Fixed flakiness in oc extract image ref

addressed comments

Author: YamunadeviShanmugam

test/extended/cli/admin.go

@@ -15,7 +15,6 @@ import (
 	"k8s.io/apiserver/pkg/storage/names"
 	"k8s.io/kubernetes/test/e2e/framework"
 
-	"github.com/openshift/origin/test/extended/testdata"
 	exutil "github.com/openshift/origin/test/extended/util"
 )
 
@@ -547,10 +546,35 @@ var _ = g.Describe("[sig-cli] oc adm", func() {
 	})
 
 	g.It("release extract image-references", func() {
-		expected := string(testdata.MustAsset("test/extended/testdata/cli/test-release-image-references.json"))
-		out, err := oc.Run("adm", "release", "extract").Args("--file", "image-references", "quay.io/openshift-release-dev/ocp-release:4.13.0-rc.0-x86_64").Output()
-		o.Expect(err).NotTo(o.HaveOccurred())
-		o.Expect(out).To(o.Equal(expected))
+		payloadImage, err := oc.AsAdmin().Run("get").Args("clusterversion", "version", "-o", "jsonpath={.status.desired.image}").Output()
+		o.Expect(err).NotTo(o.HaveOccurred(), "Failed to get current payload image from clusterversion")
+		payloadImage = strings.TrimSpace(payloadImage)
+		o.Expect(payloadImage).NotTo(o.BeEmpty())
+		var out string
+		cleanup, regArgs, prepErr := exutil.PrepareImagePullSecretAndCABundle(ocns)
+		if cleanup != nil {
+			defer cleanup()
+		}
+		if prepErr == nil {
+			args := append([]string{"--file", "image-references"}, regArgs...)
+			args = append(args, payloadImage)
+			out, err = oc.AsAdmin().Run("adm", "release", "extract").Args(args...).Output()
+		} else {
+			err = prepErr
+		}
+		if err != nil {
+			ctx := context.Background()
+			isHyperShift, hsErr := exutil.IsHypershift(ctx, oc.AdminConfigClient())
+			o.Expect(hsErr).NotTo(o.HaveOccurred())
+			errorText := fmt.Sprintf("release extract err=%v output=%s", err, out)
+			if isHyperShift && cliOutputSuggestsNetworkIsolation(errorText) {
+				g.Skip("Skipping on HyperShift: `oc adm release extract` failed due to likely outbound network reachability issues to the release image registry (expected in some restricted VPC environments without mirrors)")
+			}
+			o.Expect(err).NotTo(o.HaveOccurred(), "oc adm release extract failed where registry reachability appears healthy; details: %s", errorText)
+		}
+		o.Expect(out).To(o.ContainSubstring(`"kind": "ImageStream"`))
+		o.Expect(out).To(o.ContainSubstring(`"apiVersion": "image.openshift.io/v1"`))
+		o.Expect(out).To(o.MatchRegexp(`"name": ".*"`), "Output should contain a valid name field")
 	})
 
 	// TODO (soltysh): sync with Standa and figure out if we can get these
@@ -636,3 +660,32 @@ func randomNode(oc *exutil.CLI) string {
 	o.Expect(err).NotTo(o.HaveOccurred())
 	return nodes.Items[rand.Intn(len(nodes.Items))].Name
 }
+
+// cliOutputSuggestsNetworkIsolation returns true when command output contains
+// errors typical of blocked egress or DNS/connectivity failures.
+func cliOutputSuggestsNetworkIsolation(output string) bool {
+	lowerOutput := strings.ToLower(output)
+	networkHints := []string{
+		"connection refused",
+		"connection reset by peer",
+		"context deadline exceeded",
+		"dial tcp",
+		"i/o timeout",
+		"no route to host",
+		"network is unreachable",
+		"tls handshake timeout",
+		"temporary failure in name resolution",
+		"failed to resolve",
+		"name or service not known",
+		"lookup ",
+		"rpc error",
+		"code = unavailable",
+		"unavailable: connection",
+	}
+	for _, hint := range networkHints {
+		if strings.Contains(lowerOutput, hint) {
+			return true
+		}
+	}
+	return false
+}