Pass network_driver template option as CNI type

Read the ``network_driver`` cluster template option and pass it through
to the helm chart as ``addons.cni.type`` so users can select between
calico (default) and cilium per template.

Assisted-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Change-Id: Iab25356b704fd531aca5ef9593126848e49e2eeb
Signed-off-by: Sam Morrison <sorrison@gmail.com>
Signed-off-by: Matt Crees <mattc@stackhpc.com>

magnum_capi_helm/driver.py

@@ -882,6 +882,13 @@ class Driver(driver.Driver):
             CONF.capi_helm_cluster_labels.octavia_provider,
         )
 
+    def _get_cni_type(self, cluster):
+        network_driver = cluster.cluster_template.network_driver
+        if not network_driver:
+            return None
+        # NOTE: filtering untrusted user input
+        return re.sub(r"[^a-zA-Z0-9\.\-_]+", "", network_driver)
+
     def _get_octavia_lb_algorithm(self, cluster):
         provider = self._get_octavia_provider(cluster)
         conf_default = CONF.capi_helm_cluster_labels.octavia_lb_algorithm
@@ -1173,6 +1180,11 @@ class Driver(driver.Driver):
             }
             values = helm.mergeconcat(values, allowed_cidrs_config)
 
+        cni_type = self._get_cni_type(cluster)
+        if cni_type:
+            cni_config = {"addons": {"cni": {"type": cni_type}}}
+            values = helm.mergeconcat(values, cni_config)
+
         self._helm_client.install_or_upgrade(
             driver_utils.chart_release_name(cluster),
             CONF.capi_helm.helm_chart_name,

magnum_capi_helm/tests/test_driver.py

@@ -1961,6 +1961,49 @@ class ClusterAPIDriverTest(base.DbTestCase):
             self.driver, self.context, self.cluster_obj
         )
 
+    @mock.patch.object(driver.Driver, "_get_allowed_cidrs")
+    @mock.patch.object(
+        driver.Driver, "_get_k8s_keystone_auth_enabled", return_value=False
+    )
+    @mock.patch.object(
+        driver.Driver,
+        "_storageclass_definitions",
+        return_value=mock.ANY,
+    )
+    @mock.patch.object(driver.Driver, "_validate_allowed_flavor")
+    @mock.patch.object(
+        driver.Driver, "_ensure_certificate_secrets", autospec=True
+    )
+    @mock.patch.object(driver.Driver, "_create_appcred_secret", autospec=True)
+    @mock.patch.object(kubernetes.Client, "load", autospec=True)
+    @mock.patch.object(driver.Driver, "_get_image_details", autospec=True)
+    @mock.patch.object(helm.Client, "install_or_upgrade", autospec=True)
+    def test_create_cluster_network_driver(
+        self,
+        mock_install,
+        mock_image,
+        mock_load,
+        mock_appcred,
+        mock_certs,
+        mock_validate_allowed_flavor,
+        mock_storageclasses,
+        mock_get_keystone_auth_enabled,
+        mock_get_allowed_cidrs,
+    ):
+        mock_image.return_value = ("imageid1", "1.27.4", "ubuntu")
+        mock_client = mock.MagicMock(spec=kubernetes.Client)
+        mock_load.return_value = mock_client
+
+        self.cluster_obj.cluster_template.network_driver = "cilium"
+
+        self.driver.create_cluster(self.context, self.cluster_obj, 10)
+
+        expected_values = self._get_cluster_helm_standard_values()
+        expected_values["addons"]["cni"] = {"type": "cilium"}
+
+        helm_install_values = mock_install.call_args[0][3]
+        self.assertDictEqual(helm_install_values, expected_values)
+
     @mock.patch.object(app_creds, "create_app_cred")
     @mock.patch.object(app_creds, "get_app_cred_string_data")
     @mock.patch.object(kubernetes.Client, "load")

releasenotes/notes/add-cni-network-driver-a677f2514db975e0.yaml

@@ -0,0 +1,8 @@
+---
+features:
+  - |
+    The CNI deployed in clusters can now be selected via the
+    ``network_driver`` cluster template option. The value is passed
+    through to the helm chart as ``addons.cni.type``. Supported values
+    are ``calico`` (default) and ``cilium``. When unset, the helm chart
+    default is used.

zuul.d/base.yaml

@@ -70,3 +70,17 @@
           $TEMPEST_CONFIG:
             magnum:
               network_driver: calico
+
+- job:
+    name: magnum-capi-helm-tests-cluster-cilium
+    parent: magnum-capi-helm-tests-cluster
+    vars:
+      devstack_local_conf:
+        post-config:
+          $MAGNUM_CONF:
+            cluster_template:
+              kubernetes_allowed_network_drivers: flannel,calico,cilium
+        test-config:
+          $TEMPEST_CONFIG:
+            magnum:
+              network_driver: cilium

zuul.d/project-templates-tempest.yaml

@@ -6,9 +6,11 @@
     check:
       jobs:
         - magnum-capi-helm-tests-cluster-calico-v1-34
+        - magnum-capi-helm-tests-cluster-cilium-v1-34
     gate:
       jobs:
         - magnum-capi-helm-tests-cluster-calico-v1-34
+        - magnum-capi-helm-tests-cluster-cilium-v1-34
 
 - project-template:
     name: magnum-capi-helm-tests-cluster
@@ -17,11 +19,15 @@
     check:
       jobs:
         - magnum-capi-helm-tests-cluster-calico-v1-34
+        - magnum-capi-helm-tests-cluster-cilium-v1-34
         - magnum-capi-helm-tests-cluster-calico-v1-35
+        - magnum-capi-helm-tests-cluster-cilium-v1-35
     gate:
       jobs:
         - magnum-capi-helm-tests-cluster-calico-v1-34
+        - magnum-capi-helm-tests-cluster-cilium-v1-34
         - magnum-capi-helm-tests-cluster-calico-v1-35
+        - magnum-capi-helm-tests-cluster-cilium-v1-35
 
 - project-template:
     name: magnum-capi-helm-tests-cluster-2026-1

zuul.d/tempest-jobs-v1-34.yaml

@@ -6,6 +6,13 @@
       kube_version: "v1.34.8"
       kube_version_dir: "2026.05-6"
 
+- job:
+    name: magnum-capi-helm-tests-cluster-cilium-v1-34
+    parent: magnum-capi-helm-tests-cluster-cilium
+    vars:
+      kube_version: "v1.34.8"
+      kube_version_dir: "2026.05-6"
+
 - job:
     name: magnum-capi-helm-tests-cluster-v1_34
     parent: magnum-capi-helm-tests-cluster-calico

zuul.d/tempest-jobs-v1-35.yaml

@@ -6,6 +6,13 @@
       kube_version: "v1.35.5"
       kube_version_dir: "2026.05-6"
 
+- job:
+    name: magnum-capi-helm-tests-cluster-cilium-v1-35
+    parent: magnum-capi-helm-tests-cluster-cilium
+    vars:
+      kube_version: "v1.35.5"
+      kube_version_dir: "2026.05-6"
+
 - job:
     name: magnum-capi-helm-tests-cluster-calico-v1-35-2025-1
     parent: magnum-capi-helm-tests-cluster-calico-v1-35