[wmousa]

Summary

Removes the firewall/iptables leftovers from the control plane on main. Three commits:

1. Fence only through the SPDK RPC, drop the FirewallClient fallback. This is the main version of #1496, which targets R26.3, so main doesn't need a separate cherry-pick of #1496.

• port_block no longer routes fences to the legacy firewall API (FirewallClient, mgmt_ip:firewall_port) when node.spdk_version is empty or the RPC returns method-not-found. Every node upgraded from 25.10 had an empty spdk_version, and nothing listens on that port any more (ultra Testing K8s e2e run. Adding check for docker logs if it is not k8s #218).
• fw_api_client.py is deleted.
• The tests now fence through the SPDK RPCs, and there is a regression test.
• Main never had fix(spdk-start): pass the host's fence ports to the SPDK pod so the entrypoint stops flushing iptables (R26.3) #1484, so there is nothing to revert here.

2. Remove the dead plumbing behind it.

• firewall_port → FW_PORT:

  • the StorageNode.firewall_port field;
  • the spdk_process_start(firewall_port=) param in SNodeClient;
  • the field in both node-API SPDKParams;
  • the FW_PORT env on the SPDK container (docker env and the k8s template);
  • constants.FW_PORT_START.

  The SPDK image stopped reading FW_PORT with ultra Testing K8s e2e run. Adding check for docker logs if it is not k8s #218.

• utils.get_next_fw_port: nothing called it. Its tests are removed.

• Deprecated node API routes /snode/firewall_set_port and /snode/get_firewall: they already returned False and did nothing, but were still routes on the unauthenticated :5000 API.

• StorageNode.spdk_version: it was only read by the fallback removed in commit 1.

• The jc dependency (it parsed iptables output). uv.lock was regenerated with uv 0.12.22, the version docker/Dockerfile pins, which also drops ruamel-yaml and xmltodict. That uv writes revision = 5, and uv lock --check passes.

Removing a field from the hand-rolled BaseModel is safe for existing FDB records: from_dict only reads the model's declared attributes, so the stored firewall_port / spdk_version keys are ignored.

Not changed

• --snode-api-port / cluster.snode_api_port: its only reader was get_next_fw_port, so it no longer has any effect. It's part of the cluster-create CLI and the v1/v2 API, so removing it should be a separate interface change.
• install_deps.sh still installs iptables on Docker-mode hosts. Docker needs it.

Test plan

• ruff check: clean
• mypy simplyblock_web simplyblock_cli simplyblock_core: only the 2 asyncio.open_unix_connection errors that also occur on unmodified main when run on Windows
• Unit suite: 4054 passed. The 34 failures (31 in test_spdk_proxy_unit.py, 3 in test_lblk_persistent_names.py) are in files this PR does not touch. They look Windows-specific (the proxy tests use Unix sockets) and should pass on Linux CI.
• uv lock --check
• Integration tier (needs FDB): CI
• On a cluster: SPDK pod spec has no FW_PORT; fence and unfence work through nvmf_port_block

3. Remove utils.port_block (Max's review on #1496). With the fallback gone, the module was a pass-through:

• set_port: its 13 call sites all passed block= as a constant. Each now calls node.rpc_client(timeout=…, retry=…).nvmf_port_block(port) or .nvmf_port_unblock(port) directly, with the same budget it used before. The note on why fences need a short budget moved to RPCClient.nvmf_port_block.
• get_blocked_ports_set: the conversion to a set of port numbers moved into RPCClient.nvmf_get_blocked_ports, its only caller.
• is_port_blocked: removed; check_port_on_node does the check inline.
• Tests: they faked fencing by patching port_block.set_port, and that patch also told them which node each fence was for. The new tests._mocks.route_fences keeps that: it wraps each node's rpc_client so nvmf_port_block / nvmf_port_unblock reach the same (node, port, block) callback as before. In addition:
  • Source-text checks and "must not fence" checks now look for the RPC calls.
  • Mocks of nvmf_get_blocked_ports return a set.
  • The expansion simulator returns a set too.
• Local verification: the affected integration files can run with mocks, using the unit-tier FDB stub and --noconftest. That gives the same result before and after this commit: 302 passed, with the same environment-only failures. ftt2 and expansion_sim need their real fixtures, so CI is the check for those.

Found while doing this, not changed: the l2-fw / m2-fw cases in tests/integration/ftt2/test_restart_peer_states.py disconnect a peer when its mock server sees a firewall_set_port RPC. Fencing never reached the mock server, before or after this PR, and the server has no port RPCs, so those cases never trigger and just repeat their siblings. Making them real means adding nvmf_port_block to FTT2MockRpcServer and hooking that instead.

🤖 Generated with Claude Code

[mxsrc]

I like this, I'd only raise the same comment as on #1496 though.