Fix iptables symlink detection to use explicit iptables-legacy command

[Copilot]

Problem

When detecting iptables version, the Azure NPM code correctly uses iptables-nft for NFT detection, but when legacy iptables is detected, it uses the iptables symlink instead of the explicit iptables-legacy command. This causes warning messages and potential inconsistencies.

From the issue logs:

I0708 16:14:16.001722       1 chain-management_linux.go:523] executing iptables command [iptables-nft] with args [-w 60 -L KUBE-IPTABLES-HINT -t mangle -n]
2025/07/08 16:14:16 [1] error: There was an error running command: [iptables-nft -w 60 -L KUBE-IPTABLES-HINT -t mangle -n] Stderr: [exit status 1, # Warning: iptables-legacy tables present, use iptables-legacy to see them

Solution

Updated the iptables detection logic to use explicit commands for both NFT and legacy detection:

• NFT detection: iptables-nft (already working correctly)
• Legacy detection: iptables-legacy (fixed to use explicit command)

Changes

1. Added new constant: IptablesLegacyCmd = "iptables-legacy" in npm/util/const.go
2. Updated detection logic: Modified detectIptablesVersion() in npm/pkg/dataplane/policies/chain-management_linux.go to use util.IptablesLegacyCmd instead of util.IptablesLegacy
3. Updated tests: All test cases now expect iptables-legacy command calls

Before vs After

Before:

executing iptables command [iptables] with args [-w 60 -L KUBE-IPTABLES-HINT -t mangle -n]

After:

executing iptables command [iptables-legacy] with args [-w 60 -L KUBE-IPTABLES-HINT -t mangle -n]

Benefits

• ✅ Eliminates symlink warnings mentioned in the issue
• ✅ Consistent explicit command usage for both NFT and legacy detection
• ✅ Follows the same pattern: iptables-nft vs iptables-legacy
• ✅ No regression in existing functionality
• ✅ All existing tests pass

Testing

• All existing unit tests pass with updated expectations
• Detection logic correctly handles both NFT and legacy scenarios
• Commands are called in the expected sequence
• Validated against the exact issue scenario

Fixes #3777.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[github-actions]

This pull request is stale because it has been open for 2 weeks with no activity. Remove stale label or comment or this will be closed in 7 days

[github-actions]

Pull request closed due to inactivity.