--- apiVersion: v1 items: - apiVersion: v1 data: applied: '{"managementState":"Managed","logLevel":"Normal","operatorLogLevel":"Normal","unsupportedConfigOverrides":null,"observedConfig":null,"clusterNetwork":[{"cidr":"10.132.0.0/14","hostPrefix":23}],"serviceNetwork":["172.31.0.0/16"],"defaultNetwork":{"type":"OVNKubernetes","ovnKubernetesConfig":{"mtu":8901,"genevePort":6081,"ipsecConfig":{"mode":"Disabled"},"policyAuditConfig":{"rateLimit":20,"maxFileSize":50,"maxLogFiles":5,"destination":"null","syslogFacility":"local0"},"gatewayConfig":{"ipv4":{},"ipv6":{}},"egressIPConfig":{}}},"disableMultiNetwork":false,"useMultiNetworkPolicy":false,"deployKubeProxy":false,"disableNetworkDiagnostics":false}' kind: ConfigMap metadata: creationTimestamp: "2026-02-17T12:42:41Z" managedFields: - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: f:applied: {} f:metadata: f:ownerReferences: k:{"uid":"90714041-3359-45e8-85cb-f85d3b3cdb86"}: {} manager: cluster-network-operator/operconfig operation: Apply time: "2026-02-17T12:43:04Z" name: applied-cluster namespace: openshift-network-operator ownerReferences: - apiVersion: operator.openshift.io/v1 blockOwnerDeletion: true controller: true kind: Network name: cluster uid: 90714041-3359-45e8-85cb-f85d3b3cdb86 resourceVersion: "3305" uid: 3c7af562-c99c-4dc7-8e07-d3fb787b03cc - apiVersion: v1 data: iptables-alerter.sh: |- #!/bin/bash set -euo pipefail function crictl { chroot /host /bin/crictl "$@" } function ip { chroot /host /sbin/ip "$@" } function nsenter { chroot /host /bin/nsenter "$@" } function check_pods { # We need to use crictl to be able to map pod information to network namespace # information, but there seems to be some bug in crictl that causes excessive CPU # usage on some hosts, for unknown reasons. Since we expect that most nodes won't # have any iptables-using pods anyway, do a pre-scan of all (non-hostnetwork) # namespaces without using crictl, and bail out early if we don't find anything iptables_output="" for netns_pid in $(lsns -t net -o pid -nr | sort -u | grep -v '^1$'); do # Set iptables_output to the first iptables rule in the network namespace, if any. # (We use `awk` here rather than `grep` intentionally to avoid awkwardness with # grep's exit status on no match.) iptables_output=$( (nsenter -n -t "${netns_pid}" iptables-save || true; nsenter -n -t "${netns_pid}" ip6tables-save || true) 2>/dev/null | \ awk '/^-A/ {print; exit}' ) if [[ -n "${iptables_output}" ]]; then break fi done if [[ -z "${iptables_output}" ]]; then # Nothing to see here return 0 fi # Somebody was using iptables, so now we have to figure out who. for id in $(crictl pods -q); do # Inspect the pod read pod_namespace pod_name pod_uid netns netns_path <<<$(crictl inspectp -o go-template --template '{{.status.metadata.namespace}} {{.status.metadata.name}} {{.status.metadata.uid}} {{.status.linux.namespaces.options.network}} {{range .info.runtimeSpec.linux.namespaces }}{{if eq .type "network"}}{{.path}}{{end}}{{end}}' ${id} 2>/dev/null || true ) # Check that it's a pod-network pod. (This also catches "crictl errored out".) if [[ "${netns}" != "POD" ]]; then continue fi if [[ ! "${netns_path}" =~ ^/var/run/netns/ ]]; then continue fi netns=$(basename "${netns_path}") # Set iptables_output to the first iptables rule in the pod's network # namespace, if any. (We use `awk` here rather than `grep` intentionally # to avoid awkwardness with grep's exit status on no match.) iptables_output=$( (ip netns exec "${netns}" iptables-save || true; ip netns exec "${netns}" ip6tables-save || true) 2>/dev/null | \ awk '/^-A/ {print; exit}' ) if [[ -z "${iptables_output}" ]]; then continue fi # Check if we already logged an event for it events=$(kubectl get events -n "${pod_namespace}" -l pod-uid="${pod_uid}" 2>/dev/null) if [[ -n "${events}" ]]; then echo "Skipping pod ${pod_namespace}/${pod_name} which we already logged an event for." continue fi echo "Logging event for ${pod_namespace}/${pod_name} which has iptables rules" # eg "2023-10-19T15:45:10.353846Z" event_time=$(date -u +%FT%T.%6NZ) kubectl create -f - <