Skip to content

test/extended/networking: OCPBUGS-82501 - Fix DualStack EgressFirewal…#31147

Open
shreyasbe wants to merge 1 commit intoopenshift:mainfrom
shreyasbe:DS_OCPBUGS_82501_fix
Open

test/extended/networking: OCPBUGS-82501 - Fix DualStack EgressFirewal…#31147
shreyasbe wants to merge 1 commit intoopenshift:mainfrom
shreyasbe:DS_OCPBUGS_82501_fix

Conversation

@shreyasbe
Copy link
Copy Markdown

@shreyasbe shreyasbe commented May 8, 2026

…l CI fail on AWS

Summary by CodeRabbit

Release Notes

  • Tests
    • Enhanced egress firewall testing with comprehensive DNS resolution and connectivity diagnostics.
    • Improved network validation logging providing detailed troubleshooting information.
    • Refined test assertions for better coverage of domain connectivity scenarios.

…l CI fail on AWS

Signed-off-by: Shreyas B <shbehera@redhat.com>
Signed-off-by: Shreyas Be <52690686+shreyasbe@users.noreply.github.com>
@openshift-merge-bot
Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented May 8, 2026

Walkthrough

The sendEgressFwTraffic test function was enhanced to add detailed DNS-resolution and curl diagnostics for egress firewall tests on redhat.com and www.redhat.com, replacing simple quiet curl checks with multi-step verbose inspection of name resolution, connection details, and HTTP responses.

Changes

Egress Firewall Test Diagnostics

Layer / File(s) Summary
DNS and Verbose Curl Logging
test/extended/networking/egress_firewall.go (lines 159–182, 205–224)
nslookup and verbose curl with connect timeout are executed for both domains, capturing and logging resolution and connection details; a second curl invocation logs the resolved remote IP and HTTP status code.
Assertion Updates
test/extended/networking/egress_firewall.go (lines 228–230)
Error expectations are updated to use the new diagnostic variables: expectNoError for redhat.com and expectError for www.redhat.com.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

🚥 Pre-merge checks | ✅ 7 | ❌ 5

❌ Failed checks (5 warnings)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
Test Structure And Quality ⚠️ Warning Missing assertion messages (13 of 14 expectNoError calls). Pod cleanup via inline calls not BeforeEach/AfterEach. sendEgressFwTraffic tests multiple unrelated behaviors. Add meaningful messages to expectNoError/expectError. Use BeforeEach/AfterEach for pod resource management. Refactor helpers mixing multiple behaviors.
Microshift Test Compatibility ⚠️ Warning New test uses Infrastructure API (config.openshift.io/v1) which is not available on MicroShift. Only Route and SecurityContextConstraints are supported. Add [apigroup:config.openshift.io] tag to test names or guard with IsMicroShiftCluster check. Infrastructure API accessed at lines 64, 143.
Single Node Openshift (Sno) Test Compatibility ⚠️ Warning New tests call findAppropriateNodes(DIFFERENT_NODE) requiring ≥2 nodes. No SNO-specific skip guards found ([Skipped:SingleReplicaTopology] or exutil.IsSingleNode() checks). Add [Skipped:SingleReplicaTopology] labels to test names or add exutil.IsSingleNode() checks in test bodies for SNO compatibility.
Ipv6 And Disconnected Network Test Compatibility ⚠️ Warning Tests require public internet access (google.com, redhat.com, amazon.com, apple.com) and hardcoded IPv4 addresses (8.8.8.8, 1.1.1.1). Incompatible with IPv6-only disconnected environments. Add [Skipped:Disconnected] tag to test names. Use correctCIDRFamily() for CIDR values. Adapt tests with InIPv4ClusterContext() or GetIPAddressFamily() for IPv6 compatibility.
✅ Passed checks (7 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title references a specific bug fix (OCPBUGS-82501) and clearly indicates the test file being modified (test/extended/networking) with a focus on DualStack EgressFirewall CI issues on AWS.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed All test names are static and deterministic with no dynamic content like generated suffixes, timestamps, UUIDs, or IP addresses in test titles.
Topology-Aware Scheduling Compatibility ✅ Passed This PR modifies test code in test/extended/networking/egress_firewall.go, not deployment manifests, operator code, or controllers. The check is not applicable to test-only changes.
Ote Binary Stdout Contract ✅ Passed All logging is within test case blocks using framework-instrumented e2e.Logf(). No process-level code outputs to stdout.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

  • Generate code and open pull requests
  • Plan features and break down work
  • Investigate incidents and troubleshoot customer tickets together
  • Automate recurring tasks and respond to alerts with triggers
  • Summarize progress and report instantly

Built for teams:

  • Shared memory across your entire org—no repeating context
  • Per-thread sandboxes to safely plan and execute work
  • Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@openshift-ci openshift-ci Bot requested review from arghosh93 and tssurya May 8, 2026 03:53
@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented May 8, 2026

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: shreyasbe
Once this PR has been reviewed and has the lgtm label, please assign jcaamano for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (2)
test/extended/networking/egress_firewall.go (2)

225-229: ⚡ Quick win

Duplicate g.By step name makes CI output ambiguous

Line 227 uses the same g.By("sending traffic that does not match allow dns rule") already present at line 204 for www.redhat.com. Two test steps with the same name in a single It block are hard to distinguish in CI logs, which undermines the diagnostic intent of this change.

🔧 Proposed fix
-	g.By("sending traffic that does not match allow dns rule")
-	_, err = oc.Run("exec").Args(pod, "--", "curl", "-q", "-s", "-I", "-m5", "https://www.apple.com").Output()
+	g.By("sending traffic to www.apple.com that does not match allow dns rule")
+	_, err = oc.Run("exec").Args(pod, "--", "curl", "-q", "-s", "-I", "-m5", "https://www.apple.com").Output()
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/extended/networking/egress_firewall.go` around lines 225 - 229,
Duplicate test step description: replace the repeated g.By("sending traffic that
does not match allow dns rule") used for the www.apple.com curl with a distinct
message so CI output is unambiguous (e.g., mention www.apple.com or "apple.com"
specifically); locate the g.By call paired with the curl command that runs
oc.Run("exec").Args(pod, "--", "curl", ... "https://www.apple.com") and update
the string passed to g.By to uniquely identify this step.

225-229: ⚡ Quick win

Disambiguate the g.By label for the www.apple.com step

Line 227 reuses the identical g.By("sending traffic that does not match allow dns rule") string already present at line 204 for www.redhat.com. Two indistinguishable step names in the same It block make CI log triage harder — the very scenario this PR is trying to improve.

🔧 Proposed fix
-	g.By("sending traffic that does not match allow dns rule")
-	_, err = oc.Run("exec").Args(pod, "--", "curl", "-q", "-s", "-I", "-m5", "https://www.apple.com").Output()
+	g.By("sending traffic to www.apple.com that does not match allow dns rule")
+	_, err = oc.Run("exec").Args(pod, "--", "curl", "-q", "-s", "-I", "-m5", "https://www.apple.com").Output()
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/extended/networking/egress_firewall.go` around lines 225 - 229, The test
step re-uses the same g.By message as the earlier www.redhat.com check, making
logs ambiguous; update the g.By call in the www.apple.com curl block (the line
invoking g.By before oc.Run("exec") for curl https://www.apple.com) to use a
distinct label that includes the hostname (e.g., mention "www.apple.com") so the
step is uniquely identifiable in CI logs.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@test/extended/networking/egress_firewall.go`:
- Around line 225-229: Duplicate test step description: replace the repeated
g.By("sending traffic that does not match allow dns rule") used for the
www.apple.com curl with a distinct message so CI output is unambiguous (e.g.,
mention www.apple.com or "apple.com" specifically); locate the g.By call paired
with the curl command that runs oc.Run("exec").Args(pod, "--", "curl", ...
"https://www.apple.com") and update the string passed to g.By to uniquely
identify this step.
- Around line 225-229: The test step re-uses the same g.By message as the
earlier www.redhat.com check, making logs ambiguous; update the g.By call in the
www.apple.com curl block (the line invoking g.By before oc.Run("exec") for curl
https://www.apple.com) to use a distinct label that includes the hostname (e.g.,
mention "www.apple.com") so the step is uniquely identifiable in CI logs.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: a33b059e-311a-49e4-aee8-37232d8756dc

📥 Commits

Reviewing files that changed from the base of the PR and between 65f4e3a and 83f0cf1.

📒 Files selected for processing (1)
  • test/extended/networking/egress_firewall.go

@openshift-merge-bot openshift-merge-bot Bot added the ready-for-human-review Indicates a PR has been reviewed by automated tools and is ready for human review label May 8, 2026
@shreyasbe
Copy link
Copy Markdown
Author

/test ?

@shreyasbe
Copy link
Copy Markdown
Author

/test e2e-aws-ovn

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented May 8, 2026

@shreyasbe: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/images 83f0cf1 link true /test images
ci/prow/e2e-aws-ovn 83f0cf1 link false /test e2e-aws-ovn

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@shreyasbe
Copy link
Copy Markdown
Author

/test e2e-aws-ovn-installer-dualstack-ipv4-primary-techpreview

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented May 8, 2026

@shreyasbe: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

/test e2e-aws-csi
/test e2e-aws-jenkins
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-image-registry
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-builds
/test e2e-gcp-ovn-image-ecosystem
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi
/test go-verify-deps
/test images
/test lint
/test okd-scos-images
/test unit
/test verify
/test verify-deps
/test verify-image-manifest-lists

The following commands are available to trigger optional jobs:

/test e2e-agnostic-ovn-cmd
/test e2e-aws-disruptive
/test e2e-aws-etcd-certrotation
/test e2e-aws-etcd-recovery
/test e2e-aws-ovn
/test e2e-aws-ovn-cgroupsv2
/test e2e-aws-ovn-edge-zones
/test e2e-aws-ovn-etcd-scaling
/test e2e-aws-ovn-kube-apiserver-rollout
/test e2e-aws-ovn-kubevirt
/test e2e-aws-ovn-serial-fast
/test e2e-aws-ovn-serial-ipsec
/test e2e-aws-ovn-serial-publicnet-1of2
/test e2e-aws-ovn-serial-publicnet-2of2
/test e2e-aws-ovn-single-node
/test e2e-aws-ovn-single-node-serial
/test e2e-aws-ovn-single-node-techpreview
/test e2e-aws-ovn-single-node-techpreview-serial
/test e2e-aws-ovn-single-node-upgrade
/test e2e-aws-ovn-upgrade
/test e2e-aws-ovn-upgrade-rollback
/test e2e-aws-ovn-upi
/test e2e-aws-proxy
/test e2e-azure
/test e2e-azure-ovn-etcd-scaling
/test e2e-azure-ovn-upgrade
/test e2e-baremetalds-kubevirt
/test e2e-external-aws
/test e2e-external-aws-ccm
/test e2e-external-vsphere-ccm
/test e2e-gcp-disruptive
/test e2e-gcp-fips-serial-1of2
/test e2e-gcp-fips-serial-2of2
/test e2e-gcp-ovn-etcd-scaling
/test e2e-gcp-ovn-kube-apiserver-rollout
/test e2e-gcp-ovn-rt-upgrade
/test e2e-gcp-ovn-techpreview
/test e2e-gcp-ovn-techpreview-serial-1of2
/test e2e-gcp-ovn-techpreview-serial-2of2
/test e2e-gcp-ovn-usernamespace
/test e2e-hypershift-conformance
/test e2e-metal-ipi-ovn
/test e2e-metal-ipi-ovn-bgp-virt-dualstack
/test e2e-metal-ipi-ovn-bgp-virt-dualstack-techpreview
/test e2e-metal-ipi-ovn-dualstack
/test e2e-metal-ipi-ovn-dualstack-bgp
/test e2e-metal-ipi-ovn-dualstack-bgp-local-gw
/test e2e-metal-ipi-ovn-dualstack-local-gateway
/test e2e-metal-ipi-ovn-kube-apiserver-rollout
/test e2e-metal-ipi-serial-1of2
/test e2e-metal-ipi-serial-2of2
/test e2e-metal-ipi-serial-ovn-ipv6-1of2
/test e2e-metal-ipi-serial-ovn-ipv6-2of2
/test e2e-metal-ipi-virtualmedia
/test e2e-metal-ovn-single-node-live-iso
/test e2e-metal-ovn-single-node-with-worker-live-iso
/test e2e-metal-ovn-two-node-arbiter
/test e2e-metal-ovn-two-node-fencing
/test e2e-metal-ovn-two-node-fencing-recovery
/test e2e-openstack-dualstack-v6primary
/test e2e-openstack-ovn
/test e2e-openstack-serial
/test e2e-vsphere-ovn-etcd-scaling
/test okd-scos-e2e-aws-ovn

Use /test all to run the following jobs that were automatically triggered:

pull-ci-openshift-origin-main-go-verify-deps
pull-ci-openshift-origin-main-images
pull-ci-openshift-origin-main-lint
pull-ci-openshift-origin-main-okd-scos-images
pull-ci-openshift-origin-main-unit
pull-ci-openshift-origin-main-verify
pull-ci-openshift-origin-main-verify-deps
Details

In response to this:

/test e2e-aws-ovn-installer-dualstack-ipv4-primary-techpreview

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ready-for-human-review Indicates a PR has been reviewed by automated tools and is ready for human review

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant