Skip to content

CNF-21001: Remove iptables compatibility commits #108

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 2 commits into from
Apr 14, 2026
+0 −24
Merged

CNF-21001: Remove iptables compatibility commits #108

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
08b6c81
Revert "ds: force accept ICMPv6 ND packets"
zeeke Apr 13, 2026
984b663
Revert "ds: compatibility with the iptables implementation"
zeeke Apr 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 0 additions & 3 deletions Dockerfile.openshift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,4 @@ LABEL io.k8s.display-name="Multus NetworkPolicy" \
io.openshift.tags="openshift" \
maintainer="Doug Smith <dosmith@redhat.com>"

# TODO: compatibility layer with the original multus-networkpolicy-iptables image. Remove this once the ClsuterNetworkOperator is updated to use the nftables implementation.
RUN ln -s /usr/bin/multi-networkpolicy-nftables /usr/bin/multi-networkpolicy-iptables

ENTRYPOINT ["multi-networkpolicy-nftables"]
21 changes: 0 additions & 21 deletions cmd/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,10 +64,6 @@ func run() error {
flag.StringVar(&customIPv6IngressRuleFile, "custom-v6-ingress-rule-file", "", "custom rule file for IPv6 ingress")
flag.StringVar(&customIPv6EgressRuleFile, "custom-v6-egress-rule-file", "", "custom rule file for IPv6 egress")

// TODO: compatibility layer with the multus-networkpolicy-iptables image. Remove this once the ClsuterNetworkOperator is updated to use the nftables implementation.
var podIptables string
flag.StringVar(&podIptables, "pod-iptables", "", "compatibility layer")

opts := zap.Options{
Development: true,
}
Expand Down Expand Up @@ -106,27 +102,10 @@ func run() error {
return fmt.Errorf("unable to get custom nftables rules: %w", err)
}

// TODO: compatibility layer with the multus-networkpolicy-iptables image. Remove this once the ClsuterNetworkOperator is updated to use the nftables implementation.
commonRules = &nftables.CommonRules{}

// Set ICMP acceptance rules
commonRules.AcceptICMP = acceptICMP
commonRules.AcceptICMPv6 = acceptICMPv6

// TODO: put this in ClusterNetworkOperator
commonRules.CustomIPv6EgressRules = []string{
"icmpv6 type nd-neighbor-solicit accept",
"icmpv6 type nd-neighbor-advert accept",
"icmpv6 type nd-router-advert accept",
"icmpv6 type nd-router-solicit accept",
}
commonRules.CustomIPv6IngressRules = []string{
"icmpv6 type nd-neighbor-solicit accept",
"icmpv6 type nd-neighbor-advert accept",
"icmpv6 type nd-router-advert accept",
"icmpv6 type nd-router-solicit accept",
}

setupLog.Info("Common rules applied to all pods affected by MultiNetworkPolicies", "rules", commonRules)

ctx := ctrl.SetupSignalHandler()
Expand Down