Add release note

Author: jovial

etc/kayobe/ansible/fixes/flush-iptables-legacy.yml

@@ -0,0 +1,34 @@
+---
+
+# This playbook flushes iptables-legacy rules in the neutron_openvswitch_agent container on overcloud hosts.
+# It is intended to be used in scenarios where neutron_openvswitch_agent was updated to a version without
+# iptables-nft.
+
+- hosts: overcloud
+  gather_facts: false
+  tasks:
+    - name: Gather service facts
+      ansible.builtin.service_facts:
+
+    - name: End play for hosts without openvswitch agent
+      meta: end_host
+      when: "'kolla-neutron_openvswitch_agent-container.service' not in ansible_facts.services"
+
+    - name: Flush iptables-legacy in neutron_openvswitch_agent container
+      ansible.builtin.shell: |
+        set -euo pipefail
+        {{ container_engine }} exec -u root neutron_openvswitch_agent iptables-legacy -P INPUT ACCEPT
+        {{ container_engine }} exec -u root neutron_openvswitch_agent iptables-legacy -P FORWARD ACCEPT
+        {{ container_engine }} exec -u root neutron_openvswitch_agent iptables-legacy -P OUTPUT ACCEPT
+        {{ container_engine }} exec -u root neutron_openvswitch_agent iptables-legacy -t nat -F
+        {{ container_engine }} exec -u root neutron_openvswitch_agent iptables-legacy -t nat -X
+        {{ container_engine }} exec -u root neutron_openvswitch_agent iptables-legacy -t mangle -F
+        {{ container_engine }} exec -u root neutron_openvswitch_agent iptables-legacy -t mangle -X
+        {{ container_engine }} exec -u root neutron_openvswitch_agent iptables-legacy -t raw -F
+        {{ container_engine }} exec -u root neutron_openvswitch_agent iptables-legacy -t raw -X
+        {{ container_engine }} exec -u root neutron_openvswitch_agent iptables-legacy -t filter -F
+        {{ container_engine }} exec -u root neutron_openvswitch_agent iptables-legacy -t filter -X
+        {{ container_engine }} exec -u root neutron_openvswitch_agent iptables-legacy -F
+        {{ container_engine }} exec -u root neutron_openvswitch_agent iptables-legacy -X
+      args:
+        executable: /bin/bash

releasenotes/notes/fix-iptables-nft-missing-1a4e69f92811cd12.yaml

@@ -0,0 +1,17 @@
+---
+fixes:
+  - |
+    Fixes an issue where neutron security rules were creating legacy iptables
+    rules.  The expectation was that these would be created as nf_tables rules
+    using the iptables-nft compatability package. This matches the behaviour in
+    the ``2024.1`` release.
+upgrade:
+  - |
+    In ML2/OVS deployments, neutron security group rules will be installed in
+    nf_tables to match the behaviour in the ``2024.1`` release.  The
+    ``neutron_legacy_iptables`` kolla-ansible variable can be set to ``true``
+    if you still wish to use legacy iptables. Otherwise, please run the
+    ``$KAYOBE_CONFIG_PATH/ansible/fixes/flush-iptables-legacy.yml`` playbook
+    after upgrading the neutron containers to prevent iptables-legacy
+    conflicting with iptables-nft rules. If you upgrading to this release or
+    newer, you do not have to run the playbook.