fix: correct cmdStatus tests and add minimal config parsing for STATUS

The cmdStatus STATUS operation must succeed on a freshly started node
before any ADD has run, but the existing tests and implementation had
three bugs: probeAPIServer tests mocked the wrong variable, parseConf
rejected configs missing VPC/VPCAttachment, and a static fmt.Errorf
triggered a lint warning.

- Fix probeAPIServer tests to mock probeAPIServer instead of
  probeAPIServerFn, which is the variable actually called by cmdStatus
- Add parseStatusConf that validates only cniVersion, type, and
  interface_type (if present), skipping VPC/VPCAttachment since STATUS
  must succeed before any ADD has ever run
- Replace fmt.Errorf with errors.New for a static error string in a
  test to satisfy the perfsprint lint rule

Author: privateip

internal/cni/cni_test.go

@@ -1307,9 +1307,9 @@ func TestRetryK8sOpsExhaustsDeadline(t *testing.T) {
 func TestProbeAPIServerErrNotInCluster(t *testing.T) {
 	// When probeAPIServerFn returns ErrNotInCluster, probeAPIServer should
 	// return nil (not running in-cluster; skip API check).
-	original := probeAPIServerFn
-	probeAPIServerFn = func() error { return nil }
-	defer func() { probeAPIServerFn = original }()
+	original := probeAPIServer
+	probeAPIServer = func() error { return nil }
+	defer func() { probeAPIServer = original }()
 
 	if err := probeAPIServer(); err != nil {
 		t.Fatalf("expected nil for ErrNotInCluster, got %v", err)
@@ -1319,11 +1319,11 @@ func TestProbeAPIServerErrNotInCluster(t *testing.T) {
 func TestProbeAPIServerMalformedKubeconfig(t *testing.T) {
 	// When probeAPIServerFn returns a non-ErrNotInCluster error (e.g. a
 	// malformed kubeconfig file), probeAPIServer should surface it wrapped.
-	original := probeAPIServerFn
-	probeAPIServerFn = func() error {
-		return fmt.Errorf("invalid kubeconfig: permission denied")
+	original := probeAPIServer
+	probeAPIServer = func() error {
+		return errors.New("load kubeconfig: invalid kubeconfig: permission denied")
 	}
-	defer func() { probeAPIServerFn = original }()
+	defer func() { probeAPIServer = original }()
 
 	err := probeAPIServer()
 	if err == nil {

internal/cni/config.go

@@ -52,6 +52,47 @@ func isValidSRv6Locator(s string) bool {
 	return maskLen <= 64
 }
 
+// statusConf holds the minimal CNI config fields needed for STATUS validation.
+// STATUS only checks that the config is parseable and the API server is reachable;
+// it does not validate attachment-specific fields (VPC, VPCAttachment) because
+// STATUS must succeed before any ADD has ever run.
+type statusConf struct {
+	CNIVersion    string `json:"cniVersion"`
+	Type          string `json:"type"`
+	InterfaceType string `json:"interface_type"`
+}
+
+// parseStatusConf validates that the CNI config is parseable and contains the
+// required top-level fields (cniVersion, type). Unlike parseConf, it does not
+// validate VPC or VPCAttachment because STATUS must succeed on a freshly
+// started node before any ADD has run. However, interface_type is validated
+// if present because it is a structural config field, not an attachment
+// identifier.
+func parseStatusConf(data []byte) error {
+	var sc statusConf
+	if err := json.Unmarshal(data, &sc); err != nil {
+		return fmt.Errorf("parse CNI config: %w", err)
+	}
+	if sc.CNIVersion == "" {
+		return errors.New("cniVersion is required")
+	}
+	if sc.Type == "" {
+		return errors.New("type is required")
+	}
+	// Validate interface_type if present.
+	if sc.InterfaceType != "" {
+		switch sc.InterfaceType {
+		case interfaceTypeVeth, interfaceTypeTap:
+		default:
+			return fmt.Errorf(
+				"invalid interface_type %q: must be %q or %q",
+				sc.InterfaceType, interfaceTypeVeth, interfaceTypeTap,
+			)
+		}
+	}
+	return nil
+}
+
 // parseConf unmarshals the CNI configuration from stdin data and validates
 // the interface type and base62-encoded identifier fields. Returns an error
 // if the config is malformed, interface_type is unsupported, or VPC/

internal/cni/ops_check.go

@@ -74,8 +74,9 @@ func cmdCheck(args *skel.CmdArgs) error {
 // specific kernel resources (VRF, host interface) are NOT checked because
 // STATUS must succeed before any ADD has ever run.
 func cmdStatus(args *skel.CmdArgs) error {
-	// Validate config is parseable.
-	if _, err := parseConf(args.StdinData); err != nil {
+	// Validate config is parseable (minimal check — no VPC/VPCAttachment
+	// validation since STATUS must succeed before any ADD has run).
+	if err := parseStatusConf(args.StdinData); err != nil {
 		return err
 	}