Egress PNI support for CLI by danielayaz · Pull Request #3258 · confluentinc/cli

Daniel Ayaz (danielayaz) · 2026-02-11T04:09:45Z

Release Notes

Breaking Changes

PLACEHOLDER

New Features

Add --routes flag to network access-point private-network-interface create and update commands. Display egress routes in describe and list output.

Bug Fixes

PLACEHOLDER

Checklist

What

Adds --routes flag (comma-separated CIDRs) to PNI access point create/update commands, and displays egress_routes in describe/list output. Uses internal SDK v0.11.0 for the egress_routes field. TODO: Replace with public SDK once released.

Blast Radius

Low. Additive optional flag, no existing behavior changed.

References

https://confluentinc.atlassian.net/browse/APIE-778

Test & Review

Bug bash doc for CLI: https://confluentinc.atlassian.net/wiki/spaces/~71202022dd5651f4f94e99a18f5bef3de17c2d/pages/5155718005/Egress+PNI+CLI+Bug+Bash+Manual+Tests+Overview

confluent-cla-assistant · 2026-02-11T04:09:56Z

🎉 All Contributor License Agreements have been signed. Ready to merge.
_{Please push an empty commit if you would like to re-run the checks to verify CLA status for all contributors.}

Copilot

Pull request overview

Adds CLI support for configuring and displaying egress CIDR routes on AWS Access Point Private Network Interface resources, including wiring through to the networking-access-point SDK model and updating integration test fixtures accordingly.

Changes:

Add --routes support to network access-point private-network-interface create|update and plumb EgressRoutes into request payloads.
Include “Egress Routes” in human and JSON outputs for describe/list/update flows.
Update test server + golden fixtures to reflect the new field and add new integration test cases.

Reviewed changes

Copilot reviewed 18 out of 19 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
`internal/network/command_access_point_private_network_interface_create.go`	Adds `--routes` flag and sets `EgressRoutes` in AWS PNI create payload.
`internal/network/command_access_point_private_network_interface_update.go`	Adds `--routes` flag and sets `EgressRoutes` in AWS PNI update payload.
`internal/network/command_access_point_private_network_interface_list.go`	Adds `EgressRoutes` to list output model population.
`internal/network/command_access_point_private_network_interface.go`	Extends output struct + printing to include `EgressRoutes`.
`test/test-server/networking_handlers.go`	Test server returns default `EgressRoutes` for AWS PNI and supports updating routes.
`test/network_test.go`	Adds create-with-routes and update-routes integration test cases.
`test/fixtures/output/network/access-point/private-network-interface/create-help.golden`	Updates help text to document `--routes`.
`test/fixtures/output/network/access-point/private-network-interface/create-with-routes.golden`	New golden output for create including routes.
`test/fixtures/output/network/access-point/private-network-interface/update-help.golden`	Updates help text to document `--routes`.
`test/fixtures/output/network/access-point/private-network-interface/update-autocomplete.golden`	Updates autocomplete output for new flag.
`test/fixtures/output/network/access-point/private-network-interface/update.golden`	Adds Egress Routes row to update output.
`test/fixtures/output/network/access-point/private-network-interface/update-network-interfaces.golden`	Adds Egress Routes row to update output when updating ENIs.
`test/fixtures/output/network/access-point/private-network-interface/update-routes.golden`	New golden output for update routes case.
`test/fixtures/output/network/access-point/private-network-interface/list.golden`	Adds Egress Routes column to list table output.
`test/fixtures/output/network/access-point/private-network-interface/list-json.golden`	Adds `egress_routes` field to list JSON output.
`test/fixtures/output/network/access-point/private-network-interface/describe.golden`	Adds Egress Routes row to describe output.
`test/fixtures/output/network/access-point/private-network-interface/describe-json.golden`	Adds `egress_routes` field to describe JSON output.
`go.mod`	Adds a `replace` to redirect `networking-access-point` to an internal module version.
`go.sum`	Updates dependency checksums for the new/replaced SDK module.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-11T04:19:42Z

test/network_test.go

 func (s *CLITestSuite) TestNetworkAccessPointPrivateNetworkInterfaceCreate() {
 	tests := []CLITest{
 		{args: "network access-point private-network-interface create --cloud aws --gateway gw-123456 --network-interfaces eni-00000000000000000,eni-00000000000000001 --account 000000000000", fixture: "network/access-point/private-network-interface/create.golden"},
+		{args: "network access-point private-network-interface create --cloud aws --gateway gw-123456 --network-interfaces eni-00000000000000000,eni-00000000000000001 --account 000000000000 --routes 172.31.0.0/16,192.168.1.0/24", fixture: "network/access-point/private-network-interface/create-with-routes.golden"},
 	}


The PR description still contains placeholder Release Notes entries and an unchecked checklist. Please complete the Release Notes (and remove placeholders) and update the checklist/testing sections before merging so reviewers/users can understand the customer-facing impact and verification status.

Copilot · 2026-02-11T04:19:43Z

internal/network/command_access_point_private_network_interface_update.go

 	if err != nil {
 		return err
 	}
-	if len(networkInterfaces) > 0 {
+
+	routes, err := cmd.Flags().GetStringSlice("routes")


This update request always includes Spec.DisplayName (set earlier from the --name flag defaulting to ""), so running update with only --network-interfaces or --routes may unintentionally clear the access point display name. Consider only setting DisplayName in the payload when cmd.Flags().Changed("name") is true (and otherwise leaving it unset).

Copilot · 2026-02-11T04:19:43Z

test/test-server/networking_handlers.go

 			if networkInterfaces := body.Spec.GetConfig().NetworkingV1AwsPrivateNetworkInterface.GetNetworkInterfaces(); len(networkInterfaces) > 0 {
 				accessPoint.Spec.Config.NetworkingV1AwsPrivateNetworkInterface.SetNetworkInterfaces(body.Spec.GetConfig().NetworkingV1AwsPrivateNetworkInterface.GetNetworkInterfaces())
 			}
+			if routes := body.Spec.GetConfig().NetworkingV1AwsPrivateNetworkInterface.GetEgressRoutes(); len(routes) > 0 {
+				accessPoint.Spec.Config.NetworkingV1AwsPrivateNetworkInterface.SetEgressRoutes(body.Spec.GetConfig().NetworkingV1AwsPrivateNetworkInterface.GetEgressRoutes())


In this handler, the response access point’s display name is updated unconditionally later via accessPoint.Spec.SetDisplayName(body.Spec.GetDisplayName()). For patch-style updates where display_name is omitted, GetDisplayName() typically returns "", so this can unintentionally wipe the existing name. Consider guarding the name update with a nil check on the incoming DisplayName pointer (consistent with other update handlers in this file).

Copilot · 2026-02-11T04:19:43Z

go.mod

 	sigs.k8s.io/yaml v1.3.0 // indirect
 )
+
+replace github.com/confluentinc/ccloud-sdk-go-v2/networking-access-point => github.com/confluentinc/ccloud-sdk-go-v2-internal/networking-access-point v0.11.0


This replace pins github.com/confluentinc/ccloud-sdk-go-v2/networking-access-point to the ccloud-sdk-go-v2-internal module. Since go.mod still requires networking-access-point v0.5.0, this creates a confusing version mismatch (the build will use the replacement even though the required version is older). Consider bumping the required version to match the replacement, and confirm whether introducing a dependency on the -internal module is intended for all consumers/build environments.

Co-authored-by: Cursor <cursoragent@cursor.com> # Conflicts: # go.sum

Egress PNI for CLI done

629e19d

Copilot AI review requested due to automatic review settings February 11, 2026 04:09

Daniel Ayaz (danielayaz) requested a review from a team as a code owner February 11, 2026 04:09

Copilot started reviewing on behalf of Daniel Ayaz (danielayaz) February 11, 2026 04:10 View session

Copilot AI reviewed Feb 11, 2026

View reviewed changes

Merge remote-tracking branch 'origin/main' into egress_pni_cli

867f5bb

Co-authored-by: Cursor <cursoragent@cursor.com> # Conflicts: # go.sum

Steven Gagniere (sgagniere) approved these changes Feb 11, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

Egress PNI support for CLI#3258

Egress PNI support for CLI#3258
Daniel Ayaz (danielayaz) wants to merge 2 commits intomainfrom
egress_pni_cli

Daniel Ayaz (danielayaz) commented Feb 11, 2026 •

edited

Loading

Uh oh!

confluent-cla-assistant bot commented Feb 11, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 11, 2026

Uh oh!

Copilot AI Feb 11, 2026

Uh oh!

Copilot AI Feb 11, 2026

Uh oh!

Copilot AI Feb 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Comments

Conversation

Daniel Ayaz (danielayaz) commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Checklist

What

Blast Radius

References

Test & Review

Uh oh!

confluent-cla-assistant bot commented Feb 11, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Daniel Ayaz (danielayaz) commented Feb 11, 2026 •

edited

Loading