feat: add active network policy probe

[shreyanshjain7174]

Summary

• Add passive agentctl doctor network-policy CNI detection.
• Add explicit --active-probe packet test in a scratch namespace.
• Require an updated operator image and clean up probe resources by default.

Safety

• Passive mode makes no mutations.
• Active mode requires --active-probe and --probe-image.
• Known non-enforcing CNI fingerprints require an explicit override.
• The verdict only covers the scratch-namespace probe policy.

Validation

• go build ./...
• make test-go
• make lint
• go test ./internal/netpolicy ./internal/netpolicy/netprobe ./cmd/agentctl
• helm unittest charts
• helm lint charts

go test ./... remains locally blocked only by missing envtest etcd assets.

[Copilot]

🟡 Changes recommended

There are a few correctness and operability issues (error reporting and probe reliability assumptions) that should be addressed before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds an agentctl doctor network-policy command that can passively fingerprint likely NetworkPolicy enforcement, or run an opt-in active probe that creates a scratch namespace, runs a TCP control dial, applies a deny-egress policy, then re-tests connectivity.

Changes:

• Add active NetworkPolicy probe logic and supporting netprobe runner.
• Wire agentctl doctor network-policy and document passive vs active modes.
• Add an operator binary entrypoint mode to run netprobe inside the operator image.

File summaries

File	Description
README.md	Mentions the new doctor command and active probe mode.
internal/netpolicy/probe.go	Implements the scratch-namespace active probe and result classification.
internal/netpolicy/probe_test.go	Unit tests for probe refusal paths, verdict classification, and restricted pod settings.
internal/netpolicy/netprobe/runner.go	Implements netprobe serve and netprobe dial with distinct exit codes.
internal/netpolicy/netprobe/runner_test.go	Tests for dial success, DNS failure classification, and arg validation.
docs/10-troubleshooting.md	Documents how to run the passive and active NetworkPolicy checks.
docs/07-security.md	Documents probe permissions and probe scope limits.
cmd/main.go	Adds a netprobe fast-path to run the embedded probe command in the operator binary.
cmd/agentctl/doctor_sandbox.go	Adds the doctor network-policy Cobra subcommand and output formatting.
cmd/agentctl/doctor_sandbox_test.go	Adds tests for the new subcommand and passive behavior.

Review details

• Files reviewed: 10/10 changed files
• Comments generated: 4
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.