[emy]

The egress firewall connectivity check could resolve to an IPv6 address on an IPv6-only cluster or an IPv4 address on a NAT64 cluster leading to inconsistent results. Add curl's -4 flag to the connectivity check in egress_firewall.go so it tests IPv4 reachability only.

Summary by CodeRabbit

• Bug Fixes
  • External connectivity checks now use IPv4, providing consistent results in environments where IPv6 connectivity may be unavailable. This improves the reliability of network egress validation without changing the destination or other probe settings.

[openshift-merge-bot]

Pipeline controller notification

This PR uses the pipeline controller for second-stage tests. Selection and triggering follow the repository configuration.

Use /test ? to list jobs and /pipeline help for commands.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: openshift/origin
• Branch: main
• File: .coderabbit.yaml
• Commit: 8ea11c2
• Layers: Repository YAML (base), Central YAML (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: b92d315e-6cfd-477c-b1d5-6d91c67ae9e4

📥 Commits

Reviewing files that changed from the base of the PR and between 8ea11c2 and cccdf5f.

📒 Files selected for processing: 1

• test/extended/networking/egress_firewall.go

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Walkthrough

The external-host connectivity check now passes curl’s -4 option. The probe URL and other curl options remain unchanged.

Changes

External connectivity probe

Layer / File(s)	Summary
Select IPv4 for the probe test/extended/networking/egress_firewall.go	The curl command now forces IPv4 address selection. The probe URL and other options are unchanged.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Suggested reviewers: not-stbenjam

Merge Risk: ⚪ Minimal · up to cccdf

The focused probe change is ready to merge.

Pre-merge checks: 13 · 2

Failed checks: 2 warnings

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Ipv6 And Disconnected Network Test Compatibility		The pull request changes an existing Ginkgo e2e test helper to run curl -4 against public www.google.com. This introduces an IPv4-only assumption and requires public internet connectivity. IPv6-on…	IPv6 and disconnected network compatibility notice: This test may contain IPv4 assumptions or external connectivity requirements that will fail in IPv6-only disconnected environments. Please verify your test works on IPv6 by running an addi…

Passed checks: 13 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: forcing the egress firewall curl check to use IPv4.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names		The pull request changes only the curl arguments in checkConnectivityToExternalHost. It does not add or modify any Ginkgo test title. The existing titles are static and contain no dynamic values or …
Test Structure And Quality		The pull request changes only the existing connectivity probe in test/extended/networking/egress_firewall.go by adding curl’s -4 option. It adds no It block, setup, cleanup, cluster wait, or ass…
Microshift Test Compatibility		PASS: The pull request changes only the existing checkConnectivityToExternalHost curl command by adding -4. It adds no Ginkgo It, Describe, Context, or When test and introduces no MicroShi…
Single Node Openshift (Sno) Test Compatibility		PASS: The pull request changes only the existing checkConnectivityToExternalHost helper by adding curl’s -4 option. It adds no new Ginkgo It, Describe, Context, or When test, so the SNO mu…
Topology-Aware Scheduling Compatibility		PASS: The pull request changes only test/extended/networking/egress_firewall.go. The sole change adds curl's -4 option to an external connectivity test. It does not add or modify deployment manife…
Ote Binary Stdout Contract		PASS. The PR only adds curl's -4 option to checkConnectivityToExternalHost at test/extended/networking/egress_firewall.go:279. The helper runs from Ginkgo It bodies at lines 60 and 110, not fr…
No-Weak-Crypto		PASS. The pull request changes only the curl command in checkConnectivityToExternalHost by adding -4. The diff introduces no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom cryptography, or secre…
Container-Privileges		The pull request changes only the curl arguments in checkConnectivityToExternalHost by adding -4. It does not add or modify a container or Kubernetes security setting. The reviewed diff contains n…
No-Sensitive-Data-In-Logs		PASS — The pull request only adds curl’s -4 option to the external connectivity probe. It does not add logging or expose passwords, tokens, API keys, PII, session IDs, internal hostnames, or custome…

Full details: Stable And Deterministic Test Names

Explanation

The pull request changes only the curl arguments in checkConnectivityToExternalHost. It does not add or modify any Ginkgo test title. The existing titles are static and contain no dynamic values or legacy metadata tokens.

Full details: Test Structure And Quality

Explanation

The pull request changes only the existing connectivity probe in test/extended/networking/egress_firewall.go by adding curl’s -4 option. It adds no It block, setup, cleanup, cluster wait, or assertion. The probe retains its existing -m5 timeout and diagnostic log. No stated test-structure or quality failure is introduced.

Full details: Microshift Test Compatibility

Explanation

PASS: The pull request changes only the existing checkConnectivityToExternalHost curl command by adding -4. It adds no Ginkgo It, Describe, Context, or When test and introduces no MicroShift-incompatible API or resource reference.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS: The pull request changes only the existing checkConnectivityToExternalHost helper by adding curl’s -4 option. It adds no new Ginkgo It, Describe, Context, or When test, so the SNO multi-node compatibility check does not apply.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS: The pull request changes only test/extended/networking/egress_firewall.go. The sole change adds curl's -4 option to an external connectivity test. It does not add or modify deployment manifests, operator code, controllers, replicas, affinity, topology spread, node selectors, tolerations, or PDBs. No topology-aware scheduling condition applies.

Full details: Ote Binary Stdout Contract

Explanation

PASS. The PR only adds curl's -4 option to checkConnectivityToExternalHost at test/extended/networking/egress_firewall.go:279. The helper runs from Ginkgo It bodies at lines 60 and 110, not from process-level setup. The changed code has no stdout write, logging setup, or suite-level output operation.

Full details: No-Weak-Crypto

Explanation

PASS. The pull request changes only the curl command in checkConnectivityToExternalHost by adding -4. The diff introduces no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom cryptography, or secret comparison.

Full details: Container-Privileges

Explanation

The pull request changes only the curl arguments in checkConnectivityToExternalHost by adding -4. It does not add or modify a container or Kubernetes security setting. The reviewed diff contains no privileged, host namespace, SYS_ADMIN, root, or allowPrivilegeEscalation change.

Full details: No-Sensitive-Data-In-Logs

Explanation

PASS — The pull request only adds curl’s -4 option to the external connectivity probe. It does not add logging or expose passwords, tokens, API keys, PII, session IDs, internal hostnames, or customer data. The existing error log remains unchanged.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

The pull request changes an existing Ginkgo e2e test helper to run curl -4 against public www.google.com. This introduces an IPv4-only assumption and requires public internet connectivity. IPv6-only disconnected jobs cannot satisfy this probe.

Resolution

IPv6 and disconnected network compatibility notice: This test may contain IPv4 assumptions or external connectivity requirements that will fail in IPv6-only disconnected environments. Please verify your test works on IPv6 by running an additional CI job. For parallel tests, use /payload-job periodic-ci-openshift-release-master-nightly-4.22-e2e-metal-ipi-ovn-ipv6. If the test requires external internet connectivity and cannot be adapted, add [Skipped:Disconnected] to the test name. Otherwise, detect the cluster IP family with GetIPAddressFamily() or GetIPFamilyForCluster() and adapt or skip the IPv4-only probe.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}

[emy]

CC: @mkowalski

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: emy
Once this PR has been reviewed and has the lgtm label, please assign tssurya for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• test/extended/networking/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@emy: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[redhat-chai-bot]

Chai test selection for cccdf5fca07291d28f1d3845e2e1f7c2ddb1103b → main

None.

Reason: Changed surface: Single test helper function checkConnectivityToExternalHost in test/extended/networking/egress_firewall.go — adds -4 flag to curl to force IPv4 resolution. Classification: Test-file-only change. The modification affects only the test's connectivity probe mechanism, not any production egress firewall code. No runtime behavior of the product is altered. First-stage coverage: All 8 first-stage jobs passed (unit, verify, lint, images, verify-deps, go-verify-deps, agentic-images, okd-scos-images), confirming the change compiles and passes static analysis. Selection rationale: No second-stage e2e jobs are warranted. The change cannot affect product runtime behavior — it only adjusts how a test helper resolves DNS when probing external connectivity. No candidate job exercises production code affected by this change.

[redhat-chai-bot]

/pipeline mark-pipeline-gate cccdf5f