ROSAENG-65671: add validation for --reason field if egress-verificati…

[rolandmkunkel]

…on is run against an HCP cluster

• Fix validation gap where osdctl network verify-egress --cluster-id <id> against an HCP cluster fails with an opaque Kubernetes RBAC error instead of telling the user to provide --reason

• The --reason check in validateInput() only fires when --pod-mode is explicitly passed, but HCP clusters auto-force pod mode after validation has already run

• Added an early --reason check inside the HCP pod-mode forcing block so users get a clear error

  Fixes: ROSAENG-65671

Summary by CodeRabbit

• Bug Fixes
  • Added validation to prevent forcing pod mode for an HCP cluster without an elevation reason or explicit kubeconfig when a cluster ID is provided.
  • Displays an error instead of proceeding with incomplete authorization details.

[openshift-ci-robot]

@rolandmkunkel: This pull request references ROSAENG-65671 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.1.0" version, but no target version was set.

Details

In response to this:

…on is run against an HCP cluster

• Fix validation gap where osdctl network verify-egress --cluster-id <id> against an HCP cluster fails with an opaque Kubernetes RBAC error instead of telling the user to provide --reason
• The --reason check in validateInput() only fires when --pod-mode is explicitly passed, but HCP clusters auto-force pod mode after validation has already run
• Added an early --reason check inside the HCP pod-mode forcing block so users get a clear error

Fixes: ROSAENG-65671

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d47265d1-ab69-4913-9039-00a99c184eeb

📥 Commits

Reviewing files that changed from the base of the PR and between 7976587 and 837b410.

📒 Files selected for processing (1)

• cmd/network/verification.go

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

Walkthrough

The command now rejects HCP cluster requests that provide a cluster ID without an elevation reason or explicit kubeconfig before forcing pod mode.

Changes

HCP cluster verification

Layer / File(s)	Summary
Validate elevation reason before pod mode cmd/network/verification.go	The command now returns an error when a cluster ID is provided without --reason or explicit kubeconfig before it forces pod mode.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 837b4

This is a localized validation change for HCP egress verification, and no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only verification.go and adds no Ginkgo test declarations or test titles, so no unstable test name was introduced.
Test Structure And Quality	✅ Passed	HEAD changes only cmd/network/verification.go; no *_test.go or Ginkgo test code changed, so none of the listed test-quality failure conditions were introduced.
Microshift Test Compatibility	✅ Passed	The PR changes only cmd/network/verification.go and adds no Ginkgo e2e tests, so MicroShift test compatibility does not apply.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR changes only cmd/network/verification.go and adds no Ginkgo e2e tests, so SNO multi-node compatibility criteria do not apply.
Topology-Aware Scheduling Compatibility	✅ Passed	The pull request changes only CLI validation in cmd/network/verification.go; it adds no manifests, controllers, operators, replicas, affinity, topology, selectors, or tolerations.
Ote Binary Stdout Contract	✅ Passed	The PR adds only stdlib log.Fatalf in cmd/network/verification.go, which writes to stderr; no OTE/Ginkgo process entry point is changed.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The commit changes only cmd/network/verification.go and adds no Ginkgo e2e tests, IPv4 assumptions, or external connectivity requirements.
No-Weak-Crypto	✅ Passed	HEAD^..HEAD changes only HCP --reason validation in verification.go; no weak crypto primitive, custom crypto, or secret/token comparison was introduced.
Container-Privileges	✅ Passed	The commit changes only Go validation logic. Its diff introduces no privileged containers, host namespaces, SYS_ADMIN, root execution, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	The PR adds one fixed log.Fatalf message with flag guidance and a sample ticket; it does not log passwords, tokens, PII, hostnames, or customer data.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the addition of --reason validation for egress verification and references the related issue.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[petrkotas]

/lgtm seems straightforward

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: petrkotas, rolandmkunkel

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [petrkotas,rolandmkunkel]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[rolandmkunkel]

/retest

[openshift-ci]

@rolandmkunkel: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.