Conversation
|
/hold |
WalkthroughThis pull request removes the container startup command override and pod-iptables flag from the multus-networkpolicy manifest, and converts ICMPv6 firewall rules in custom-rules.yaml from iptables-style syntax to nftables-style format. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes ✨ Finishing touches🧪 Generate unit tests (beta)
Tip 🧪 Unit Test Generation v2 is now available!We have significantly improved our unit test generation capabilities. To enable: Add this to your reviews:
finishing_touches:
unit_tests:
enabled: trueTry it out by using the Have feedback? Share your thoughts on our Discord thread! Comment |
openshift-ci
bot
added
the
do-not-merge/hold
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@bindata/network/multus-networkpolicy/custom-iptables-rules.yaml`:
- Around line 13-17: The YAML file contains tab characters in the indentation
for lines like "icmpv6 type nd-neighbor-solicit accept", "icmpv6 type
nd-router-advert accept", and "icmpv6 type nd-router-solicit accept" which
breaks YAML parsing; fix this by replacing all leading tabs with spaces (use
consistent space-based indentation) for those icmpv6 rule lines so the ConfigMap
parses correctly and the deployment can proceed.
| @@ -10,8 +10,8 @@ data: | |||
|
|
|||
| custom-v6-rules.txt: | | |||
There was a problem hiding this comment.
in addition to what the bot said, can you remove the stray blank line here (line 10), and also rename the yaml file to "custom-nftables-rules.yaml"? (Or just "custom-rules.yaml")
There was a problem hiding this comment.
sure! fixed and renamed to custom-rules.yaml
zeeke
force-pushed
the
CNF-21001_mnp_nftables
branch
2 times, most recently
from
7db73ce to
af37b2c
Compare
| -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT | ||
| -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT | ||
| icmpv6 type nd-neighbor-solicit accept | ||
| icmpv6 type nd-neighbor-advert accept |
There was a problem hiding this comment.
still has tabs instead of spaces in some places
Image `quay.io/openshift/origin-multus-networkpolicy` has been updated with the nftables implemenation (https://github.com/k8snetworkplumbingwg/multi-networkpolicy-nftables). Adjust the deployment parameter to fit the new code. Signed-off-by: Andrea Panattoni <apanatto@redhat.com>
zeeke
force-pushed
the
CNF-21001_mnp_nftables
branch
from
af37b2c to
9fb14f4
Compare
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: danwinship, zeeke The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
|
@zeeke: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Image
quay.io/openshift/origin-multus-networkpolicyhas been updated with the nftables implemenation (https://github.com/k8snetworkplumbingwg/multi-networkpolicy-nftables). Adjust the deployment parameter to fit the new code.depends on: