multus: MultiNetworkPolicy nftables #2883
Conversation
Image `quay.io/openshift/origin-multus-networkpolicy` has been updated with the nftables implemenation (https://github.com/k8snetworkplumbingwg/multi-networkpolicy-nftables). Adjust the deployment parameter to fit the new code. Signed-off-by: Andrea Panattoni <apanatto@redhat.com>
|
/hold |
WalkthroughThe pull request modifies Multus network policy configuration files: reformatting icmpv6 rules from iptables syntax to shortened form in custom-iptables-rules.yaml, and removing explicit command override and pod-iptables argument from the multus-networkpolicy container specification. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Comment |
openshift-ci
bot
added
the
do-not-merge/hold
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: zeeke The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@bindata/network/multus-networkpolicy/custom-iptables-rules.yaml`:
- Around line 13-17: The YAML file contains tab characters in the indentation
for lines like "icmpv6 type nd-neighbor-solicit accept", "icmpv6 type
nd-router-advert accept", and "icmpv6 type nd-router-solicit accept" which
breaks YAML parsing; fix this by replacing all leading tabs with spaces (use
consistent space-based indentation) for those icmpv6 rule lines so the ConfigMap
parses correctly and the deployment can proceed.
| icmpv6 type nd-neighbor-solicit accept | ||
| icmpv6 type nd-neighbor-advert accept | ||
| # accept RA/RS | ||
| -p icmpv6 --icmpv6-type router-solicitation -j ACCEPT | ||
| -p icmpv6 --icmpv6-type router-advertisement -j ACCEPT | ||
| icmpv6 type nd-router-advert accept | ||
| icmpv6 type nd-router-solicit accept |
There was a problem hiding this comment.
YAML syntax error: Tab characters will break parsing.
Lines 14, 16, and 17 use tab characters for indentation while line 13 uses spaces. YAML does not allow tabs for indentation—this will cause the ConfigMap to fail parsing and prevent deployment.
Proposed fix: Replace tabs with spaces
custom-v6-rules.txt: |
# accept NDP
icmpv6 type nd-neighbor-solicit accept
- icmpv6 type nd-neighbor-advert accept
+ icmpv6 type nd-neighbor-advert accept
# accept RA/RS
- icmpv6 type nd-router-advert accept
- icmpv6 type nd-router-solicit accept
+ icmpv6 type nd-router-advert accept
+ icmpv6 type nd-router-solicit accept🧰 Tools
🪛 YAMLlint (1.38.0)
[error] 14-14: syntax error: found character '\t' that cannot start any token
(syntax)
🤖 Prompt for AI Agents
In `@bindata/network/multus-networkpolicy/custom-iptables-rules.yaml` around lines
13 - 17, The YAML file contains tab characters in the indentation for lines like
"icmpv6 type nd-neighbor-solicit accept", "icmpv6 type nd-router-advert accept",
and "icmpv6 type nd-router-solicit accept" which breaks YAML parsing; fix this
by replacing all leading tabs with spaces (use consistent space-based
indentation) for those icmpv6 rule lines so the ConfigMap parses correctly and
the deployment can proceed.
| namespace: openshift-multus | ||
| data: | ||
|
|
||
| custom-v6-rules.txt: | |
There was a problem hiding this comment.
in addition to what the bot said, can you remove the stray blank line here (line 10), and also rename the yaml file to "custom-nftables-rules.yaml"? (Or just "custom-rules.yaml")
|
@zeeke: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Image
quay.io/openshift/origin-multus-networkpolicyhas been updated with the nftables implemenation (https://github.com/k8snetworkplumbingwg/multi-networkpolicy-nftables). Adjust the deployment parameter to fit the new code.depends on: