Skip to content

Commit 00a43b6

Browse files
authored
Update 20200204-NetworkPolicy-verification-rearchitecture.md
1 parent 87800ee commit 00a43b6

File tree

1 file changed

+8
-4
lines changed

1 file changed

+8
-4
lines changed

keps/sig-network/20200204-NetworkPolicy-verification-rearchitecture.md

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -66,11 +66,14 @@ Note that this approach of higher level DSLs for testing may be moved into sig-t
6666
<!-- /toc -->
6767

6868
## Summary
69-
This proposal suggests that we create and maintain a domain-specific language (DSL) for defining NetworkPolicies against connectivity truth tables, so we can automate positive and negative control tests to address the opportunities for improvement in the performance and adherence to Kubernetes network policy standards of CNI plugins. We propose that the current NetworkPolicy test suite comprises 25 tests which can take 30 minutes to 1 hour to run, and this time period will be dramatically improved, while increasing test coverage dramatically as well, by following this approach - and initial tests corroborate the findings of this proposal. In summary, this involves:
69+
70+
We propose that the current NetworkPolicy test suite which comprises 25 tests, and can take 30 minutes to 1 hour to run, should be drastically improved both in terms of readability, performance, coverage, and scalability. The mechanism we propose for this includes building a "Reachability matrix" for evaluating all pod connectivities, while also building reusable APIs for designing tests in a more modular way for the future.
71+
72+
In summary, this involves:
7073

7174
- Defining (redefining in some cases) the common set of test scenarios for all network policy tests and increasing performance by reusing a set of containers.
7275
- Rearchitecting network policy tests to enhance readibility and reusability.
73-
- Improve coverage for NetworkPolicy functional tests, and making them more hackable.
76+
- Provide comprehnsive coverage for NetworkPolicy communication matrices by using a truth-table approach to define connectivity.
7477
- Introduce time to conversion tests to measure performance against perturbed state at scale.
7578

7679
## Motivation
@@ -89,8 +92,9 @@ In general, we think that outside the original motivations, these tests will hel
8992

9093
### Goals
9194

92-
- Rearchitect the way we write and define CNI NetworkPolicy test verifications
93-
- Increase the visibility and quality of documentation available for network policies
95+
- Rearchitect the way we write and define CNI NetworkPolicy test verifications.
96+
- Increase the visibility and quality of documentation available for network policies.
97+
- Drastically improve the performance of existing tests so they can be run continually, or be designed in the future to validate at larger scales.
9498

9599
#### Concrete goals
96100

0 commit comments

Comments
 (0)