fix worker node external conectivity

[masco]

No description provided.

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• New Features

  • Added automatic network address configuration for the bootstrap environment.
  • Added NAT masquerading for outbound traffic through the system’s default route.

• Bug Fixes

  • Improved firewall setup by removing conflicting default reject rules before deployment.
  • Updated NAT handling to apply at the appropriate deployment stage.

Walkthrough

The bootstrap role removes default iptables reject rules and adds default-interface NAT masquerading. The values-prep role assigns 172.16.0.1/16 to iface_0 and removes its previous jump-host NAT task.

Changes

Network setup

Layer / File(s)	Summary
Bootstrap firewall and NAT configuration ansible/roles/bootstrap/tasks/main.yml	Removes default INPUT and FORWARD reject rules, detects the default route interface, and appends a POSTROUTING masquerade rule.
Control-plane gateway assignment ansible/roles/values-prep/tasks/main.yml	Assigns 172.16.0.1/16 to iface_0 and removes the previous jump-host masquerading task.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: links84

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	No pull request description was provided, so there is no text to assess against the changeset.	Add a brief description of the worker node connectivity and iptables changes.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the worker node connectivity fix reflected by the iptables changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

ansible/roles/bootstrap/tasks/main.yml (1)

54-57: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Make the MASQUERADE rule idempotent.

iptables -A adds a duplicate rule every time this role runs, and stale rules remain if the default interface changes. Use ansible.posix.iptables with state: present, or check with iptables -C before appending.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ansible/roles/bootstrap/tasks/main.yml` around lines 54 - 57, Update the
“masquerade on public interface” task to manage the MASQUERADE rule
idempotently, preferably using ansible.posix.iptables with state: present and
the existing default_route.stdout interface. Ensure reruns do not duplicate the
rule and changes to the default interface remove the stale rule.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ansible/roles/bootstrap/tasks/main.yml`:
- Around line 48-56: Update the “get default route” task to extract the
interface following the dev field from exactly one default route, and fail
explicitly when no default interface is found. Ensure the “masquerade on public
interface” task uses that validated single interface value when constructing the
iptables command.

---

Nitpick comments:
In `@ansible/roles/bootstrap/tasks/main.yml`:
- Around line 54-57: Update the “masquerade on public interface” task to manage
the MASQUERADE rule idempotently, preferably using ansible.posix.iptables with
state: present and the existing default_route.stdout interface. Ensure reruns do
not duplicate the rule and changes to the default interface remove the stale
rule.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: a857bbc3-6de6-419d-ab5f-ec52a19ab676

📥 Commits

Reviewing files that changed from the base of the PR and between 4bd83c0 and 26c6716.

📒 Files selected for processing (2)

• ansible/roles/bootstrap/tasks/main.yml
• ansible/roles/values-prep/tasks/main.yml

💤 Files with no reviewable changes (1)

• ansible/roles/values-prep/tasks/main.yml

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

git ls-files ansible/roles/bootstrap/tasks/main.yml
wc -l ansible/roles/bootstrap/tasks/main.yml
cat -n ansible/roles/bootstrap/tasks/main.yml | sed -n '1,120p'

Repository: redhat-performance/JetBrew

Length of output: 3374

---

Select one default interface before building the NAT rule. (ansible/roles/bootstrap/tasks/main.yml:48-56) ip r | grep default | cut -d ' ' -f5 can return multiple or empty values depending on route output, which makes the iptables command invalid; parse the dev field from a single default route and fail when none is found.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ansible/roles/bootstrap/tasks/main.yml` around lines 48 - 56, Update the “get
default route” task to extract the interface following the dev field from
exactly one default route, and fail explicitly when no default interface is
found. Ensure the “masquerade on public interface” task uses that validated
single interface value when constructing the iptables command.

[rajeshP524]

LGTM!