Support IPv6 Secondary Interface in shiftstack-qa automation

[tusharjadhav3302]

Summary

• Add create_ipv6_secondary_networks.yml prepare task that creates IPv6 networks
  (slaac + dhcpstateless), subnets, and router for secondary worker interfaces
• Add configure_ipv6_secondary day2ops procedure that applies DHCP kernel arg
  MachineConfig, patches CNO with macvlan additionalNetworks, deploys test pods,
  and verifies pod-to-pod IPv6 connectivity
• Fix naming mismatch: validation now reads secondary_ip_protocol instead of
  non-existent network_secondary
• Add osp_verification_ipv6_secondary.yaml job definition (4-stable) for the scenario
• Add IPv6 secondary network config block to configs/global.yml

Details

Prepare phase:

• Creates 2 IPv6 networks with different RA modes (slaac, dhcpv6-stateless)
• Creates IPv6 subnets with appropriate RA/address modes
• Creates a router and attaches both subnets
• Registers resources for cleanup tracking

Install phase:

• Adds additionalNetworkIDs to install-config worker platform block when
  secondary_ip_protocol == 'ipv6', so Nova pre-creates IPv6 ports on workers

Post-install (day2ops procedure):

• Applies 05-worker-kernelarg-dhcp MachineConfig for ip=dhcp,dhcp6
• Waits for MCP update and cluster health
• Discovers IPv6 interfaces on workers via oc adm node-logs
• Patches CNO network.operator with macvlan additionalNetworks
• Deploys hello-openshift pods with IPv6 network annotations
• Disables port security on worker IPv6 ports (required for macvlan)
• Verifies pod-to-pod connectivity on both slaac and dhcpstateless networks
• Validates external reachability via oc debug node/ from worker nodes

Cleanup:

• Dedicated cleanup_ipv6_secondary.yml detaches subnets, removes router and networks
• Integrated into cleanup stage (runs before cluster destruction)

Future Scope (not in this PR)

• ci-framework-jobs integration: Add periodic pipeline scenario file
  (scenarios/baremetal/shiftstack/tests-ipv6-secondary.yml) pointing to the
  new job definition for automated Zuul scheduling.
• IPv6 VM connectivity testing: Deploy a standalone OpenStack VM attached to the
  IPv6 secondary networks for full VM-to-pod and pod-to-VM validation.
  Deferred because it requires admin-only OpenStack operations (image upload, flavor creation).
• Worker scaleup re-verification: After scaling up workers, re-scale IPv6 deployments
  and re-check connectivity.

Test Plan

• ansible-lint passes with production profile
• ci-framework-testproject Zuul run with osp_verification_ipv6_secondary.yaml
• IPv6 secondary networks created in OpenStack
• Workers have IPv6 interfaces after MachineConfig application
• NetworkAttachmentDefinition CRs created by CNO
• Pods can communicate over IPv6 secondary interfaces (same node + different nodes)
• External reachability validated via oc debug node/

Jira

https://redhat.atlassian.net/browse/OSPRH-6486

[tusharjadhav3302]

Manual Validation — End-to-End Pass

Environment: RHOSO 18.0 + OCP 4.22.4 (4-stable) on serval70 shiftstackclient pod

Result: PASSED

PLAY RECAP: ok=444  changed=94  unreachable=0  failed=0  skipped=125  rescued=0  ignored=2

Stage Timings

Stage	Duration
Cleanup + Prepare	~1 min 12 sec
Verification (cluster health)	30 min 13 sec
Day2Ops (IPv6 secondary)	40 min 13 sec
Total pipeline	~2 hours 3 min

Day2Ops breakdown: ~25 min MachineConfig rollout + ~15 min interface discovery/CNO/connectivity tests.

What Was Validated

• IPv6 networks (slaac + dhcpstateless), subnets, and router created in OpenStack
• Workers deployed with additionalNetworkIDs — IPv6 ports pre-attached by Nova
• DHCP MachineConfig applied, MCP rollout completed
• IPv6 interfaces discovered on ALL workers (enp4s0, enp5s0), NIC naming validated consistent
• CNO patched with macvlan additionalNetworks, NADs created
• Hello-openshift pods deployed with IPv6 annotation, addresses confirmed on net1
• Port security disabled on worker IPv6 ports
• Pod-to-pod connectivity verified (cross-node): Hello OpenShift!
• External reachability verified from worker node to pod (cross-node): Hello OpenShift!

Fixes Made During Testing

1. openstack.cloud.port requires network param — added network: "{{ item.network_id }}" (48ac74a)
2. Macvlan same-host limitation — rewrote external test to curl from a different worker than where the pod runs (9930f71)

Both fixes are included in the current branch head.

[ekuris-redhat]

lgtm , confirmed with TJ that it was tested.