Porting Duplicate MAC Test to Origin - #31478

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/extended/networking/egressip_helpers.go`:
- Around line 1873-1880: Update findNodeEgressIPsBaremetal around the ipnetStr
selection and getFirstFreeIPs call to prevent IPv6 CIDRs from reaching unbounded
address enumeration. Restrict this bare-metal allocation path to IPv4, or
validate the selected CIDR’s prefix length before calling getFirstFreeIPs and
return a clear error for unsupported IPv6 ranges.
- Around line 1839-1846: Handle the error returned by listEgressIPs in the
surrounding helper instead of ignoring it: return or propagate the error
immediately when it is non-nil, and only iterate over egressipList.Items to
populate reservedIPs after a successful call.
- Around line 1790-1824: Add a preflight check before the retry loop that
verifies the selected arping or ndisc6 binary is available in the probe pod,
using the existing adminExecInPod execution context. If the check fails, return
immediately with an error explicitly naming the missing binary; only enter the
MAC-probing loop after presence is confirmed.

In `@test/extended/networking/egressip.go`:
- Around line 771-780: Update the shutdown verification around the nftChainFound
select to close stopChecking exactly once: remove the timeout-branch close and
register a defer immediately after starting the checker goroutine to close the
channel. Preserve the existing timeout failure behavior and successful
verification flow.
- Around line 838-846: Update the nftables cleanup verification around
adminExecInPod so it always validates the command output, including when the
command returns a non-zero error because the table is absent. Retain only the
“No such file” matcher, and fail explicitly for unexpected adminExecInPod errors
instead of logging success unconditionally.
- Around line 694-705: Update the networking test flow around
findBridgePhysicalInterface to resolve and retain separate physical interface
names for egressNode1Name, egressNode2Name, and the probe node. Use each node’s
matching interface for getNodeInterfaceMAC, the discovery command, and
checkForDuplicateMACOnNode instead of reusing egressNode1Name’s interface.

---

Nitpick comments:
In `@test/extended/networking/egressip.go`:
- Around line 639-642: Update the egress-label cleanup in the test’s AfterEach
block to track which worker nodes were labeled by this test and remove
k8s.ovn.org/egress-assignable only from those nodes. Preserve pre-existing
labels on all other nodes, using the existing worker-node setup and labeling
flow to maintain the tracked-node set.
- Around line 738-762: Replace the per-tick oc.AsAdmin().Run("debug") invocation
in the nftChainFound polling goroutine with a long-lived node debug session
established before polling, and execute a shell loop inside that session to
repeatedly check nftChainCheckCmd locally at the required interval. Ensure the
session remains active through ovnkube-node termination, signals nftChainFound
when the command detects “FOUND,” and still exits cleanly via stopChecking with
proper resource cleanup.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/extended/networking/egressip.go`:
- Around line 664-667: In the EgressIP validation flow after
findNodeEgressIPsBaremetal returns, assert that nodeEgressIPMap[egressNode1Name]
contains at least one address before indexing element 0. Keep the existing error
assertion and logging behavior, but report a clear test failure when no EgressIP
was allocated instead of allowing an index-out-of-range panic.
- Around line 593-607: Update the platform check in the egress IP test to read
the type from infra.Status.PlatformStatus.Type instead of
infra.Spec.PlatformSpec.Type. Guard against a nil PlatformStatus and preserve
the existing cloud-platform skip behavior when the status type matches an
unsupported platform.
- Around line 733-764: Update the nftables monitoring goroutine around
nftChainCheckCmd to use a separate CLI instance from the main test path,
preventing concurrent mutation of shared oc command state during Output
execution. Also increase the ticker interval beyond 200ms to allow each oc debug
invocation to complete without queuing repeated commands and adding unnecessary
cluster load.
- Around line 711-726: Replace the isIPv6-based branching in the discovery and
duplicate-MAC validation flow with a family check derived from
net.ParseIP(egressIPStr).To4() == nil. Use that result to select the IPv6 ndisc6
command and regex for IPv6 allocated addresses, while preserving the arping path
for IPv4 addresses, including dual-stack clusters.