OCPBUGS-86571: templates: pass --dual-stack to nodeip-configuration

[mkowalski]

Summary

Companion PR to openshift/baremetal-runtimecfg#391.

Passes the new --dual-stack flag to baremetal-runtimecfg node-ip set when the cluster is configured as dual-stack (DualStack or DualStackIPv6Primary). This tells nodeip-configuration to wait for both IPv4 and IPv6 addresses before writing the kubelet/crio config.

Background

On RHEL 10, IPv4 ACD (Address Conflict Detection) is enabled by default, delaying IPv4 address assignment by ~200ms-3s. This creates a race condition on dual-stack clusters where nodeip-configuration.service sees only IPv6 and writes an IPv6-only config.

The baremetal-runtimecfg fix (#391) adds dual-stack awareness to getSuitableIPs():

• Auto-detects dual-stack from VIPs (covers on-prem)
• Accepts --dual-stack flag (covers non-VIP platforms like None/External)
• Bounded 10s wait for the second address family
• Graceful fallback if timeout expires

Changes

Added --dual-stack flag to all 4 nodeip-configuration service templates:

Template	Platform
_base/units/nodeip-configuration.service.yaml	None, External
on-prem/units/nodeip-configuration.service.yaml	BareMetal, OpenStack, oVirt, Nutanix
kubevirt/units/nodeip-configuration.service.yaml	KubeVirt
vsphere/units/nodeip-configuration-vsphere-upi.service.yaml	vSphere UPI

The flag is conditionally passed using the same .IPFamilies template variable already used for --prefer-ipv6:

{{if or (eq .IPFamilies "DualStack") (eq .IPFamilies "DualStackIPv6Primary") -}}
--dual-stack \
{{end -}}

Note: On-prem deployments also auto-detect dual-stack from VIPs, so the flag is belt-and-suspenders there. Non-on-prem deployments (None/External) have no VIPs, so the flag is essential.

Dependencies

• Depends on openshift/baremetal-runtimecfg#391 (adds the --dual-stack flag to node-ip set)

Fixes: https://issues.redhat.com/browse/OCPBUGS-86571

---

🤖 This PR was created by OpenClaw on behalf of @mkowalski.

Summary by CodeRabbit

Bug Fixes

• Added dual-stack IP address configuration support across multiple deployment scenarios. The system now properly handles dual-stack IP families during node IP configuration.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@mkowalski: This pull request references Jira Issue OCPBUGS-86571, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @rbbratta

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

Companion PR to openshift/baremetal-runtimecfg#391.

Passes the new --dual-stack flag to baremetal-runtimecfg node-ip set when the cluster is configured as dual-stack (DualStack or DualStackIPv6Primary). This tells nodeip-configuration to wait for both IPv4 and IPv6 addresses before writing the kubelet/crio config.

Background

On RHEL 10, IPv4 ACD (Address Conflict Detection) is enabled by default, delaying IPv4 address assignment by ~200ms-3s. This creates a race condition on dual-stack clusters where nodeip-configuration.service sees only IPv6 and writes an IPv6-only config.

The baremetal-runtimecfg fix (#391) adds dual-stack awareness to getSuitableIPs():

• Auto-detects dual-stack from VIPs (covers on-prem)
• Accepts --dual-stack flag (covers non-VIP platforms like None/External)
• Bounded 10s wait for the second address family
• Graceful fallback if timeout expires

Changes

Added --dual-stack flag to all 4 nodeip-configuration service templates:

Template	Platform
_base/units/nodeip-configuration.service.yaml	None, External
on-prem/units/nodeip-configuration.service.yaml	BareMetal, OpenStack, oVirt, Nutanix
kubevirt/units/nodeip-configuration.service.yaml	KubeVirt
vsphere/units/nodeip-configuration-vsphere-upi.service.yaml	vSphere UPI

The flag is conditionally passed using the same .IPFamilies template variable already used for --prefer-ipv6:

{{if or (eq .IPFamilies "DualStack") (eq .IPFamilies "DualStackIPv6Primary") -}}
--dual-stack \
{{end -}}

Note: On-prem deployments also auto-detect dual-stack from VIPs, so the flag is belt-and-suspenders there. Non-on-prem deployments (None/External) have no VIPs, so the flag is essential.

Dependencies

• Depends on openshift/baremetal-runtimecfg#391 (adds the --dual-stack flag to node-ip set)

Fixes: https://issues.redhat.com/browse/OCPBUGS-86571

---

🤖 This PR was created by OpenClaw on behalf of @mkowalski.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 406b5b02-c42d-4793-baa6-fb71a2605149

📥 Commits

Reviewing files that changed from the base of the PR and between d72b715 and 35fc604.

📒 Files selected for processing (4)

• templates/common/_base/units/nodeip-configuration.service.yaml
• templates/common/kubevirt/units/nodeip-configuration.service.yaml
• templates/common/on-prem/units/nodeip-configuration.service.yaml
• templates/common/vsphere/units/nodeip-configuration-vsphere-upi.service.yaml

---

Walkthrough

This pull request adds dual-stack IP family support to the nodeip-configuration systemd service across four template variants. Each template now conditionally includes a --dual-stack flag when IP families are configured for dual-stack networking.

Changes

Dual-stack flag support in nodeip-configuration service

Layer / File(s)	Summary
Add dual-stack conditional flag to nodeip-configuration service templates templates/common/_base/units/nodeip-configuration.service.yaml, templates/common/kubevirt/units/nodeip-configuration.service.yaml, templates/common/on-prem/units/nodeip-configuration.service.yaml, templates/common/vsphere/units/nodeip-configuration-vsphere-upi.service.yaml	Four nodeip-configuration service unit templates add identical conditional logic to emit --dual-stack when .IPFamilies is DualStack or DualStackIPv6Primary: base template, kubevirt variant, on-prem variant, and vSphere UPI variant.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding the --dual-stack flag to nodeip-configuration service templates across multiple environments.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR contains only YAML systemd unit template changes with no Ginkgo test code. Check for test name stability is not applicable.
Test Structure And Quality	✅ Passed	This PR only modifies YAML template files (adding --dual-stack flag to nodeip-configuration services). No Ginkgo test code was added or modified, making the test quality check not applicable.
Microshift Test Compatibility	✅ Passed	This PR contains no new Ginkgo e2e tests, only modifications to YAML systemd service templates. The MicroShift Test Compatibility check is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR only modifies YAML systemd service templates; no new Ginkgo e2e tests are added, so SNO test compatibility check does not apply.
Topology-Aware Scheduling Compatibility	✅ Passed	Systemd unit templates add a conditional command-line flag based on IP family config. No Kubernetes scheduling constraints, affinity rules, or topology-incompatible logic introduced.
Ote Binary Stdout Contract	✅ Passed	PR modifies only YAML template files for systemd service units, not Go code or test infrastructure. No stdout writes in process-level code; check not applicable.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	This PR does not add any Ginkgo e2e tests; it only modifies systemd unit template YAML files. The check applies only when Ginkgo e2e tests are added, so it is not applicable here.
No-Weak-Crypto	✅ Passed	PR modifies only systemd unit templates adding a --dual-stack flag; contains no cryptographic code, weak crypto algorithms, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	PR only adds a --dual-stack command-line flag to node-ip set tool. No privileged mode, elevated capabilities, hostPID/IPC/Network, SYS_ADMIN, or allowPrivilegeEscalation flags introduced.
No-Sensitive-Data-In-Logs	✅ Passed	The PR adds only --dual-stack flag to nodeip-configuration service templates. This flag contains no sensitive data like passwords, tokens, API keys, PII, or customer data.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: mkowalski
Once this PR has been reviewed and has the lgtm label, please assign djoshy for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@mkowalski: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/unit	35fc604	link	true	/test unit
ci/prow/e2e-openstack	35fc604	link	false	/test e2e-openstack

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.