downstream: Transition to nftables backend #77

zeeke · 2025-11-10T16:34:40Z

This PR replaces the implementation from iptables [1] to nftables [2].
Once this PR is merged, subsequent upstream to downstream sync merges must come from the new upstream repository (nftables).

[1] https://github.com/k8snetworkplumbingwg/multi-networkpolicy-iptables
[2] https://github.com/k8snetworkplumbingwg/multi-networkpolicy-nftables

Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.25.2 to 2.27.1. - [Release notes](https://github.com/onsi/ginkgo/releases) - [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md) - [Commits](onsi/ginkgo@v2.25.2...v2.27.1) --- updated-dependencies: - dependency-name: github.com/onsi/ginkgo/v2 dependency-version: 2.27.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

These tests were ocassionally failing due to some race conditions. The logic to verify reconcilation triggers has been changed. Signed-off-by: Marcelo <marguerr@redhat.com>

Signed-off-by: Marcelo <marguerr@redhat.com>

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 5. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4...v5) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

…github_actions/actions/upload-artifact-5 Bump actions/upload-artifact from 4 to 5

Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.27.1 to 2.27.2. - [Release notes](https://github.com/onsi/ginkgo/releases) - [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md) - [Commits](onsi/ginkgo@v2.27.1...v2.27.2) --- updated-dependencies: - dependency-name: github.com/onsi/ginkgo/v2 dependency-version: 2.27.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

zeeke · 2025-11-11T13:55:03Z

/hold
not before 4.22 branch cut

zeeke · 2025-11-13T10:55:43Z

/retest

zeeke · 2025-11-13T11:20:55Z

/test ci/prow/e2e-aws

openshift-ci · 2025-11-13T11:21:43Z

@zeeke: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

/test e2e-aws

/test images

/test okd-scos-images

/test verify-deps

The following commands are available to trigger optional jobs:

/test okd-scos-e2e-aws-ovn

/test security

Use /test all to run all jobs.

Details

In response to this:

/test ci/prow/e2e-aws

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

zeeke · 2025-11-13T11:24:37Z

/test e2e-aws

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.75.1 to 1.77.0. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.75.1...v1.77.0) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.77.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

zeeke · 2025-11-18T16:23:52Z

/retest ci/prow/images

openshift-ci · 2025-11-18T16:24:45Z

@zeeke: The /retest command does not accept any targets.
The following commands are available to trigger required jobs:

/test e2e-aws

/test images

/test okd-scos-images

/test verify-deps

The following commands are available to trigger optional jobs:

/test okd-scos-e2e-aws-ovn

/test security

Use /test all to run the following jobs that were automatically triggered:

pull-ci-openshift-multus-networkpolicy-main-e2e-aws

pull-ci-openshift-multus-networkpolicy-main-images

pull-ci-openshift-multus-networkpolicy-main-okd-scos-images

pull-ci-openshift-multus-networkpolicy-main-security

pull-ci-openshift-multus-networkpolicy-main-verify-deps

Details

In response to this:

/retest ci/prow/images

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

zeeke · 2025-11-18T16:25:50Z

/test images

SchSeba · 2025-11-23T11:08:30Z

amazing work on this one!
/lgtm
/approve

openshift-ci · 2025-11-23T11:09:04Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: SchSeba, zeeke

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [zeeke]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Dump operating info like the hostname and the common rules when starting, as they could be useful for debugging purpose. Signed-off-by: Andrea Panattoni <apanatto@redhat.com>

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

…go_modules/github.com/onsi/gomega-1.38.3 Bump github.com/onsi/gomega from 1.38.2 to 1.38.3

Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.27.2 to 2.27.3. - [Release notes](https://github.com/onsi/ginkgo/releases) - [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md) - [Commits](onsi/ginkgo@v2.27.2...v2.27.3) --- updated-dependencies: - dependency-name: github.com/onsi/ginkgo/v2 dependency-version: 2.27.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

…go_modules/github.com/onsi/ginkgo/v2-2.27.3 Bump github.com/onsi/ginkgo/v2 from 2.27.2 to 2.27.3

openshift-ci · 2025-12-11T15:54:24Z

New changes are detected. LGTM label has been removed.

Give precendence to IPBlock field over PodSelector

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 5 to 6. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v5...v6) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

…github_actions/actions/upload-artifact-6 Bump actions/upload-artifact from 5 to 6

Bumps [github.com/containernetworking/plugins](https://github.com/containernetworking/plugins) from 1.8.0 to 1.9.0. - [Release notes](https://github.com/containernetworking/plugins/releases) - [Commits](containernetworking/plugins@v1.8.0...v1.9.0) --- updated-dependencies: - dependency-name: github.com/containernetworking/plugins dependency-version: 1.9.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.77.0 to 1.78.0. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.77.0...v1.78.0) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.78.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: Andrea Panattoni <apanatto@redhat.com>

openshift-ci · 2026-01-09T19:03:06Z

@zeeke: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/okd-scos-e2e-aws-ovn	`5e70256`	link	false	`/test okd-scos-e2e-aws-ovn`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

zeeke · 2026-01-12T13:46:59Z

/test images

zeeke · 2026-01-13T07:29:47Z

/retest

zeeke · 2026-01-13T13:00:03Z

/hold cancel

as the depending PR is mered, this one is ready for review

Marcelo and others added 7 commits October 16, 2025 10:26

First commit

bea73f3

Fix controller integration tests

1f3c46f

These tests were ocassionally failing due to some race conditions. The logic to verify reconcilation triggers has been changed. Signed-off-by: Marcelo <marguerr@redhat.com>

Modify references to private repo

abee32c

Signed-off-by: Marcelo <marguerr@redhat.com>

Merge pull request openshift#17 from k8snetworkplumbingwg/dependabot/…

6289953

…github_actions/actions/upload-artifact-5 Bump actions/upload-artifact from 4 to 5

openshift-ci bot requested review from dougbtv and s1061123 November 10, 2025 16:36

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 10, 2025

zeeke force-pushed the ds/transition-nftables branch from 520f047 to 352e20f Compare November 11, 2025 11:37

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 11, 2025

zeeke force-pushed the ds/transition-nftables branch from 6444e09 to bc0c388 Compare November 13, 2025 16:08

zeeke force-pushed the ds/transition-nftables branch 2 times, most recently from cf06e31 to dc9e90b Compare November 18, 2025 14:42

openshift-ci bot assigned SchSeba Nov 23, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Nov 23, 2025

zeeke and others added 2 commits December 2, 2025 13:16

logging: Print info at startup

280ba75

Dump operating info like the hostname and the common rules when starting, as they could be useful for debugging purpose. Signed-off-by: Andrea Panattoni <apanatto@redhat.com>

zeeke and others added 3 commits December 9, 2025 09:35

Merge pull request openshift#28 from k8snetworkplumbingwg/dependabot/…

06faba2

…go_modules/github.com/onsi/gomega-1.38.3 Bump github.com/onsi/gomega from 1.38.2 to 1.38.3

Merge pull request openshift#27 from k8snetworkplumbingwg/dependabot/…

d5cb49b

…go_modules/github.com/onsi/ginkgo/v2-2.27.3 Bump github.com/onsi/ginkgo/v2 from 2.27.2 to 2.27.3

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Dec 11, 2025

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Dec 11, 2025

zeeke force-pushed the ds/transition-nftables branch from 721d874 to 9e3564a Compare December 11, 2025 17:31

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Dec 11, 2025

zeeke force-pushed the ds/transition-nftables branch from 9e3564a to aec819b Compare December 11, 2025 17:38

openshift-bot pushed a commit to openshift-bot/multus-networkpolicy that referenced this pull request Dec 12, 2025

Merge pull request openshift#77 from zeeke/us/OCPBUGS-45980

2849ee0

Give precendence to IPBlock field over PodSelector

dependabot bot and others added 8 commits December 15, 2025 08:36

Merge pull request openshift#33 from k8snetworkplumbingwg/dependabot/…

df25a79

…github_actions/actions/upload-artifact-6 Bump actions/upload-artifact from 5 to 6

ds: remove iptables codebase

bb91079

Signed-off-by: Andrea Panattoni <apanatto@redhat.com>

Merge remote-tracking branch 'upstream/main' into ds/transition-nftables

4302850

ds: Update Dockerfile

28e5ee4

Signed-off-by: Andrea Panattoni <apanatto@redhat.com>

ds: restore OWNERS file

d7d3d96

Signed-off-by: Andrea Panattoni <apanatto@redhat.com>

zeeke force-pushed the ds/transition-nftables branch from aec819b to 2bb745b Compare January 5, 2026 18:01

zeeke added 3 commits January 5, 2026 19:17

ds: run go mod vendor

43b8071

Signed-off-by: Andrea Panattoni <apanatto@redhat.com>

snyk: ignore vendor folder

1e4d7e4

Signed-off-by: Andrea Panattoni <apanatto@redhat.com>

ds: compatibility with the iptables implementation

211ff66

Signed-off-by: Andrea Panattoni <apanatto@redhat.com>

zeeke force-pushed the ds/transition-nftables branch from 2bb745b to bf11819 Compare January 5, 2026 18:18

ds: force accept ICMPv6 ND packets

b95fd32

Signed-off-by: Andrea Panattoni <apanatto@redhat.com>

zeeke force-pushed the ds/transition-nftables branch from bf11819 to b95fd32 Compare January 9, 2026 17:38

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jan 13, 2026

downstream: Transition to nftables backend #77

Are you sure you want to change the base?

downstream: Transition to nftables backend #77

Uh oh!

Conversation

zeeke commented Nov 10, 2025

Uh oh!

zeeke commented Nov 11, 2025

Uh oh!

zeeke commented Nov 13, 2025

Uh oh!

zeeke commented Nov 13, 2025

Uh oh!

openshift-ci bot commented Nov 13, 2025

Uh oh!

zeeke commented Nov 13, 2025

Uh oh!

zeeke commented Nov 18, 2025

Uh oh!

openshift-ci bot commented Nov 18, 2025

Uh oh!

zeeke commented Nov 18, 2025

Uh oh!

SchSeba commented Nov 23, 2025

Uh oh!

openshift-ci bot commented Nov 23, 2025

Uh oh!

openshift-ci bot commented Dec 11, 2025

Uh oh!

openshift-ci bot commented Jan 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zeeke commented Jan 12, 2026

Uh oh!

zeeke commented Jan 13, 2026

Uh oh!

zeeke commented Jan 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

openshift-ci bot commented Jan 9, 2026 •

edited

Loading