Add connection test using Goldpinger

[UncivilizedGhost]

The Goldpinger tool is deployed into the workload cluster
after provisioning. It runs as a DaemonSet, with one copy on every node
in the cluster. Each copy discovers the others using the
Kubernetes API, then pings them over HTTP. /check_all is queried
to assert every peer is reachable.

It will be triggered by:

make test
make verify_provision

install_goldpinger.yaml is an Ansible task that pulls the image from
Docker Hub, pushes it to the local registry, creates namespaces and
RBAC resources, deploys Goldpinger, pings and asserts nodes are reachable,
then cleans up.

The task is added at the end of verify.yml.

Goldpinger uses the apache 2.0 license and is maintained by Bloomberg engineering.

Fix #1012

[metal3-io-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign rozzii for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[UncivilizedGhost]

/copilot-review

[metal3-io-bot]

Copilot code review has been requested by @UncivilizedGhost. Please allow a few moments for the review to be added.

[Copilot]

Pull request overview

Adds Goldpinger-based pod network connectivity verification to workload-cluster tests.

Changes:

• Deploys Goldpinger through Ansible.
• Checks connectivity and cleans up test resources.
• Integrates the check into cluster verification.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
tests/roles/run_tests/tasks/verify.yml	Invokes network verification.
tests/roles/run_tests/tasks/install_goldpinger.yaml	Deploys, checks, and removes Goldpinger.

Suppressed comments (3)

tests/roles/run_tests/tasks/install_goldpinger.yaml:22

• These commands hard-code Docker, but CentOS/RHEL hosts support only Podman and CONTAINER_RUNTIME defaults to Podman there. The verifier will fail before deploying Goldpinger. Use the configured runtime for pull/tag/push and disable registry TLS verification for Podman, as the existing image-push path does.

- name: Pull Goldpinger image on the host
  ansible.builtin.command:
    cmd: "sudo docker pull {{ GOLDPINGER_SOURCE_IMAGE }}"

tests/roles/run_tests/tasks/install_goldpinger.yaml:247

• This assertion only proves that the response contains at least one host; it still passes when expected peers are missing or a returned peer reports an error. Check the expected peer count and verify every host response has a healthy status before reporting network connectivity as successful.

- name: Verify all Goldpinger peers are healthy
  ansible.builtin.assert:
    that:
    - "(goldpinger_check.content | from_json).hosts | length > 0"

tests/roles/run_tests/tasks/install_goldpinger.yaml:233

• For IPv6 or dual-stack clusters, an IPv6 InternalIP is inserted into the URL without brackets, producing an invalid URL such as http://fd55::10:31234/check_all. Bracket IPv6 literals when constructing the endpoint.

    url: "http://{{ goldpinger_node_ip }}:{{ goldpinger_nodeport }}/check_all"

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[UncivilizedGhost]

/Checkall queries all other instances using their pod IPs and calls their /check endpoint. Each pod reports its own connectivity results back.

[UncivilizedGhost]

/test metal3-dev-env-integration-test-ubuntu-main

[UncivilizedGhost]

/test metal3-centos-e2e-integration-test-release-1-13

[Rozzii]

Will take a look.