USHIFT-7346: C2CC upstream user documentation

[pmtk]

Summary by CodeRabbit

• Documentation
  • Added a new how-to guide for Cluster-to-Cluster Connectivity (C2CC), covering multi-cluster setup, health/latency verification, cross-cluster DNS behavior, cleanup, and operational considerations.
  • Expanded the IPsec companion guide with more concrete verification outputs, deeper IPsec/XFRM inspection steps, and stricter nftables-based enforcement guidance (including persistence and MTU sizing for jumbo frames).
  • Updated the user documentation index to link both new C2CC guides.

[openshift-ci-robot]

@pmtk: This pull request references USHIFT-7346 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 2c52ece1-5144-4429-a2c1-89490e5e5dfc

📥 Commits

Reviewing files that changed from the base of the PR and between 4754772 and 77512f1.

📒 Files selected for processing (3)

• docs/user/howto_c2cc.md
• docs/user/howto_c2cc_ipsec.md
• test/resources/ipsec.resource

✅ Files skipped from review due to trivial changes (1)

• docs/user/howto_c2cc.md

🚧 Files skipped from review as they are similar to previous changes (1)

• docs/user/howto_c2cc_ipsec.md

---

Walkthrough

This PR adds a new C2CC user guide, links it from the user docs index, and expands the IPsec guide with verification, nftables enforcement, and updated operational guidance.

Changes

C2CC and IPsec documentation

Layer / File(s)	Summary
Index and C2CC overview docs/user/README.md, docs/user/howto_c2cc.md	Adds C2CC links in the user docs index and introduces C2CC capabilities, host-side mechanisms, and prerequisites.
Setup and verification flow docs/user/howto_c2cc.md	Documents the multi-cluster setup path, firewall and restart behavior, verification steps, DNS behavior, and the configuration reference.
Cleanup and operational notes docs/user/howto_c2cc.md	Adds IPv6/dual-stack requirements, disable and cleanup steps, and operational considerations.
IPsec guide and enforcement resource docs/user/howto_c2cc_ipsec.md, test/resources/ipsec.resource	Expands the IPsec guide with a C2CC cross-reference, tunnel verification, nftables enforcement, and updated considerations, and changes the enforcement test resource to use forwarded traffic.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: ready-for-human-review

Suggested reviewers: jerpeter1, kasturinarra

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding C2CC upstream user documentation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Only docs files changed; no Ginkgo test titles or test files were added or edited.
Test Structure And Quality	✅ Passed	No Ginkgo test blocks were changed; the only test artifact is a Robot resource, so the Ginkgo-specific quality checks don’t apply.
Microshift Test Compatibility	✅ Passed	PR only changes docs markdown; no Ginkgo tests or unsupported MicroShift APIs/features were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR changes only user docs; no Ginkgo e2e tests or SNO-sensitive code were added.
Topology-Aware Scheduling Compatibility	✅ Passed	Changed files are docs only (.md); no deployment manifests, operator code, or controllers were modified, so topology-aware scheduling concerns don’t apply.
Ote Binary Stdout Contract	✅ Passed	PR only changes docs and a Robot resource; no main/init/TestMain/suite code or stdout writes were added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Patch changes only docs/user/howto_c2cc.md and docs/user/howto_c2cc_ipsec.md; no new Ginkgo e2e tests or networked test code were added.
No-Weak-Crypto	✅ Passed	No MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons were added; the docs use AES-256/SHA-256 and IPsec/nftables examples.
Container-Privileges	✅ Passed	Changed files are docs and a Robot resource; no privileged:true, hostPID/hostNetwork/hostIPC, SYS_ADMIN, or allowPrivilegeEscalation were found.
No-Sensitive-Data-In-Logs	✅ Passed	No actual secrets or PII are logged; only placeholder PSK text and debug tcpdump output appear in the added docs/tests.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: pmtk

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [pmtk]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/user/howto_c2cc_ipsec.md`:
- Line 221: The MTU guidance in the C2CC IPsec documentation is missing the
reboot requirement, which makes the example misleading. Update the text around
the MicroShift MTU example to state that changing `/etc/microshift/ovn.yaml` for
`mtu` requires a node reboot to take effect, and adjust the instructions near
the IPsec overhead and `mtu: 8900` example so they no longer imply that
restarting MicroShift alone is sufficient.
- Around line 194-202: The CIDR enforcement example in the IPsec how-to uses the
wrong nftables hook; update the rules in the c2cc_ipsec example to use the
forward path instead of input so routed pod/service traffic is actually
filtered. Keep the existing table and chain setup, but adjust the chain
definition and accompanying rule examples in the section around the Host A/Host
B CIDRs so the `enforce` chain is bound to the forwarding hook.

In `@docs/user/howto_c2cc.md`:
- Around line 423-429: The IPsec recommendation in the c2c documentation is too
broad and implies protection is always enforced, even though the Libreswan setup
can stop protecting CIDRs if the service is stopped or a connection definition
is removed. Update the text in the c2cc how-to section to tie the recommendation
to the enforced setup by referencing the IPsec guide’s shunt/connection
requirements and making it clear that IPsec only provides the intended
protection when that enforced configuration remains in place. Use the existing
“howto_c2cc” and “howto_c2cc_ipsec” guidance sections as the anchor points for
the wording.
- Around line 314-316: The fenced block showing
<service>.<namespace>.svc.<domain> is missing a language tag, causing the
markdown lint failure. Update that fenced code block in the howto content to use
a typed fence such as text so it matches the expected markdown style and
resolves MD040.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 97446b08-c708-4412-91ad-0d37a1b3de70

📥 Commits

Reviewing files that changed from the base of the PR and between 89260da and 4754772.

📒 Files selected for processing (3)

• docs/user/README.md
• docs/user/howto_c2cc.md
• docs/user/howto_c2cc_ipsec.md

[openshift-ci]

@pmtk: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.