NETOBSERV-2598: NETOBSERV-2517: Remove dependency on oc/kubectl #457

jotak · 2026-02-03T08:23:47Z

No description provided.

github-actions · 2026-02-03T08:29:03Z

New image:
quay.io/netobserv/network-observability-cli:40b01b8

It will expire after two weeks.

To use this build, update your commands using:

USER=netobserv VERSION=40b01b8 make commands

or download the updated commands.

github-actions · 2026-02-03T12:49:12Z

New image:
quay.io/netobserv/network-observability-cli:c9c2b30

It will expire after two weeks.

To use this build, update your commands using:

USER=netobserv VERSION=c9c2b30 make commands

or download the updated commands.

jpinsonneau · 2026-02-03T13:15:47Z

internal/pkg/kubernetes/kubernetes.go

+		return fmt.Errorf("cannot create Kubernetes client from InClusterConfig: %w", err)
+	}
+
+	return clientset.AppsV1().DaemonSets("netobserv-cli").Delete(ctx, "netobserv-cli", v1.DeleteOptions{})


The netobserv-cli namespace is configurable in the script

yes, but I don't think it's set when running from the pod? It always uses the default, no?

It's configurable from NETOBSERV_NAMESPACE environment variable.

I mean, ok I will fix it, but it's not a new bug: this variable was already ignored, afaict when the go binary called exec.Command("/oc-netobserv", "stop") from within the collector pod

fixed: 8536824

jpinsonneau · 2026-02-03T13:41:41Z

Took the opportunity to address https://issues.redhat.com/browse/NETOBSERV-2598 here since it's straightforward
230b7ae

leandroberetta

lgtm

openshift-ci-robot · 2026-02-03T15:19:23Z

@jotak: This pull request references NETOBSERV-2517 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the vulnerability to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-02-03T15:22:15Z

@jotak: This pull request references NETOBSERV-2598 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

jotak · 2026-02-03T15:22:33Z

/cherry-pick release-1.11

openshift-cherrypick-robot · 2026-02-03T15:22:38Z

@jotak: once the present PR merges, I will cherry-pick it on top of release-1.11 in a new PR and assign it to you.

Details

In response to this:

/cherry-pick release-1.11

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

codecov · 2026-02-03T16:52:11Z

Codecov Report

❌ Patch coverage is 33.33333% with 20 lines in your changes missing coverage. Please review.
✅ Project coverage is 13.18%. Comparing base (57ab3e4) to head (a9fbf01).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/pkg/kubernetes/kubernetes.go	0.00%	8 Missing ⚠️
cmd/root.go	50.00%	4 Missing and 2 partials ⚠️
cmd/flow_capture.go	0.00%	4 Missing ⚠️
cmd/flow_db.go	80.00%	1 Missing ⚠️
cmd/packet_capture.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #457      +/-   ##
==========================================
+ Coverage   12.95%   13.18%   +0.22%     
==========================================
  Files          19       20       +1     
  Lines        2439     2443       +4     
==========================================
+ Hits          316      322       +6     
+ Misses       2099     2095       -4     
- Partials       24       26       +2

Flag	Coverage Δ
unittests	`13.18% <33.33%> (+0.22%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
cmd/flow_db.go	`52.38% <80.00%> (+0.41%)`	⬆️
cmd/packet_capture.go	`0.00% <0.00%> (ø)`
cmd/flow_capture.go	`7.59% <0.00%> (+0.61%)`	⬆️
cmd/root.go	`27.65% <50.00%> (+4.13%)`	⬆️
internal/pkg/kubernetes/kubernetes.go	`0.00% <0.00%> (ø)`

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

kapjain-rh · 2026-02-03T20:07:41Z

/ok-to-test

kapjain-rh · 2026-02-03T20:08:53Z

/ok-to-test

github-actions · 2026-02-03T20:10:55Z

New image:
quay.io/netobserv/network-observability-cli:53424a8

It will expire after two weeks.

To use this build, update your commands using:

USER=netobserv VERSION=53424a8 make commands

or download the updated commands.

kapjain-rh · 2026-02-03T20:55:06Z

./oc-netobserv flows --interfaces=br-ex --max-time=10s --log-level=debug
Checking dependencies... 
'yq' is up to date (version v4.48.1).
'bash' is up to date (version v5.3.3).
Setting up... 
OpenShift version: 4.16.0-0.nightly-2026-02-03-034937
creating netobserv-cli namespace
namespace/netobserv-cli created
creating service account
serviceaccount/netobserv-cli created
clusterrole.rbac.authorization.k8s.io/netobserv-cli configured
clusterrolebinding.rbac.authorization.k8s.io/netobserv-cli configured
clusterrolebinding.rbac.authorization.k8s.io/netobserv-cli-monitoring configured
securitycontextconstraints.security.openshift.io/netobserv-cli configured
creating collector service
service/collector created
creating flow-capture agents
opt: interfaces, value: br-ex
opt: log_level, value: debug
daemonset.apps/netobserv-cli created
Waiting for daemonset pods to be ready...
6/6 Ready. Reason(s): 
Running collector oc run -n netobserv-cli collector \
  --image=quay.io/netobserv/network-observability-cli:main --image-pull-policy='Always'   --overrides='{"spec":{"serviceAccount": "netobserv-cli"}}' \
  --command -- sleep infinity... 
pod/collector created
pod/collector condition met
Executing collector command... 
Starting network-observability-cli:
=====
Build version: main-13cad47
Build date: 2026-01-29 11:07

Error: unknown flag: --namespace
Usage:
  network-observability-cli get-flows [flags]

Flags:
  -h, --help   help for get-flows

Global Flags:
      --filename string    Output file name
  -l, --loglevel string    Log level (default "info")
      --maxbytes int       Maximum capture bytes (default 50000000)
      --maxtime duration   Maximum capture time (default 5m0s)
      --mock               Use mock
      --options string     Options(s)
      --port int           TCP port to listen (default 9999)

2026/02/03 20:54:03 unknown flag: --namespace
command terminated with exit code 1

jotak · 2026-02-04T08:57:50Z

@kapjain-rh the logs show it's using the current "main" image, not the one from this PR:

Running collector oc run -n netobserv-cli collector \
  --image=quay.io/netobserv/network-observability-cli:main --image-pull-policy='Always'   --overrides='{"spec":{"serviceAccount": "netobserv-cli"}}' \
  --command -- sleep infinity...

It should be quay.io/netobserv/network-observability-cli:53424a8 instead of quay.io/netobserv/network-observability-cli:main.

You need to set NETOBSERV_COLLECTOR_IMAGE env to the PR image

(Also I think that's what make commands is doing, if you follow what is said here)

USER=netobserv VERSION=53424a8 make commands

kapjain-rh · 2026-02-04T16:49:23Z

getting error while capturing metrics

./oc-netobserv metrics --drops --include_list=node,namespace
...
ERRO[0000] exec failed: unable to start container process: exec: "/network-observability-cli get-metrics": stat /network-observability-cli get-metrics: no such file or directory 
command terminated with exit code 255
...

openshift-ci · 2026-02-05T13:22:45Z

New changes are detected. LGTM label has been removed.

openshift-ci · 2026-02-05T13:22:49Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from jpinsonneau. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

DOWNSTREAM_OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

jotak · 2026-02-05T13:23:37Z

@kapjain-rh last commit should fix it

The --filename argument of the go binary, which isn't used at the moment, is not sanitized for path traversal. This could be an unnoticed vulnerability if we chose to leverage it later on. This change uses go 1.24 "os.Root" API to prevent path traversal.

For some reason (??) it worked for get-flows but not for get-metrics ... "eval" makes it work for metrics too

kapjain-rh · 2026-02-05T17:10:23Z

/ok-to-test

github-actions · 2026-02-05T17:12:32Z

New image:
quay.io/netobserv/network-observability-cli:66427b8

It will expire after two weeks.

To use this build, update your commands using:

USER=netobserv VERSION=66427b8 make commands

or download the updated commands.

kapjain-rh · 2026-02-05T18:04:11Z

/label qe-approved

openshift-ci-robot · 2026-02-05T18:04:17Z

@jotak: This pull request references NETOBSERV-2598 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-cherrypick-robot · 2026-02-06T07:35:22Z

@jotak: new pull request created: #461

Details

In response to this:

/cherry-pick release-1.11

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

jotak added the ok-to-test label Feb 3, 2026

github-actions bot removed the ok-to-test label Feb 3, 2026

jotak added the ok-to-test label Feb 3, 2026

jotak requested review from jpinsonneau and leandroberetta February 3, 2026 12:47

jotak added the needs-review Tells that the PR needs a review label Feb 3, 2026

jpinsonneau reviewed Feb 3, 2026

View reviewed changes

github-actions bot removed the ok-to-test label Feb 3, 2026

leandroberetta approved these changes Feb 3, 2026

View reviewed changes

openshift-ci bot assigned leandroberetta Feb 3, 2026

openshift-ci bot added lgtm and removed lgtm labels Feb 3, 2026

jotak removed the needs-review Tells that the PR needs a review label Feb 3, 2026

jotak changed the title ~~Remove dependency on oc/kubectl~~ NETOBSERV-2518: Remove dependency on oc/kubectl Feb 3, 2026

openshift-ci-robot added the jira/valid-reference label Feb 3, 2026

jotak changed the title ~~NETOBSERV-2518: Remove dependency on oc/kubectl~~ NETOBSERV-2517: Remove dependency on oc/kubectl Feb 3, 2026

netobserv deleted a comment from openshift-ci-robot Feb 3, 2026

jotak changed the title ~~NETOBSERV-2517: Remove dependency on oc/kubectl~~ NETOBSERV-2598: NETOBSERV-2517: Remove dependency on oc/kubectl Feb 3, 2026

jpinsonneau approved these changes Feb 3, 2026

View reviewed changes

openshift-ci bot assigned jpinsonneau Feb 3, 2026

openshift-ci bot added the lgtm label Feb 3, 2026

openshift-ci bot added the ok-to-test label Feb 3, 2026

openshift-merge-robot added the needs-rebase label Feb 4, 2026

openshift-ci bot removed the lgtm label Feb 5, 2026

github-actions bot removed the ok-to-test label Feb 5, 2026

jotak and others added 7 commits February 5, 2026 15:38

Remove dependency on oc/kubectl

ae7684f

Prevent future path traversal

ecd79f4

The --filename argument of the go binary, which isn't used at the moment, is not sanitized for path traversal. This could be an unnoticed vulnerability if we chose to leverage it later on. This change uses go 1.24 "os.Root" API to prevent path traversal.

Use go-client to delete daemonset

b652970

fix options array

14f07d6

fix namespace not propagated to go runtime

55b172a

separate foreground and background cases

59a6f52

Add "eval" on command exec

a9fbf01

For some reason (??) it worked for get-flows but not for get-metrics ... "eval" makes it work for metrics too

jotak force-pushed the rm-oc branch from e82e96c to a9fbf01 Compare February 5, 2026 14:40

openshift-merge-robot removed the needs-rebase label Feb 5, 2026

openshift-ci bot added the ok-to-test label Feb 5, 2026

openshift-ci bot added the qe-approved label Feb 5, 2026

jotak merged commit 7885b72 into netobserv:main Feb 6, 2026
11 of 12 checks passed

openshift-cherrypick-robot mentioned this pull request Feb 6, 2026

[release-1.11] NETOBSERV-2598: NETOBSERV-2517: Remove dependency on oc/kubectl #461

Merged

NETOBSERV-2598: NETOBSERV-2517: Remove dependency on oc/kubectl #457

NETOBSERV-2598: NETOBSERV-2517: Remove dependency on oc/kubectl #457

Uh oh!

Conversation

jotak commented Feb 3, 2026

Uh oh!

github-actions bot commented Feb 3, 2026

Uh oh!

github-actions bot commented Feb 3, 2026

Uh oh!

jpinsonneau Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

jotak Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

leandroberetta Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

jotak Feb 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jotak Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

jpinsonneau commented Feb 3, 2026

Uh oh!

leandroberetta left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci-robot commented Feb 3, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Feb 3, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jotak commented Feb 3, 2026

Uh oh!

openshift-cherrypick-robot commented Feb 3, 2026

Uh oh!

codecov bot commented Feb 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

kapjain-rh commented Feb 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kapjain-rh commented Feb 3, 2026

Uh oh!

github-actions bot commented Feb 3, 2026

Uh oh!

kapjain-rh commented Feb 3, 2026

Uh oh!

jotak commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kapjain-rh commented Feb 4, 2026

Uh oh!

openshift-ci bot commented Feb 5, 2026

Uh oh!

openshift-ci bot commented Feb 5, 2026

Uh oh!

jotak commented Feb 5, 2026

Uh oh!

kapjain-rh commented Feb 5, 2026

Uh oh!

github-actions bot commented Feb 5, 2026

Uh oh!

kapjain-rh commented Feb 5, 2026

Uh oh!

openshift-ci-robot commented Feb 5, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

openshift-cherrypick-robot commented Feb 6, 2026

Uh oh!

Reviewers

Assignees

Labels

jotak Feb 3, 2026 •

edited

Loading

openshift-ci-robot commented Feb 3, 2026 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented Feb 3, 2026 •

edited by openshift-ci bot

Loading

codecov bot commented Feb 3, 2026 •

edited

Loading

kapjain-rh commented Feb 3, 2026 •

edited

Loading

jotak commented Feb 4, 2026 •

edited

Loading

openshift-ci-robot commented Feb 5, 2026 •

edited by openshift-ci bot

Loading