SREP-862: Add support for `osdctl network verify-egress --pod-mode` #784

joshbranham · 2025-08-05T22:50:00Z

This extends the existing osdctl network verify-egress command to support our new --pod-mode feature in osd-network-verifier.

It relies on OCM and Backplane to fetch cluster data, and then constructs the necessary config to perform egress validation.

Of note, the CaCert option is not supported, as this will be configured automatically since the verification runs as a Pod in the cluster.

This code was written in conjunction with claude, and commits reflect that.

Sample Run

> ./dist/osdctl_darwin_arm64_v8.0/osdctl network verify-egress --cluster-id 26lot29426h7hol5hi9saend50s6r5ab --pod-mode -S
2025/08/06 14:37:19 Preparing to run pod-based network verification in namespace openshift-network-diagnostics.
INFO[0002] Backplane URL retrieved via OCM environment: https://api.backplane.openshift.com
INFO[0002] No PagerDuty API Key configuration available. This will result in failure of `ocm-backplane login --pd <incident-id>` command.
INFO[0004] Backplane URL retrieved via OCM environment: https://api.backplane.openshift.com
INFO[0004] No PagerDuty API Key configuration available. This will result in failure of `ocm-backplane login --pd <incident-id>` command.
2025/08/06 14:37:23 Pod mode using backplane credentials for cluster: 26lot29426h7hol5hi9saend50s6r5ab
2025/08/06 14:37:23 Pod mode initialized with namespace: openshift-network-diagnostics
2025/08/06 14:37:23 Detected AWS region from OCM: us-east-1
Using egress URL list from https://api.github.com/repos/openshift/osd-network-verifier/contents/pkg/data/egress_lists/aws-classic.yaml?ref=main at SHA 997186fa8fbf863db4b071d246e7bb781bc1e796
Summary:
All tests passed!

Implement --pod-mode flag to run egress verification using Kubernetes Jobs instead of cloud instances, providing more accurate results by testing from within the actual cluster environment. Key features: - New --pod-mode flag enables Kubernetes-based verification - Automatic region detection from OCM for AWS clusters - Manual region override with --region flag - Configurable namespace with --namespace flag (default: openshift-network-diagnostics) - Custom kubeconfig support with --kubeconfig flag - Automatic probe switching to curl (required for pod mode) - Comprehensive input validation with clear error messages - Mutual exclusivity with cloud-specific flags Benefits: - No cloud credentials required - Tests actual cluster network environment - More accurate results than external instance testing - Secure execution with restrictive pod security contexts Usage examples: osdctl network verify-egress --cluster-id my-cluster --pod-mode osdctl network verify-egress --pod-mode --platform aws-classic --region us-east-1 Includes comprehensive unit test coverage with 21 new tests covering: - Input validation logic - Region detection (OCM vs manual) - Probe validation and switching - AWS config generation - Error handling scenarios 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

openshift-ci-robot · 2025-08-05T22:50:04Z

@joshbranham: This pull request references SREP-862 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

Details

In response to this:

This extends the existing osdctl network verify-egress command to support our new --pod-mode feature in osd-network-verifier.

It relies on OCM and Backplane to fetch cluster data, and then constructs the necessary config to perform egress validation.

Of note, the CaCert option is not supported, as this will be configured automatically since the verification runs as a Pod in the cluster.

This code was written in conjunction with claude, and commits reflect that.

TODO:

Cut a new release of osd-network-verifier and update go.mod to use that tag.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

joshbranham · 2025-08-05T22:50:05Z

/hold

openshift-ci-robot · 2025-08-05T22:54:16Z

@joshbranham: This pull request references SREP-862 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

Details

In response to this:

This extends the existing osdctl network verify-egress command to support our new --pod-mode feature in osd-network-verifier.

It relies on OCM and Backplane to fetch cluster data, and then constructs the necessary config to perform egress validation.

Of note, the CaCert option is not supported, as this will be configured automatically since the verification runs as a Pod in the cluster.

This code was written in conjunction with claude, and commits reflect that.

Sample Run
 ./dist/osdctl_darwin_arm64_v8.0/osdctl network verify-egress --cluster-id 26lot29426h7hol5hi9saend50s6r5ab --pod-mode --egress-timeout 30s -S
2025/08/05 16:53:29 Preparing to run pod-based network verification in namespace openshift-network-diagnostics.
INFO[0002] Backplane URL retrieved via OCM environment: https://api.backplane.openshift.com
INFO[0002] No PagerDuty API Key configuration available. This will result in failure of `ocm-backplane login --pd <incident-id>` command.
INFO[0003] Backplane URL retrieved via OCM environment: https://api.backplane.openshift.com
INFO[0003] No PagerDuty API Key configuration available. This will result in failure of `ocm-backplane login --pd <incident-id>` command.
2025/08/05 16:53:32 Pod mode using osdcloud credentials for cluster: 26lot29426h7hol5hi9saend50s6r5ab
2025/08/05 16:53:32 Pod mode initialized with namespace: openshift-network-diagnostics
2025/08/05 16:53:32 Detected AWS region from OCM: us-east-1
Using egress URL list from https://api.github.com/repos/openshift/osd-network-verifier/contents/pkg/data/egress_lists/aws-classic.yaml?ref=main at SHA 997186fa8fbf863db4b071d246e7bb781bc1e796
Summary:
All tests passed!
TODO

Cut a new release of osd-network-verifier and update go.mod to use that tag.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

joshbranham · 2025-08-05T23:01:38Z

/label tide/merge-method-squash

docs/osdctl_network_verify-egress.md

dakotalongRH · 2025-08-06T19:08:51Z

/lgtm

openshift-ci-robot · 2025-08-06T20:38:00Z

@joshbranham: This pull request references SREP-862 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

Details

In response to this:

This extends the existing osdctl network verify-egress command to support our new --pod-mode feature in osd-network-verifier.

It relies on OCM and Backplane to fetch cluster data, and then constructs the necessary config to perform egress validation.

Of note, the CaCert option is not supported, as this will be configured automatically since the verification runs as a Pod in the cluster.

This code was written in conjunction with claude, and commits reflect that.

Sample Run
> ./dist/osdctl_darwin_arm64_v8.0/osdctl network verify-egress --cluster-id 26lot29426h7hol5hi9saend50s6r5ab --pod-mode -S
2025/08/06 14:37:19 Preparing to run pod-based network verification in namespace openshift-network-diagnostics.
INFO[0002] Backplane URL retrieved via OCM environment: https://api.backplane.openshift.com
INFO[0002] No PagerDuty API Key configuration available. This will result in failure of `ocm-backplane login --pd <incident-id>` command.
INFO[0004] Backplane URL retrieved via OCM environment: https://api.backplane.openshift.com
INFO[0004] No PagerDuty API Key configuration available. This will result in failure of `ocm-backplane login --pd <incident-id>` command.
2025/08/06 14:37:23 Pod mode using backplane credentials for cluster: 26lot29426h7hol5hi9saend50s6r5ab
2025/08/06 14:37:23 Pod mode initialized with namespace: openshift-network-diagnostics
2025/08/06 14:37:23 Detected AWS region from OCM: us-east-1
Using egress URL list from https://api.github.com/repos/openshift/osd-network-verifier/contents/pkg/data/egress_lists/aws-classic.yaml?ref=main at SHA 997186fa8fbf863db4b071d246e7bb781bc1e796
Summary:
All tests passed!
TODO

Cut a new release of osd-network-verifier and update go.mod to use that tag.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2025-08-06T20:38:58Z

@joshbranham: This pull request references SREP-862 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

Details

In response to this:

This extends the existing osdctl network verify-egress command to support our new --pod-mode feature in osd-network-verifier.

It relies on OCM and Backplane to fetch cluster data, and then constructs the necessary config to perform egress validation.

Of note, the CaCert option is not supported, as this will be configured automatically since the verification runs as a Pod in the cluster.

This code was written in conjunction with claude, and commits reflect that.

Sample Run

> ./dist/osdctl_darwin_arm64_v8.0/osdctl network verify-egress --cluster-id 26lot29426h7hol5hi9saend50s6r5ab --pod-mode -S
2025/08/06 14:37:19 Preparing to run pod-based network verification in namespace openshift-network-diagnostics.
INFO[0002] Backplane URL retrieved via OCM environment: https://api.backplane.openshift.com
INFO[0002] No PagerDuty API Key configuration available. This will result in failure of `ocm-backplane login --pd <incident-id>` command.
INFO[0004] Backplane URL retrieved via OCM environment: https://api.backplane.openshift.com
INFO[0004] No PagerDuty API Key configuration available. This will result in failure of `ocm-backplane login --pd <incident-id>` command.
2025/08/06 14:37:23 Pod mode using backplane credentials for cluster: 26lot29426h7hol5hi9saend50s6r5ab
2025/08/06 14:37:23 Pod mode initialized with namespace: openshift-network-diagnostics
2025/08/06 14:37:23 Detected AWS region from OCM: us-east-1
Using egress URL list from https://api.github.com/repos/openshift/osd-network-verifier/contents/pkg/data/egress_lists/aws-classic.yaml?ref=main at SHA 997186fa8fbf863db4b071d246e7bb781bc1e796
Summary:
All tests passed!

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

joshbranham · 2025-08-06T21:54:50Z

/retest

joshbranham · 2025-08-06T22:01:02Z

/unhold

openshift-ci · 2025-08-06T22:32:22Z

@joshbranham: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

reedcort · 2025-08-07T15:06:20Z

/lgtm

openshift-ci · 2025-08-07T15:12:58Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dakotalongRH, joshbranham, reedcort

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [joshbranham]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

…penshift#784) * Bump osd-network-verifier and dependencies * Add pod mode support to osdctl network verify-egress Implement --pod-mode flag to run egress verification using Kubernetes Jobs instead of cloud instances, providing more accurate results by testing from within the actual cluster environment. Key features: - New --pod-mode flag enables Kubernetes-based verification - Automatic region detection from OCM for AWS clusters - Manual region override with --region flag - Configurable namespace with --namespace flag (default: openshift-network-diagnostics) - Custom kubeconfig support with --kubeconfig flag - Automatic probe switching to curl (required for pod mode) - Comprehensive input validation with clear error messages - Mutual exclusivity with cloud-specific flags Benefits: - No cloud credentials required - Tests actual cluster network environment - More accurate results than external instance testing - Secure execution with restrictive pod security contexts Usage examples: osdctl network verify-egress --cluster-id my-cluster --pod-mode osdctl network verify-egress --pod-mode --platform aws-classic --region us-east-1 Includes comprehensive unit test coverage with 21 new tests covering: - Input validation logic - Region detection (OCM vs manual) - Probe validation and switching - AWS config generation - Error handling scenarios 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> * Use backplane as preference for getting k8s credentials * Docs and fmt * Consolidate and cleanup tests * Pull in actual osd-network-verifier release, update region flag --------- Co-authored-by: Claude <noreply@anthropic.com>

joshbranham and others added 3 commits August 5, 2025 15:36

Bump osd-network-verifier and dependencies

a715e84

Use backplane as preference for getting k8s credentials

eb9a85c

joshbranham self-assigned this Aug 5, 2025

joshbranham added the kind/feature Categorizes issue or PR as related to a new feature. label Aug 5, 2025

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Aug 5, 2025

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 5, 2025

openshift-ci bot requested review from dustman9000 and fahlmant August 5, 2025 22:50

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 5, 2025

openshift-ci bot added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Aug 5, 2025

joshbranham added 2 commits August 5, 2025 17:02

Docs and fmt

7756680

Consolidate and cleanup tests

4fb6843

geowa4 reviewed Aug 6, 2025

View reviewed changes

docs/osdctl_network_verify-egress.md Outdated Show resolved Hide resolved

openshift-ci bot assigned dakotalongRH Aug 6, 2025

openshift-ci bot added lgtm Indicates that a PR is ready to be merged. and removed lgtm Indicates that a PR is ready to be merged. labels Aug 6, 2025

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 6, 2025

Pull in actual osd-network-verifier release, update region flag

558fcaf

joshbranham force-pushed the feature/add-network-verifier-pod-mode branch from 29e33f5 to 558fcaf Compare August 6, 2025 22:13

openshift-ci bot assigned reedcort Aug 7, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Aug 7, 2025

openshift-merge-bot bot merged commit 510d4d1 into openshift:master Aug 7, 2025
7 checks passed

joshbranham deleted the feature/add-network-verifier-pod-mode branch August 7, 2025 15:17

SREP-862: Add support for osdctl network verify-egress --pod-mode #784

SREP-862: Add support for osdctl network verify-egress --pod-mode #784

Uh oh!

Conversation

joshbranham commented Aug 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Sample Run

Uh oh!

openshift-ci-robot commented Aug 5, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

joshbranham commented Aug 5, 2025

Uh oh!

openshift-ci-robot commented Aug 5, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Sample Run

TODO

Uh oh!

joshbranham commented Aug 5, 2025

Uh oh!

Uh oh!

dakotalongRH commented Aug 6, 2025

Uh oh!

openshift-ci-robot commented Aug 6, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Sample Run

TODO

Uh oh!

openshift-ci-robot commented Aug 6, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Sample Run

Uh oh!

joshbranham commented Aug 6, 2025

Uh oh!

joshbranham commented Aug 6, 2025

Uh oh!

openshift-ci bot commented Aug 6, 2025

Uh oh!

reedcort commented Aug 7, 2025

Uh oh!

openshift-ci bot commented Aug 7, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

SREP-862: Add support for `osdctl network verify-egress --pod-mode` #784

SREP-862: Add support for `osdctl network verify-egress --pod-mode` #784

joshbranham commented Aug 5, 2025 •

edited

Loading

openshift-ci-robot commented Aug 5, 2025 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented Aug 5, 2025 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented Aug 6, 2025 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented Aug 6, 2025 •

edited by openshift-ci bot

Loading