@@ -12,6 +12,7 @@ import (
1212 "github.com/Azure/azure-container-networking/cns"
1313 "github.com/Azure/azure-container-networking/iptables"
1414 "github.com/Azure/azure-container-networking/network"
15+ "github.com/Azure/azure-container-networking/network/policy"
1516 cniSkel "github.com/containernetworking/cni/pkg/skel"
1617 "github.com/stretchr/testify/require"
1718)
@@ -521,14 +522,38 @@ func TestCNSIPAMInvoker_Add(t *testing.T) {
521522 hostSubnetPrefix * net.IPNet
522523 options map [string ]interface {}
523524 }
525+ valueOut := []byte (`{
526+ "Type": "ACL",
527+ "Action": "Block",
528+ "Direction": "Out",
529+ "Priority": 10000
530+ }` )
524531
532+ valueIn := []byte (`{
533+ "Type": "ACL",
534+ "Action": "Block",
535+ "Direction": "In",
536+ "Priority": 10000
537+ }` )
538+
539+ expectedEndpointPolicies := []policy.Policy {
540+ {
541+ Type : policy .EndpointPolicy ,
542+ Data : valueOut ,
543+ },
544+ {
545+ Type : policy .EndpointPolicy ,
546+ Data : valueIn ,
547+ },
548+ }
525549 tests := []struct {
526- name string
527- fields fields
528- args args
529- wantDefaultResult network.InterfaceInfo
530- wantMultitenantResult network.InterfaceInfo
531- wantErr bool
550+ name string
551+ fields fields
552+ args args
553+ wantDefaultDenyEndpoints bool
554+ wantDefaultResult network.InterfaceInfo
555+ wantMultitenantResult network.InterfaceInfo
556+ wantErr bool
532557 }{
533558 {
534559 name : "Test happy CNI add" ,
@@ -559,7 +584,8 @@ func TestCNSIPAMInvoker_Add(t *testing.T) {
559584 PrimaryIP : "10.0.0.1" ,
560585 Subnet : "10.0.0.0/24" ,
561586 },
562- NICType : cns .InfraNIC ,
587+ NICType : cns .InfraNIC ,
588+ EndpointPolicies : expectedEndpointPolicies ,
563589 },
564590 },
565591 Response : cns.Response {
@@ -588,6 +614,7 @@ func TestCNSIPAMInvoker_Add(t *testing.T) {
588614 Gateway : net .ParseIP ("10.0.0.1" ),
589615 },
590616 },
617+ EndpointPolicies : expectedEndpointPolicies ,
591618 Routes : []network.RouteInfo {
592619 {
593620 Dst : network .Ipv4DefaultRouteDstPrefix ,
@@ -597,7 +624,8 @@ func TestCNSIPAMInvoker_Add(t *testing.T) {
597624 NICType : cns .InfraNIC ,
598625 HostSubnetPrefix : * parseCIDR ("10.0.0.0/24" ),
599626 },
600- wantErr : false ,
627+ wantDefaultDenyEndpoints : true ,
628+ wantErr : false ,
601629 },
602630 {
603631 name : "Test CNI add with pod ip info empty nictype" ,
@@ -665,7 +693,8 @@ func TestCNSIPAMInvoker_Add(t *testing.T) {
665693 NICType : cns .InfraNIC ,
666694 HostSubnetPrefix : * parseCIDR ("10.0.0.0/24" ),
667695 },
668- wantErr : false ,
696+ wantDefaultDenyEndpoints : false ,
697+ wantErr : false ,
669698 },
670699 {
671700 name : "Test happy CNI add for both ipv4 and ipv6" ,
@@ -696,7 +725,8 @@ func TestCNSIPAMInvoker_Add(t *testing.T) {
696725 PrimaryIP : "10.0.0.1" ,
697726 Subnet : "10.0.0.0/24" ,
698727 },
699- NICType : cns .InfraNIC ,
728+ NICType : cns .InfraNIC ,
729+ EndpointPolicies : expectedEndpointPolicies ,
700730 },
701731 {
702732 PodIPConfig : cns.IPSubnet {
@@ -716,7 +746,8 @@ func TestCNSIPAMInvoker_Add(t *testing.T) {
716746 PrimaryIP : "fe80::1234:5678:9abc" ,
717747 Subnet : "fd11:1234::/112" ,
718748 },
719- NICType : cns .InfraNIC ,
749+ NICType : cns .InfraNIC ,
750+ EndpointPolicies : expectedEndpointPolicies ,
720751 },
721752 },
722753 Response : cns.Response {
@@ -749,6 +780,7 @@ func TestCNSIPAMInvoker_Add(t *testing.T) {
749780 Gateway : net .ParseIP ("fe80::1234:5678:9abc" ),
750781 },
751782 },
783+ EndpointPolicies : expectedEndpointPolicies ,
752784 Routes : []network.RouteInfo {
753785 {
754786 Dst : network .Ipv4DefaultRouteDstPrefix ,
@@ -762,7 +794,8 @@ func TestCNSIPAMInvoker_Add(t *testing.T) {
762794 NICType : cns .InfraNIC ,
763795 HostSubnetPrefix : * parseCIDR ("fd11:1234::/112" ),
764796 },
765- wantErr : false ,
797+ wantDefaultDenyEndpoints : true ,
798+ wantErr : false ,
766799 },
767800 {
768801 name : "fail to request IP addresses from cns" ,
@@ -773,12 +806,24 @@ func TestCNSIPAMInvoker_Add(t *testing.T) {
773806 require : require ,
774807 requestIPs : requestIPsHandler {
775808 ipconfigArgument : getTestIPConfigsRequest (),
776- result : nil ,
777- err : errors .New ("failed error from CNS" ), //nolint "error for ut"
809+ result : & cns.IPConfigsResponse {
810+ PodIPInfo : []cns.PodIpInfo {
811+ {
812+ EndpointPolicies : expectedEndpointPolicies ,
813+ },
814+ },
815+ Response : cns.Response {
816+ ReturnCode : 0 ,
817+ Message : "" ,
818+ },
819+ },
820+ err : errors .New ("failed error from CNS" ), //nolint "error for ut"
821+
778822 },
779823 },
780824 },
781- wantErr : true ,
825+ wantDefaultDenyEndpoints : false ,
826+ wantErr : true ,
782827 },
783828 }
784829 for _ , tt := range tests {
@@ -794,6 +839,7 @@ func TestCNSIPAMInvoker_Add(t *testing.T) {
794839 }
795840 ipamAddResult , err := invoker .Add (IPAMAddConfig {nwCfg : tt .args .nwCfg , args : tt .args .args , options : tt .args .options })
796841 if tt .wantErr {
842+ require .Equalf ([]policy.Policy (nil ), ipamAddResult .interfaceInfo [string (cns .InfraNIC )].EndpointPolicies , "There was an error requesting IP addresses from cns" )
797843 require .Error (err )
798844 } else {
799845 require .NoError (err )
@@ -809,6 +855,11 @@ func TestCNSIPAMInvoker_Add(t *testing.T) {
809855 }
810856 if ifInfo .NICType == cns .InfraNIC {
811857 require .Equalf (tt .wantDefaultResult , ifInfo , "incorrect default response" )
858+ if tt .wantDefaultDenyEndpoints {
859+ require .Equalf (expectedEndpointPolicies , ifInfo .EndpointPolicies , "Correct default deny ACL" )
860+ } else {
861+ require .Equalf ([]policy.Policy (nil ), ifInfo .EndpointPolicies , "Correct default deny ACL" )
862+ }
812863 }
813864 }
814865 })
0 commit comments