From 8422372ea9940a1a6a8936cf4daa14927df14443 Mon Sep 17 00:00:00 2001 From: Sergio Regidor Date: Wed, 2 Sep 2026 15:41:08 +0000 Subject: [PATCH] OCPBUGS-116490: remove nft chains before checking the ignition config --- test/extended-priv/machineconfigpool.go | 7 +++++ test/extended-priv/mco_security.go | 5 ++++ test/extended-priv/mco_storage.go | 6 ++++ test/extended-priv/node.go | 37 +++++++++++++++++++++++++ 4 files changed, 55 insertions(+) diff --git a/test/extended-priv/machineconfigpool.go b/test/extended-priv/machineconfigpool.go index 77842b4a82..ad9b82ddc5 100644 --- a/test/extended-priv/machineconfigpool.go +++ b/test/extended-priv/machineconfigpool.go @@ -400,6 +400,13 @@ func (mcp *MachineConfigPool) GetMCSIgnitionConfig(secure bool, ignitionVersion return "", err } + logger.Infof("Flush nftables rules that block the ignition config") + savedNftRules, err := master.FlushNftablesMCSBlockingRules() + defer master.RestoreNftablesMCSBlockingRules(savedNftRules) + if err != nil { + return "", err + } + cmd := []string{"curl", "-s"} if secure { cmd = append(cmd, "-k") diff --git a/test/extended-priv/mco_security.go b/test/extended-priv/mco_security.go index 1cc357e40b..5771163240 100644 --- a/test/extended-priv/mco_security.go +++ b/test/extended-priv/mco_security.go @@ -770,6 +770,11 @@ var _ = g.Describe("[sig-mco][Suite:openshift/machine-config-operator/longdurati removed6Rules, err := node.RemoveIP6TablesRulesByRegexp(fmt.Sprintf("%d", port)) o.Expect(err).NotTo(o.HaveOccurred(), "Error removing the IPv6 iptables rules for port %s in node %s", port, node.GetName()) defer node.ExecIP6Tables(removed6Rules) + + logger.Infof("Flush nftables rules that block the ignition config") + savedNftRules, err := node.FlushNftablesMCSBlockingRules() + o.Expect(err).NotTo(o.HaveOccurred(), "Error flushing nftables mcs-blocking rules in node %s", node.GetName()) + defer node.RestoreNftablesMCSBlockingRules(savedNftRules) logger.Infof("OK!\n") internalAPIServerURI, err := GetAPIServerInternalURI(mcp.oc) diff --git a/test/extended-priv/mco_storage.go b/test/extended-priv/mco_storage.go index 2abd8ae442..7dbadd815b 100644 --- a/test/extended-priv/mco_storage.go +++ b/test/extended-priv/mco_storage.go @@ -31,6 +31,12 @@ var _ = g.Describe("[sig-mco][Suite:openshift/machine-config-operator/longdurati exutil.By("get one master node to do mc query") masterNode := NewNodeList(oc.AsAdmin()).GetAllMasterNodesOrFail()[0] + + logger.Infof("Flush nftables rules that block the ignition config") + savedNftRules, nftErr := masterNode.FlushNftablesMCSBlockingRules() + o.Expect(nftErr).NotTo(o.HaveOccurred(), "Error flushing nftables mcs-blocking rules in node %s", masterNode.GetName()) + defer masterNode.RestoreNftablesMCSBlockingRules(savedNftRules) + stdout, err := masterNode.DebugNode("curl", "-w", "'Total: %{time_total}'", "-k", "-s", "-o", "/dev/null", "https://localhost:22623/config/worker") o.Expect(err).NotTo(o.HaveOccurred()) diff --git a/test/extended-priv/node.go b/test/extended-priv/node.go index 5e876b0e30..8885f8250e 100644 --- a/test/extended-priv/node.go +++ b/test/extended-priv/node.go @@ -1203,6 +1203,43 @@ func (n *Node) ExecIP6Tables(rules []string) error { return n.execIPTables(true, rules) } +// FlushNftablesMCSBlockingRules saves and then flushes the mcs-blocking chain in the inet ovn-kubernetes nftables table. +// Returns the original rules so they can be restored later with RestoreNftablesMCSBlockingRules. +func (n *Node) FlushNftablesMCSBlockingRules() (string, error) { + savedRules, stderr, err := n.DebugNodeWithChrootStd("nft", "list", "chain", "inet", "ovn-kubernetes", "mcs-blocking") + if err != nil { + logger.Warnf("nft mcs-blocking chain not found (nftables may not be in use). Stderr: %s", stderr) + return "", nil + } + + logger.Infof("%s. Flushing nftables mcs-blocking chain", n.GetName()) + output, flushErr := n.DebugNodeWithChroot("nft", "flush", "chain", "inet", "ovn-kubernetes", "mcs-blocking") + if flushErr != nil { + logger.Errorf("Output: %s", output) + return savedRules, flushErr + } + + return savedRules, nil +} + +// RestoreNftablesMCSBlockingRules restores the mcs-blocking chain rules that were saved by FlushNftablesMCSBlockingRules. +// Using echo piped to `nft -f -` is the simplest approach. If we find problems with echo (e.g. special characters +// in the rules), we can use the RemoteFile.Create approach to write the rules to a file on the node and then +// run `nft -f ` instead. +func (n *Node) RestoreNftablesMCSBlockingRules(savedRules string) error { + if savedRules == "" { + return nil + } + + logger.Infof("%s. Restoring nftables mcs-blocking chain rules", n.GetName()) + output, err := n.DebugNodeWithChroot("bash", "-c", + fmt.Sprintf("echo '%s' | nft -f -", savedRules)) + if err != nil { + logger.Errorf("Output: %s", output) + } + return err +} + // GetArchitecture get the architecture used in the node func (n *Node) GetArchitecture() (architecture.Architecture, error) { arch, err := n.Get(`{.status.nodeInfo.architecture}`)