      - hostPath:
+          path: /etc/cni/net.d
+        name: cni
+      - configMap:
+          name: kube-flannel-cfg
+        name: flannel-cfg
+      - hostPath:
+          path: /usr/lib/modules
+        name: lib-modules
+  updateStrategy: {}
+status:
+  currentNumberScheduled: 0
+  desiredNumberScheduled: 0
+  numberMisscheduled: 0
+  numberReady: 0

pkg/machinery/api/resource/definitions/k8s/k8s.pb.go

@@ -115,6 +115,7 @@ type K8sFlannelCNIConfig interface {
 	Resources() Resources
 	ExtraArgs() []string
 	KubeNetworkPoliciesEnabled() bool
+	KubeNetworkPoliciesVerbose() bool
 }
 
 // K8sAdmissionControlPluginConfig defines the configuration options for kube-apiserver admission control plugins.

pkg/machinery/api/resource/definitions/k8s/k8s_vtproto.pb.go

@@ -2785,6 +2785,13 @@
           "description": "Deploys kube-network-policies along with Flannel.\n\nThis enables Kubernetes Network Policies support in the cluster.\n",
           "markdownDescription": "Deploys kube-network-policies along with Flannel.\n\nThis enables Kubernetes Network Policies support in the cluster.",
           "x-intellij-html-description": "\u003cp\u003eDeploys kube-network-policies along with Flannel.\u003c/p\u003e\n\n\u003cp\u003eThis enables Kubernetes Network Policies support in the cluster.\u003c/p\u003e\n"
+        },
+        "kubeNetworkPoliciesVerbose": {
+          "type": "boolean",
+          "title": "kubeNetworkPoliciesVerbose",
+          "description": "Enables verbose logging for kube-network-policies.\n\nThis enables verbose logging for the kube-network-policies container.\n",
+          "markdownDescription": "Enables verbose logging for kube-network-policies.\n\nThis enables verbose logging for the kube-network-policies container.",
+          "x-intellij-html-description": "\u003cp\u003eEnables verbose logging for kube-network-policies.\u003c/p\u003e\n\n\u003cp\u003eThis enables verbose logging for the kube-network-policies container.\u003c/p\u003e\n"
         }
       },
       "additionalProperties": false,