cni: update MCS-blocking code to do both IPv4 and IPv6

go-controller/pkg/cni/helper_linux.go

@@ -20,6 +20,7 @@ import (
 	"github.com/vishvananda/netlink"
 
 	"k8s.io/apimachinery/pkg/util/wait"
+	utilnet "k8s.io/utils/net"
 )
 
 func renameLink(curName, newName string) error {
@@ -308,15 +309,39 @@ func (pr *PodRequest) ConfigureInterface(namespace string, podName string, ifInf
 		}
 	}
 
+	// Block access to certain things
 	err = netns.Do(func(hostNS ns.NetNS) error {
-		// Block access to certain things
+		var hasIPv4, hasIPv6 bool
+		for _, ip := range ifInfo.IPs {
+			if utilnet.IsIPv6CIDR(ip) {
+				hasIPv6 = true
+			} else {
+				hasIPv4 = true
+			}
+		}
+
 		for _, args := range iptablesCommands {
-			out, err := exec.Command("iptables", args...).CombinedOutput()
-			if err != nil {
-				return fmt.Errorf("could not set up pod iptables rules: %s", string(out))
+			if hasIPv4 {
+				out, err := exec.Command("iptables", args...).CombinedOutput()
+				if err != nil {
+					return fmt.Errorf("could not set up pod iptables rules: %s", string(out))
+				}
+			}
+			if hasIPv6 {
+				out, err := exec.Command("ip6tables", args...).CombinedOutput()
+				if err != nil {
+					return fmt.Errorf("could not set up pod iptables rules: %s", string(out))
+				}
 			}
 		}
 
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	err = netns.Do(func(hostNS ns.NetNS) error {
 		if _, err := os.Stat("/proc/sys/net/ipv6/conf/all/dad_transmits"); !os.IsNotExist(err) {
 			err = setSysctl("/proc/sys/net/ipv6/conf/all/dad_transmits", 0)
 			if err != nil {