CNF-23786: Add --dry-run flag to preview scan targets without scanning

[sebrandon1]

Summary

• Extract discovery phase from PerformClusterScan() into reusable DiscoverTargets() function
• Add --dry-run flag that runs pod/port discovery only and prints a tabular summary of scan targets and skipped ports
• Works with --all-pods, --targets, and single-host modes
• Skips testssl.sh installation check when --dry-run is set since it is not needed for discovery

Jira: CNF-23786

Example output

$ tls-scanner --all-pods --dry-run --namespace-filter openshift-etcd

=== DISCOVERY COMPLETE: 6 pods -> 102 scan jobs (0 deduplicated), 38 skipped ===

========================================
DRY RUN: Discovery complete
========================================
Scan targets:          102
Skipped (localhost):   35
Skipped (no ports):    3
Skipped (probe ports): 0
========================================

SCAN TARGETS:
IP            Port   Pod Name               Namespace       Component
10.46.97.140  9107   etcd-cnfdt16-master-1  openshift-etcd  openshift-component
10.46.97.140  2380   etcd-cnfdt16-master-1  openshift-etcd  openshift-component
10.46.97.140  2379   etcd-cnfdt16-master-1  openshift-etcd  openshift-component
10.46.97.140  6443   etcd-cnfdt16-master-1  openshift-etcd  openshift-component
...

SKIPPED PORTS:
IP            Port   Pod Name               Namespace       Status          Reason
10.46.97.140  8797   etcd-cnfdt16-master-1  openshift-etcd  LOCALHOST_ONLY  Bound to 127.0.0.1, not accessible from pod IP
10.46.97.140  9537   etcd-cnfdt16-master-1  openshift-etcd  LOCALHOST_ONLY  Bound to 127.0.0.1, not accessible from pod IP
10.46.97.140  10248  etcd-cnfdt16-master-1  openshift-etcd  LOCALHOST_ONLY  Bound to 127.0.0.1, not accessible from pod IP
...

Test plan

• go build ./... passes
• go test ./... passes
• go vet ./... passes
• tls-scanner --all-pods --dry-run prints target table and exits without scanning
• tls-scanner --all-pods --dry-run --namespace-filter openshift-etcd filters correctly
• tls-scanner --targets 10.0.0.1:443 --dry-run prints target list
• tls-scanner --dry-run (single host default) prints single target
• Normal scan without --dry-run still works identically

[smith-xyz]

this is a good feature, I think just a few things to clean up would be great before we merge. Let me know if I missed anything

[smith-xyz]

/retest

[smith-xyz]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sebrandon1, smith-xyz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [smith-xyz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD eee0a3a and 2 for PR HEAD 4d0705e in total

[openshift-ci]

@sebrandon1: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/tls13-conformance	6585541	link	false	/test tls13-conformance
ci/prow/tls13-adherence	4d0705e	link	false	/test tls13-adherence
ci/prow/default-tls	4d0705e	link	false	/test default-tls
ci/prow/tls13-pqc-readiness	4d0705e	link	false	/test tls13-pqc-readiness
ci/prow/default-pqc-readiness	4d0705e	link	false	/test default-pqc-readiness

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@sebrandon1: This pull request references CNF-23786 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Extract discovery phase from PerformClusterScan() into reusable DiscoverTargets() function
• Add --dry-run flag that runs pod/port discovery only and prints a tabular summary of scan targets and skipped ports
• Works with --all-pods, --targets, and single-host modes
• Skips testssl.sh installation check when --dry-run is set since it is not needed for discovery

Jira: CNF-23786

Example output

$ tls-scanner --all-pods --dry-run --namespace-filter openshift-etcd

=== DISCOVERY COMPLETE: 6 pods -> 102 scan jobs (0 deduplicated), 38 skipped ===

========================================
DRY RUN: Discovery complete
========================================
Scan targets:          102
Skipped (localhost):   35
Skipped (no ports):    3
Skipped (probe ports): 0
========================================

SCAN TARGETS:
IP            Port   Pod Name               Namespace       Component
10.46.97.140  9107   etcd-cnfdt16-master-1  openshift-etcd  openshift-component
10.46.97.140  2380   etcd-cnfdt16-master-1  openshift-etcd  openshift-component
10.46.97.140  2379   etcd-cnfdt16-master-1  openshift-etcd  openshift-component
10.46.97.140  6443   etcd-cnfdt16-master-1  openshift-etcd  openshift-component
...

SKIPPED PORTS:
IP            Port   Pod Name               Namespace       Status          Reason
10.46.97.140  8797   etcd-cnfdt16-master-1  openshift-etcd  LOCALHOST_ONLY  Bound to 127.0.0.1, not accessible from pod IP
10.46.97.140  9537   etcd-cnfdt16-master-1  openshift-etcd  LOCALHOST_ONLY  Bound to 127.0.0.1, not accessible from pod IP
10.46.97.140  10248  etcd-cnfdt16-master-1  openshift-etcd  LOCALHOST_ONLY  Bound to 127.0.0.1, not accessible from pod IP
...

Test plan

• go build ./... passes
• go test ./... passes
• go vet ./... passes
• tls-scanner --all-pods --dry-run prints target table and exits without scanning
• tls-scanner --all-pods --dry-run --namespace-filter openshift-etcd filters correctly
• tls-scanner --targets 10.0.0.1:443 --dry-run prints target list
• tls-scanner --dry-run (single host default) prints single target
• Normal scan without --dry-run still works identically

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[smith-xyz]

/lgtm