test: raise pkg coverage above 80% and bump tool versions (#65)

Add unit tests across pkg providers so every package in ./pkg exceeds 80%
statement coverage:

- utils: 6.5% -> 100% (shell tool, kubeconfig, RegisterTools)
- cilium: 46.7% -> 85.5% (cilium-dbg and CLI handlers)
- argo: 49.7% -> 88.3% (gateway plugin, list/check logs, RegisterTools)
- istio: 61.6% -> 92.7% (waypoint apply/delete/status, ztunnel)
- prometheus: 72.4% -> 81.6% (RegisterTools, validation/error paths)
- k8s: 73.9% -> 82.2% (RegisterTools, NewK8sToolWithConfig)

Extract the shell tool closure into a named handleShellTool for testability.

Bump tool versions to latest releases (make check-releases):
- cilium 0.19.2 -> 0.19.4
- istio 1.29.1 -> 1.30.1
- helm 4.1.3 -> 4.2.2
- kubectl 1.35.3 -> 1.36.2

Signed-off-by: Dmytro Rashko <dmitriy.rashko@amdocs.com>

Author: dimetron

Makefile

@@ -136,11 +136,11 @@ DOCKER_BUILDER ?= docker buildx
 DOCKER_BUILD_ARGS ?= --pull --load --platform linux/$(LOCALARCH) --builder $(BUILDX_BUILDER_NAME)
 
 # tools image build args
-TOOLS_ISTIO_VERSION ?= 1.29.1
+TOOLS_ISTIO_VERSION ?= 1.30.1
 TOOLS_ARGO_ROLLOUTS_VERSION ?= 1.9.0
-TOOLS_KUBECTL_VERSION ?= 1.35.3
-TOOLS_HELM_VERSION ?= 4.1.3
-TOOLS_CILIUM_VERSION ?= 0.19.2
+TOOLS_KUBECTL_VERSION ?= 1.36.2
+TOOLS_HELM_VERSION ?= 4.2.2
+TOOLS_CILIUM_VERSION ?= 0.19.4
 
 # build args
 TOOLS_IMAGE_BUILD_ARGS =  --build-arg VERSION=$(VERSION)

go.mod

@@ -1,6 +1,6 @@
 module github.com/kagent-dev/tools
 
-go 1.26.1
+go 1.26.4
 
 require (
 	github.com/joho/godotenv v1.5.1

pkg/argo/argo_test.go

@@ -7,10 +7,166 @@ import (
 
 	"github.com/kagent-dev/tools/internal/cmd"
 	"github.com/mark3labs/mcp-go/mcp"
+	"github.com/mark3labs/mcp-go/server"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+func TestRegisterTools(t *testing.T) {
+	t.Run("read-write", func(t *testing.T) {
+		s := server.NewMCPServer("test", "v0.0.1")
+		RegisterTools(s, false)
+	})
+	t.Run("read-only", func(t *testing.T) {
+		s := server.NewMCPServer("test", "v0.0.1")
+		RegisterTools(s, true)
+	})
+}
+
+func TestHandleListRollouts(t *testing.T) {
+	t.Run("default namespace and type", func(t *testing.T) {
+		mock := cmd.NewMockShellExecutor()
+		mock.AddCommandString("kubectl", []string{"argo", "rollouts", "list", "rollouts", "-n", "argo-rollouts"}, "NAME STATUS\nmyapp Healthy", nil)
+		ctx := cmd.WithShellExecutor(context.Background(), mock)
+
+		result, err := handleListRollouts(ctx, mcp.CallToolRequest{})
+		assert.NoError(t, err)
+		assert.False(t, result.IsError)
+		assert.Contains(t, getResultText(result), "myapp")
+	})
+
+	t.Run("experiments type custom namespace", func(t *testing.T) {
+		mock := cmd.NewMockShellExecutor()
+		mock.AddCommandString("kubectl", []string{"argo", "rollouts", "list", "experiments", "-n", "prod"}, "NAME", nil)
+		ctx := cmd.WithShellExecutor(context.Background(), mock)
+
+		req := mcp.CallToolRequest{}
+		req.Params.Arguments = map[string]interface{}{"type": "experiments", "namespace": "prod"}
+		result, err := handleListRollouts(ctx, req)
+		assert.NoError(t, err)
+		assert.False(t, result.IsError)
+	})
+
+	t.Run("command failure", func(t *testing.T) {
+		mock := cmd.NewMockShellExecutor()
+		mock.AddCommandString("kubectl", []string{"argo", "rollouts", "list", "rollouts", "-n", "argo-rollouts"}, "", assert.AnError)
+		ctx := cmd.WithShellExecutor(context.Background(), mock)
+
+		result, err := handleListRollouts(ctx, mcp.CallToolRequest{})
+		assert.NoError(t, err)
+		assert.True(t, result.IsError)
+		assert.Contains(t, getResultText(result), "Error listing rollouts")
+	})
+}
+
+func TestHandleCheckPluginLogs(t *testing.T) {
+	t.Run("plugin install found in logs", func(t *testing.T) {
+		mock := cmd.NewMockShellExecutor()
+		logs := `Downloading plugin argoproj-labs/gatewayAPI from: https://github.com/x/releases/download/v0.5.0/gatewayapi-plugin-linux-amd64"
+Download complete, it took 1.5s`
+		mock.AddCommandString("kubectl", []string{"logs", "-n", "argo-rollouts", "-l", "app.kubernetes.io/name=argo-rollouts", "--tail", "100"}, logs, nil)
+		ctx := cmd.WithShellExecutor(context.Background(), mock)
+
+		result, err := handleCheckPluginLogs(ctx, mcp.CallToolRequest{})
+		assert.NoError(t, err)
+		assert.Contains(t, getResultText(result), "0.5.0")
+		assert.Contains(t, getResultText(result), `"installed": true`)
+	})
+
+	t.Run("plugin install not found", func(t *testing.T) {
+		mock := cmd.NewMockShellExecutor()
+		mock.AddCommandString("kubectl", []string{"logs", "-n", "argo-rollouts", "-l", "app.kubernetes.io/name=argo-rollouts", "--tail", "100"}, "no plugin here", nil)
+		ctx := cmd.WithShellExecutor(context.Background(), mock)
+
+		result, err := handleCheckPluginLogs(ctx, mcp.CallToolRequest{})
+		assert.NoError(t, err)
+		assert.Contains(t, getResultText(result), "Plugin installation not found")
+	})
+
+	t.Run("command failure", func(t *testing.T) {
+		mock := cmd.NewMockShellExecutor()
+		mock.AddCommandString("kubectl", []string{"logs", "-n", "argo-rollouts", "-l", "app.kubernetes.io/name=argo-rollouts", "--tail", "100"}, "", assert.AnError)
+		ctx := cmd.WithShellExecutor(context.Background(), mock)
+
+		result, err := handleCheckPluginLogs(ctx, mcp.CallToolRequest{})
+		assert.NoError(t, err)
+		assert.Contains(t, getResultText(result), `"installed": false`)
+	})
+}
+
+func TestConfigureGatewayPlugin(t *testing.T) {
+	t.Run("applies configmap successfully", func(t *testing.T) {
+		mock := cmd.NewMockShellExecutor()
+		mock.AddPartialMatcherString("kubectl", []string{"apply", "-f"}, "configmap/argo-rollouts-config created", nil)
+		ctx := cmd.WithShellExecutor(context.Background(), mock)
+
+		status := configureGatewayPlugin(ctx, "0.5.0", "argo-rollouts")
+		assert.True(t, status.Installed)
+		assert.Equal(t, "0.5.0", status.Version)
+		assert.NotEmpty(t, status.Architecture)
+	})
+
+	t.Run("apply failure", func(t *testing.T) {
+		mock := cmd.NewMockShellExecutor()
+		mock.AddPartialMatcherString("kubectl", []string{"apply", "-f"}, "", assert.AnError)
+		ctx := cmd.WithShellExecutor(context.Background(), mock)
+
+		status := configureGatewayPlugin(ctx, "0.5.0", "argo-rollouts")
+		assert.False(t, status.Installed)
+		assert.Contains(t, status.ErrorMessage, "Error applying Gateway API plugin config")
+	})
+}
+
+func TestHandleVerifyGatewayPluginAlreadyConfigured(t *testing.T) {
+	mock := cmd.NewMockShellExecutor()
+	mock.AddCommandString("kubectl", []string{"get", "configmap", "argo-rollouts-config", "-n", "argo-rollouts", "-o", "yaml"}, "data:\n  trafficRouterPlugins: argoproj-labs/gatewayAPI", nil)
+	ctx := cmd.WithShellExecutor(context.Background(), mock)
+
+	result, err := handleVerifyGatewayPlugin(ctx, mcp.CallToolRequest{})
+	assert.NoError(t, err)
+	assert.Contains(t, getResultText(result), "already configured")
+}
+
+func TestHandleVerifyArgoRolloutsControllerInstallStatuses(t *testing.T) {
+	baseCmd := []string{"get", "pods", "-n", "argo-rollouts", "-l", "app.kubernetes.io/component=rollouts-controller", "-o", "jsonpath={.items[*].status.phase}"}
+
+	t.Run("all running", func(t *testing.T) {
+		mock := cmd.NewMockShellExecutor()
+		mock.AddCommandString("kubectl", baseCmd, "Running Running", nil)
+		ctx := cmd.WithShellExecutor(context.Background(), mock)
+		result, err := handleVerifyArgoRolloutsControllerInstall(ctx, mcp.CallToolRequest{})
+		assert.NoError(t, err)
+		assert.Contains(t, getResultText(result), "All pods are running")
+	})
+
+	t.Run("not all running", func(t *testing.T) {
+		mock := cmd.NewMockShellExecutor()
+		mock.AddCommandString("kubectl", baseCmd, "Running Pending", nil)
+		ctx := cmd.WithShellExecutor(context.Background(), mock)
+		result, err := handleVerifyArgoRolloutsControllerInstall(ctx, mcp.CallToolRequest{})
+		assert.NoError(t, err)
+		assert.Contains(t, getResultText(result), "Not all pods are running")
+	})
+
+	t.Run("no pods", func(t *testing.T) {
+		mock := cmd.NewMockShellExecutor()
+		mock.AddCommandString("kubectl", baseCmd, "", nil)
+		ctx := cmd.WithShellExecutor(context.Background(), mock)
+		result, err := handleVerifyArgoRolloutsControllerInstall(ctx, mcp.CallToolRequest{})
+		assert.NoError(t, err)
+		assert.Contains(t, getResultText(result), "No pods found")
+	})
+
+	t.Run("command error", func(t *testing.T) {
+		mock := cmd.NewMockShellExecutor()
+		mock.AddCommandString("kubectl", baseCmd, "", assert.AnError)
+		ctx := cmd.WithShellExecutor(context.Background(), mock)
+		result, err := handleVerifyArgoRolloutsControllerInstall(ctx, mcp.CallToolRequest{})
+		assert.NoError(t, err)
+		assert.True(t, result.IsError)
+	})
+}
+
 // Helper function to extract text content from MCP result
 func getResultText(result *mcp.CallToolResult) string {
 	if result == nil || len(result.Content) == 0 {

pkg/cilium/cilium_test.go

@@ -619,3 +619,147 @@ func getResultText(r *mcp.CallToolResult) string {
 	}
 	return ""
 }
+
+type ciliumHandler func(context.Context, mcp.CallToolRequest) (*mcp.CallToolResult, error)
+
+// TestCiliumDbgHandlers exercises the success path of every cilium-dbg based handler.
+func TestCiliumDbgHandlers(t *testing.T) {
+	cases := []struct {
+		name    string
+		handler ciliumHandler
+		args    map[string]any
+		dbgArgs []string
+		expect  string
+	}{
+		{"manage_endpoint_labels", handleManageEndpointLabels, map[string]any{"endpoint_id": "34", "labels": "key=val"}, []string{"endpoint", "labels", "34", "--add", "key=val"}, "ok"},
+		{"manage_endpoint_configuration", handleManageEndpointConfiguration, map[string]any{"endpoint_id": "34", "config": "Debug=true"}, []string{"endpoint", "config", "34", "Debug=true"}, "ok"},
+		{"disconnect_endpoint", handleDisconnectEndpoint, map[string]any{"endpoint_id": "34"}, []string{"endpoint", "disconnect", "34"}, "ok"},
+		{"get_identity_details", handleGetIdentityDetails, map[string]any{"identity_id": "123"}, []string{"identity", "get", "123"}, "ok"},
+		{"flush_ipsec_state", handleFlushIPsecState, map[string]any{}, []string{"encrypt", "flush", "-f"}, "ok"},
+		{"list_envoy_config", handleListEnvoyConfig, map[string]any{"resource_name": "clusters"}, []string{"envoy", "admin", "clusters"}, "ok"},
+		{"show_ipcache_cidr", handleShowIPCacheInformation, map[string]any{"cidr": "10.0.0.0/24"}, []string{"ip", "get", "10.0.0.0/24"}, "ok"},
+		{"show_ipcache_labels", handleShowIPCacheInformation, map[string]any{"labels": "app=foo"}, []string{"ip", "get", "--labels", "app=foo"}, "ok"},
+		{"delete_kvstore_key", handleDeleteKeyFromKVStore, map[string]any{"key": "foo"}, []string{"kvstore", "delete", "foo"}, "ok"},
+		{"get_kvstore_key", handleGetKVStoreKey, map[string]any{"key": "foo"}, []string{"kvstore", "get", "foo"}, "ok"},
+		{"set_kvstore_key", handleSetKVStoreKey, map[string]any{"key": "foo", "value": "bar"}, []string{"kvstore", "set", "foo=bar"}, "ok"},
+		{"show_load_information", handleShowLoadInformation, map[string]any{}, []string{"loadinfo"}, "ok"},
+		{"display_policy_node_info", handleDisplayPolicyNodeInformation, map[string]any{}, []string{"policy", "get"}, "ok"},
+		{"display_policy_node_info_labels", handleDisplayPolicyNodeInformation, map[string]any{"labels": "k=v"}, []string{"policy", "get", "k=v"}, "ok"},
+		{"delete_policy_rules_all", handleDeletePolicyRules, map[string]any{"all": "true"}, []string{"policy", "delete", "--all"}, "ok"},
+		{"delete_policy_rules_labels", handleDeletePolicyRules, map[string]any{"labels": "k=v"}, []string{"policy", "delete", "k=v"}, "ok"},
+		{"update_xdp_cidr", handleUpdateXDPCIDRFilters, map[string]any{"cidr_prefixes": "10.0.0.0/8"}, []string{"prefilter", "update", "--cidr", "10.0.0.0/8"}, "ok"},
+		{"update_xdp_cidr_rev", handleUpdateXDPCIDRFilters, map[string]any{"cidr_prefixes": "10.0.0.0/8", "revision": "2"}, []string{"prefilter", "update", "--cidr", "10.0.0.0/8", "--revision", "2"}, "ok"},
+		{"delete_xdp_cidr", handleDeleteXDPCIDRFilters, map[string]any{"cidr_prefixes": "10.0.0.0/8"}, []string{"prefilter", "delete", "--cidr", "10.0.0.0/8"}, "ok"},
+		{"delete_xdp_cidr_rev", handleDeleteXDPCIDRFilters, map[string]any{"cidr_prefixes": "10.0.0.0/8", "revision": "2"}, []string{"prefilter", "delete", "--cidr", "10.0.0.0/8", "--revision", "2"}, "ok"},
+		{"validate_cnp", handleValidateCiliumNetworkPolicies, map[string]any{"enable_k8s": "true", "enable_k8s_api_discovery": "true"}, []string{"preflight", "validate-cnp", "--enable-k8s", "--enable-k8s-api-discovery"}, "ok"},
+		{"list_pcap_recorders", handleListPCAPRecorders, map[string]any{}, []string{"recorder", "list"}, "ok"},
+		{"get_pcap_recorder", handleGetPCAPRecorder, map[string]any{"recorder_id": "1"}, []string{"recorder", "get", "1"}, "ok"},
+		{"delete_pcap_recorder", handleDeletePCAPRecorder, map[string]any{"recorder_id": "1"}, []string{"recorder", "delete", "1"}, "ok"},
+		{"update_pcap_recorder", handleUpdatePCAPRecorder, map[string]any{"recorder_id": "1", "filters": "f"}, []string{"recorder", "update", "1", "--filters", "f", "--caplen", "0", "--id", "0"}, "ok"},
+		{"get_service_information", handleGetServiceInformation, map[string]any{"service_id": "5"}, []string{"service", "get", "5"}, "ok"},
+		{"delete_service_all", handleDeleteService, map[string]any{"all": "true"}, []string{"service", "delete", "--all"}, "ok"},
+		{"delete_service_id", handleDeleteService, map[string]any{"service_id": "5"}, []string{"service", "delete", "5"}, "ok"},
+		{"update_service", handleUpdateService, map[string]any{"backends": "b", "frontend": "f", "id": "1"}, []string{"service", "update", "1", "--backends", "b", "--frontend", "f", "--protocol", "TCP", "--states", "active"}, "ok"},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			mock := cmd.NewMockShellExecutor()
+			mockCiliumDbgCommand(mock, tc.dbgArgs, tc.expect, nil)
+			ctx := cmd.WithShellExecutor(context.Background(), mock)
+
+			tc.args["node_name"] = "test-node"
+			result, err := tc.handler(ctx, newRequestWithArgs(tc.args))
+			require.NoError(t, err)
+			assert.False(t, result.IsError, "handler returned error result: %s", getResultText(result))
+			assert.Contains(t, getResultText(result), tc.expect)
+		})
+	}
+}
+
+// TestCiliumDbgHandlersMissingParams covers required-parameter validation branches.
+func TestCiliumDbgHandlersMissingParams(t *testing.T) {
+	cases := []struct {
+		name    string
+		handler ciliumHandler
+		args    map[string]any
+	}{
+		{"manage_endpoint_labels", handleManageEndpointLabels, map[string]any{}},
+		{"manage_endpoint_configuration_no_id", handleManageEndpointConfiguration, map[string]any{}},
+		{"manage_endpoint_configuration_no_config", handleManageEndpointConfiguration, map[string]any{"endpoint_id": "34"}},
+		{"disconnect_endpoint", handleDisconnectEndpoint, map[string]any{}},
+		{"get_identity_details", handleGetIdentityDetails, map[string]any{}},
+		{"list_envoy_config", handleListEnvoyConfig, map[string]any{}},
+		{"show_ipcache_none", handleShowIPCacheInformation, map[string]any{}},
+		{"delete_kvstore_key", handleDeleteKeyFromKVStore, map[string]any{}},
+		{"get_kvstore_key", handleGetKVStoreKey, map[string]any{}},
+		{"set_kvstore_key", handleSetKVStoreKey, map[string]any{"key": "foo"}},
+		{"delete_policy_rules_none", handleDeletePolicyRules, map[string]any{}},
+		{"update_xdp_cidr", handleUpdateXDPCIDRFilters, map[string]any{}},
+		{"delete_xdp_cidr", handleDeleteXDPCIDRFilters, map[string]any{}},
+		{"get_pcap_recorder", handleGetPCAPRecorder, map[string]any{}},
+		{"delete_pcap_recorder", handleDeletePCAPRecorder, map[string]any{}},
+		{"update_pcap_recorder", handleUpdatePCAPRecorder, map[string]any{"recorder_id": "1"}},
+		{"get_service_information", handleGetServiceInformation, map[string]any{}},
+		{"delete_service_none", handleDeleteService, map[string]any{}},
+		{"update_service", handleUpdateService, map[string]any{"backends": "b"}},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			mock := cmd.NewMockShellExecutor()
+			ctx := cmd.WithShellExecutor(context.Background(), mock)
+			result, err := tc.handler(ctx, newRequestWithArgs(tc.args))
+			require.NoError(t, err)
+			assert.True(t, result.IsError)
+			assert.Empty(t, mock.GetCallLog())
+		})
+	}
+}
+
+// TestCiliumCliHandlers covers the cilium-CLI based handlers.
+func TestCiliumCliHandlers(t *testing.T) {
+	cases := []struct {
+		name    string
+		handler ciliumHandler
+		args    map[string]any
+		cliArgs []string
+	}{
+		{"show_cluster_mesh_status", handleShowClusterMeshStatus, map[string]any{}, []string{"clustermesh", "status"}},
+		{"show_features_status", handleShowFeaturesStatus, map[string]any{}, []string{"features", "status"}},
+		{"toggle_cluster_mesh_enable", handleToggleClusterMesh, map[string]any{"enable": "true"}, []string{"clustermesh", "enable"}},
+		{"toggle_cluster_mesh_disable", handleToggleClusterMesh, map[string]any{"enable": "false"}, []string{"clustermesh", "disable"}},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			mock := cmd.NewMockShellExecutor()
+			mock.AddCommandString("cilium", tc.cliArgs, "cli-ok", nil)
+			ctx := cmd.WithShellExecutor(context.Background(), mock)
+			result, err := tc.handler(ctx, newRequestWithArgs(tc.args))
+			require.NoError(t, err)
+			assert.False(t, result.IsError)
+			assert.Contains(t, getResultText(result), "cli-ok")
+		})
+	}
+}
+
+func TestCiliumCliHandlersError(t *testing.T) {
+	mock := cmd.NewMockShellExecutor()
+	mock.AddCommandString("cilium", []string{"clustermesh", "status"}, "", assert.AnError)
+	ctx := cmd.WithShellExecutor(context.Background(), mock)
+	result, err := handleShowClusterMeshStatus(ctx, newRequestWithArgs(map[string]any{}))
+	require.NoError(t, err)
+	assert.True(t, result.IsError)
+	assert.Contains(t, getResultText(result), "Error getting cluster mesh status")
+}
+
+// TestCiliumDbgHandlerError covers the error path shared by dbg handlers.
+func TestCiliumDbgHandlerError(t *testing.T) {
+	mock := cmd.NewMockShellExecutor()
+	mockCiliumDbgCommand(mock, []string{"loadinfo"}, "", assert.AnError)
+	ctx := cmd.WithShellExecutor(context.Background(), mock)
+	result, err := handleShowLoadInformation(ctx, newRequestWithArgs(map[string]any{"node_name": "test-node"}))
+	require.NoError(t, err)
+	assert.True(t, result.IsError)
+}