net: NAD live-update connectivity test for Linux bridge

azhivovk · azhivovk · commit 46965028259e · 2026-05-27T21:37:35.000+03:00
Implement test_connectivity (CNV-15972): after the NAD reference change
moves iface-1 from VLAN-A to VLAN-B, verifies that the under-test VM
gains TCP connectivity to the reference VM on VLAN-B and loses it on
VLAN-A. Uses client_bind_dev and server_bind_dev to pin traffic to the
correct interface, eliminating ECMP routing ambiguity.

Implement test_two_networks (CNV-15946): applies a single atomic patch
swapping both secondary networks simultaneously, then verifies each
interface reaches its new VLAN.

Adds the ref_vm fixture (module-scoped): a reference VM with iface-1 on
NAD-VLAN-A and iface-2 on NAD-VLAN-B. Baseline connectivity is verified
in baseline_connectivity before the first test runs.

Signed-off-by: Asia Khromov &lt;azhivovk@redhat.com&gt;
Assisted-by: Claude Sonnet 4.6 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/tests/network/l2_bridge/nad_ref_change/conftest.py b/tests/network/l2_bridge/nad_ref_change/conftest.py
@@ -4,17 +4,19 @@
 from kubernetes.dynamic import DynamicClient
 from ocp_resources.namespace import Namespace
 
-from libs.net.ip import random_cidr_addresses_by_family
+from libs.net.ip import filter_link_local_addresses, random_cidr_addresses_by_family
 from libs.net.netattachdef import CNIPluginBridgeConfig, NetConfig, NetworkAttachmentDefinition
-from libs.net.vmspec import wait_for_ifaces_status
+from libs.net.vmspec import lookup_iface_status, wait_for_ifaces_status
 from libs.vm.vm import BaseVirtualMachine
 from tests.network.l2_bridge.libl2bridge import LINUX_BRIDGE_IFACE_NAME_1, LINUX_BRIDGE_IFACE_NAME_2
 from tests.network.l2_bridge.nad_ref_change.lib_helpers import (
+    GUEST_IFACE_1,
+    GUEST_IFACE_2,
     NET_SEED,
     two_secondary_bridge_vm,
 )
 from tests.network.libs import nodenetworkconfigurationpolicy as libnncp
-from tests.network.libs.connectivity import ARP_ISOLATION_SYSCTL_CMD
+from tests.network.libs.connectivity import ARP_ISOLATION_SYSCTL_CMD, poll_tcp_connectivity
 
 
 @pytest.fixture(scope="module")
@@ -55,6 +57,36 @@ def bridge_nad_b(
         yield nad
 
 
+@pytest.fixture(scope="module")
+def ref_vm(
+    namespace: Namespace,
+    unprivileged_client: DynamicClient,
+    bridge_nad_a: NetworkAttachmentDefinition,
+    bridge_nad_b: NetworkAttachmentDefinition,
+) -> Generator[BaseVirtualMachine]:
+    iface_a_ips = random_cidr_addresses_by_family(net_seed=NET_SEED, host_address=1)
+    iface_b_ips = random_cidr_addresses_by_family(net_seed=NET_SEED, host_address=2)
+    with two_secondary_bridge_vm(
+        namespace=namespace.name,
+        name="ref-vm",
+        client=unprivileged_client,
+        nad_names=[bridge_nad_a.name, bridge_nad_b.name],
+        ip_addresses=[iface_a_ips, iface_b_ips],
+        iface_names=[LINUX_BRIDGE_IFACE_NAME_1, LINUX_BRIDGE_IFACE_NAME_2],
+        runcmd=ARP_ISOLATION_SYSCTL_CMD,
+    ) as vm:
+        vm.start(wait=True)
+        vm.wait_for_agent_connected()
+        wait_for_ifaces_status(
+            vm=vm,
+            ip_addresses_by_spec_net_name={
+                LINUX_BRIDGE_IFACE_NAME_1: [addr.split("/")[0] for addr in iface_a_ips],
+                LINUX_BRIDGE_IFACE_NAME_2: [addr.split("/")[0] for addr in iface_b_ips],
+            },
+        )
+        yield vm
+
+
 @pytest.fixture(scope="class")
 def under_test_vm_two_ifaces(
     namespace: Namespace,
@@ -82,3 +114,34 @@ def under_test_vm_two_ifaces(
             },
         )
         yield vm
+
+
+@pytest.fixture(scope="class")
+def baseline_connectivity(
+    under_test_vm_two_ifaces: BaseVirtualMachine,
+    ref_vm: BaseVirtualMachine,
+) -> None:
+    """Verify baseline connectivity before the NAD reference change.
+
+    Asserts that the under-test VM can reach the reference VM on VLAN-A (iface-1)
+    and cannot reach it on VLAN-B (iface-2) before any NAD update is applied.
+    """
+    for server_ip in filter_link_local_addresses(
+        ip_addresses=lookup_iface_status(vm=ref_vm, iface_name=LINUX_BRIDGE_IFACE_NAME_1).ipAddresses
+    ):
+        poll_tcp_connectivity(
+            client_vm=under_test_vm_two_ifaces,
+            server_vm=ref_vm,
+            server_ip=str(server_ip),
+            server_bind_dev=GUEST_IFACE_1,
+        )
+    for server_ip in filter_link_local_addresses(
+        ip_addresses=lookup_iface_status(vm=ref_vm, iface_name=LINUX_BRIDGE_IFACE_NAME_2).ipAddresses
+    ):
+        poll_tcp_connectivity(
+            client_vm=under_test_vm_two_ifaces,
+            server_vm=ref_vm,
+            server_ip=str(server_ip),
+            server_bind_dev=GUEST_IFACE_2,
+            expect_connectivity=False,
+        )
diff --git a/tests/network/l2_bridge/nad_ref_change/lib_helpers.py b/tests/network/l2_bridge/nad_ref_change/lib_helpers.py
@@ -15,6 +15,7 @@
 from libs.vm.vm import BaseVirtualMachine, add_volume_disk, cloudinitdisk_storage
 from tests.network.libs import cloudinit
 from tests.network.libs.cloudinit import primary_iface_cloud_init
+from tests.network.libs.connectivity import poll_tcp_connectivity
 
 NET_SEED: Final[int] = 0
 
@@ -23,6 +24,57 @@
 GUEST_IFACE_2: Final[str] = "eth2"
 
 
+def assert_connectivity(
+    client_vm: BaseVirtualMachine,
+    server_vm: BaseVirtualMachine,
+    server_ip: str,
+    server_bind_dev: str,
+    client_bind_dev: str,
+) -> None:
+    """Assert TCP connectivity from client to server for a single IP address.
+
+    Args:
+        client_vm: VM initiating the connection.
+        server_vm: VM accepting the connection.
+        server_ip: IP address to connect to.
+        server_bind_dev: Guest device to bind the iperf3 server to (bypasses ECMP).
+        client_bind_dev: Guest device to bind the iperf3 client to (bypasses ECMP).
+    """
+    poll_tcp_connectivity(
+        client_vm=client_vm,
+        server_vm=server_vm,
+        server_ip=server_ip,
+        client_bind_dev=client_bind_dev,
+        server_bind_dev=server_bind_dev,
+    )
+
+
+def assert_no_connectivity(
+    client_vm: BaseVirtualMachine,
+    server_vm: BaseVirtualMachine,
+    server_ip: str,
+    server_bind_dev: str,
+    client_bind_dev: str,
+) -> None:
+    """Assert no TCP connectivity from client to server for a single IP address.
+
+    Args:
+        client_vm: VM initiating the connection.
+        server_vm: VM accepting the connection.
+        server_ip: IP address to connect to.
+        server_bind_dev: Guest device to bind the iperf3 server to (bypasses ECMP).
+        client_bind_dev: Guest device to bind the iperf3 client to (bypasses ECMP).
+    """
+    poll_tcp_connectivity(
+        client_vm=client_vm,
+        server_vm=server_vm,
+        server_ip=server_ip,
+        client_bind_dev=client_bind_dev,
+        server_bind_dev=server_bind_dev,
+        expect_connectivity=False,
+    )
+
+
 def update_nad_references(vm: BaseVirtualMachine, nad_name_by_net: dict[str, str]) -> None:
     """Update secondary network NAD references and wait for the change to be fully applied.
 
diff --git a/tests/network/l2_bridge/nad_ref_change/test_nad_ref_change.py b/tests/network/l2_bridge/nad_ref_change/test_nad_ref_change.py
@@ -13,13 +13,19 @@
 
 import pytest
 
+from libs.net.ip import filter_link_local_addresses
 from libs.net.vmspec import lookup_iface_status
-from tests.network.l2_bridge.libl2bridge import LINUX_BRIDGE_IFACE_NAME_1
+from tests.network.l2_bridge.libl2bridge import LINUX_BRIDGE_IFACE_NAME_1, LINUX_BRIDGE_IFACE_NAME_2
 from tests.network.l2_bridge.nad_ref_change.lib_helpers import (
+    GUEST_IFACE_1,
+    GUEST_IFACE_2,
+    assert_connectivity,
+    assert_no_connectivity,
     update_nad_references,
 )
 
 
+@pytest.mark.usefixtures("baseline_connectivity")
 @pytest.mark.incremental
 class TestRunningVMLinuxBridgeVlanChange:
     """
@@ -80,7 +86,7 @@ def test_vm_state_iface_info_preserved(
 
         Expected:
             - Under-test VM remains running after the NAD reference change
-            - Guest first secondary interface MAC address, name, and IP addresses are the same before and after the
+            - All guest first secondary interface status fields are identical before and after the
               NAD reference change
         """
         iface_before = lookup_iface_status(vm=under_test_vm_two_ifaces, iface_name=LINUX_BRIDGE_IFACE_NAME_1)
@@ -95,7 +101,14 @@ def test_vm_state_iface_info_preserved(
         )
 
     @pytest.mark.polarion("CNV-15972")
-    def test_connectivity(self):
+    def test_connectivity(
+        self,
+        subtests,
+        under_test_vm_two_ifaces,
+        ref_vm,
+        bridge_nad_a,
+        bridge_nad_b,
+    ):
         """
         Test that the under-test VM has TCP connectivity to the reference VM on the new NAD-VLAN-B and no TCP
         connectivity on the old NAD-VLAN-A after the NAD reference change.
@@ -112,11 +125,38 @@ def test_connectivity(self):
             - Under-test VM eventually has TCP connectivity to the reference VM on NAD-VLAN-B
             - Under-test VM has no TCP connectivity to the reference VM on NAD-VLAN-A
         """
-
-    test_connectivity.__test__ = False
+        for server_ip in filter_link_local_addresses(
+            ip_addresses=lookup_iface_status(vm=ref_vm, iface_name=LINUX_BRIDGE_IFACE_NAME_2).ipAddresses
+        ):
+            with subtests.test(msg=f"IPv{server_ip.version} on {bridge_nad_b.name}"):
+                assert_connectivity(
+                    client_vm=under_test_vm_two_ifaces,
+                    server_vm=ref_vm,
+                    server_ip=str(server_ip),
+                    server_bind_dev=GUEST_IFACE_2,
+                    client_bind_dev=GUEST_IFACE_1,
+                )
+        for server_ip in filter_link_local_addresses(
+            ip_addresses=lookup_iface_status(vm=ref_vm, iface_name=LINUX_BRIDGE_IFACE_NAME_1).ipAddresses
+        ):
+            with subtests.test(msg=f"IPv{server_ip.version} on {bridge_nad_a.name}"):
+                assert_no_connectivity(
+                    client_vm=under_test_vm_two_ifaces,
+                    server_vm=ref_vm,
+                    server_ip=str(server_ip),
+                    server_bind_dev=GUEST_IFACE_1,
+                    client_bind_dev=GUEST_IFACE_1,
+                )
 
     @pytest.mark.polarion("CNV-15946")
-    def test_two_networks(self):
+    def test_two_networks(
+        self,
+        subtests,
+        under_test_vm_two_ifaces,
+        ref_vm,
+        bridge_nad_a,
+        bridge_nad_b,
+    ):
         """
         Test that both secondary Linux bridge networks on a running VM can have their VLANs
         changed in a single patch, with each network switching to a different VLAN.
@@ -140,8 +180,36 @@ def test_two_networks(self):
             - Under-test VM first secondary network eventually has TCP connectivity to the reference VM on NAD-VLAN-A
             - Under-test VM second secondary network eventually has TCP connectivity to the reference VM on NAD-VLAN-B
         """
+        update_nad_references(
+            vm=under_test_vm_two_ifaces,
+            nad_name_by_net={
+                LINUX_BRIDGE_IFACE_NAME_1: bridge_nad_a.name,
+                LINUX_BRIDGE_IFACE_NAME_2: bridge_nad_b.name,
+            },
+        )
 
-    test_two_networks.__test__ = False
+        for server_ip in filter_link_local_addresses(
+            ip_addresses=lookup_iface_status(vm=ref_vm, iface_name=LINUX_BRIDGE_IFACE_NAME_1).ipAddresses
+        ):
+            with subtests.test(msg=f"IPv{server_ip.version} on {bridge_nad_a.name}"):
+                assert_connectivity(
+                    client_vm=under_test_vm_two_ifaces,
+                    server_vm=ref_vm,
+                    server_ip=str(server_ip),
+                    server_bind_dev=GUEST_IFACE_1,
+                    client_bind_dev=GUEST_IFACE_1,
+                )
+        for server_ip in filter_link_local_addresses(
+            ip_addresses=lookup_iface_status(vm=ref_vm, iface_name=LINUX_BRIDGE_IFACE_NAME_2).ipAddresses
+        ):
+            with subtests.test(msg=f"IPv{server_ip.version} on {bridge_nad_b.name}"):
+                assert_connectivity(
+                    client_vm=under_test_vm_two_ifaces,
+                    server_vm=ref_vm,
+                    server_ip=str(server_ip),
+                    server_bind_dev=GUEST_IFACE_2,
+                    client_bind_dev=GUEST_IFACE_2,
+                )
 
 
 @pytest.mark.polarion("CNV-15947")
