Feat/check target connectivity

[alvlkov]

What type of PR is this?

This adds a new managed script to perform multiple checks to validate external target connectivity from Openshift cluster.

What this PR does / Why we need it?

OSD-26447

Special notes for your reviewer

Pre-checks (if applicable)

• Validated the changes in a cluster
• Included documentation changes with PR

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: alvlkov
Once this PR has been reviewed and has the lgtm label, please assign wanghaoran1988 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[feichashao]

Hi @alvlkov , thank you for raising this PR and thank you for including a README!

The managed-script itself will run as pod in the cluster. I see the script is calling oc create another pod and runs the network utils in the new pod, is there a specific reason to run them in a new pod?

[alvlkov]

Hi @alvlkov , thank you for raising this PR and thank you for including a README!

The managed-script itself will run as pod in the cluster. I see the script is calling oc create another pod and runs the network utils in the new pod, is there a specific reason to run them in a new pod?

@feichashao thank you for the review!

Yes, there is a particular reason to create another pod. I believe the base image used by managed-script does not provide all necessary dependencies to perform the checks, i.e. nmap:

• DNS resolution check via nslookup: $ nslookup "$TARGET"
• DNS resolution via Dig: $ dig +short "$TARGET"
• ICMP check via ping: $ timeout 10 ping -c 3 "$TARGET"
• Routing Check via traceroute: $ timeout 5 traceroute -m 10 -w 1 -q 1 "$TARGET"
• Check Target Port is Open via nmap: $ timeout 5 nmap -p "$PORT" "$TARGET" 2>&1 | grep -q "$PORT/tcp open"

Other scripts as PCAP collector use the same approach and image: quay.io/app-sre/srep-network-toolbox:latest is suitable.

[feichashao]

@alvlkov thanks for the clarifications! That make sense if the image itself doesn't have the needed binaries. Probably we can add it to the image https://github.com/openshift/managed-scripts/blob/main/Dockerfile but let me discuss with the team.

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[alvlkov]

/remove-lifecycle stale

[openshift-ci]

@alvlkov: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/images	92558fa	link	true	/test images

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.