Install iptables-nft in Rocky 9 containers

There was a regression in 2025.1 where we switched back to using
iptables-legacy. Explicitly installing iptables-nft restores the
old behaviour.

Closes-Bug: #2144562
Change-Id: I2bba43407a10edb283d8605d579667cb8d8e3126
Signed-off-by: Will Szumski <will@stackhpc.com>

docker/neutron/neutron-base/Dockerfile.j2

@@ -7,11 +7,15 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 
 {% import "macros.j2" as macros with context %}
 
-{{ macros.enable_extra_repos(['docker-ce', 'openvswitch']) }}
+{{ macros.enable_extra_repos(['docker-ce', 'openvswitch', 'epel']) }}
 {{ macros.configure_user(name='neutron') }}
 
 {% if base_package_type == 'rpm' %}
 
+    # FIXME(wszumski): iptables-nft is deprecated. We need to advise users
+    # to migrate to some other firewall driver as we cannot rely on this
+    # package forever, see: https://access.redhat.com/solutions/6739041.
+    # iptables-legacy is not available from EPEL 10.
     {% set neutron_base_packages = [
         'conntrack-tools',
         'dnsmasq',
@@ -21,6 +25,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
         'iproute-tc',
         'ipset',
         'iptables',
+        'iptables-nft',
         'iputils',
         'keepalived',
         'net-tools',
@@ -33,9 +38,13 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
             'python3-openvswitch3.5'
         ] %}
     {% else %}
+	# NOTE(wszumski): iptables-legacy lets us check and clear out legacy
+	# iptables rules due to LP#2144562. This package is installed from the
+	# EPEL repository.
         {% set neutron_base_packages = neutron_base_packages + [
             'openvswitch',
-            'python3-openvswitch'
+            'python3-openvswitch',
+            'iptables-legacy',
         ] %}
     {% endif %}
 
@@ -64,6 +73,18 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 
 {{ macros.install_packages(neutron_base_packages | customizable("packages")) }}
 
+{% if base_distro_tag.startswith('9') or base_distro_tag.startswith('stream9') %}
+# NOTE(wszumski): Without this iptables-legacy is selected as default. This
+# increases the priority from 10 to 200.
+RUN update-alternatives --install /usr/sbin/iptables iptables /usr/sbin/iptables-nft 200 \
+  --slave /usr/sbin/ip6tables ip6tables /usr/sbin/ip6tables-nft \
+  --slave /usr/sbin/iptables-restore iptables-restore /usr/sbin/iptables-nft-restore \
+  --slave /usr/sbin/iptables-save iptables-save /usr/sbin/iptables-nft-save \
+  --slave /usr/sbin/ip6tables-restore ip6tables-restore /usr/sbin/ip6tables-nft-restore \
+  --slave /usr/sbin/ip6tables-save ip6tables-save /usr/sbin/ip6tables-nft-save \
+  && update-alternatives --auto iptables
+{% endif %}
+
 ADD neutron-base-archive /neutron-base-source
 ADD plugins-archive /
 

releasenotes/notes/fixes-missing-iptables-nft-fd71eeee04c9345e.yaml

@@ -0,0 +1,37 @@
+upgrade:
+  - |
+    On Rocky9 or CentOS Stream 9 based installations, VMs may be using legacy
+    iptables rules if you installed or upgraded before this release. You can
+    check by running ``iptables-legacy-save`` inside of the
+    ``neutron_openvswitch_agent`` container and looking for neutron rules.
+
+    After upgrading you will need to clear out the old iptables rules to
+    prevent conflicts::
+
+      iptables-legacy -P INPUT ACCEPT
+      iptables-legacy -P FORWARD ACCEPT
+      iptables-legacy -P OUTPUT ACCEPT
+      iptables-legacy -t nat -F
+      iptables-legacy -t nat -X
+      iptables-legacy -t mangle -F
+      iptables-legacy -t mangle -X
+      iptables-legacy -t raw -F
+      iptables-legacy -t raw -X
+      iptables-legacy -t filter -F
+      iptables-legacy -t filter -X
+      iptables-legacy -F
+      iptables-legacy -X
+
+    If you are updating to this release or newer, no action is required.
+
+    For more information, please see
+    `LP#2144562 <https://bugs.launchpad.net/kolla/+bug/2144562>`__.
+
+fixes:
+  - |
+    Fixes an issue where firewall rules were being implemented via legacy
+    iptables rules. This differed from the behaviour in previous releases,
+    where iptables-nft was used to create these as nftables rules. On upgrade,
+    this could lead to mixture of iptables and nftables rules based on whether
+    the VM was booted before or after the upgrade. For more information, please
+    see `LP#2144562 <https://bugs.launchpad.net/kolla/+bug/2144562>`__.