net: Filter IPv4 on IPv6-only clusters

[azhivovk]

What this PR does / why we need it:

On IPv6-only clusters, VMIs may still report IPv4 addresses due to a cloud-init limitation:

• If DHCPv4 is disabled with no static IPv4 provided, DHCPv4 is still left enabled by cloud-init.
• If DHCPv4 is disabled with a static IPv4 provided, DHCPv4 is kept disabled.

Which issue(s) this PR fixes:

This caused fixture predicates to wait indefinitely (count mismatch) and the IP visibility test to fail (extra IPv4 address in reported set).

This change includes extracting a new cached helper for repeated fetching of cluster IP support and addition of a new helper to strip cluster-unsupported addresses. Apply it in the localnet fixture predicates and in test_vmi_reports_ip_on_secondary_interface_without_vlan.

Filtering rather than blocking preserves test coverage on IPv6-only clusters. Blocking would skip the test entirely, losing the regression guard for CNV-38477. The cloud-init DHCPv4 behavior is a
known infrastructure limitation, not a product bug - filtering the extra IPv4 addresses out is the correct response

Special notes for reviewer:

Targeted for backport to 4.22, the first release to support secondary networks on single-stack IPv6 clusters

jira-ticket: -

Summary by CodeRabbit

• Bug Fixes
  • Improved IP address validation to count and report only IPv4/IPv6 addresses supported by the cluster configuration.
  • Updated local network and bridge interface checks to ignore unsupported IP families when verifying VM interface IPs.
• Tests
  • Adjusted test fixtures and upgrade scenario validations to use the unified cluster-supported IP-family logic.
  • Removed a disabled test marker and refined expected IP-mismatch reporting formatting.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a cluster-aware IP version helper, applies it to upgrade and localnet IP checks, and updates one default-bridge test to filter unsupported addresses before comparing IPs.

Changes

Cluster-supported IP filtering

Layer / File(s)	Summary
Cluster IP filter helper libs/net/cluster.py, libs/net/ip.py	Adds supported_cluster_ip_versions() and filter_cluster_unsupported_addresses, which keep only IP versions enabled by the cluster.
Upgrade fixture IP families tests/conftest.py	Updates upgrade VM fixtures to derive expected IP families from supported_cluster_ip_versions().
Localnet status checks tests/network/localnet/conftest.py	Updates localnet VM status predicates to count IPs after link-local and cluster-unsupported filtering, and to compare against the supported cluster IP-version set.
Default-bridge IP assertion tests/network/localnet/test_default_bridge.py	Updates the default-bridge test to apply cluster-unsupported filtering to both IP lists and removes the JIRA marker.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• RedHatQE/openshift-virtualization-tests#5094: Directly changes the same test_vmi_reports_ip_on_secondary_interface_without_vlan in tests/network/localnet/test_default_bridge.py.
• RedHatQE/openshift-virtualization-tests#5275: Also touches tests/network/localnet/test_default_bridge.py and the same JIRA-marked test setup.
• RedHatQE/openshift-virtualization-tests#5306: Also updates tests/conftest.py upgrade fixtures to respect the cluster IP stack when validating VM interface IPs.

Suggested reviewers: dshchedr, rnetser, yossisegev, servolkov, hmeir

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stp Link Required	✅ Passed	No new test files or added test functions appear in the diff; only existing tests were modified, so link requirements don’t apply.
Title check	✅ Passed	It clearly states the main change and stays within the 120-character limit.
Description check	✅ Passed	All required sections are present and the PR purpose, issue context, and reviewer notes are clear; only jira-ticket is underspecified.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Review ran into problems

🔥 Problems

Linked repositories: Couldn't analyze RedHatQE/openshift-virtualization-tests-design-docs - clone failed: 2 UNKNOWN:

<title>500 Server Error</title>

Error: Server Error

The server encountered an error and could not complete your request.

Please try again in 30 seconds.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-virtualization-qe-bot-6]

Report bugs in Issues

Welcome! 🎉

This pull request will be automatically processed with the following features:

🔄 Automatic Actions

• Reviewer Assignment: Reviewers are automatically assigned based on the OWNERS file in the repository root
• Size Labeling: PR size labels (XS, S, M, L, XL, XXL) are automatically applied based on changes
• Issue Creation: A tracking issue is created for this PR and will be closed when the PR is merged or closed
• Branch Labeling: Branch-specific labels are applied to track the target branch
• Auto-verification: Auto-verified users have their PRs automatically marked as verified
• Labels: Enabled categories: branch, can-be-merged, cherry-pick, has-conflicts, hold, needs-rebase, size, verified, wip

📋 Available Commands

PR Status Management

• /wip - Mark PR as work in progress (adds WIP: prefix to title)
• /wip cancel - Remove work in progress status
• /hold - Block PR merging (approvers only)
• /hold cancel - Unblock PR merging
• /verified - Mark PR as verified
• /verified cancel - Remove verification status
• /reprocess - Trigger complete PR workflow reprocessing (useful if webhook failed or configuration changed)
• /regenerate-welcome - Regenerate this welcome message
• /security-override - Set security check runs to pass (maintainers only)
• /security-override cancel - Re-run security checks

Review & Approval

• /lgtm - Approve changes (looks good to me)
• /approve - Approve PR (approvers only)
• /assign-reviewers - Assign reviewers based on OWNERS file
• /assign-reviewer @username - Assign specific reviewer
• /check-can-merge - Check if PR meets merge requirements

Testing & Validation

• /retest tox - Run Python test suite with tox
• /retest build-container - Rebuild and test container image
• /retest verify-bugs-are-open - verify-bugs-are-open
• /retest all - Run all available tests

Container Operations

• /build-and-push-container - Build and push container image (tagged with PR number)
  • Supports additional build arguments: /build-and-push-container --build-arg KEY=value

Cherry-pick Operations

• /cherry-pick <branch> - Schedule cherry-pick to target branch when PR is merged
  • Multiple branches: /cherry-pick branch1 branch2 branch3
• /cherry-pick-retry <branch> - Retry a failed cherry-pick (merged PRs only)

Branch Management

• /rebase - Rebase this PR branch onto its base branch

Label Management

• /<label-name> - Add a label to the PR
• /<label-name> cancel - Remove a label from the PR

✅ Merge Requirements

This PR will be automatically approved when the following conditions are met:

1. Approval: /approve from at least one approver
2. LGTM Count: Minimum 2 /lgtm from reviewers
3. Status Checks: All required status checks must pass
4. No Blockers: No wip, hold, has-conflicts labels and PR must be mergeable (no conflicts)
5. Verified: PR must be marked as verified

📊 Review Process

Approvers and Reviewers

Approvers:

• EdDev
• dshchedr
• myakove
• rnetser
• vsibirsk

Reviewers:

• Anatw
• EdDev
• RoniKishner
• azhivovk
• dshchedr
• frenzyfriday
• nirdothan
• orelmisan
• rnetser
• servolkov
• vsibirsk
• yossisegev

Available Labels

• hold
• verified
• wip
• lgtm
• approve

AI Features

• Cherry-Pick Conflict Resolution: Enabled (claude/claude-opus-4-6-1m)

Security Checks

• Suspicious Path Detection: Monitors paths: .claude/, .vscode/, .cursor/, .devcontainer/, .pi/, .github/workflows/, .github/actions/
• Committer Identity Check: Verifies last committer matches PR author
• Mandatory: Security checks block merge (use /security-override to bypass — maintainers only)

💡 Tips

• WIP Status: Use /wip when your PR is not ready for review
• Verification: The verified label is removed on new commits unless the push is detected as a clean rebase
• Cherry-picking: Cherry-pick labels are processed when the PR is merged
• Container Builds: Container images are automatically tagged with the PR number
• Permission Levels: Some commands require approver permissions
• Auto-verified Users: Certain users have automatic verification and merge privileges

📌 Additional Information

Custom Commands:

• /test-plan — Triggers CodeRabbit to analyze the PR's changed files and post a test execution plan
• /rerun-smoke — Adds retest-smoke label on the PR to trigger smoke tests execution

For more information, please refer to the project documentation or contact the maintainers.

[OhadRevah]

/lgtm

[yossisegev]

Thank you Asia

[EdDev]

Nice, thanks.

See inline comments.

[servolkov]

1. @azhivovk I think the description is outdated, I don't see filter_cluster_usable_addresses() helper.
2. don't you forget to fix running_vm_upgrade_a (maybe smth else)? or we don't need to update those fixtures?

[azhivovk]

@servolkov
Edited the description, thanks

upgrade VMs were refactored accordingly in the first commit 20456ef

[azhivovk]

/verified
Dual-stack BM with cnv-4.23:
uv run pytest --verbose --jira -rs -s -o log_cli=true --leftovers-collector --tb=native --skip-deprecated-api-test --cluster-sanity-skip-storage-check -m cnv_upgrade --upgrade cnv --cnv-version 4.23.0 --cnv-image 4.23.0 tests/network/upgrade/test_upgrade_network.py -p no:pytest_dependency tests/network/localnet/
Result: 10 passed, 23 deselected, 2 warnings, 4 subtests passed in 646.10s (0:10:46)

Single-stack IPv6 BM with cnv-4.23:
uv run pytest --verbose -rs -s -o log_cli=true --leftovers-collector --tb=native --skip-deprecated-api-test --cluster-sanity-skip-storage-check tests/network/localnet/ -m "ipv6 and not ipv4"
Result: 6 passed, 17 deselected, 42 warnings in 586.90s (0:09:46)

[openshift-virtualization-qe-bot-3]

@coderabbitai

Test execution plan request details

CRITICAL: You MUST post an inline review comment on the first changed line of the first file.
The inline comment should contain the full Test Execution Plan (smoke decision, gating decision, and specific affected tests).
Do NOT submit a blocking review event (REQUEST_CHANGES/APPROVE).
Post a single inline PR comment on Files Changed (non-blocking COMMENT flow).

As an expert software testing engineer, analyze all modified files in this PR and create a targeted test execution plan.
You will post an inline review comment with the test execution plan on the first changed file.
If you fail to run or post a comment, retry.

Analysis Requirements:

1. Examine code changes in each modified file

2. Identify affected code paths, functions, and classes

3. Analyze pytest-specific elements: fixtures (scope, dependencies), parametrization, markers, conftest changes

4. Trace test dependencies through imports, shared utilities, fixture inheritance, fixture teardown, and yield from cleanup in conftest

5. Detect new tests introduced in the PR

6. Utilities and libs impact (when utilities/ or libs/ changes):
   You MUST use shell scripts (rg, git diff) to trace the full impact.
   Follow these sub-steps in order:

   6a. Identify modified symbols: For each changed file under utilities/ or libs/,
   list every modified function or method.
   Example: git diff HEAD~1 --unified=0 -- utilities/hco.py | grep '^[+-]def '

   6b. Find direct callers: Search tests and conftest for each symbol from 6a.
   Example: rg -l 'get_hco_version' tests/

   6c. Trace fixture teardown and cleanup: Find fixtures that reach
   the modified symbol through yield from or context-manager wrappers.
   Example: rg -l 'yield from.*enable_common_boot|def.*enable_common_boot' tests/

   6d. Trace same-file callers: In each changed file, find other functions
   whose body calls a modified symbol (including code after yield
   in @contextmanager helpers).
   Example: rg 'get_hco_version|enable_common_boot' utilities/hco.py

   6e. Expand transitively: If function A calls modified B, then
   tests/fixtures that call A are affected — even when the test body
   never imports B directly.

   Do NOT limit impact to tests that import the modified symbol only.

7. Smoke test impact: Intersect the affected set from step 6 with smoke-marked tests.
   Run: rg -l '@pytest.mark.smoke' tests/
   VERIFY the above command returned actual file paths before concluding False.
   Set True if either condition is met:

   • a smoke-marked file appears in the affected set from 6b-6e, OR
   • any conftest.py in the smoke test's parent-directory hierarchy (up to repo root)
     imports or calls a modified utilities/libs symbol — including autouse fixtures
     that depend on modified functions. ALL tests in that directory and below are affected.
     Example check: for each smoke_file, scan dirname(smoke_file)/conftest.py,
     dirname(dirname(smoke_file))/conftest.py, etc. for modified symbol imports
     and autouse fixtures that depend on modified symbols.

8. Gating test impact: Intersect the affected set from step 6 with gating-marked tests.
   Run: rg -l '@pytest.mark.gating' tests/
   Set True if a gating-marked file also appears in the affected set from 6b-6e.
   Utilities/libs changes often affect gating tests without affecting smoke tests.
   Do NOT stop analysis after concluding Run smoke tests: False.

Output rules:
Do NOT include analysis step numbers (1-8) in your visible output.

Your deliverable:
Your inline informational comment will be based on the following requirements:

Test Execution Plan

• Run smoke tests: True / False — If True, state the dependency path (test → fixture → changed symbol). True ONLY with a verified path.
• Run gating tests: True / False — If True, state the dependency path. True if any gating-marked test is in the affected set.
• Affected tests to run (required when utilities/, libs/, or shared conftest changes — list concrete paths even when smoke is False)

Use these formats:

• path/to/test_file.py - When the entire test file needs verification
• path/to/test_file.py::TestClass::test_method - When specific test(s) needed
• path/to/test_file.py::test_function - When specific test(s) needed
• -m marker - When a marker covers multiple affected tests (e.g. -m gating only if ALL gating tests in scope need run)
• Tag each listed test or group with its marker when not obvious, e.g. (gating) or (smoke)

Real test commands (MANDATORY when changes affect session/runtime code):

When the affected code runs at session/collection time (conftest fixtures, pytest plugins,
config hooks, session-scoped setup) or modifies runtime behavior that unit tests mock away,
you MUST include concrete pytest commands the PR author must run on a real cluster
to verify the change works end-to-end. Include:

• A command for the error/fix path (the scenario the PR fixes)
• A command for the happy path (regression: the normal case still works)
• Use lightweight tests (e.g., --collect-only for startup failures,
  a single small test for runtime behavior)
  If the PR only changes test logic (not utilities/libs/conftest), the affected test
  paths themselves serve as the real test commands — no separate section needed.

Example output for a session-startup fix:

**Real tests (cluster required)**
Error path (the fix):
`pytest tests/storage/.../test_foo.py --storage-class-matrix=nonexistent-sc --collect-only`
Expected: ValueError with clear message, not IndexError

Happy path (regression):
`pytest tests/storage/.../test_foo.py --storage-class-matrix=<valid-sc> -k test_bar`
Expected: session starts normally

Guidelines:

• Include tests affected directly OR via fixture setup/teardown, yield from cleanup, or transitive utility call chains (caller calls modified helper)
• Use a full file path only if ALL tests in that file require verification
• Use file path + test name when only specific tests use an affected fixture or utility wrapper (preferred for partial file impact)
• If a test marker can cover multiple files/tests, provide the marker
• Balance coverage vs over-testing - Keep descriptions minimal
• Example: if leaf helper foo() changes, include tests whose fixture teardown calls wrapper bar() where bar() calls foo(), even when the test body only imports an unrelated symbol from the same utilities module

Hardware-Related Checks (SR-IOV, GPU, DPDK):

When PR modifies fixtures for hardware-specific resources:

• Collection Safety: Fixtures MUST have existence checks (return None when hardware unavailable)
• Test Plan: MUST verify both WITH and WITHOUT hardware:
  • Run affected tests on cluster WITH hardware
  • Verify collection succeeds on cluster WITHOUT hardware

CRITICAL WORKFLOW COMPLETION RULES:

When responding to this test execution plan request, you MUST follow these rules EXACTLY:

1. YOUR ONLY DELIVERABLE: Post one non-blocking inline comment containing the test execution plan on the first changed line
2. THEN STOP IMMEDIATELY - Do NOT generate any additional response
3. FALLBACK ONLY: If inline comment API calls fail after retrying, post as a regular PR comment
4. SILENCE = SUCCESS: After successfully submitting the review, your task is complete. No confirmation needed.

ABSOLUTE PROHIBITIONS (violating these creates empty/meaningless reviews):

• ❌ Do NOT post acknowledgment messages like "Test execution plan posted", "Review posted successfully", "I've successfully posted"
• ❌ Do NOT mention review IDs, URLs, or confirmation of posting in the PR thread
• ❌ Do NOT add any follow-up comments after submitting the review
• ❌ Do NOT reply to confirm task completion
• ❌ Do NOT explain what you did - just do it and stop

Remember: The pull request review is visible to users. Additional comments are redundant noise.

CRITICAL — Verification rules for smoke and gating decisions:
- For each True decision, you must have traced a concrete path: test file → fixture → utility function → modified symbol.
- Do NOT assume impact based on scope, file proximity, or infrastructure-sounding names.
Only set True when you trace a concrete path through steps 6a-6e, then 7 or 8.
WRONG: "utilities/hco.py changed → run smoke" (no traced dependency path)
WRONG: "Run smoke tests: False" with no affected-test list when gating tests use the changed utility
RIGHT: "Run smoke tests: False, Run gating tests: True" plus tests/.../test_foo.py::TestBar::test_baz (gating)
RIGHT: "Smoke test X uses fixture Y → wrapper Z → changed function W in utilities/hco.py"

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -e
echo "=== git diff stat ==="
git diff origin/main...HEAD --stat 2>/dev/null || true
echo "=== ip.py content ==="
cat -n libs/net/ip.py | sed -n '1,80p'
echo "=== cluster.py content ==="
cat -n libs/net/cluster.py
echo "=== conftest.py (localnet) ==="
cat -n tests/network/localnet/conftest.py
echo "=== test_default_bridge.py ==="
cat -n tests/network/localnet/test_default_bridge.py
echo "=== root conftest relevant section ==="
rg -n "supported_cluster_ip_versions|ipv4_supported_cluster|ipv6_supported_cluster" tests/conftest.py

Length of output: 2568

---

🏁 Script executed:

#!/bin/bash
set -e
echo "=== ip.py content ==="
cat -n libs/net/ip.py | sed -n '1,80p'
echo "=== cluster.py content ==="
cat -n libs/net/cluster.py
echo "=== conftest.py (localnet) ==="
cat -n tests/network/localnet/conftest.py
echo "=== test_default_bridge.py ==="
cat -n tests/network/localnet/test_default_bridge.py
echo "=== root conftest relevant section ==="
rg -n "supported_cluster_ip_versions|ipv4_supported_cluster|ipv6_supported_cluster" tests/conftest.py

Length of output: 2484

---

@openshift-virtualization-qe-bot-3, I'm unable to complete the requested inline test-execution-plan comment for two reasons:

1. Repository access failure: Two consecutive clone attempts for RedHatQE/openshift-virtualization-tests failed with Invalid username or token. Password authentication is not supported for Git operations. This blocks the mandated rg/git diff tracing steps (6a–8) needed to verify smoke/gating impact with a concrete dependency path, so I cannot responsibly assert True for either without fabricating a path.
2. No inline-comment capability: My available capabilities in this context are limited to shell, web_search, external_tools, and coderabbit_configuration. I don't have a capability to post a standalone inline review comment independent of a full review pass, so this response is posted as a regular PR comment instead (per the stated fallback rule).

Best-effort plan based on available PR summary context (unverified against live repo):

• Run smoke tests: Unknown — could not verify via rg -l '@pytest.mark.smoke' due to clone failure.
• Run gating tests: Unknown — could not verify via rg -l '@pytest.mark.gating' due to clone failure.
• Affected tests to run (based on files touched per the AI-generated summary):
  • tests/network/localnet/conftest.py — fixtures localnet_running_vms, ovs_bridge_localnet_running_vms now use supported_cluster_ip_versions() + filter_cluster_unsupported_addresses().
  • tests/network/localnet/test_default_bridge.py::test_vmi_reports_ip_on_secondary_interface_without_vlan
  • tests/conftest.py — fixtures running_vm_upgrade_a, running_vm_upgrade_b (used by tests/network/upgrade/test_upgrade_network.py, per author's confirmation in the thread).
  • libs/net/ip.py::filter_cluster_unsupported_addresses and libs/net/cluster.py::supported_cluster_ip_versions are new/changed symbols — any other test under tests/network/ importing these should be re-checked once repo access is restored.

Note: the author (azhivovk) already ran manual verification on dual-stack and IPv6-only clusters (see their /verified comment), covering tests/network/localnet/ and tests/network/upgrade/test_upgrade_network.py, which aligns with the affected-tests list above.

Once repository access is restored, please re-trigger /test-plan so I can run the full rg/git diff tracing and post a verified smoke/gating decision.

[EdDev]

Thanks.

/approve

[azhivovk]

/check-can-merge

[rnetser]

/approve

[openshift-virtualization-qe-bot-5]

New container for quay.io/openshift-cnv/openshift-virtualization-tests:latest published

[azhivovk]

/cherry-pick cnv-4.22

[openshift-virtualization-qe-bot]

Cherry-pick conflicts were resolved by AI

Cherry-picked PR net: Filter IPv4 on IPv6-only clusters into cnv-4.22: #5596
Conflicts were automatically resolved by AI (claude/claude-opus-4-6-1m).

@azhivovk Manual verification is required — please review the changes and test before merging.