CORENET-7252: Migrate iptables to nftables in networking test suite#3935
CORENET-7252: Migrate iptables to nftables in networking test suite#3935weliang1 wants to merge 1 commit into
Conversation
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Replace all iptables command references with nftables equivalents across 5 test feature files in the networking test suite. Changes: - pod.feature: Migrate u32 module matching to nftables raw payload - egress-ip.feature: Update EgressIP rule verification to use nft - ovn.feature: Convert OVN port blocking with IPv4/IPv6 support - service.feature: Update service DNAT/REDIRECT verification - sdn.feature: Rule repair, version checks, and conntrack rules Migration statistics: - 5 files updated, 108 lines changed (55+, 53-) - 8 test scenarios updated - 100% iptables references removed Technical changes: - iptables --version → nft --version - iptables-save → nft list ruleset - iptables -S -t <table> → nft list table ip <table> - ip6tables support → nft family ip6 - Rule deletion now uses handle-based approach Note: Ruby step definitions still need updates for: - node nftables config checks - nftables rule removal/flush operations Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
weliang1
force-pushed
the
replace-iptable-with-nftable
branch
from
2d6dbf9 to
b6fc3cd
Compare
|
@weliang1 Does it make sense to migrate all to go so that when they are OTE enabled we do not need to think of ruby tests all? |
|
@weliang1: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
weliang1
changed the title
openshift-ci-robot
added
the
jira/valid-reference
|
@weliang1: This pull request references CORENET-7252 which is a valid jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
| @inactive | ||
| Scenario: OCP-15473:SDN The related iptables/openflow rules will be removed once the egressIP gets removed from netnamespace | ||
| Scenario: OCP-15473:SDN The related nftables/openflow rules will be removed once the egressIP gets removed from netnamespace | ||
| Given the env is using "OpenShiftSDN" networkType |
There was a problem hiding this comment.
This is an openshift-sdn-specific test, so (if it's still going to be kept) it should still refer to iptables.
| # don't block all traffic that breaks etcd, just block the OVN ssl ports | ||
| When I run commands on the host: | ||
| | <%= cb.iptables_command %> -t filter -A INPUT -s <%= cb.south_leader.ip %> -p tcp --dport 9643:9644 -j DROP | | ||
| | bash | -c | nft add rule <%= cb.nft_family %> filter INPUT <%= cb.nft_saddr %> <%= cb.south_leader.ip %> tcp dport 9643-9644 drop | |
There was a problem hiding this comment.
The filter table and INPUT chain are created by iptables-nft. In the future, in nftables-only systems, they will not exist. You need to create your own table and chain. eg:
nft add table inet ocp-testing
nft add chain inet ocp-testing input { type filter hook input priority filter ; }
nft add rule inet ocp-testing input <%= cb.nft_family %> saddr <%= cb.south_leader.ip %> tcp dport 9643-9644 drop
and then just nft delete table inet ocp-testing for the cleanup.
| Given evaluation of `(cb.south_leader.ip.include? ":") ? "ip6tables" : "iptables"` is stored in the :iptables_command clipboard | ||
| # Determine IP family for nftables (ip or ip6) | ||
| Given evaluation of `(cb.south_leader.ip.include? ":") ? "ip6" : "ip"` is stored in the :nft_family clipboard | ||
| Given evaluation of `(cb.south_leader.ip.include? ":") ? "ip6 saddr" : "ip saddr"` is stored in the :nft_saddr clipboard |
There was a problem hiding this comment.
(You don't really need nft_saddr as a separate variable, since it's always just nft_family followed by "saddr")
| @admin | ||
| @destructive | ||
| @inactive | ||
| Scenario: OCP-33413:SDN xt_u32 kernel module functionality check from NET_ADMIN pods |
There was a problem hiding this comment.
Searching for "OCP-33413" in Jira turns up https://redhat.atlassian.net/browse/CNF-930. This is specifically a test that customers can use the iptables xt_u32 module. It should not be changed.
| @@ -1 +1 @@ | |||
| Feature: SDN related networking scenarios | |||
There was a problem hiding this comment.
This whole file seems to be openshift-sdn specific and should not be changed.
| @s390x @ppc64le @heterogeneous @arm64 @amd64 | ||
| @hypershift-hosted | ||
| Scenario: OCP-10216:SDN The iptables rules for the service should be DNAT or REDIRECT to node after being idled | ||
| Scenario: OCP-10216:SDN The nftables rules for the service should be DNAT or REDIRECT to node after being idled |
There was a problem hiding this comment.
This also appears to be an openshift-sdn-specific test, and should not be changed.
4 participants
Summary
Replace all iptables command references with nftables equivalents across the networking test suite.
Changes
Migration Statistics
Technical Changes
iptables --version→nft --versioniptables-save→nft list rulesetiptables -S -t <table>→nft list table ip <table>ip6tablessupport →nftfamilyip6Documentation
MIGRATION_SUMMARY.mdwith complete migration guideStatus: WIP
Pending work:
the node nftables config is checkedthe node standard nftables rules are removedthe node standard nftables rules are completely flushedTesting
Requires RHEL 8+ nodes with nftables support.
See
MIGRATION_SUMMARY.mdfor complete technical details.