|
| 1 | +const DROP_QUERY = 'round(increase(hubble_drop_total{reason="POLICY_DENIED"}[5m]))' |
| 2 | +const ACCEPT_QUERY = |
| 3 | + 'sum by (traffic_direction) (round(increase(hubble_flows_processed_total{verdict="FORWARDED"}[5m])))' |
| 4 | + |
| 5 | +function makePrometheusURL(/** @type {Cluster} */ cluster) { |
| 6 | + const port = cluster === 'wc' ? Cypress.env('WC_PROXY_PORT') : Cypress.env('SC_PROXY_PORT') |
| 7 | + |
| 8 | + return ( |
| 9 | + `http://127.0.0.1:${port}/api/v1/namespaces/monitoring/services` + |
| 10 | + '/kube-prometheus-stack-prometheus:9090/proxy' |
| 11 | + ) |
| 12 | +} |
| 13 | + |
| 14 | +describe('workload cluster network policies (cilium)', function () { |
| 15 | + before(function () { |
| 16 | + cy.yqDig('wc', '.networkPlugin.type').then(function (value) { |
| 17 | + if (value !== 'cilium') { |
| 18 | + this.skip('not a cilium cluster') |
| 19 | + } |
| 20 | + }) |
| 21 | + }) |
| 22 | + |
| 23 | + it('are not dropping any packets from workloads', function () { |
| 24 | + cy.request('GET', makeQueryURL('wc', DROP_QUERY)).then((response) => { |
| 25 | + assertNoDrops(response, 'egress', 'from') |
| 26 | + }) |
| 27 | + }) |
| 28 | + |
| 29 | + it('are not dropping any packets to workloads', function () { |
| 30 | + cy.request('GET', makeQueryURL('wc', DROP_QUERY)).then((response) => { |
| 31 | + assertNoDrops(response, 'ingress', 'to') |
| 32 | + }) |
| 33 | + }) |
| 34 | + |
| 35 | + it('are accepting allowed traffic', function () { |
| 36 | + cy.retryRequest({ |
| 37 | + request: { method: 'GET', url: makeQueryURL('wc', ACCEPT_QUERY) }, |
| 38 | + condition: acceptCondition, |
| 39 | + waitTime: 10000, |
| 40 | + attempts: 30, |
| 41 | + }) |
| 42 | + }) |
| 43 | +}) |
| 44 | + |
| 45 | +describe('service cluster network policies (cilium)', function () { |
| 46 | + before(function () { |
| 47 | + cy.yqDig('sc', '.networkPlugin.type').then(function (value) { |
| 48 | + if (value !== 'cilium') { |
| 49 | + this.skip('not a cilium cluster') |
| 50 | + } |
| 51 | + }) |
| 52 | + }) |
| 53 | + |
| 54 | + it('are not dropping any packets from workloads', function () { |
| 55 | + cy.request('GET', makeQueryURL('sc', DROP_QUERY)).then((response) => { |
| 56 | + assertNoDrops(response, 'egress', 'from') |
| 57 | + }) |
| 58 | + }) |
| 59 | + |
| 60 | + it('are not dropping any packets to workloads', function () { |
| 61 | + cy.request('GET', makeQueryURL('sc', DROP_QUERY)).then((response) => { |
| 62 | + assertNoDrops(response, 'ingress', 'to') |
| 63 | + }) |
| 64 | + }) |
| 65 | + |
| 66 | + it('are accepting allowed traffic', function () { |
| 67 | + cy.retryRequest({ |
| 68 | + request: { method: 'GET', url: makeQueryURL('sc', ACCEPT_QUERY) }, |
| 69 | + condition: acceptCondition, |
| 70 | + waitTime: 10000, |
| 71 | + attempts: 30, |
| 72 | + }) |
| 73 | + }) |
| 74 | +}) |
| 75 | + |
| 76 | +const makeQueryURL = (/** @type {Cluster} */ cluster, query, serverTime = '') => { |
| 77 | + const metric = encodeURI(query) |
| 78 | + let returnValue = `${makePrometheusURL(cluster)}/api/v1/query?query=${metric}` |
| 79 | + if (serverTime !== '') { |
| 80 | + returnValue = `${returnValue}&${new URLSearchParams({ time: serverTime })}` |
| 81 | + } |
| 82 | + return returnValue |
| 83 | +} |
| 84 | + |
| 85 | +const assertNoDrops = (response, trafficDirection, direction) => { |
| 86 | + expect(response.status).to.eq(200) |
| 87 | + expect(response.body.data.result).to.be.a('array') |
| 88 | + |
| 89 | + const result = response.body.data.result |
| 90 | + |
| 91 | + const drops = result.filter(filterNonZero(trafficDirection)).map((element) => mapDrops(element)) |
| 92 | + |
| 93 | + if (drops.length > 0) { |
| 94 | + cy.fail(formatError(drops, direction)) |
| 95 | + } |
| 96 | +} |
| 97 | + |
| 98 | +const acceptCondition = (response) => { |
| 99 | + try { |
| 100 | + expect(response.status).to.eq(200) |
| 101 | + expect(response.body.data.result).to.be.a('array') |
| 102 | + |
| 103 | + const result = response.body.data.result |
| 104 | + |
| 105 | + const innerAssert = (values) => { |
| 106 | + expect(values).to.be.an('array') |
| 107 | + expect(values).to.have.property('0').that.is.a('number').and.is.greaterThan(0) |
| 108 | + } |
| 109 | + |
| 110 | + innerAssert( |
| 111 | + result.filter(filterNonZero('egress')).map((item) => Number.parseInt(item.value[1])) |
| 112 | + ) |
| 113 | + innerAssert( |
| 114 | + result.filter(filterNonZero('ingress')).map((item) => Number.parseInt(item.value[1])) |
| 115 | + ) |
| 116 | + return true |
| 117 | + } catch { |
| 118 | + return false |
| 119 | + } |
| 120 | +} |
| 121 | + |
| 122 | +const filterNonZero = (trafficDirection) => { |
| 123 | + return (item) => |
| 124 | + item.metric.traffic_direction === trafficDirection && item.value && item.value[1] !== '0' |
| 125 | +} |
| 126 | + |
| 127 | +const mapDrops = (item) => { |
| 128 | + return { |
| 129 | + podName: item.metric.pod, |
| 130 | + podNamespace: item.metric.namespace, |
| 131 | + drops: Number.parseInt(item.value[1]), |
| 132 | + } |
| 133 | +} |
| 134 | + |
| 135 | +const formatError = (drops, direction) => { |
| 136 | + const fmtDrops = drops |
| 137 | + .map((item) => `- ${item.podNamespace}/${item.podName} had ${item.drops} dropped packets`) |
| 138 | + .join('\n') |
| 139 | + return `\nFound packets dropped ${direction} workloads:\n${fmtDrops}\n` |
| 140 | +} |
0 commit comments