From the openQA meeting (roughly):

Adam: There is a staging instance of openqa, it's just not staging in the way infra thinks of it, and we can try rolling out the iptables to nftables migration on it this week sometime just open a ticket and tag me.

So here's the ticket, and the tag: @adamwill

Also this is the ansible PR that should be all we need: https://pagure.io/fedora-infra/ansible/pull-request/2588