Skip to content

OCPBUGS-87079: Add polling and longer waits in the EgressFirewall tests to avoid flakiness#31376

Open
arkadeepsen wants to merge 1 commit into
openshift:mainfrom
arkadeepsen:efw-tests
Open

OCPBUGS-87079: Add polling and longer waits in the EgressFirewall tests to avoid flakiness#31376
arkadeepsen wants to merge 1 commit into
openshift:mainfrom
arkadeepsen:efw-tests

Conversation

@arkadeepsen

@arkadeepsen arkadeepsen commented Jul 9, 2026

Copy link
Copy Markdown
Member

This PR adds polling and longer waits in the EgressFirewall tests to avoid flakiness. These tests have a long history of flaking. To avoid the flakiness, the additional polling and waits are introduced so that the tests don't fail immediately on the first incorrect EgressFirewall rule enforcement.

Summary by CodeRabbit

  • Tests
    • Improved egress firewall connectivity validation by switching ICMP checks to polling-based logic that waits for expected failure (one destination) and expected success (another).
    • Refined egress firewall “rules applied” readiness polling timing to align the first verification attempt and reduce flakiness.
    • Increased curl/HTTP probe timeouts for several domains (including wildcard cases) and the related control-plane curl probe when node selection is supported.
    • Updated IPv6 wildcard/deny-all test data so the ::/0 selector is correctly placed and covered.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

@openshift-ci-robot openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Jul 9, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@arkadeepsen: This pull request references Jira Issue OCPBUGS-87079, which is invalid:

  • expected the bug to target the "5.0.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

This PR adds polling and longer waits in the EgressFirewall tests to avoid flakiness. These tests have a long history of flaking. To avoid the flakiness, the additional polling and waits are introduced so that the tests don't fail immediately on the first incorrect EgressFirewall rule enforcement.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai

coderabbitai Bot commented Jul 9, 2026

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 56a5f8a5-32c1-45ba-b22e-e5c1abd578b0

📥 Commits

Reviewing files that changed from the base of the PR and between 97abcde and 9f19fa0.

📒 Files selected for processing (3)
  • test/extended/networking/egress_firewall.go
  • test/extended/testdata/bindata.go
  • test/extended/testdata/egress-firewall/ovnk-egressfirewall-wildcard-test.yaml
✅ Files skipped from review due to trivial changes (2)
  • test/extended/testdata/egress-firewall/ovnk-egressfirewall-wildcard-test.yaml
  • test/extended/testdata/bindata.go
🚧 Files skipped from review as they are similar to previous changes (1)
  • test/extended/networking/egress_firewall.go

Walkthrough

This PR revises egress firewall test polling and command timeouts, and corrects the IPv6 wildcard fixture’s default deny rule and embedded test data.

Changes

Egress firewall test updates

Layer / File(s) Summary
Polling and traffic validation
test/extended/networking/egress_firewall.go
The rule-application wait loop changes its initial polling behavior, ICMP checks use polling for expected failure and success, and curl probes use 15-second timeouts.
IPv6 wildcard fixture alignment
test/extended/testdata/egress-firewall/ovnk-egressfirewall-wildcard-test.yaml, test/extended/testdata/bindata.go
The IPv6 default deny rule places to.cidrSelector: ::/0 under the to block, with matching embedded test data formatting.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Ipv6 And Disconnected Network Test Compatibility ⚠️ Warning egress_firewall.go pings 1.1.1.1/8.8.8.8 and curls redhat.com, amazon.com, google.com, plus a precheck to www.google.com. Use cluster-internal endpoints or gate with IPv6/disconnected skips; avoid public internet hosts and hardcoded IPv4-only assumptions.
✅ Passed checks (14 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main change: adding polling and longer waits to EgressFirewall tests to reduce flakiness.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The changed Ginkgo titles in egress_firewall.go are static strings; no dynamic values, generated identifiers, or timestamps appear in any test names.
Test Structure And Quality ✅ Passed The updated EgressFirewall tests use bounded PollUntilContextTimeout waits, explicit curl timeouts, and cleanup of created pods, matching repo patterns.
Microshift Test Compatibility ✅ Passed PR only changes polling/timeouts and testdata formatting in existing egress-firewall tests; no new Ginkgo tests were added.
Single Node Openshift (Sno) Test Compatibility ✅ Passed PASS: The test already skips on 1-node clusters via findAppropriateNodes(DIFFERENT_NODE); this PR only changes polling/timeouts and testdata.
Topology-Aware Scheduling Compatibility ✅ Passed Changes are test-only timing/YAML edits; no pod scheduling constraints, replicas, affinity, or topology-dependent workload placement were introduced.
Ote Binary Stdout Contract ✅ Passed Touched files only adjust polling/timeouts and YAML; no main/init/TestMain suite code or stdout writes were added.
No-Weak-Crypto ✅ Passed Touched files only add polling/timeouts and YAML formatting; no MD5/SHA1/DES/RC4/etc. or secret comparisons appear in the changed code.
Container-Privileges ✅ Passed No added or removed diff lines introduce privileged:true, hostPID/hostNetwork/hostIPC, SYS_ADMIN, root, or allowPrivilegeEscalation:true.
No-Sensitive-Data-In-Logs ✅ Passed The touched test changes only add polling and public IP/domain probes; no passwords, tokens, PII, internal hostnames, or customer data are logged.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@arkadeepsen

Copy link
Copy Markdown
Member Author

/jira refresh

@openshift-ci-robot openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Jul 9, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@arkadeepsen: This pull request references Jira Issue OCPBUGS-87079, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (5.0.0) matches configured target version for branch (5.0.0)
  • bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)
Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci

openshift-ci Bot commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: arkadeepsen
Once this PR has been reviewed and has the lgtm label, please assign smg247 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot requested review from jluhrsen and sjenning July 9, 2026 17:40
@openshift-ci-robot

Copy link
Copy Markdown

@arkadeepsen: This pull request references Jira Issue OCPBUGS-87079, which is valid.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (5.0.0) matches configured target version for branch (5.0.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)
Details

In response to this:

This PR adds polling and longer waits in the EgressFirewall tests to avoid flakiness. These tests have a long history of flaking. To avoid the flakiness, the additional polling and waits are introduced so that the tests don't fail immediately on the first incorrect EgressFirewall rule enforcement.

Summary by CodeRabbit

  • Tests
  • Improved firewall validation coverage to make connectivity checks more reliable.
  • Adjusted network probing timing and increased request timeouts to reduce flaky failures during test runs.
  • Refined IPv6 deny-all test data for wildcard firewall scenarios.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/extended/networking/egress_firewall.go`:
- Around line 152-159: The poll logic in the egress firewall test is inverted:
the callback in `wait.PollUntilContextTimeout` should report success when
`oc.Run("exec").Args(... "ping" ...)` starts failing, so the final assertion
should expect a nil result instead of an error. Update the polling condition in
the ping check to return true when the ping command errors, and change the
`expectError` assertion in `TestEgressFirewall` to assert the poll completes
successfully once the block is enforced.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: e3cefe46-f7f5-4639-adfc-85fa8c3c36e9

📥 Commits

Reviewing files that changed from the base of the PR and between a40276a and ea337d9.

📒 Files selected for processing (2)
  • test/extended/networking/egress_firewall.go
  • test/extended/testdata/egress-firewall/ovnk-egressfirewall-wildcard-test.yaml

Comment thread test/extended/networking/egress_firewall.go Outdated
@openshift-ci openshift-ci Bot added the ready-for-human-review Indicates a PR has been reviewed by automated tools and is ready for human review label Jul 9, 2026
@arkadeepsen

Copy link
Copy Markdown
Member Author

/payload-aggregate periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-dualstack 5
/payload-aggregate periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-ipv4 5
/payload-aggregate periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-techpreview 5
/payload-aggregate periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-dualstack-techpreview 5

@openshift-ci

openshift-ci Bot commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

@arkadeepsen: trigger 4 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-dualstack
  • periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-ipv4
  • periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-techpreview
  • periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-dualstack-techpreview

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/5dd8fed0-7bc2-11f1-80ca-668e7a7852e2-0

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

@arkadeepsen

Copy link
Copy Markdown
Member Author

/retest

…kiness

Signed-off-by: arkadeepsen <arsen@redhat.com>
@arkadeepsen

Copy link
Copy Markdown
Member Author

/payload-aggregate periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-dualstack 5
/payload-aggregate periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-ipv4 5
/payload-aggregate periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-techpreview 5
/payload-aggregate periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-dualstack-techpreview 5

@openshift-ci

openshift-ci Bot commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

@arkadeepsen: trigger 4 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-dualstack
  • periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-ipv4
  • periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-techpreview
  • periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-dualstack-techpreview

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/1a5018c0-7c2f-11f1-9b1b-968f6e120138-0

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-gcp-csi
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-ipv6
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi

@arkadeepsen

Copy link
Copy Markdown
Member Author

/retest/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial

@arkadeepsen

Copy link
Copy Markdown
Member Author

/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial

1 similar comment
@arkadeepsen

Copy link
Copy Markdown
Member Author

/test e2e-aws-ovn-fips
/test e2e-aws-ovn-microshift
/test e2e-aws-ovn-microshift-serial

@arkadeepsen

Copy link
Copy Markdown
Member Author

/payload-aggregate periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-dualstack 5
/payload-aggregate periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-ipv4 5
/payload-aggregate periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-techpreview 5
/payload-aggregate periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-dualstack-techpreview 5

@openshift-ci

openshift-ci Bot commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

@arkadeepsen: trigger 4 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-dualstack
  • periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-ipv4
  • periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-techpreview
  • periodic-ci-openshift-release-main-nightly-5.0-e2e-metal-ipi-ovn-dualstack-techpreview

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/7f521ff0-7c81-11f1-83c8-1d2ff238c663-0

@arkadeepsen

Copy link
Copy Markdown
Member Author

/retest-required

@openshift-ci

openshift-ci Bot commented Jul 11, 2026

Copy link
Copy Markdown
Contributor

@arkadeepsen: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-aws-ovn-fips 9f19fa0 link true /test e2e-aws-ovn-fips

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. ready-for-human-review Indicates a PR has been reviewed by automated tools and is ready for human review

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants