Skip to content

Commit f993a5a

Browse files
l1b0kl1b0k
committed
feat: add enterprise security group creation script and connectivity tests for Trunk ENI mode
Signed-off-by: l1b0k <libokang.lbk@alibaba-inc.com>
1 parent 3b85957 commit f993a5a

File tree

3 files changed

+622
-0
lines changed

3 files changed

+622
-0
lines changed

‎tests/main_test.go‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -410,3 +410,54 @@ func printClusterEnvironment(ctx context.Context, config *envconf.Config) (conte
410410

411411
return ctx, nil
412412
}
413+
414+
// SecurityGroupTestConfig holds security group IDs for a specific test
415+
type SecurityGroupTestConfig struct {
416+
TestName string
417+
ClientSGID string
418+
ServerSGID string
419+
}
420+
421+
// GetSecurityGroupTestConfig returns the security group configuration for a specific test
422+
// Uses environment variable TERWAY_SG_TEST_CONFIG
423+
// Config format: TEST_NAME:CLIENT_SG:SERVER_SG;TEST_NAME2:CLIENT_SG2:SERVER_SG2
424+
// Example: export TERWAY_SG_TEST_CONFIG="TestSecurityGroup_TrunkMode:sg-xxx:sg-yyy"
425+
func GetSecurityGroupTestConfig(testName string) *SecurityGroupTestConfig {
426+
configStr := os.Getenv("TERWAY_SG_TEST_CONFIG")
427+
if configStr == "" {
428+
return nil
429+
}
430+
431+
// Parse each config entry separated by semicolon
432+
entries := strings.Split(configStr, ";")
433+
for _, entry := range entries {
434+
entry = strings.TrimSpace(entry)
435+
if entry == "" {
436+
continue
437+
}
438+
439+
parts := strings.Split(entry, ":")
440+
if len(parts) != 3 {
441+
continue
442+
}
443+
444+
name := strings.TrimSpace(parts[0])
445+
clientSG := strings.TrimSpace(parts[1])
446+
serverSG := strings.TrimSpace(parts[2])
447+
448+
if name == testName && clientSG != "" && serverSG != "" {
449+
return &SecurityGroupTestConfig{
450+
TestName: name,
451+
ClientSGID: clientSG,
452+
ServerSGID: serverSG,
453+
}
454+
}
455+
}
456+
457+
return nil
458+
}
459+
460+
// HasSecurityGroupTestConfig checks if security group test config is available for a test
461+
func HasSecurityGroupTestConfig(testName string) bool {
462+
return GetSecurityGroupTestConfig(testName) != nil
463+
}

‎tests/scripts/create_enterprise_security_groups.sh‎

Lines changed: 332 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,332 @@
1+
#!/bin/bash
2+
# =============================================================================
3+
# Enterprise Security Group Creation Script for Terway E2E Testing
4+
# =============================================================================
5+
#
6+
# This script creates two enterprise security groups for security group
7+
# connectivity testing in Terway E2E tests.
8+
#
9+
# Prerequisites:
10+
# - aliyun CLI installed and configured
11+
# - VPC ID where the security groups will be created
12+
#
13+
# Usage:
14+
# ./create_enterprise_security_groups.sh --region <region> --vpc <vpc-id>
15+
#
16+
# Example:
17+
# ./create_enterprise_security_groups.sh --region cn-hangzhou --vpc vpc-xxx
18+
#
19+
# After running this script, use the output to set the test configuration:
20+
# export TERWAY_SG_TEST_CONFIG="TestSecurityGroup_TrunkMode:<client-sg-id>:<server-sg-id>"
21+
# =============================================================================
22+
23+
set -e
24+
25+
# Default values
26+
REGION=""
27+
VPC_ID=""
28+
RESOURCE_GROUP_ID=""
29+
CLIENT_SG_NAME="terway-e2e-client-sg"
30+
SERVER_SG_NAME="terway-e2e-server-sg"
31+
32+
# Colors for output
33+
RED='\033[0;31m'
34+
GREEN='\033[0;32m'
35+
YELLOW='\033[1;33m'
36+
NC='\033[0m' # No Color
37+
38+
print_usage() {
39+
echo "Usage: $0 --region <region> --vpc <vpc-id> [--resource-group <resource-group-id>]"
40+
echo ""
41+
echo "Required arguments:"
42+
echo " --region Aliyun region (e.g., cn-hangzhou)"
43+
echo " --vpc VPC ID where security groups will be created"
44+
echo ""
45+
echo "Optional arguments:"
46+
echo " --resource-group Resource group ID (optional)"
47+
echo " --client-sg-name Client security group name (default: terway-e2e-client-sg)"
48+
echo " --server-sg-name Server security group name (default: terway-e2e-server-sg)"
49+
echo " --help Show this help message"
50+
}
51+
52+
# Parse arguments
53+
while [[ $# -gt 0 ]]; do
54+
case $1 in
55+
--region)
56+
REGION="$2"
57+
shift 2
58+
;;
59+
--vpc)
60+
VPC_ID="$2"
61+
shift 2
62+
;;
63+
--resource-group)
64+
RESOURCE_GROUP_ID="$2"
65+
shift 2
66+
;;
67+
--client-sg-name)
68+
CLIENT_SG_NAME="$2"
69+
shift 2
70+
;;
71+
--server-sg-name)
72+
SERVER_SG_NAME="$2"
73+
shift 2
74+
;;
75+
--help)
76+
print_usage
77+
exit 0
78+
;;
79+
*)
80+
echo -e "${RED}Unknown argument: $1${NC}"
81+
print_usage
82+
exit 1
83+
;;
84+
esac
85+
done
86+
87+
# Validate required arguments
88+
if [[ -z "$REGION" ]]; then
89+
echo -e "${RED}Error: --region is required${NC}"
90+
print_usage
91+
exit 1
92+
fi
93+
94+
if [[ -z "$VPC_ID" ]]; then
95+
echo -e "${RED}Error: --vpc is required${NC}"
96+
print_usage
97+
exit 1
98+
fi
99+
100+
echo -e "${GREEN}=== Creating Enterprise Security Groups for Terway E2E Testing ===${NC}"
101+
echo "Region: $REGION"
102+
echo "VPC ID: $VPC_ID"
103+
echo ""
104+
105+
# Build common arguments
106+
COMMON_ARGS="--RegionId $REGION"
107+
if [[ -n "$RESOURCE_GROUP_ID" ]]; then
108+
COMMON_ARGS="$COMMON_ARGS --ResourceGroupId $RESOURCE_GROUP_ID"
109+
fi
110+
111+
# =============================================================================
112+
# Create Client Security Group
113+
# - Allows egress TCP port 80 to all destinations
114+
# - Allows ingress TCP port 80 from private IP ranges
115+
# =============================================================================
116+
117+
echo -e "${YELLOW}Step 1: Creating client security group...${NC}"
118+
119+
CLIENT_SG_RESULT=$(aliyun ecs CreateSecurityGroup \
120+
$COMMON_ARGS \
121+
--VpcId "$VPC_ID" \
122+
--SecurityGroupName "$CLIENT_SG_NAME" \
123+
--SecurityGroupType enterprise \
124+
--Description "Terway E2E test - Client SG: egress 80 allowed, ingress 80 from private" \
125+
--output cols=SecurityGroupId)
126+
127+
CLIENT_SG_ID=$(echo "$CLIENT_SG_RESULT" | tail -n 1 | tr -d ' ')
128+
129+
if [[ -z "$CLIENT_SG_ID" ]] || [[ "$CLIENT_SG_ID" == "SecurityGroupId" ]]; then
130+
echo -e "${RED}Failed to create client security group${NC}"
131+
exit 1
132+
fi
133+
134+
echo -e "${GREEN}Created client security group: $CLIENT_SG_ID${NC}"
135+
136+
# Add egress rule for port 80
137+
echo "Adding egress rule: allow TCP port 80 to all..."
138+
aliyun ecs AuthorizeSecurityGroupEgress \
139+
--RegionId "$REGION" \
140+
--SecurityGroupId "$CLIENT_SG_ID" \
141+
--IpProtocol tcp \
142+
--PortRange "80/80" \
143+
--DestCidrIp "0.0.0.0/0" \
144+
--Policy accept \
145+
--Description "Allow egress TCP port 80" \
146+
> /dev/null
147+
148+
# Add ingress rules for port 80 from private IP ranges
149+
echo "Adding ingress rule: allow TCP port 80 from 10.0.0.0/8..."
150+
aliyun ecs AuthorizeSecurityGroup \
151+
--RegionId "$REGION" \
152+
--SecurityGroupId "$CLIENT_SG_ID" \
153+
--IpProtocol tcp \
154+
--PortRange "80/80" \
155+
--SourceCidrIp "10.0.0.0/8" \
156+
--Policy accept \
157+
--Description "Allow ingress TCP port 80 from 10.0.0.0/8" \
158+
> /dev/null
159+
160+
echo "Adding ingress rule: allow TCP port 80 from 172.16.0.0/12..."
161+
aliyun ecs AuthorizeSecurityGroup \
162+
--RegionId "$REGION" \
163+
--SecurityGroupId "$CLIENT_SG_ID" \
164+
--IpProtocol tcp \
165+
--PortRange "80/80" \
166+
--SourceCidrIp "172.16.0.0/12" \
167+
--Policy accept \
168+
--Description "Allow ingress TCP port 80 from 172.16.0.0/12" \
169+
> /dev/null
170+
171+
echo "Adding ingress rule: allow TCP port 80 from 192.168.0.0/16..."
172+
aliyun ecs AuthorizeSecurityGroup \
173+
--RegionId "$REGION" \
174+
--SecurityGroupId "$CLIENT_SG_ID" \
175+
--IpProtocol tcp \
176+
--PortRange "80/80" \
177+
--SourceCidrIp "192.168.0.0/16" \
178+
--Policy accept \
179+
--Description "Allow ingress TCP port 80 from 192.168.0.0/16" \
180+
> /dev/null
181+
182+
echo -e "${GREEN}✓ Client security group configured${NC}"
183+
echo ""
184+
185+
# =============================================================================
186+
# Create Server Security Group
187+
# - Allows ingress TCP port 80 from private IP ranges
188+
# - Denies egress TCP port 80 to private IP ranges
189+
# =============================================================================
190+
191+
echo -e "${YELLOW}Step 2: Creating server security group...${NC}"
192+
193+
SERVER_SG_RESULT=$(aliyun ecs CreateSecurityGroup \
194+
$COMMON_ARGS \
195+
--VpcId "$VPC_ID" \
196+
--SecurityGroupName "$SERVER_SG_NAME" \
197+
--SecurityGroupType enterprise \
198+
--Description "Terway E2E test - Server SG: ingress 80 allowed, egress 80 denied to private" \
199+
--output cols=SecurityGroupId)
200+
201+
SERVER_SG_ID=$(echo "$SERVER_SG_RESULT" | tail -n 1 | tr -d ' ')
202+
203+
if [[ -z "$SERVER_SG_ID" ]] || [[ "$SERVER_SG_ID" == "SecurityGroupId" ]]; then
204+
echo -e "${RED}Failed to create server security group${NC}"
205+
# Cleanup client SG
206+
aliyun ecs DeleteSecurityGroup --RegionId "$REGION" --SecurityGroupId "$CLIENT_SG_ID" > /dev/null 2>&1 || true
207+
exit 1
208+
fi
209+
210+
echo -e "${GREEN}Created server security group: $SERVER_SG_ID${NC}"
211+
212+
# Add ingress rules for port 80 from private IP ranges
213+
echo "Adding ingress rule: allow TCP port 80 from 10.0.0.0/8..."
214+
aliyun ecs AuthorizeSecurityGroup \
215+
--RegionId "$REGION" \
216+
--SecurityGroupId "$SERVER_SG_ID" \
217+
--IpProtocol tcp \
218+
--PortRange "80/80" \
219+
--SourceCidrIp "10.0.0.0/8" \
220+
--Policy accept \
221+
--Description "Allow ingress TCP port 80 from 10.0.0.0/8" \
222+
> /dev/null
223+
224+
echo "Adding ingress rule: allow TCP port 80 from 172.16.0.0/12..."
225+
aliyun ecs AuthorizeSecurityGroup \
226+
--RegionId "$REGION" \
227+
--SecurityGroupId "$SERVER_SG_ID" \
228+
--IpProtocol tcp \
229+
--PortRange "80/80" \
230+
--SourceCidrIp "172.16.0.0/12" \
231+
--Policy accept \
232+
--Description "Allow ingress TCP port 80 from 172.16.0.0/12" \
233+
> /dev/null
234+
235+
echo "Adding ingress rule: allow TCP port 80 from 192.168.0.0/16..."
236+
aliyun ecs AuthorizeSecurityGroup \
237+
--RegionId "$REGION" \
238+
--SecurityGroupId "$SERVER_SG_ID" \
239+
--IpProtocol tcp \
240+
--PortRange "80/80" \
241+
--SourceCidrIp "192.168.0.0/16" \
242+
--Policy accept \
243+
--Description "Allow ingress TCP port 80 from 192.168.0.0/16" \
244+
> /dev/null
245+
246+
# Add egress deny rules for port 80 to private IP ranges
247+
echo "Adding egress rule: deny TCP port 80 to 10.0.0.0/8..."
248+
aliyun ecs AuthorizeSecurityGroupEgress \
249+
--RegionId "$REGION" \
250+
--SecurityGroupId "$SERVER_SG_ID" \
251+
--IpProtocol tcp \
252+
--PortRange "80/80" \
253+
--DestCidrIp "10.0.0.0/8" \
254+
--Policy drop \
255+
--Description "Deny egress TCP port 80 to 10.0.0.0/8" \
256+
> /dev/null
257+
258+
echo "Adding egress rule: deny TCP port 80 to 172.16.0.0/12..."
259+
aliyun ecs AuthorizeSecurityGroupEgress \
260+
--RegionId "$REGION" \
261+
--SecurityGroupId "$SERVER_SG_ID" \
262+
--IpProtocol tcp \
263+
--PortRange "80/80" \
264+
--DestCidrIp "172.16.0.0/12" \
265+
--Policy drop \
266+
--Description "Deny egress TCP port 80 to 172.16.0.0/12" \
267+
> /dev/null
268+
269+
echo "Adding egress rule: deny TCP port 80 to 192.168.0.0/16..."
270+
aliyun ecs AuthorizeSecurityGroupEgress \
271+
--RegionId "$REGION" \
272+
--SecurityGroupId "$SERVER_SG_ID" \
273+
--IpProtocol tcp \
274+
--PortRange "80/80" \
275+
--DestCidrIp "192.168.0.0/16" \
276+
--Policy drop \
277+
--Description "Deny egress TCP port 80 to 192.168.0.0/16" \
278+
> /dev/null
279+
280+
echo -e "${GREEN}✓ Server security group configured${NC}"
281+
echo ""
282+
283+
# =============================================================================
284+
# Output Summary
285+
# =============================================================================
286+
287+
echo -e "${GREEN}=== Security Groups Created Successfully ===${NC}"
288+
echo ""
289+
echo "Client Security Group:"
290+
echo " ID: $CLIENT_SG_ID"
291+
echo " Name: $CLIENT_SG_NAME"
292+
echo " Rules:"
293+
echo " - Egress: ALLOW TCP port 80 to all (0.0.0.0/0)"
294+
echo " - Ingress: ALLOW TCP port 80 from private IP ranges"
295+
echo ""
296+
echo "Server Security Group:"
297+
echo " ID: $SERVER_SG_ID"
298+
echo " Name: $SERVER_SG_NAME"
299+
echo " Rules:"
300+
echo " - Ingress: ALLOW TCP port 80 from private IP ranges"
301+
echo " - Egress: DENY TCP port 80 to private IP ranges"
302+
echo ""
303+
echo "Private IP ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16"
304+
echo ""
305+
echo "Test scenario:"
306+
echo " - Client -> Server (port 80): SHOULD SUCCEED"
307+
echo " (Client egress allowed, Server ingress allowed)"
308+
echo " - Server -> Client (port 80): SHOULD FAIL"
309+
echo " (Server egress denied to private IPs)"
310+
echo ""
311+
echo -e "${YELLOW}=== Test Configuration ===${NC}"
312+
echo ""
313+
echo "To use these security groups in the Terway E2E test, set the environment variable:"
314+
echo ""
315+
echo -e "${GREEN}export TERWAY_SG_TEST_CONFIG=\"TestSecurityGroup_TrunkMode:$CLIENT_SG_ID:$SERVER_SG_ID\"${NC}"
316+
echo ""
317+
echo "Then run the test:"
318+
echo ""
319+
echo -e "${GREEN}go test -count=1 -v -tags e2e ./tests -run TestSecurityGroup_TrunkMode${NC}"
320+
echo ""
321+
322+
# =============================================================================
323+
# Cleanup Script
324+
# =============================================================================
325+
326+
echo -e "${YELLOW}=== Cleanup (run after testing) ===${NC}"
327+
echo ""
328+
echo "To delete the security groups after testing:"
329+
echo ""
330+
echo "aliyun ecs DeleteSecurityGroup --RegionId $REGION --SecurityGroupId $CLIENT_SG_ID"
331+
echo "aliyun ecs DeleteSecurityGroup --RegionId $REGION --SecurityGroupId $SERVER_SG_ID"
332+
echo ""

0 commit comments

Comments
 (0)