net: Introduce dual-stream linux bridge tests (#4772)

##### Short description:
Dual-stream clusters run worker nodes with a mix of RHCOS 9 and RHCOS
10.
Live migration across OS versions can expose compatibility issues:
kernel bridge drivers, OVN flow tables, and binding plugins all behave
differently between RHCOS releases, that would only manifest during
cross-OS migration and not in homogeneous OS nodes clusters.

##### More details: STD:
#4569

##### What this PR does / why we need it:
This PR adds the shared infrastructure layer needed by all network
migration tests in this series, plus Linux bridge connectivity tests.
The shared layer registers the mixed_os_nodes marker to gate tests to
compatible clusters, and introduces helpers to direct a running VM to a
specific OS node before triggering migration.

The Linux bridge tests verify that an active TCP connection over a
secondary Linux bridge network survives live migration of the server VM
in both directions (RHCOS 9 -> 10 and back).
The client VM remains on RHCOS 9 throughout, so the test isolates the
impact of the server-side OS change on the forwarding path.

##### Which issue(s) this PR fixes: -

##### Special notes for reviewer:
This is the first PR in a series. Localnet, primary network, and primary
UDN are covered in separate PRs that depend on the same infra commits.

##### jira-ticket: https://redhat.atlassian.net/browse/CNV-86194
<!-- full-ticket-url needs to be provided. This would add a link to the
pull request to the jira and close it when the pull request is merged
If the task is not tracked by a Jira ticket, just write "NONE".
-->


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added testing framework for virtual machine migrations between RHEL9
and RHEL10 worker nodes.
* Enhanced L2 bridge network configuration and testing across mixed-OS
clusters.

* **Tests**
* Implemented comprehensive test fixtures for L2 bridge integration
testing.
* Added automated network connectivity verification during VM migrations
across operating system versions.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/RedHatQE/openshift-virtualization-tests/pull/4772)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Author: rnetser

libs/net/ip.py

@@ -15,6 +15,48 @@
 ICMP_HEADER_SIZE: Final[int] = 8
 
 
+def random_cidr_addresses_by_family(net_seed: int, host_address: int) -> list[str]:
+    """Return CIDR-formatted addresses for each IP family supported by the cluster.
+
+    This library uses /24 for IPv4 and /64 for IPv6 VM subnets, matching the
+    subnet definitions in this module. VMs with the same net_seed share the
+    same subnet, allowing direct L2 communication without routing. Only
+    families supported by the cluster are included.
+
+    Args:
+        net_seed: Index into the cached pool of random network prefixes.
+        host_address: Host portion of the address — must be unique per VM in the test.
+
+    Returns:
+        List of CIDR strings (e.g. ["192.168.1.1/24", "fd00::1/64"]).
+    """
+    return [
+        f"{ip}/64" if ipaddress.ip_address(ip).version == 6 else f"{ip}/24"
+        for ip in random_ip_addresses_by_family(net_seed=net_seed, host_address=host_address)
+    ]
+
+
+def random_ip_addresses_by_family(
+    net_seed: int,
+    host_address: int,
+) -> list[str]:
+    """Generate IP addresses for each IP family supported by the cluster network stack.
+
+    Args:
+        net_seed: Seed index for selecting the random network portion of the address.
+        host_address: Host portion of the address, used to place VMs on the same subnet.
+
+    Returns:
+        List of IP address strings, one per IP family supported by the cluster.
+    """
+    ips = []
+    if ipv4_supported_cluster():
+        ips.append(random_ipv4_address(net_seed=net_seed, host_address=host_address))
+    if ipv6_supported_cluster():
+        ips.append(random_ipv6_address(net_seed=net_seed, host_address=host_address))
+    return ips
+
+
 def random_ipv4_address(net_seed: int, host_address: int) -> str:
     """Construct a random IPv4 address using a cached list of random third octets.
 
@@ -81,27 +123,6 @@ def _random_hextets(count: int) -> list[int]:
     return random.sample(range(1, 0xFFFE), count)
 
 
-def random_ip_addresses_by_family(
-    net_seed: int,
-    host_address: int,
-) -> list[str]:
-    """Generate IP addresses for each IP family supported by the cluster network stack.
-
-    Args:
-        net_seed: Seed index for selecting the random network portion of the address.
-        host_address: Host portion of the address, used to place VMs on the same subnet.
-
-    Returns:
-        List of IP address strings, one per IP family supported by the cluster.
-    """
-    ips = []
-    if ipv4_supported_cluster():
-        ips.append(random_ipv4_address(net_seed=net_seed, host_address=host_address))
-    if ipv6_supported_cluster():
-        ips.append(random_ipv6_address(net_seed=net_seed, host_address=host_address))
-    return ips
-
-
 def filter_link_local_addresses(ip_addresses: list[str]) -> list[ipaddress.IPv4Address | ipaddress.IPv6Address]:
     """
     Filter out link-local IP addresses from a list of IP address strings.

libs/vm/affinity.py

@@ -6,6 +6,9 @@
     Affinity,
     LabelSelector,
     LabelSelectorRequirement,
+    NodeAffinity,
+    NodeSelectorTerm,
+    NodeSelectorTerms,
     PodAffinity,
     PodAffinityTerm,
     PodAntiAffinity,
@@ -80,3 +83,26 @@ def new_pod_affinity(label: tuple[str, str], namespaces: list[str] | None = None
             ]
         )
     )
+
+
+def new_node_affinity(key: str, exists: bool) -> Affinity:
+    """Create a node affinity based on whether target nodes must carry the given label.
+
+    Args:
+        key: Node role label key to match.
+        exists: If True, target nodes must carry the label (Exists operator).
+            If False, target nodes must NOT carry the label (DoesNotExist operator).
+
+    Returns:
+        Affinity object with nodeAffinity configured.
+    """
+    operator = "Exists" if exists else "DoesNotExist"
+    return Affinity(
+        nodeAffinity=NodeAffinity(
+            requiredDuringSchedulingIgnoredDuringExecution=NodeSelectorTerms(
+                nodeSelectorTerms=[
+                    NodeSelectorTerm(matchExpressions=[LabelSelectorRequirement(key=key, operator=operator)])
+                ]
+            )
+        )
+    )

libs/vm/oper.py

@@ -0,0 +1,29 @@
+import logging
+
+from kubernetes.client import ApiException
+
+from libs.vm.vm import BaseVirtualMachine
+
+LOGGER = logging.getLogger(__name__)
+
+
+def run_vms(vms: tuple[BaseVirtualMachine, ...]) -> tuple[BaseVirtualMachine, ...]:
+    """Start all VMs in parallel then wait for each to be ready and agent-connected.
+
+    Args:
+        vms: VMs to start.
+
+    Returns:
+        The same tuple of VMs, all running with guest agent connected.
+    """
+    for vm in vms:
+        try:
+            vm.start()  # type: ignore[no-untyped-call]
+        except ApiException as vm_exception:
+            if "VM is already running" in vm_exception.body:
+                LOGGER.warning(f"VM {vm.name} is already running")
+                continue
+    for vm in vms:
+        vm.wait_for_ready_status(status=True)  # type: ignore[no-untyped-call]
+        vm.wait_for_agent_connected()
+    return vms

libs/vm/spec.py

@@ -100,6 +100,22 @@ class Multus:
 class Affinity:
     podAntiAffinity: PodAntiAffinity | None = None  # noqa: N815
     podAffinity: PodAffinity | None = None  # noqa: N815
+    nodeAffinity: NodeAffinity | None = None  # noqa: N815
+
+
+@dataclass
+class NodeAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution: NodeSelectorTerms  # noqa: N815
+
+
+@dataclass
+class NodeSelectorTerms:
+    nodeSelectorTerms: list[NodeSelectorTerm]  # noqa: N815
+
+
+@dataclass
+class NodeSelectorTerm:
+    matchExpressions: list[LabelSelectorRequirement]  # noqa: N815
 
 
 @dataclass
@@ -129,7 +145,7 @@ class LabelSelector:
 class LabelSelectorRequirement:
     operator: str
     key: str
-    values: list[str]
+    values: list[str] | None = None
 
 
 @dataclass

pytest.ini

@@ -72,6 +72,7 @@ markers =
     rwx_default_storage: Tests that require RWX storage
     descheduler: Tests that require kube-descheduler on nodes
     remote_cluster: Tests that require a remote cluster
+    mixed_os_nodes: Tests that require a dual-stream cluster with both RHCOS 9 and RHCOS 10 worker nodes
 
     ## Required operators
     mtv: Tests that require the MTV operator to be installed

tests/network/l2_bridge/bandwidth/conftest.py

@@ -21,8 +21,8 @@
     BANDWIDTH_RATE_BPS,
     BANDWIDTH_SECONDARY_IFACE_NAME,
     GUEST_2ND_IFACE_NAME,
-    secondary_network_vm,
 )
+from tests.network.l2_bridge.libl2bridge import secondary_network_vm
 
 _NAD_NAME: Final[str] = "br-bw-test-nad"
 

tests/network/l2_bridge/bandwidth/lib_helpers.py

@@ -1,14 +1,8 @@
 import json
 from typing import Final
 
-from kubernetes.dynamic import DynamicClient
-
-from libs.net.cluster import ipv4_supported_cluster, ipv6_supported_cluster
 from libs.net.traffic_generator import IPERF_SERVER_PORT, TcpServer
-from libs.vm.factory import base_vmspec, fedora_vm
-from libs.vm.spec import CloudInitNoCloud, Interface, Multus, Network
-from libs.vm.vm import BaseVirtualMachine, add_volume_disk, cloudinitdisk_storage
-from tests.network.libs import cloudinit
+from libs.vm.vm import BaseVirtualMachine
 
 BANDWIDTH_SECONDARY_IFACE_NAME: Final[str] = "secondary"
 BANDWIDTH_RATE_BPS: Final[int] = 10_000_000  # 10 Mbps
@@ -84,64 +78,3 @@ def assert_bidir_throughput_within_limit(
             f"Measured {direction} throughput {throughput_bps:.0f} bps exceeds "
             f"configured limit {rate_bps} bps for {server_ip}"
         )
-
-
-def secondary_network_vm(
-    namespace: str,
-    name: str,
-    client: DynamicClient,
-    nad_name: str,
-    secondary_iface_name: str,
-    secondary_iface_addresses: list[str],
-) -> BaseVirtualMachine:
-    """Create a Fedora VM with a masquerade primary interface and a secondary Linux bridge interface.
-
-    Args:
-        namespace: Namespace to deploy the VM in.
-        name: VM name.
-        client: Kubernetes dynamic client.
-        nad_name: NetworkAttachmentDefinition name for the secondary interface.
-        secondary_iface_name: Name of the secondary network interface in the VM spec.
-        secondary_iface_addresses: CIDR addresses to assign to the secondary interface via cloud-init.
-    """
-    spec = base_vmspec()
-    spec.template.spec.domain.devices.interfaces = [  # type: ignore
-        Interface(name="default", masquerade={}),
-        Interface(name=secondary_iface_name, bridge={}),
-    ]
-    spec.template.spec.networks = [
-        Network(name="default", pod={}),
-        Network(name=secondary_iface_name, multus=Multus(networkName=nad_name)),
-    ]
-
-    ethernets = {}
-    primary = _masquerade_iface_cloud_init()
-    if primary:
-        ethernets["eth0"] = primary
-    ethernets["eth1"] = cloudinit.EthernetDevice(addresses=secondary_iface_addresses)
-
-    userdata = cloudinit.UserData(users=[])
-    disk, volume = cloudinitdisk_storage(
-        data=CloudInitNoCloud(
-            networkData=cloudinit.asyaml(no_cloud=cloudinit.NetworkData(ethernets=ethernets)),
-            userData=cloudinit.format_cloud_config(userdata=userdata),
-        )
-    )
-    spec.template.spec = add_volume_disk(vmi_spec=spec.template.spec, volume=volume, disk=disk)
-    return fedora_vm(namespace=namespace, name=name, client=client, spec=spec)
-
-
-def _masquerade_iface_cloud_init() -> cloudinit.EthernetDevice | None:
-    """Return cloud-init ethernet config for a masquerade (primary) interface.
-
-    Returns:
-        EthernetDevice with static IPv6 and optional DHCP4, or None if IPv6 is not supported.
-    """
-    if not ipv6_supported_cluster():
-        return None
-    return cloudinit.EthernetDevice(
-        addresses=["fd10:0:2::2/120"],
-        gateway6="fd10:0:2::1",
-        dhcp4=ipv4_supported_cluster(),
-        dhcp6=False,
-    )

tests/network/l2_bridge/conftest.py

@@ -7,6 +7,7 @@
 
 import tests.network.libs.nodenetworkconfigurationpolicy as libnncp
 from libs.net.ip import random_ipv4_address
+from libs.net.netattachdef import CNIPluginBridgeConfig, NetConfig, NetworkAttachmentDefinition
 from tests.network.l2_bridge.libl2bridge import DHCP_INTERFACE_NAME, bridge_attached_vm
 from tests.network.libs.dhcpd import (
     DHCP_IP_RANGE_END,
@@ -313,3 +314,22 @@ def bridge_nncp(
     ) as nncp_br:
         nncp_br.wait_for_status_success()
         yield nncp_br
+
+
+@pytest.fixture(scope="class")
+def bridge_nad(
+    admin_client: DynamicClient,
+    namespace,
+    bridge_nncp: libnncp.NodeNetworkConfigurationPolicy,
+) -> Generator[NetworkAttachmentDefinition]:
+    config = NetConfig(
+        name="test-bridge-network",
+        plugins=[CNIPluginBridgeConfig(bridge=bridge_nncp.desired_state_spec.interfaces[0].name)],  # type: ignore
+    )
+    with NetworkAttachmentDefinition(
+        name="test-bridge-network",
+        namespace=namespace.name,
+        config=config,
+        client=admin_client,
+    ) as nad:
+        yield nad