From 309694ebde3411a6737321de9f19277255dbb21f Mon Sep 17 00:00:00 2001
From: whyour <imwhyour@gmail.com>
Date: Tue, 25 Aug 2026 10:15:32 +0800
Subject: [PATCH] ci(ql3): load bridge netfilter for nested k3s

---
 .github/workflows/ql3-security-administration-live.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/ql3-security-administration-live.yml b/.github/workflows/ql3-security-administration-live.yml
index 10fe387e..6b0d7b27 100644
--- a/.github/workflows/ql3-security-administration-live.yml
+++ b/.github/workflows/ql3-security-administration-live.yml
@@ -97,6 +97,15 @@ jobs:
       - name: Preload the digest-bound K3s distribution
         run: docker pull rancher/k3s:v1.34.3-k3s1
 
+      - name: Prepare Linux bridge netfilter for nested K3s
+        shell: bash
+        run: |
+          set -euo pipefail
+          sudo modprobe br_netfilter
+          test -e /proc/sys/net/bridge/bridge-nf-call-iptables
+          sudo sysctl -w net.ipv4.ip_forward=1
+          sudo sysctl -w net.bridge.bridge-nf-call-iptables=1
+
       - name: Prove Security Administration through K3s, PostgreSQL and PVC
         env:
           QL3_SECURITY_ADMINISTRATION_KUBERNETES_LIVE: '1'