CORENET-7141,CORENET-7135: Add OVS layer tools into openshift-mcp-server

docs/openshift/README.md

@@ -10,6 +10,7 @@ This directory contains OpenShift-specific documentation for the OpenShift MCP S
 | **[NetEdge Toolset](NETEDGE.md)** | Guide for the Network Ingress & DNS troubleshooting tools |
 | **[ACM Setup](acm_setup.md)**   | Setting up Advanced Cluster Management (ACM) and using the MCP Server with multi-cluster environments |
 | **[ACM with Keycloak Setup](acm_keycloak_setup.md)** | Setting up ACM with Keycloak-based OIDC authentication for secure multi-cluster access |
+| **[OVN-Kubernetes Toolset](ovn-kubernetes.md)** | Guide for OVN-Kubernetes CNI network troubleshooting tools |
 
 ## Overview
 

docs/openshift/ovn-kubernetes.md

@@ -2,7 +2,10 @@
 
 ## Overview
 
-This toolset provides MCP tools for inspecting and troubleshooting the OVN (Open Virtual Network) layer of an OVN-Kubernetes cluster. The tools execute OVN CLI commands (`ovn-nbctl`, `ovn-sbctl`, `ovn-trace`) inside `ovnkube-node` pods via `pods/exec`.
+This toolset provides MCP tools for inspecting and troubleshooting an OVN-Kubernetes cluster across two layers:
+
+- **OVN layer** — Query OVN Northbound/Southbound databases, list logical flows, and trace packets through the logical network. Executes OVN CLI commands (`ovn-nbctl`, `ovn-sbctl`, `ovn-trace`) inside `ovnkube-node` pods via `pods/exec`.
+- **OVS layer** — Inspect Open vSwitch configuration, OpenFlow tables, and datapath state. Executes OVS CLI commands (`ovs-vsctl`, `ovs-ofctl`, `ovs-appctl`) inside `ovnkube-node` pods via `pods/exec`.
 
 **OVN Layer Tools** — Query OVN Northbound/Southbound databases, list logical flows, and trace packets through the logical network:
 
@@ -13,14 +16,22 @@ This toolset provides MCP tools for inspecting and troubleshooting the OVN (Open
 | `ovn_lflow_list` | List logical flows from the Southbound database via `ovn-sbctl lflow-list` |
 | `ovn_trace` | Trace a packet through the OVN logical network via `ovn-trace` |
 
-All OVN layer tools are read-only and do not modify OVN state.
+**OVS Layer Tools** — Inspect Open vSwitch configuration, OpenFlow tables, and datapath state on ovnkube-node pods:
+
+| Tool | Description |
+|------|-------------|
+| `ovs_vsctl` | OVS switch configuration (bridges, ports, interfaces) via `ovs-vsctl` |
+| `ovs_ofctl` | OpenFlow flow inspection via `ovs-ofctl` |
+| `ovs_appctl` | OVS datapath and pipeline diagnostics via `ovs-appctl` |
+
+All tools in this toolset are read-only and do not modify OVN or OVS state.
 
 ## Prerequisites
 
 ### Cluster Requirements
 
 - **CNI**: OVN-Kubernetes installed and configured
-- **Nodes**: At least one node running `ovnkube-node` pods with `nbdb`, `sbdb`, and `northd` containers
+- **Nodes**: At least one node running `ovnkube-node` pods
 
 ### RBAC Requirements
 
@@ -36,7 +47,7 @@ rules:
   - apiGroups: [""]
     resources: ["pods"]
     verbs: ["get", "list"]
-  # Required to execute OVN commands in ovnkube-node containers
+  # Required to execute OVN/OVS commands inside ovnkube-node containers
   - apiGroups: [""]
     resources: ["pods/exec"]
     verbs: ["create"]
@@ -85,7 +96,7 @@ The `core` toolset is required for discovering ovnkube-node pods via `pods_list`
 
 ## Tools Reference
 
-OVN layer tools (`ovn_show`, `ovn_get`, `ovn_lflow_list`, `ovn_trace`) execute against the `nbdb`, `sbdb`, or `northd` container of an `ovnkube-node` pod depending on the database or operation requested.
+OVN layer tools (`ovn_show`, `ovn_get`, `ovn_lflow_list`, `ovn_trace`) execute against an `ovnkube-node` pod.
 
 **Default behavior notes:**
 
@@ -169,6 +180,76 @@ Microflow specification examples:
 - `inport=="pod1" && eth.src==00:00:00:00:00:01 && ip4.src==10.244.0.5 && ip4.dst==10.244.1.5`
 - `inport=="pod1" && eth.src==00:00:00:00:00:01 && icmp && ip4.src==10.244.0.5 && ip4.dst==8.8.8.8`
 
+---
+
+OVS layer tools (`ovs_vsctl`, `ovs_ofctl`, `ovs_appctl`) execute against an `ovnkube-node` pod. The required `action` parameter selects the specific subcommand to run.
+
+**Default behavior notes for OVS layer tools:**
+
+- **`namespace`**: required; on OpenShift this is `openshift-ovn-kubernetes`
+- **`name`**: required; the name of a specific `ovnkube-node` pod (discover with `pods_list`)
+- **`head`**: omitted or `0` → first **100** lines when `tail` is not specified
+- **`tail`**: omitted or `0` → not applied
+- **`apply_tail_first`**: `false` by default; when both `head` and `tail` are set, `head` is applied first
+
+### `ovs_vsctl`
+
+Inspect OVS switch configuration on an `ovnkube-node` pod.
+
+| Parameter | Required | Default | Description |
+|-----------|----------|---------|-------------|
+| `namespace` | Yes | — | Kubernetes namespace of the ovnkube-node pod (e.g. `openshift-ovn-kubernetes`) |
+| `name` | Yes | — | Name of the ovnkube-node pod |
+| `action` | Yes | — | One of: `show`, `list-br`, `list-ports`, `list-ifaces` |
+| `bridge` | When `action=list-ports` or `list-ifaces` | — | OVS bridge name (e.g. `br-int`) |
+| `head` | No | `100` | Return only the first N lines of output (only used when `action=show`) |
+| `tail` | No | `—` (not applied) | Return only the last N lines of output (only used when `action=show`) |
+| `apply_tail_first` | No | `false` | When both `head` and `tail` are applied, apply `tail` before `head` (only used when `action=show`) |
+
+Actions:
+
+- `show` — full OVS configuration overview: bridges, ports, interfaces, controllers, versions
+- `list-br` — bridge names only
+- `list-ports` — ports attached to the specified bridge
+- `list-ifaces` — interfaces attached to the specified bridge
+
+### `ovs_ofctl`
+
+Inspect OpenFlow flow tables on an OVS bridge.
+
+| Parameter | Required | Default | Description |
+|-----------|----------|---------|-------------|
+| `namespace` | Yes | — | Kubernetes namespace of the ovnkube-node pod |
+| `name` | Yes | — | Name of the ovnkube-node pod |
+| `action` | Yes | — | Currently: `dump-flows` |
+| `bridge` | Yes | — | OVS bridge name (e.g. `br-int`) |
+| `pattern` | No | `—` (empty) | Regex pattern to filter output lines |
+| `head` | No | `100` | Return only the first N lines of output |
+| `tail` | No | `—` (not applied) | Return only the last N lines of output |
+| `apply_tail_first` | No | `false` | When both `head` and `tail` are applied, apply `tail` before `head` |
+
+### `ovs_appctl`
+
+Run OVS datapath and OpenFlow pipeline diagnostics on an `ovnkube-node` pod.
+
+| Parameter | Required | Default | Description |
+|-----------|----------|---------|-------------|
+| `namespace` | Yes | — | Kubernetes namespace of the ovnkube-node pod |
+| `name` | Yes | — | Name of the ovnkube-node pod |
+| `action` | Yes | — | One of: `dpctl/dump-conntrack`, `ofproto/trace` |
+| `bridge` | When `action=ofproto/trace` | — | OVS bridge name (e.g. `br-int`) |
+| `flow` | When `action=ofproto/trace` | — | Flow specification (e.g. `in_port=1,ip,nw_src=10.244.0.5,nw_dst=10.96.0.1`) |
+| `additional_params` | No | `—` (empty) | Additional CLI arguments (only used when `action=dpctl/dump-conntrack`; e.g. `["zone=5"]`) |
+| `pattern` | No | `—` (empty) | Regex pattern to filter output lines |
+| `head` | No | `100` | Return only the first N lines of output |
+| `tail` | No | `—` (not applied) | Return only the last N lines of output |
+| `apply_tail_first` | No | `false` | When both `head` and `tail` are applied, apply `tail` before `head` |
+
+Actions:
+
+- `dpctl/dump-conntrack` — datapath connection tracking entries (protocol, source, destination, ports, state)
+- `ofproto/trace` — simulate a packet through the OpenFlow pipeline for the given bridge and flow
+
 ## Usage Examples
 
 ### OVN Configuration (`ovn_show`)
@@ -317,6 +398,109 @@ Microflow specification examples:
 }
 ```
 
+### OVS Configuration (`ovs_vsctl`)
+
+**Show full OVS configuration on a specific ovnkube-node pod**:
+
+```json
+{
+  "name": "ovs_vsctl",
+  "arguments": {
+    "namespace": "openshift-ovn-kubernetes",
+    "name": "ovnkube-node-abcde",
+    "action": "show"
+  }
+}
+```
+
+**List bridges**:
+
+```json
+{
+  "name": "ovs_vsctl",
+  "arguments": {
+    "namespace": "openshift-ovn-kubernetes",
+    "name": "ovnkube-node-abcde",
+    "action": "list-br"
+  }
+}
+```
+
+**List ports attached to br-int**:
+
+```json
+{
+  "name": "ovs_vsctl",
+  "arguments": {
+    "namespace": "openshift-ovn-kubernetes",
+    "name": "ovnkube-node-abcde",
+    "action": "list-ports",
+    "bridge": "br-int"
+  }
+}
+```
+
+### OpenFlow Flows (`ovs_ofctl`)
+
+**Dump all flows on br-int**:
+
+```json
+{
+  "name": "ovs_ofctl",
+  "arguments": {
+    "namespace": "openshift-ovn-kubernetes",
+    "name": "ovnkube-node-abcde",
+    "action": "dump-flows",
+    "bridge": "br-int"
+  }
+}
+```
+
+**Filter flows matching a specific priority**:
+
+```json
+{
+  "name": "ovs_ofctl",
+  "arguments": {
+    "namespace": "openshift-ovn-kubernetes",
+    "name": "ovnkube-node-abcde",
+    "action": "dump-flows",
+    "bridge": "br-int",
+    "pattern": "priority=100"
+  }
+}
+```
+
+### Datapath and Pipeline (`ovs_appctl`)
+
+**Dump datapath connection tracking**:
+
+```json
+{
+  "name": "ovs_appctl",
+  "arguments": {
+    "namespace": "openshift-ovn-kubernetes",
+    "name": "ovnkube-node-abcde",
+    "action": "dpctl/dump-conntrack"
+  }
+}
+```
+
+**Trace a packet through the OpenFlow pipeline on br-int**:
+
+```json
+{
+  "name": "ovs_appctl",
+  "arguments": {
+    "namespace": "openshift-ovn-kubernetes",
+    "name": "ovnkube-node-abcde",
+    "action": "ofproto/trace",
+    "bridge": "br-int",
+    "flow": "in_port=1,ip,nw_src=10.244.0.5,nw_dst=10.96.0.1"
+  }
+}
+```
+
 ## Common Diagnostic Workflows
 
 ### Inspect Logical Network Topology
@@ -381,6 +565,51 @@ ovn_get: namespace="openshift-ovn-kubernetes", name="<pod>", database="nbdb",
 ovn_get: namespace="openshift-ovn-kubernetes", name="<pod>", database="nbdb", table="Port_Group"
 ```
 
+### Verify OVS Configuration on a Node
+
+**Scenario**: Confirm that OVS bridges and ports are configured as expected on a specific node.
+
+```text
+# 1. Find ovnkube-node pods
+pods_list: labelSelector="app=ovnkube-node"
+
+# 2. Show OVS configuration overview
+ovs_vsctl: namespace="openshift-ovn-kubernetes", name="<pod>", action="show"
+
+# 3. Inspect ports on br-int specifically
+ovs_vsctl: namespace="openshift-ovn-kubernetes", name="<pod>", action="list-ports", bridge="br-int"
+```
+
+### Trace Packet Forwarding for a Pod
+
+**Scenario**: A pod cannot reach a Kubernetes Service; simulate the packet path through OVS on the source node.
+
+```text
+# 1. Locate the ovnkube-node pod on the source node
+pods_list: labelSelector="app=ovnkube-node"
+
+# 2. Trace the packet through the br-int OpenFlow pipeline
+ovs_appctl: namespace="openshift-ovn-kubernetes", name="<pod>", action="ofproto/trace",
+            bridge="br-int",
+            flow="in_port=1,ip,nw_src=<pod-ip>,nw_dst=<service-clusterip>"
+
+# 3. Inspect the matching flows on br-int for additional context
+ovs_ofctl: namespace="openshift-ovn-kubernetes", name="<pod>", action="dump-flows",
+           bridge="br-int"
+```
+
+### Inspect Datapath Conntrack State
+
+**Scenario**: Investigate stateful connections tracked by the OVS datapath on a node.
+
+```text
+# 1. Locate an ovnkube-node pod on the node of interest
+pods_list: labelSelector="app=ovnkube-node"
+
+# 2. Dump datapath conntrack entries
+ovs_appctl: namespace="openshift-ovn-kubernetes", name="<pod>", action="dpctl/dump-conntrack"
+```
+
 ## Troubleshooting
 
 ### Common Issues
@@ -393,13 +622,22 @@ ovn_get: namespace="openshift-ovn-kubernetes", name="<pod>", database="nbdb", ta
 
 #### "Container not found" errors
 
-**Symptom**: `Error: container "nbdb" not found in pod "..."`
+**Symptom**: `Error: container "nbdb" not found in pod "..."` or `Error: container "ovn-controller" not found in pod "..."`
 
 **Solution**:
 
 - Confirm the pod is an `ovnkube-node` pod (`kubectl get pod <name> -o jsonpath='{.spec.containers[*].name}'`)
 - On some OVN-K variants the container names may differ; use `pods_list` with the `app=ovnkube-node` label selector to find the correct pod
 
+#### "Bridge not found" errors
+
+**Symptom**: `ovs-vsctl: no bridge named ...`
+
+**Solution**:
+
+- Use `ovs_vsctl` with `action=list-br` to see the actual bridges on the node
+- `br-int` is the OVN integration bridge and is always present; `br-ex` exists on OpenShift but may be named differently on other distributions
+
 #### Empty or truncated output
 
 **Symptom**: Output appears incomplete or is cut off.

evals/core-eval-testing/acp-google/eval-ovn-kubernetes.yaml

@@ -0,0 +1,25 @@
+kind: Eval
+metadata:
+  name: "ovn-kubernetes-e2e"
+config:
+  agent:
+    type: "file"
+    path: agent.yaml
+  mcpConfigFile: ../../mcp-config.yaml
+  extensions:
+    kubernetes:
+      package: https://github.com/mcpchecker/kubernetes-extension@v0.0.4
+  llmJudge:
+    ref:
+      type: file
+      path: agent.yaml
+  taskSets:
+    - glob: ../../tasks/*/*/*.yaml
+      labelSelector:
+        suite: ovn-kubernetes
+      assertions:
+        toolsUsed:
+          - server: kubernetes
+            toolPattern: ".*"
+        minToolCalls: 1
+        maxToolCalls: 20

evals/tasks/ovn-kubernetes/ovs-appctl/ovs-appctl-dump-conntrack.yaml

@@ -0,0 +1,27 @@
+kind: Task
+apiVersion: mcpchecker/v1alpha2
+metadata:
+  name: "ovs-appctl-dump-conntrack"
+  difficulty: easy
+  category: "OVS Datapath"
+  description: "Dump datapath connection tracking entries on an ovnkube-node pod"
+  labels:
+    suite: ovn-kubernetes
+    requires: ovn-kubernetes
+spec:
+  limits:
+    timeout: "5m"
+  setup:
+    - script:
+        file: ./setup.sh
+  prompt:
+    inline: |
+      Dump the OVS datapath connection tracking entries on one of the ovnkube-node pods.
+  verify:
+    - llmJudge:
+        contains: "Shows the OVS datapath conntrack entries with tuples for the tracked connections including protocol, source and destination addresses and ports"
+        reasoning: "dpctl/dump-conntrack returns tracked connection entries. Each entry is a tuple describing the protocol and endpoints of a connection currently in the datapath"
+  assertions:
+    toolsUsed:
+      - server: kubernetes
+        toolPattern: "ovs_appctl"