WIP: Migrate iptables to nftables in networking test suite#3935
WIP: Migrate iptables to nftables in networking test suite#3935weliang1 wants to merge 1 commit into
Conversation
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Replace all iptables command references with nftables equivalents across 5 test feature files in the networking test suite. Changes: - pod.feature: Migrate u32 module matching to nftables raw payload - egress-ip.feature: Update EgressIP rule verification to use nft - ovn.feature: Convert OVN port blocking with IPv4/IPv6 support - service.feature: Update service DNAT/REDIRECT verification - sdn.feature: Rule repair, version checks, and conntrack rules Migration statistics: - 5 files updated, 108 lines changed (55+, 53-) - 8 test scenarios updated - 100% iptables references removed Technical changes: - iptables --version → nft --version - iptables-save → nft list ruleset - iptables -S -t <table> → nft list table ip <table> - ip6tables support → nft family ip6 - Rule deletion now uses handle-based approach Note: Ruby step definitions still need updates for: - node nftables config checks - nftables rule removal/flush operations Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
weliang1
force-pushed
the
replace-iptable-with-nftable
branch
from
2d6dbf9 to
b6fc3cd
Compare
|
@weliang1 Does it make sense to migrate all to go so that when they are OTE enabled we do not need to think of ruby tests all? |
|
@weliang1: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Summary
Replace all iptables command references with nftables equivalents across the networking test suite.
Changes
Migration Statistics
Technical Changes
iptables --version→nft --versioniptables-save→nft list rulesetiptables -S -t <table>→nft list table ip <table>ip6tablessupport →nftfamilyip6Documentation
MIGRATION_SUMMARY.mdwith complete migration guideStatus: WIP
Pending work:
the node nftables config is checkedthe node standard nftables rules are removedthe node standard nftables rules are completely flushedTesting
Requires RHEL 8+ nodes with nftables support.
See
MIGRATION_SUMMARY.mdfor complete technical details.