Add hostmode to check interface and fix formatter

- Adds a hostmode check function to the check interface
- Remove host-network redundant arguments
- Work to debug iptables rule detection failure

Author: ryanelliottsmith

Dockerfile

@@ -27,6 +27,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     curl \
     iperf3 \
     iproute2 \
+    iptables \
     netcat-openbsd \
     tcpdump \
     procps \

cmd/netdebug/commands/run.go

@@ -146,7 +146,7 @@ func runTests(cmd *cobra.Command, args []string) error {
 
 		if overlay {
 			fmt.Println("\n--- Overlay Network Tests ---")
-			overlayChecks := filterOutCheck(checksWithoutBandwidth, "ports")
+			overlayChecks := filterHostNetworkOnlyChecks(checksWithoutBandwidth)
 			events, err := runStandardTests(ctx, coord, overlayTargets, overlayPods, overlayChecks, timeout, debug, types.NetworkTypeOverlay)
 			if err != nil {
 				fmt.Printf("Warning: overlay network tests failed: %v\n", err)
@@ -284,12 +284,14 @@ func runBandwidthTests(ctx context.Context, coord *coordinator.Coordinator, targ
 	return allEvents, nil
 }
 
-func filterOutCheck(checks []string, checkToRemove string) []string {
+func filterHostNetworkOnlyChecks(checks []string) []string {
 	var filtered []string
-	for _, check := range checks {
-		if check != checkToRemove {
-			filtered = append(filtered, check)
+	for _, name := range checks {
+		check := checkspkg.DefaultRegistry.Get(name)
+		if check != nil && check.HostNetworkOnly() {
+			continue
 		}
+		filtered = append(filtered, name)
 	}
 	return filtered
 }

internal/manifests/daemonset-host.yaml

@@ -53,6 +53,7 @@ spec:
             fieldRef:
               fieldPath: status.hostIP
         securityContext:
+          runAsUser: 0
           privileged: true
           capabilities:
             add:

pkg/agent/runner.go

@@ -26,7 +26,8 @@ func RunTests(ctx context.Context, config *types.Config, self *SelfInfo) error {
 		wg.Add(1)
 		go func(checkName string) {
 			defer wg.Done()
-			if isLocalOnlyCheck(checkName) {
+			check := checks.DefaultRegistry.Get(checkName)
+			if check != nil && check.IsLocal() {
 				runSingleCheck(ctx, checkName, "localhost", self.NodeName, config, self)
 			} else {
 				runCheckAgainstAllTargets(ctx, checkName, targets, config, self)
@@ -63,15 +64,6 @@ func filterTargets(targets []types.TargetNode, selfNodeName string) []types.Targ
 	return filtered
 }
 
-func isLocalOnlyCheck(checkName string) bool {
-	switch checkName {
-	case "hostconfig", "conntrack", "iptables":
-		return true
-	default:
-		return false
-	}
-}
-
 func runCheckAgainstAllTargets(ctx context.Context, checkName string, targets []types.TargetNode, config *types.Config, self *SelfInfo) {
 	for _, target := range targets {
 		if checkName == "ports" {

pkg/checks/bandwidth.go

@@ -101,6 +101,10 @@ func (c *BandwidthCheck) IsLocal() bool {
 	return false
 }
 
+func (c *BandwidthCheck) HostNetworkOnly() bool {
+	return false
+}
+
 func (c *BandwidthCheck) AlwaysShow() bool {
 	return true
 }

pkg/checks/check.go

@@ -26,6 +26,11 @@ type Check interface {
 	// These checks won't display a Target column in table output.
 	IsLocal() bool
 
+	// HostNetworkOnly returns true if this check requires the host network namespace
+	// and should only run on hostNetwork pods. Checks that inspect host-level networking
+	// (iptables, conntrack, ports, etc.) should return true.
+	HostNetworkOnly() bool
+
 	// AlwaysShow returns true if this check should always be displayed in output,
 	// even when passing. This is useful for checks like bandwidth where the
 	// result value is always interesting regardless of pass/fail status.

pkg/checks/conntrack.go

@@ -122,6 +122,10 @@ func (c *ConntrackCheck) IsLocal() bool {
 	return true
 }
 
+func (c *ConntrackCheck) HostNetworkOnly() bool {
+	return true
+}
+
 func (c *ConntrackCheck) AlwaysShow() bool {
 	return false
 }

pkg/checks/dns.go

@@ -81,6 +81,10 @@ func (c *DNSCheck) IsLocal() bool {
 	return false
 }
 
+func (c *DNSCheck) HostNetworkOnly() bool {
+	return false
+}
+
 func (c *DNSCheck) AlwaysShow() bool {
 	return false
 }

pkg/checks/hostconfig.go

@@ -146,6 +146,10 @@ func (c *HostConfigCheck) IsLocal() bool {
 	return true
 }
 
+func (c *HostConfigCheck) HostNetworkOnly() bool {
+	return true
+}
+
 func (c *HostConfigCheck) AlwaysShow() bool {
 	return true
 }

pkg/checks/iptables.go

@@ -41,11 +41,6 @@ func (c *IptablesCheck) Run(ctx context.Context, target string) (*types.TestResu
 			details.LegacyRuleCount, details.NftableRuleCount))
 	}
 
-	backend, err := c.detectActiveBackend(ctx)
-	if err == nil && backend != "" {
-		issues = append(issues, fmt.Sprintf("detected active backend: %s", backend))
-	}
-
 	if len(issues) > 0 && details.DuplicateRules > 0 {
 		result.Status = types.StatusFail
 		result.Error = "iptables configuration conflict detected"
@@ -80,24 +75,11 @@ func (c *IptablesCheck) countIptablesRules(ctx context.Context, binary string) (
 	return count, nil
 }
 
-func (c *IptablesCheck) detectActiveBackend(ctx context.Context) (string, error) {
-	cmd := exec.CommandContext(ctx, "iptables", "--version")
-	output, err := cmd.CombinedOutput()
-	if err != nil {
-		return "", err
-	}
-
-	versionStr := strings.ToLower(string(output))
-	if strings.Contains(versionStr, "nf_tables") {
-		return "nftables", nil
-	} else if strings.Contains(versionStr, "legacy") {
-		return "legacy", nil
-	}
-
-	return "unknown", nil
+func (c *IptablesCheck) IsLocal() bool {
+	return true
 }
 
-func (c *IptablesCheck) IsLocal() bool {
+func (c *IptablesCheck) HostNetworkOnly() bool {
 	return true
 }
 
@@ -125,18 +107,17 @@ func (c *IptablesCheck) FormatSummary(details interface{}, debug bool) string {
 		return ""
 	}
 
-	// Get issues if present
-	issuesRaw, hasIssues := iptablesMap["issues"]
-	if hasIssues {
-		if issues, ok := issuesRaw.([]interface{}); ok && len(issues) > 0 {
-			return fmt.Sprintf("%d issues", len(issues))
-		}
-	}
-
 	legacyCount, _ := iptablesMap["legacy_rule_count"].(float64)
 	nftCount, _ := iptablesMap["nftable_rule_count"].(float64)
 
 	summary := fmt.Sprintf("%.0f legacy, %.0f nftables rules", legacyCount, nftCount)
+
+	if issuesRaw, ok := iptablesMap["issues"]; ok {
+		if issues, ok := issuesRaw.([]interface{}); ok && len(issues) > 0 {
+			summary += fmt.Sprintf(" | %d issues", len(issues))
+		}
+	}
+
 	if debug {
 		return summary
 	}