Unify egress allowlist by merging connected and disconnected modes

CI captures egress traffic from both connected and disconnected e2e
deployments. However, both jobs run on the same hypervisor with shared
caching (pip, Ansible collections), causing the disconnected run to
skip traffic already cached by connected. This produces misleading
per-mode splits.

Merge all captured logs into a single unified allowlist grouped only by
caller category (ansible, pip, podman, etc.).

Changes:
- analyze_egress.py: Accept multiple log files, output complete YAML
- update_allowlist.sh: Use find to collect all log files
- Workflows: Consolidate artifact downloads, remove mode arguments
- Test fixtures: Update to unified format

Signed-off-by: Rafa Porres Molina <rporresm@redhat.com>
Assisted-by: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: rporres

.github/workflows/egress-capture.yml

@@ -62,20 +62,12 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Download connected egress logs
+      - name: Download egress logs
         uses: actions/download-artifact@v4
         with:
-          pattern: egress-logs-connected-*
-          path: egress-logs/connected/
-          merge-multiple: true
-        continue-on-error: true
-
-      - name: Download disconnected egress logs
-        uses: actions/download-artifact@v4
-        with:
-          pattern: egress-logs-disconnected-*
-          path: egress-logs/disconnected/
-          merge-multiple: true
+          pattern: egress-logs-*
+          path: egress-logs/
+          merge-multiple: false
         continue-on-error: true
 
       - name: Analyze and update allow list

.github/workflows/infra-verify.yml

@@ -173,7 +173,7 @@ jobs:
         if: (inputs.capture-egress == true || steps.egress_trigger.outputs.enabled == 'true') && !cancelled()
         run: |
           python3 scripts/egress/analyze_egress.py \
-            artifacts/egress/opensnitch-connections.json.gz infra \
+            artifacts/egress/opensnitch-connections.json.gz \
             > egress-allowlist-infra.yaml
           cat egress-allowlist-infra.yaml
           echo "## Egress Allow List (smoke test — infra only)" >> $GITHUB_STEP_SUMMARY

docs/EGRESS_ALLOWLIST.yaml

@@ -1,5 +1,3 @@
 # Auto-generated by scripts/egress/analyze_egress.py
 # Do not edit manually — updated by the egress-capture CI workflow
-egress:
-  connected: {}
-  disconnected: {}
+egress: {}

scripts/egress/analyze_egress.py

@@ -3,12 +3,11 @@
 Parse OpenSnitch journald JSON logs and produce a normalized YAML egress allow list.
 
 Usage:
-    analyze_egress.py <log_file> <mode>
+    analyze_egress.py <log_file> [<log_file> ...]
 
-    log_file  Path to journald JSON log file (journalctl -u opensnitchd -o json)
-    mode      Section label in the output YAML (e.g. "connected", "disconnected", "infra")
+    log_file  Path(s) to journald JSON log file(s) (journalctl -u opensnitchd -o json)
 
-Output: YAML section to stdout, suitable for inclusion in docs/EGRESS_ALLOWLIST.yaml.
+Output: Complete YAML document to stdout (docs/EGRESS_ALLOWLIST.yaml format).
 
 Log format (MESSAGE field from opensnitchd journald entries):
     [action] src=<ip>:<port> dst=<ip>:<port> proto=<tcp|udp> ... host=<fqdn>
@@ -234,13 +233,33 @@ def parse_log_file(path: str) -> List[Dict]:
     return sorted(entries, key=lambda e: (e["category"], e["dns"], e["protocol"], e["port"]))
 
 
-def render_yaml(mode: str, entries: List[Dict]) -> str:
-    """Render entries as grouped YAML, sorted by category then dns."""
+def parse_log_files(paths: List[str]) -> List[Dict]:
+    """Parse multiple log files and return merged, deduplicated entries."""
+    seen: Set[Tuple[str, str, int, str]] = set()
+    entries: List[Dict] = []
+
+    for path in paths:
+        for entry in parse_log_file(path):
+            key = (entry["dns"], entry["protocol"], entry["port"], entry["category"])
+            if key not in seen:
+                seen.add(key)
+                entries.append(entry)
+
+    return sorted(entries, key=lambda e: (e["category"], e["dns"], e["protocol"], e["port"]))
+
+
+def render_yaml(entries: List[Dict]) -> str:
+    """Render entries as a complete YAML document, grouped by category."""
     from collections import defaultdict
 
-    lines = [f"  {mode}:"]
+    lines = [
+        "# Auto-generated by scripts/egress/analyze_egress.py",
+        "# Do not edit manually — updated by the egress-capture CI workflow",
+        "egress:"
+    ]
+
     if not entries:
-        lines.append("    {}")
+        lines[-1] = "egress: {}"
         return "\n".join(lines)
 
     # Group by category
@@ -250,23 +269,23 @@ def render_yaml(mode: str, entries: List[Dict]) -> str:
 
     # Sort categories alphabetically
     for category in sorted(by_category.keys()):
-        lines.append(f"    {category}:")
+        lines.append(f"  {category}:")
         for e in by_category[category]:
-            lines.append(f"      - dns: {e['dns']}")
-            lines.append(f"        protocol: {e['protocol']}")
-            lines.append(f"        port: {e['port']}")
+            lines.append(f"    - dns: {e['dns']}")
+            lines.append(f"      protocol: {e['protocol']}")
+            lines.append(f"      port: {e['port']}")
 
     return "\n".join(lines)
 
 
 def main() -> None:
-    if len(sys.argv) != 3:
-        print(f"Usage: {sys.argv[0]} <log_file> <mode>", file=sys.stderr)
+    if len(sys.argv) < 2:
+        print(f"Usage: {sys.argv[0]} <log_file> [<log_file> ...]", file=sys.stderr)
         sys.exit(1)
 
-    log_file, mode = sys.argv[1], sys.argv[2]
-    entries = parse_log_file(log_file)
-    print(render_yaml(mode, entries))
+    log_files = sys.argv[1:]
+    entries = parse_log_files(log_files)
+    print(render_yaml(entries))
 
 
 if __name__ == "__main__":

scripts/egress/test_analyze_egress.sh

@@ -12,7 +12,7 @@ EXPECTED="${SCRIPT_DIR}/testdata/expected.yaml"
 ACTUAL=$(mktemp)
 trap 'rm -f "$ACTUAL"' EXIT
 
-python3 "$ANALYZER" "$FIXTURE" connected > "$ACTUAL"
+python3 "$ANALYZER" "$FIXTURE" > "$ACTUAL"
 
 if diff -u "$EXPECTED" "$ACTUAL"; then
     echo "PASS: analyze_egress.py output matches expected"

scripts/egress/testdata/expected.yaml

@@ -1,20 +1,22 @@
-  connected:
-    ansible:
-      - dns: github.com
-        protocol: tcp
-        port: 443
-      - dns: mirror.openshift.com
-        protocol: tcp
-        port: 443
-    oc-mirror:
-      - dns: registry.access.redhat.com
-        protocol: tcp
-        port: 443
-    other:
-      - dns: dns.google
-        protocol: udp
-        port: 53
-    podman:
-      - dns: quay.io
-        protocol: tcp
-        port: 443
+# Auto-generated by scripts/egress/analyze_egress.py
+# Do not edit manually — updated by the egress-capture CI workflow
+egress:
+  ansible:
+    - dns: github.com
+      protocol: tcp
+      port: 443
+    - dns: mirror.openshift.com
+      protocol: tcp
+      port: 443
+  oc-mirror:
+    - dns: registry.access.redhat.com
+      protocol: tcp
+      port: 443
+  other:
+    - dns: dns.google
+      protocol: udp
+      port: 53
+  podman:
+    - dns: quay.io
+      protocol: tcp
+      port: 443

scripts/egress/update_allowlist.sh

@@ -18,36 +18,26 @@ PR_NUMBER="${PR_NUMBER:-}"
 
 ALLOWLIST="${ENCLAVE_DIR}/docs/EGRESS_ALLOWLIST.yaml"
 GENERATED=$(mktemp)
-CONNECTED_LOGS="egress-logs/connected/opensnitch-connections.json.gz"
-DISCONNECTED_LOGS="egress-logs/disconnected/opensnitch-connections.json.gz"
 
 trap 'rm -f "$GENERATED"' EXIT
 
 # ── Build the generated allow list ────────────────────────────────────────────
 
-{
-    echo "# Auto-generated by scripts/egress/analyze_egress.py"
-    echo "# Do not edit manually — updated by the egress-capture CI workflow"
-    echo "egress:"
-} > "$GENERATED"
+LOG_FILES=$(find egress-logs/ -name 'opensnitch-connections.json.gz' -type f 2>/dev/null || true)
 
-if [ -f "$CONNECTED_LOGS" ]; then
-    python3 "${SCRIPT_DIR}/analyze_egress.py" "$CONNECTED_LOGS" connected >> "$GENERATED"
-else
-    printf "  connected:\n    []\n" >> "$GENERATED"
+if [ -z "$LOG_FILES" ]; then
+    echo "No egress log files found — nothing to analyze." | tee -a "${GITHUB_STEP_SUMMARY:-/dev/null}"
+    exit 0
 fi
 
-if [ -f "$DISCONNECTED_LOGS" ]; then
-    python3 "${SCRIPT_DIR}/analyze_egress.py" "$DISCONNECTED_LOGS" disconnected >> "$GENERATED"
-else
-    printf "  disconnected:\n    []\n" >> "$GENERATED"
-fi
+# shellcheck disable=SC2086
+python3 "${SCRIPT_DIR}/analyze_egress.py" $LOG_FILES > "$GENERATED"
 
 # ── Compare with current allow list ───────────────────────────────────────────
 
 if [ ! -f "$ALLOWLIST" ]; then
     # First run — treat an empty file as the current state
-    printf "# Auto-generated by scripts/egress/analyze_egress.py\n# Do not edit manually — updated by the egress-capture CI workflow\negress:\n  connected:\n    []\n  disconnected:\n    []\n" > "$ALLOWLIST"
+    printf "# Auto-generated by scripts/egress/analyze_egress.py\n# Do not edit manually — updated by the egress-capture CI workflow\negress: {}\n" > "$ALLOWLIST"
 fi
 
 DIFF=$(diff -u "$ALLOWLIST" "$GENERATED" || true)