From 9fb14f4c390111c52a6b215709bf692f8e1fae4f Mon Sep 17 00:00:00 2001 From: Andrea Panattoni Date: Tue, 20 Jan 2026 11:38:04 +0100 Subject: [PATCH] multus: MultiNetworkPolicy nftables Image `quay.io/openshift/origin-multus-networkpolicy` has been updated with the nftables implemenation (https://github.com/k8snetworkplumbingwg/multi-networkpolicy-nftables). Adjust the deployment parameter to fit the new code. Signed-off-by: Andrea Panattoni --- .../{custom-iptables-rules.yaml => custom-rules.yaml} | 8 ++++---- .../multus-networkpolicy/multus-networkpolicy.yaml | 2 -- 2 files changed, 4 insertions(+), 6 deletions(-) rename bindata/network/multus-networkpolicy/{custom-iptables-rules.yaml => custom-rules.yaml} (59%) diff --git a/bindata/network/multus-networkpolicy/custom-iptables-rules.yaml b/bindata/network/multus-networkpolicy/custom-rules.yaml similarity index 59% rename from bindata/network/multus-networkpolicy/custom-iptables-rules.yaml rename to bindata/network/multus-networkpolicy/custom-rules.yaml index 897c16a622..caeea873ac 100644 --- a/bindata/network/multus-networkpolicy/custom-iptables-rules.yaml +++ b/bindata/network/multus-networkpolicy/custom-rules.yaml @@ -10,8 +10,8 @@ data: custom-v6-rules.txt: | # accept NDP - -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT - -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT + icmpv6 type nd-neighbor-solicit accept + icmpv6 type nd-neighbor-advert accept # accept RA/RS - -p icmpv6 --icmpv6-type router-solicitation -j ACCEPT - -p icmpv6 --icmpv6-type router-advertisement -j ACCEPT + icmpv6 type nd-router-advert accept + icmpv6 type nd-router-solicit accept diff --git a/bindata/network/multus-networkpolicy/multus-networkpolicy.yaml b/bindata/network/multus-networkpolicy/multus-networkpolicy.yaml index d75779b193..a1ead1ff08 100644 --- a/bindata/network/multus-networkpolicy/multus-networkpolicy.yaml +++ b/bindata/network/multus-networkpolicy/multus-networkpolicy.yaml @@ -33,11 +33,9 @@ spec: containers: - name: multus-networkpolicy image: {{.MultiNetworkPolicyImage}} - command: ["/usr/bin/multi-networkpolicy-iptables"] args: - "--host-prefix=/host" - "--container-runtime-endpoint=/run/crio/crio.sock" - - "--pod-iptables=/var/lib/multi-networkpolicy/iptables" - "--network-plugins=macvlan,sriov,ipvlan,bond" - "--custom-v6-ingress-rule-file=/etc/multi-networkpolicy/rules/custom-v6-rules.txt" - "--custom-v6-egress-rule-file=/etc/multi-networkpolicy/rules/custom-v6-rules.txt"