NOTE: This bug is Critical because it blocks API promotion of Two Nodes with Fencing to Default

Description of problem:

The TriggerNetworkDisruption function used by TNF recovery tests hardcodes iptables for blocking network traffic between nodes. On IPv6 clusters, iptables silently ignores IPv6 addresses — ip6tables is required.
As a result, the network disruption never takes effect, fencing is never triggered, and the test times out waiting for a member removal/re-addition that never happens.

Version-Release number of selected component (if applicable):

4.22

How reproducible:

100% on IPv6 using the network disruption recovery test.

Steps to Reproduce:

1. Deploy a two-node cluster with IPv6 networking and fencing enabled
2. Run the e2e-metal-ovn-two-node-fencing-ipv6-recovery-techpreview periodic job
3. Observe the "should recover from network disruption with etcd member re-addition" test

Actual results:

The test generates an iptables command with an IPv6 peer address:
sudo iptables -I INPUT -j DROP -s fd2e:6f44:5dd8:c956::14 && sudo iptables -I OUTPUT -j DROP -d fd2e:6f44:5dd8:c956::14
iptables does not handle IPv6 addresses. No network partition occurs, no fencing triggers, and both nodes remain non-learner voting members. The test times out after 1200s with:
expected 2 members with exactly one learner, both nodes are non-learners

Expected results:

The function should detect the IP address family and use ip6tables for IPv6 addresses. The network partition should trigger fencing, member removal, and subsequent recovery.

Additional info:

The same function is also used by the BMC credential rotation test (should recover from BMC credential rotation with fencing), which is equally affected on IPv6 clusters.

Failing job: periodic-ci-openshift-release-main-nightly-4.22-e2e-metal-ovn-two-node-fencing-ipv6-recovery-techpreview #2022978966146519040

Bug location:

origin/test/extended/util/nodes.go:118-129 — TriggerNetworkDisruption function.

Fix:

Detect the address family from the peer IP and select the correct firewall command:

iptablesCmd := "iptables"
if net.ParseIP(peerIP).To4() == nil

Then use iptablesCmd in place of the hardcoded "iptables" in both the block and cleanup commands.