CNF-25757: Disable iptables-alerter in RDS configurations

telco-core/configuration/core-baseline.yaml

@@ -108,6 +108,13 @@ policies:
 
       - path: reference-crs/required/networking/NMState.yaml
 
+      # Iptables-alerter disable configuration
+      - path: reference-crs/required/networking/IptablesAlerterConfig.yaml
+      - path: reference-crs/required/networking/NetworkOperatorRestarterSA.yaml
+      - path: reference-crs/required/networking/NetworkOperatorRestarterRole.yaml
+      - path: reference-crs/required/networking/NetworkOperatorRestarterRoleBinding.yaml
+      - path: reference-crs/required/networking/RestartNetworkOperatorJob.yaml
+
       # Firewall node disruption policy
       - path: reference-crs/optional/networking/firewall/node-disruption-policy.yaml
 

telco-core/configuration/reference-crs-kube-compare/required/networking/IptablesAlerterConfig.yaml

@@ -0,0 +1,10 @@
+# required
+# Disables iptables-alerter to prevent high CPU usage in production (OCPBUGS-87026, OCPBUGS-73767)
+# KCS: https://access.redhat.com/solutions/7134521
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: iptables-alerter-config
+  namespace: openshift-network-operator
+data:
+  enabled: "false"

telco-core/configuration/reference-crs/required/networking/IptablesAlerterConfig.yaml

@@ -0,0 +1,12 @@
+# required
+# Disables iptables-alerter to prevent high CPU usage in production (OCPBUGS-87026, OCPBUGS-73767)
+# Partners must test iptables usage in pre-production and migrate to nftables before RHEL10
+# KCS: https://access.redhat.com/solutions/7134521
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: iptables-alerter-config
+  namespace: openshift-network-operator
+data:
+  enabled: "false"

telco-core/configuration/reference-crs/required/networking/NetworkOperatorRestarterRole.yaml

@@ -0,0 +1,15 @@
+# required
+# Role for network-operator restart Job (OCPBUGS-87026, OCPBUGS-73767)
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: network-operator-restarter
+  namespace: openshift-network-operator
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["list", "delete"]
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get"]

telco-core/configuration/reference-crs/required/networking/NetworkOperatorRestarterRoleBinding.yaml

@@ -0,0 +1,16 @@
+# required
+# RoleBinding for network-operator restart Job (OCPBUGS-87026, OCPBUGS-73767)
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: network-operator-restarter
+  namespace: openshift-network-operator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: network-operator-restarter
+subjects:
+  - kind: ServiceAccount
+    name: network-operator-restarter
+    namespace: openshift-network-operator

telco-core/configuration/reference-crs/required/networking/NetworkOperatorRestarterSA.yaml

@@ -0,0 +1,8 @@
+# required
+# ServiceAccount for network-operator restart Job (OCPBUGS-87026, OCPBUGS-73767)
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: network-operator-restarter
+  namespace: openshift-network-operator

telco-core/configuration/reference-crs/required/networking/RestartNetworkOperatorJob.yaml

@@ -0,0 +1,43 @@
+# required
+# Job to restart network-operator after iptables-alerter-config ConfigMap is created
+# Ensures the network operator picks up the new configuration (OCPBUGS-87026, OCPBUGS-73767)
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: restart-network-operator
+  namespace: openshift-network-operator
+spec:
+  template:
+    spec:
+      serviceAccountName: network-operator-restarter
+      restartPolicy: OnFailure
+      containers:
+        - name: kubectl
+          image: registry.redhat.io/openshift4/ose-cli:latest
+          imagePullPolicy: IfNotPresent
+          command:
+            - /bin/bash
+            - -c
+            - |
+              # Check if iptables-alerter-config ConfigMap exists
+              if ! oc get configmap iptables-alerter-config -n openshift-network-operator &>/dev/null; then
+                echo "ERROR: iptables-alerter-config ConfigMap not found"
+                exit 1
+              fi
+              echo "ConfigMap iptables-alerter-config found"
+
+              # Delete network-operator pod to pick up iptables-alerter-config
+              # Check if pod exists before deleting
+              if oc get pod -n openshift-network-operator -l name=network-operator --no-headers 2>/dev/null | grep -q .; then
+                oc delete pod -n openshift-network-operator -l name=network-operator --ignore-not-found=true
+                echo "Network operator pod deleted successfully"
+              else
+                echo "No network-operator pods found, nothing to delete"
+              fi
+      nodeSelector:
+        node-role.kubernetes.io/master: ""
+      tolerations:
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/master
+          operator: Exists

telco-hub/configuration/kustomization.yaml

@@ -17,6 +17,7 @@ resources:
 
   # mandatory resources not managed by any overlay
   - reference-crs/required/talm/
+  - reference-crs/required/networking/
 
   # include this content if you want to include the argocd
   # configuration and apps for gitops ztp management of cluster

telco-hub/configuration/reference-crs-kube-compare/required/networking/IptablesAlerterConfig.yaml

@@ -0,0 +1,10 @@
+# required
+# Disables iptables-alerter to prevent high CPU usage in production (OCPBUGS-87026, OCPBUGS-73767)
+# KCS: https://access.redhat.com/solutions/7134521
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: iptables-alerter-config
+  namespace: openshift-network-operator
+data:
+  enabled: "false"

telco-hub/configuration/reference-crs/required/networking/IptablesAlerterConfig.yaml

@@ -0,0 +1,12 @@
+# required
+# Disables iptables-alerter to prevent high CPU usage in production (OCPBUGS-87026, OCPBUGS-73767)
+# Partners must test iptables usage in pre-production and migrate to nftables before RHEL10
+# KCS: https://access.redhat.com/solutions/7134521
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: iptables-alerter-config
+  namespace: openshift-network-operator
+data:
+  enabled: "false"

telco-hub/configuration/reference-crs/required/networking/NetworkOperatorRestarterRole.yaml

@@ -0,0 +1,15 @@
+# required
+# Role for network-operator restart Job (OCPBUGS-87026, OCPBUGS-73767)
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: network-operator-restarter
+  namespace: openshift-network-operator
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["list", "delete"]
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get"]

telco-hub/configuration/reference-crs/required/networking/NetworkOperatorRestarterRoleBinding.yaml

@@ -0,0 +1,16 @@
+# required
+# RoleBinding for network-operator restart Job (OCPBUGS-87026, OCPBUGS-73767)
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: network-operator-restarter
+  namespace: openshift-network-operator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: network-operator-restarter
+subjects:
+  - kind: ServiceAccount
+    name: network-operator-restarter
+    namespace: openshift-network-operator

telco-hub/configuration/reference-crs/required/networking/NetworkOperatorRestarterSA.yaml

@@ -0,0 +1,8 @@
+# required
+# ServiceAccount for network-operator restart Job (OCPBUGS-87026, OCPBUGS-73767)
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: network-operator-restarter
+  namespace: openshift-network-operator

telco-hub/configuration/reference-crs/required/networking/RestartNetworkOperatorJob.yaml

@@ -0,0 +1,43 @@
+# required
+# Job to restart network-operator after iptables-alerter-config ConfigMap is created
+# Ensures the network operator picks up the new configuration (OCPBUGS-87026, OCPBUGS-73767)
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: restart-network-operator
+  namespace: openshift-network-operator
+spec:
+  template:
+    spec:
+      serviceAccountName: network-operator-restarter
+      restartPolicy: OnFailure
+      containers:
+        - name: kubectl
+          image: registry.redhat.io/openshift4/ose-cli:latest
+          imagePullPolicy: IfNotPresent
+          command:
+            - /bin/bash
+            - -c
+            - |
+              # Check if iptables-alerter-config ConfigMap exists
+              if ! oc get configmap iptables-alerter-config -n openshift-network-operator &>/dev/null; then
+                echo "ERROR: iptables-alerter-config ConfigMap not found"
+                exit 1
+              fi
+              echo "ConfigMap iptables-alerter-config found"
+
+              # Delete network-operator pod to pick up iptables-alerter-config
+              # Check if pod exists before deleting
+              if oc get pod -n openshift-network-operator -l name=network-operator --no-headers 2>/dev/null | grep -q .; then
+                oc delete pod -n openshift-network-operator -l name=network-operator --ignore-not-found=true
+                echo "Network operator pod deleted successfully"
+              else
+                echo "No network-operator pods found, nothing to delete"
+              fi
+      nodeSelector:
+        node-role.kubernetes.io/master: ""
+      tolerations:
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/master
+          operator: Exists

telco-hub/configuration/reference-crs/required/networking/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - IptablesAlerterConfig.yaml
+  - NetworkOperatorRestarterSA.yaml
+  - NetworkOperatorRestarterRole.yaml
+  - NetworkOperatorRestarterRoleBinding.yaml
+  - RestartNetworkOperatorJob.yaml

telco-ran/configuration/acmpolicygenerator/ran-common.yaml

@@ -31,6 +31,11 @@ policies:
     ran.openshift.io/ztp-deploy-wave: "1"
   manifests:
     - path: source-crs/cluster-tuning/monitoring-configuration/ReduceMonitoringFootprint.yaml
+    - path: source-crs/cluster-tuning/iptables-alerter/IptablesAlerterConfig.yaml
+    - path: source-crs/cluster-tuning/iptables-alerter/NetworkOperatorRestarterSA.yaml
+    - path: source-crs/cluster-tuning/iptables-alerter/NetworkOperatorRestarterRole.yaml
+    - path: source-crs/cluster-tuning/iptables-alerter/NetworkOperatorRestarterRoleBinding.yaml
+    - path: source-crs/cluster-tuning/iptables-alerter/RestartNetworkOperatorJob.yaml
     - path: source-crs/disconnected-registry/DefaultCatsrc.yaml
       patches:
       - metadata:

telco-ran/configuration/kube-compare-reference/cluster-tuning/iptables-alerter/IptablesAlerterConfig.yaml

@@ -0,0 +1,12 @@
+# required
+# Disables iptables-alerter to prevent high CPU usage in production (OCPBUGS-87026, OCPBUGS-73767)
+# KCS: https://access.redhat.com/solutions/7134521
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: iptables-alerter-config
+  namespace: openshift-network-operator
+  annotations:
+    ran.openshift.io/ztp-deploy-wave: "10"
+data:
+  enabled: "false"

telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/IptablesAlerterConfig.yaml

@@ -0,0 +1,14 @@
+# required
+# Disables iptables-alerter to prevent high CPU usage in production (OCPBUGS-87026, OCPBUGS-73767)
+# Partners must test iptables usage in pre-production and migrate to nftables before RHEL10
+# KCS: https://access.redhat.com/solutions/7134521
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: iptables-alerter-config
+  namespace: openshift-network-operator
+  annotations:
+    ran.openshift.io/ztp-deploy-wave: "10"
+data:
+  enabled: "false"

telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/NetworkOperatorRestarterRole.yaml

@@ -0,0 +1,16 @@
+# Role for network-operator restart Job (OCPBUGS-87026, OCPBUGS-73767)
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: network-operator-restarter
+  namespace: openshift-network-operator
+  annotations:
+    ran.openshift.io/ztp-deploy-wave: "10"
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["list", "delete"]
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get"]

telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/NetworkOperatorRestarterRoleBinding.yaml

@@ -0,0 +1,17 @@
+# RoleBinding for network-operator restart Job (OCPBUGS-87026, OCPBUGS-73767)
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: network-operator-restarter
+  namespace: openshift-network-operator
+  annotations:
+    ran.openshift.io/ztp-deploy-wave: "10"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: network-operator-restarter
+subjects:
+  - kind: ServiceAccount
+    name: network-operator-restarter
+    namespace: openshift-network-operator

telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/NetworkOperatorRestarterSA.yaml

@@ -0,0 +1,9 @@
+# ServiceAccount for network-operator restart Job (OCPBUGS-87026, OCPBUGS-73767)
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: network-operator-restarter
+  namespace: openshift-network-operator
+  annotations:
+    ran.openshift.io/ztp-deploy-wave: "10"

telco-ran/configuration/source-crs/cluster-tuning/iptables-alerter/RestartNetworkOperatorJob.yaml

@@ -0,0 +1,44 @@
+# Job to restart network-operator after iptables-alerter-config ConfigMap is created
+# Ensures the network operator picks up the new configuration (OCPBUGS-87026, OCPBUGS-73767)
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: restart-network-operator
+  namespace: openshift-network-operator
+  annotations:
+    ran.openshift.io/ztp-deploy-wave: "100"
+spec:
+  template:
+    spec:
+      serviceAccountName: network-operator-restarter
+      restartPolicy: OnFailure
+      containers:
+        - name: kubectl
+          image: registry.redhat.io/openshift4/ose-cli:latest
+          imagePullPolicy: IfNotPresent
+          command:
+            - /bin/bash
+            - -c
+            - |
+              # Check if iptables-alerter-config ConfigMap exists
+              if ! oc get configmap iptables-alerter-config -n openshift-network-operator &>/dev/null; then
+                echo "ERROR: iptables-alerter-config ConfigMap not found"
+                exit 1
+              fi
+              echo "ConfigMap iptables-alerter-config found"
+
+              # Delete network-operator pod to pick up iptables-alerter-config
+              # Check if pod exists before deleting
+              if oc get pod -n openshift-network-operator -l name=network-operator --no-headers 2>/dev/null | grep -q .; then
+                oc delete pod -n openshift-network-operator -l name=network-operator --ignore-not-found=true
+                echo "Network operator pod deleted successfully"
+              else
+                echo "No network-operator pods found, nothing to delete"
+              fi
+      nodeSelector:
+        node-role.kubernetes.io/master: ""
+      tolerations:
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/master
+          operator: Exists