)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":10089,"name":"Anil Shashikumar Belur","email":"abelur@linuxfoundation.org","username":"askb"},"change_message_id":"cf02c3c5545e61ec12766a044e7b7f2f97b662e5","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"975746ac_50b78eda","updated":"2026-08-06 02:34:06.000000000","message":"Thanks Clark - agreed, I\u0027d rather restructure now than after it lands.\nNeed some guidance going with your third option, a new group:\n\n- empty `nftables: []` group in groups.yaml\n- group_vars sets `iptables_use_nftables`, default false in the role\n- backend vars behind one conditional include_vars\n\nLanding that is a no-op in prod, then each tier is a one-line change\nadding a glob to the group. Picked the group over a parallel role since\nthe role is called from 20+ playbooks, and futureparser/puppet4 already\ndid exactly this here (including retiring the flag at the end).\n\nHelpfully, the new `nft list ruleset` assertions pass unchanged on\ncurrent iptables hosts - it\u0027s already the iptables-nft compat layer, I\nchecked on trixie. So one assertion set covers both backends and CI can\ntest converted and unconverted hosts side by side. And since the\nsystem-config-run nodesets use production hostnames, each tier change\nconverts the CI node and the prod host together - so it\u0027s proven in the\ngate before it merges. Roughly 15 independent changes, low risk first,\ngitea-lb/review late, bridge last.\n\nTwo questions before I respin: cacti, storyboard(-dev), translate(-dev)\nand the afs servers have no system-config-run job, so converting them\nis blind - hold them for a manual check, or just leave them until\nthey\u0027re retired? And are host globs fine, or would you rather I opt in\nexisting service groups?","commit_id":"c94c496a5e7c835447935f994072a0a4995f6ae2"},{"author":{"_account_id":10089,"name":"Anil Shashikumar Belur","email":"abelur@linuxfoundation.org","username":"askb"},"change_message_id":"2080db31f0d1b8045ea599f29a7b7c70390ff19b","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"a84f08fe_de8bcb44","in_reply_to":"6150b077_7c213590","updated":"2026-08-07 08:00:48.000000000","message":"Thanks, that all makes sense. Respun along those lines. This is now\ntwo changes:\n\n1. testinfra: teach verify_iptables() to handle both backends\n2. this change: the opt-in mechanism, with the group empty\n\nOne correction to what I said earlier - I claimed the nft assertions pass unchanged on unconverted hosts. That\u0027s true on jammy and noble, but not on focal, which still defaults iptables to iptables-legacy (alternatives priority 20 vs 10 for the nft variant), so \"nft list ruleset\" there is empty. The reverse is also true: once a host is on a natively loaded ruleset, \"iptables -S\" refuses to render it at all (\"table `filter\u0027 is incompatible, use \u0027nft\u0027 tool\"). So the two readbacks really aren\u0027t interchangeable and I had that wrong.\n\nThe testinfra change probes \"iptables -S\" first and only falls back to nft when it fails. That means unconverted hosts keep asserting exactly what they assert today, byte for byte, on both the legacy and the iptables-nft backends, and only converted hosts take the new path.\n\nAdded system-config-run-base-iptables as you suggested, parented to system-config-run-base. The base job now sets gate_nftables, which puts its nodes in the nftables group via the gate-groups template, and the new job leaves it off. So both backends are covered by the base job pair regardless of which services have been converted.\n\nAlso worth noting the legacy path is untouched here - vars/Debian.yaml, vars/RedHat.yaml, vars/Ubuntu.trusty.yaml, tasks/RedHat.yaml and both rules templates are identical to master, and the legacy handlers just gained a \"when\". The nftables bits are additive, so unconverted hosts should be a genuine no-op.","commit_id":"c94c496a5e7c835447935f994072a0a4995f6ae2"},{"author":{"_account_id":4146,"name":"Clark Boylan","email":"cboylan@sapwetik.org","username":"cboylan"},"change_message_id":"7491c0db61ab384ef28e74f53c636887fe80afe5","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"6150b077_7c213590","in_reply_to":"975746ac_50b78eda","updated":"2026-08-06 20:21:54.000000000","message":"\u003e Thanks Clark - agreed, I\u0027d rather restructure now than after it lands.\n\u003e Need some guidance going with your third option, a new group:\n\u003e \n\u003e - empty `nftables: []` group in groups.yaml\n\u003e - group_vars sets `iptables_use_nftables`, default false in the role\n\u003e - backend vars behind one conditional include_vars\n\u003e \n\u003e Landing that is a no-op in prod, then each tier is a one-line change\n\u003e adding a glob to the group. Picked the group over a parallel role since\n\u003e the role is called from 20+ playbooks, and futureparser/puppet4 already\n\u003e did exactly this here (including retiring the flag at the end).\n\nThis seems like good justification for this approach.\n\n\u003e \n\u003e Helpfully, the new `nft list ruleset` assertions pass unchanged on\n\u003e current iptables hosts - it\u0027s already the iptables-nft compat layer, I\n\u003e checked on trixie. So one assertion set covers both backends and CI can\n\u003e test converted and unconverted hosts side by side. And since the\n\u003e system-config-run nodesets use production hostnames, each tier change\n\u003e converts the CI node and the prod host together - so it\u0027s proven in the\n\u003e gate before it merges. Roughly 15 independent changes, low risk first,\n\u003e gitea-lb/review late, bridge last.\n\nYup I think this should work well. We should also probably add a new job that has parent system-config-run-base https://opendev.org/opendev/system-config/src/branch/master/zuul.d/system-config-run.yaml#L56-L91 to test the basic deployment with iptables specifically. Then we can make the existing base job test with nftables. That way it will be harder for us to regress if we\u0027re only making changes to this particular role as both the old and new method will be covered and tested before we try and convert a specific service.\n\n\u003e \n\u003e Two questions before I respin: cacti, storyboard(-dev), translate(-dev)\n\u003e and the afs servers have no system-config-run job, so converting them\n\u003e is blind - hold them for a manual check, or just leave them until\n\u003e they\u0027re retired? And are host globs fine, or would you rather I opt in\n\u003e existing service groups?\n\nYes, those servers are so old that I think we should avoid converting them. It is difficult to test them and the idea is that we\u0027re letting cacti and translate die on the vine. Storyboard is in a bit more limbo. All that to say I think we should continue to support iptables (rather than nftables) and let those hosts remain iptables only.\n\nI think host globs are fine. That gives us the ability to say convert a single host type first before committing all of the others. ze01.opendev.org first (exact match glob) before converting the rule to ze*.opendev.org as an example.","commit_id":"c94c496a5e7c835447935f994072a0a4995f6ae2"},{"author":{"_account_id":10089,"name":"Anil Shashikumar Belur","email":"abelur@linuxfoundation.org","username":"askb"},"change_message_id":"b547a6f61685b8dc13b63335093554c10f756e65","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"863d66f7_130b1a30","in_reply_to":"a84f08fe_de8bcb44","updated":"2026-08-07 08:01:24.000000000","message":"Agreed on cacti, translate, storyboard and the afs servers - I\u0027ll leave those on iptables and won\u0027t plan a change that removes the iptables path. It stays supported indefinitely.\n\nHost globs it is, and good point on going finer than I\u0027d planned: ze01.opendev.org first, then ze*.opendev.org once it\u0027s had some soak.\n\nI verified the transpile end to end in a container: a pre-existing \"table ip nat\" survives the reload (docker\u0027s masquerade rules were the thing I was worried about), the generated file is byte-identical across runs so it doesn\u0027t reload every play, and the ip6 connlimit set type workaround holds.","commit_id":"c94c496a5e7c835447935f994072a0a4995f6ae2"}]}