OCPBUGS-85529:Fix IPv6 prefix in MultiNetworkPolicy test (/32 → /64) by weliang1 · Pull Request #31407 · openshift/origin

weliang1 · 2026-07-21T18:25:14Z

Summary

Fixes a 3-year-old test bug causing the MultiNetworkPolicy IPv6 test to fail ~2-5% of the time.

Problem

The test uses /32 prefix for IPv6 addresses instead of the correct /64:

// WRONG ❌
g.Entry("IPv6", podAddressSet{
    A: mustParseIPAndMask("2001:db8::1/32"),  // Should be /64
    B: mustParseIPAndMask("2001:db8::2/32"),
    C: mustParseIPAndMask("2001:db8::3/32"),
}),

Root Cause

IPv6 /32 means "regional ISP allocation" (4.3 billion /64 subnets)
IPv6 /64 means "standard LAN subnet" (18 quintillion addresses)

With /32, the kernel believes the entire 2001:db8::/32 block is local, which confuses routing and prevents L2 adjacency detection. Pods cannot discover each other via NDP, so macvlan connectivity fails immediately.

The IPv4 test correctly uses /24 (LAN subnet) and has 100% pass rate.

Impact

Sippy data (release 5.0):

IPv6 test: 97.95% pass (3 failures / 146 runs)
IPv4 test: 100% pass (0 failures / 142 runs)

This is NOT a product bug — all components (Multus, Whereabouts, MultiNetworkPolicy, macvlan) work correctly. Only the test code is broken.

Fix

// CORRECT ✅
g.Entry("IPv6", podAddressSet{
    // Use /64 (standard IPv6 LAN subnet) - NOT /32 (regional allocation)
    // All three pods must be in the same L2 subnet for macvlan connectivity
    // Matches IPv4 pattern: /24 subnet contains multiple hosts
    A: mustParseIPAndMask("2001:db8::1/64"),
    B: mustParseIPAndMask("2001:db8::2/64"),
    C: mustParseIPAndMask("2001:db8::3/64"),
}),

The MultiNetworkPolicy IPv6 test has been failing ~2-5% of the time since introduction in May 2023 due to incorrect IPv6 prefix length. IPv6 addresses use /32 (regional allocation size) instead of /64 (standard LAN subnet). This causes L2 adjacency to fail, preventing pod-to-pod communication over the macvlan secondary network. Root cause: - With /32: Kernel believes entire 2001:db8::/32 block is local - Routing gets confused about L2 adjacency - No Neighbor Discovery Protocol (NDP) attempted - Connection fails immediately (0 ms timeout) With /64 (this fix): - All pods in same 2001:db8::/64 subnet - NDP resolves MAC addresses - Direct macvlan L2 communication succeeds - Test proceeds to policy enforcement validation The IPv4 variant uses correct /24 prefix and has 100% pass rate. Sippy data (release 5.0): - IPv6 test: 97.95% pass (3 failures / 146 runs) - IPv4 test: 100% pass (0 failures / 142 runs) References: - Original PR (introduced bug): openshift#27795 - Restoration PR (restored with bug): openshift#27927 - Jira: OCPBUGS-6917, OCPBUGS-13788 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

openshift-merge-bot · 2026-07-21T18:25:18Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

coderabbitai · 2026-07-21T18:25:46Z

Walkthrough

The IPv6 multinetpolicy test now assigns /64 masks to pods A, B, and C and documents that the pods must share an L2 subnet for macvlan connectivity.

Changes

IPv6 Multinetpolicy Test Inputs

Layer / File(s)	Summary
Update IPv6 test subnet configuration `test/extended/networking/multinetpolicy.go`	IPv6 pod test addresses use `/64` masks, with comments documenting the expected LAN subnet and shared macvlan L2 requirement.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR only changes IPv6 CIDR inputs/comments; the Ginkgo DescribeTable entries are static and contain no dynamic values.
Test Structure And Quality	✅ Passed	PASS: The PR only changes IPv6 CIDRs/comments; it doesn’t add new setup/cleanup, timeout, or assertion-pattern regressions, and existing Eventually calls are bounded.
Microshift Test Compatibility	✅ Passed	No new Ginkgo tests were added; the existing Describe is tagged [apigroup:operator.openshift.io], so MicroShift CI skips it.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The test pins all pods to one schedulable node and only requires len(nodes)>0, so it doesn’t assume multiple nodes or HA.
Topology-Aware Scheduling Compatibility	✅ Passed	Only IPv6 test CIDRs/comments changed in a test file; no scheduling, affinity, topology, or node-selector logic was added.
Ote Binary Stdout Contract	✅ Passed	The PR only changes IPv6 test CIDRs and comments in a Ginkgo test file; no new process-level stdout writes or logging were added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new IPv4-only or external-connectivity assumptions were introduced; the test remains cluster-internal and already brackets IPv6 hosts correctly.
No-Weak-Crypto	✅ Passed	The touched test file only changes IPv6 CIDR literals/comments; no weak-crypto, custom-crypto, or secret-comparison code is present.
Container-Privileges	✅ Passed	PR only changes IPv6 test CIDRs in a Go test; the touched file and diff contain no privileged, hostPID/Network/IPC, SYS_ADMIN, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	The only changes are IPv6 test CIDR fixes and explanatory comments; no passwords, tokens, PII, hostnames, or customer data appear in logs or added output.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: fixing the IPv6 prefix in the MultiNetworkPolicy test from /32 to /64.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci · 2026-07-21T18:26:13Z

@weliang1: The label(s) /label sig-network, /label backport-risk-low cannot be applied. These labels are supported: acknowledge-critical-fixes-only, platform/aws, platform/azure, platform/baremetal, platform/google, platform/libvirt, platform/openstack, ga, tide/merge-method-merge, tide/merge-method-rebase, tide/merge-method-squash, px-approved, docs-approved, qe-approved, ux-approved, no-qe, rebase/manual, cluster-config-api-changed, run-integration-tests, verified, ready-for-human-review, approved, backport-risk-assessed, bugzilla/valid-bug, cherry-pick-approved, jira/skip-dependent-bug-check, jira/valid-bug, ok-to-test, stability-fix-approved, staff-eng-approved. Is this label configured under labels -> additional_labels or labels -> restricted_labels in plugin.yaml?

Details

In response to this:

Summary

Fixes a 3-year-old test bug causing the MultiNetworkPolicy IPv6 test to fail ~2-5% of the time.

Problem

The test uses /32 prefix for IPv6 addresses instead of the correct /64:
// WRONG ❌
g.Entry("IPv6", podAddressSet{
   A: mustParseIPAndMask("2001:db8::1/32"),  // Should be /64
   B: mustParseIPAndMask("2001:db8::2/32"),
   C: mustParseIPAndMask("2001:db8::3/32"),
}),
Root Cause

IPv6 /32 means "regional ISP allocation" (4.3 billion /64 subnets)

IPv6 /64 means "standard LAN subnet" (18 quintillion addresses)

With /32, the kernel believes the entire 2001:db8::/32 block is local, which confuses routing and prevents L2 adjacency detection. Pods cannot discover each other via NDP, so macvlan connectivity fails immediately.

The IPv4 test correctly uses /24 (LAN subnet) and has 100% pass rate.

Impact

Sippy data (release 5.0):

IPv6 test: 97.95% pass (3 failures / 146 runs)

IPv4 test: 100% pass (0 failures / 142 runs)

This is NOT a product bug — all components (Multus, Whereabouts, MultiNetworkPolicy, macvlan) work correctly. Only the test code is broken.

Fix
// CORRECT ✅
g.Entry("IPv6", podAddressSet{
   // Use /64 (standard IPv6 LAN subnet) - NOT /32 (regional allocation)
   // All three pods must be in the same L2 subnet for macvlan connectivity
   // Matches IPv4 pattern: /24 subnet contains multiple hosts
   A: mustParseIPAndMask("2001:db8::1/64"),
   B: mustParseIPAndMask("2001:db8::2/64"),
   C: mustParseIPAndMask("2001:db8::3/64"),
}),
Expected Result

After this fix, the IPv6 test should achieve 100% pass rate matching the IPv4 variant.

References

Original PR (introduced bug): test/extended: Add MultiNetworkPolicy IPv4/IPv6 test cases #27795 (@zeeke, May 17, 2023)

Revert PR: Revert "test/extended: Add MultiNetworkPolicy IPv4/IPv6 test cases" #27926 (May 18, 2023)

Restoration PR (restored with bug): OCPBUGS-13788: 2x Revert "test/extended: Add MultiNetworkPolicy IPv4/IPv6 test cases" #27926 #27927 (May 26, 2023)

Jira: OCPBUGS-6917, OCPBUGS-13788

Failed job: https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn-rhcos9-techpreview-serial-2of3/2069678942259777536

Test Plan

Local verification: Change compiles

CI verification: Should see 100% pass rate in subsequent runs

/assign @zeeke
/cc @dcbw @pperiyasamy

/label sig-network
/label backport-risk-low

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2026-07-21T18:26:46Z

@weliang1: GitHub didn't allow me to request PR reviews from the following users: dcbw.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

Summary

Fixes a 3-year-old test bug causing the MultiNetworkPolicy IPv6 test to fail ~2-5% of the time.

Problem

The test uses /32 prefix for IPv6 addresses instead of the correct /64:
// WRONG ❌
g.Entry("IPv6", podAddressSet{
   A: mustParseIPAndMask("2001:db8::1/32"),  // Should be /64
   B: mustParseIPAndMask("2001:db8::2/32"),
   C: mustParseIPAndMask("2001:db8::3/32"),
}),
Root Cause

IPv6 /32 means "regional ISP allocation" (4.3 billion /64 subnets)

IPv6 /64 means "standard LAN subnet" (18 quintillion addresses)

With /32, the kernel believes the entire 2001:db8::/32 block is local, which confuses routing and prevents L2 adjacency detection. Pods cannot discover each other via NDP, so macvlan connectivity fails immediately.

The IPv4 test correctly uses /24 (LAN subnet) and has 100% pass rate.

Impact

Sippy data (release 5.0):

IPv6 test: 97.95% pass (3 failures / 146 runs)

IPv4 test: 100% pass (0 failures / 142 runs)

This is NOT a product bug — all components (Multus, Whereabouts, MultiNetworkPolicy, macvlan) work correctly. Only the test code is broken.

Fix
// CORRECT ✅
g.Entry("IPv6", podAddressSet{
   // Use /64 (standard IPv6 LAN subnet) - NOT /32 (regional allocation)
   // All three pods must be in the same L2 subnet for macvlan connectivity
   // Matches IPv4 pattern: /24 subnet contains multiple hosts
   A: mustParseIPAndMask("2001:db8::1/64"),
   B: mustParseIPAndMask("2001:db8::2/64"),
   C: mustParseIPAndMask("2001:db8::3/64"),
}),
Expected Result

After this fix, the IPv6 test should achieve 100% pass rate matching the IPv4 variant.

References

Original PR (introduced bug): test/extended: Add MultiNetworkPolicy IPv4/IPv6 test cases #27795 (@zeeke, May 17, 2023)

Revert PR: Revert "test/extended: Add MultiNetworkPolicy IPv4/IPv6 test cases" #27926 (May 18, 2023)

Restoration PR (restored with bug): OCPBUGS-13788: 2x Revert "test/extended: Add MultiNetworkPolicy IPv4/IPv6 test cases" #27926 #27927 (May 26, 2023)

Jira: OCPBUGS-6917, OCPBUGS-13788

Failed job: https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn-rhcos9-techpreview-serial-2of3/2069678942259777536

Test Plan

Local verification: Change compiles

CI verification: Should see 100% pass rate in subsequent runs

/assign @zeeke
/cc @dcbw @pperiyasamy

/label sig-network
/label backport-risk-low

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci-robot · 2026-07-21T18:30:50Z

@weliang1: This pull request references Jira Issue OCPBUGS-85529, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.0.0) matches configured target version for branch (5.0.0)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

Fixes a 3-year-old test bug causing the MultiNetworkPolicy IPv6 test to fail ~2-5% of the time.

Problem

The test uses /32 prefix for IPv6 addresses instead of the correct /64:
// WRONG ❌
g.Entry("IPv6", podAddressSet{
   A: mustParseIPAndMask("2001:db8::1/32"),  // Should be /64
   B: mustParseIPAndMask("2001:db8::2/32"),
   C: mustParseIPAndMask("2001:db8::3/32"),
}),
Root Cause

IPv6 /32 means "regional ISP allocation" (4.3 billion /64 subnets)

IPv6 /64 means "standard LAN subnet" (18 quintillion addresses)

With /32, the kernel believes the entire 2001:db8::/32 block is local, which confuses routing and prevents L2 adjacency detection. Pods cannot discover each other via NDP, so macvlan connectivity fails immediately.

The IPv4 test correctly uses /24 (LAN subnet) and has 100% pass rate.

Impact

Sippy data (release 5.0):

IPv6 test: 97.95% pass (3 failures / 146 runs)

IPv4 test: 100% pass (0 failures / 142 runs)

This is NOT a product bug — all components (Multus, Whereabouts, MultiNetworkPolicy, macvlan) work correctly. Only the test code is broken.

Fix
// CORRECT ✅
g.Entry("IPv6", podAddressSet{
   // Use /64 (standard IPv6 LAN subnet) - NOT /32 (regional allocation)
   // All three pods must be in the same L2 subnet for macvlan connectivity
   // Matches IPv4 pattern: /24 subnet contains multiple hosts
   A: mustParseIPAndMask("2001:db8::1/64"),
   B: mustParseIPAndMask("2001:db8::2/64"),
   C: mustParseIPAndMask("2001:db8::3/64"),
}),

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-merge-bot · 2026-07-21T19:24:21Z

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

weliang1 · 2026-07-21T20:50:50Z

pre merge test passed.
/verified by @weliang1

openshift-ci-robot · 2026-07-21T20:51:04Z

@weliang1: This PR has been marked as verified by @weliang1.

Details

In response to this:

pre merge test passed.
/verified by @weliang1

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-trt · 2026-07-21T23:49:41Z

Risk analysis has seen new tests most likely introduced by this PR.
Please ensure that new tests meet guidelines for naming and stability.

New tests seen in this PR at sha: 292b6a5

"Find the input image ocp-5.0-upi-installer and tag it into the pipeline" [Total: 2, Pass: 2, Fail: 0, Flake: 0]

zeeke · 2026-07-22T08:51:51Z

/lgtm

openshift-ci · 2026-07-22T08:53:36Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: weliang1, zeeke
Once this PR has been reviewed and has the lgtm label, please assign danwinship for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

test/extended/networking/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

weliang1 · 2026-07-22T13:45:08Z

/retest-required

danwinship · 2026-07-22T14:14:13Z

-			C: mustParseIPAndMask("2001:db8::3/32"),
+			// Use /64 (standard IPv6 LAN subnet) - NOT /32 (regional allocation)
+			// All three pods must be in the same L2 subnet for macvlan connectivity
+			// Matches IPv4 pattern: /24 subnet contains multiple hosts


Someone reading this comment in the future is not going to understand why it says "NOT /32", so the comment becomes more confusing than helpful.

I'm not sure a comment is really helpful here. IPv6 subnets should basically always be /64, but if someone just copies the code from this test case then they'll get that automatically, and if they don't copy the code from this test case then they probably won't see any comment here...

// All three pods must be in the same L2 subnet for macvlan connectivity

That comment applies to the IPv4 test case too, so it should go before line 103. Except, it would be better to just redo the test so you can't screw that up... have just g.Entry("192.0.2.0/24", "2001:db8::/64") and then create pod IPs 1, 2, and 3 based on those subnets?

openshift-ci · 2026-07-22T17:54:30Z

@weliang1: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-vsphere-ovn-upi	`292b6a5`	link	true	`/test e2e-vsphere-ovn-upi`
ci/prow/e2e-gcp-ovn	`292b6a5`	link	true	`/test e2e-gcp-ovn`
ci/prow/e2e-vsphere-ovn	`292b6a5`	link	true	`/test e2e-vsphere-ovn`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci Bot assigned zeeke Jul 21, 2026

openshift-ci Bot requested a review from pperiyasamy July 21, 2026 18:26

coderabbitai Bot approved these changes Jul 21, 2026

View reviewed changes

openshift-ci Bot added the ready-for-human-review Indicates a PR has been reviewed by automated tools and is ready for human review label Jul 21, 2026

weliang1 changed the title ~~Fix IPv6 prefix in MultiNetworkPolicy test (/32 → /64)~~ OCPBUGS-85529:Fix IPv6 prefix in MultiNetworkPolicy test (/32 → /64) Jul 21, 2026

openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. labels Jul 21, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Jul 21, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 22, 2026

danwinship reviewed Jul 22, 2026

View reviewed changes

Uh oh!

Conversation

weliang1 commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Problem

Root Cause

Impact

Fix

Uh oh!

openshift-merge-bot Bot commented Jul 21, 2026

Uh oh!

coderabbitai Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

openshift-ci Bot commented Jul 21, 2026

Summary

Problem

Root Cause

Impact

Fix

Expected Result

References

Test Plan

Uh oh!

openshift-ci Bot commented Jul 21, 2026

Summary

Problem

Root Cause

Impact

Fix

Expected Result

References

Test Plan

Uh oh!

openshift-ci-robot commented Jul 21, 2026

Summary

Problem

Root Cause

Impact

Fix

Uh oh!

openshift-merge-bot Bot commented Jul 21, 2026

Uh oh!

weliang1 commented Jul 21, 2026

Uh oh!

openshift-ci-robot commented Jul 21, 2026

Uh oh!

openshift-trt Bot commented Jul 21, 2026

Uh oh!

zeeke commented Jul 22, 2026

Uh oh!

openshift-ci Bot commented Jul 22, 2026

Uh oh!

weliang1 commented Jul 22, 2026

Uh oh!

danwinship Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Jul 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

weliang1 commented Jul 21, 2026 •

edited

Loading

coderabbitai Bot commented Jul 21, 2026 •

edited

Loading