Skip to content

Commit 013a17f

Browse files
tssuryatssurya
committed
Add ingress traffic conformance tests for UDP protocol
This commit tests .Spec.Ingress specifically. We test deny, allow and pass actions. We test UDP protocol with and without port combination. TODO: In future add test for port range and named ports. Signed-off-by: Surya Seetharaman <[email protected]>
1 parent 648bea0 commit 013a17f

File tree

2 files changed

+203
-0
lines changed

2 files changed

+203
-0
lines changed

‎conformance/tests/baseline-admin-network-policy-core-ingress-udp-rules.go

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
/*
2+
Copyright 2022 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package tests
18+
19+
import (
20+
"context"
21+
"testing"
22+
23+
"github.com/stretchr/testify/assert"
24+
v1 "k8s.io/api/core/v1"
25+
"k8s.io/kubernetes/test/e2e/framework"
26+
"sigs.k8s.io/controller-runtime/pkg/client"
27+
28+
"sigs.k8s.io/network-policy-api/apis/v1alpha1"
29+
"sigs.k8s.io/network-policy-api/conformance/utils/kubernetes"
30+
"sigs.k8s.io/network-policy-api/conformance/utils/suite"
31+
)
32+
33+
func init() {
34+
ConformanceTests = append(ConformanceTests,
35+
BaselineAdminNetworkPolicyIngressUDP,
36+
)
37+
}
38+
39+
var BaselineAdminNetworkPolicyIngressUDP = suite.ConformanceTest{
40+
ShortName: "BaselineAdminNetworkPolicyIngressUDP",
41+
Description: "Tests support for ingress traffic (UDP protocol) using baseline admin network policy API based on a server and client model",
42+
Features: []suite.SupportedFeature{
43+
suite.SupportBaselineAdminNetworkPolicy,
44+
},
45+
Manifests: []string{"tests/baseline-admin-network-policy-core-ingress-udp-rules_base.yaml"},
46+
Test: func(t *testing.T, s *suite.ConformanceTestSuite) {
47+
48+
t.Run("Should support an 'allow-ingress' policy for UDP protocol; ensure rule ordering is respected", func(t *testing.T) {
49+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
50+
defer cancel()
51+
// This test uses `default` BANP
52+
// cedric-diggory-0 is our server pod in hufflepuff namespace
53+
clientPod := &v1.Pod{}
54+
err := s.Client.Get(ctx, client.ObjectKey{
55+
Namespace: "network-policy-conformance-hufflepuff",
56+
Name: "cedric-diggory-0",
57+
}, clientPod)
58+
framework.ExpectNoError(err, "unable to fetch the server pod")
59+
// luna-lovegood-0 is our client pod in ravenclaw namespace
60+
// ensure ingress is ALLOWED from ravenclaw to hufflepuff
61+
// ingressRule at index0 will take precedence over ingressRule at index1; thus ALLOW takes precedence over DENY since rules are ordered
62+
success := kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-0", "udp",
63+
clientPod.Status.PodIP, int32(53), s.TimeoutConfig.RequestTimeout, true)
64+
assert.Equal(t, true, success)
65+
success = kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-1", "udp",
66+
clientPod.Status.PodIP, int32(5353), s.TimeoutConfig.RequestTimeout, true)
67+
assert.Equal(t, true, success)
68+
})
69+
70+
t.Run("Should support an 'allow-ingress' policy for UDP protocol at the specified port", func(t *testing.T) {
71+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
72+
defer cancel()
73+
// This test uses `default` BANP
74+
// cedric-diggory-1 is our server pod in hufflepuff namespace
75+
clientPod := &v1.Pod{}
76+
err := s.Client.Get(ctx, client.ObjectKey{
77+
Namespace: "network-policy-conformance-hufflepuff",
78+
Name: "cedric-diggory-1",
79+
}, clientPod)
80+
framework.ExpectNoError(err, "unable to fetch the server pod")
81+
// harry-potter-0 is our client pod in gryffindor namespace
82+
// ensure ingress is ALLOWED from gryffindor to hufflepuff at port 53; ingressRule at index5
83+
success := kubernetes.PokeServer(t, "network-policy-conformance-gryffindor", "harry-potter-0", "udp",
84+
clientPod.Status.PodIP, int32(53), s.TimeoutConfig.RequestTimeout, true)
85+
assert.Equal(t, true, success)
86+
// harry-potter-1 is our client pod in gryfindor namespace
87+
// ensure ingress is DENIED from gryffindor to hufflepuff for rest of the traffic; ingressRule at index6
88+
success = kubernetes.PokeServer(t, "network-policy-conformance-gryffindor", "harry-potter-1", "udp",
89+
clientPod.Status.PodIP, int32(5353), s.TimeoutConfig.RequestTimeout, false)
90+
assert.Equal(t, true, success)
91+
})
92+
93+
t.Run("Should support an 'deny-ingress' policy for UDP protocol; ensure rule ordering is respected", func(t *testing.T) {
94+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
95+
defer cancel()
96+
// This test uses `default` BANP
97+
// cedric-diggory-1 is our server pod in hufflepuff namespace
98+
clientPod := &v1.Pod{}
99+
err := s.Client.Get(ctx, client.ObjectKey{
100+
Namespace: "network-policy-conformance-hufflepuff",
101+
Name: "cedric-diggory-1",
102+
}, clientPod)
103+
framework.ExpectNoError(err, "unable to fetch the server pod")
104+
banp := &v1alpha1.BaselineAdminNetworkPolicy{}
105+
err = s.Client.Get(ctx, client.ObjectKey{
106+
Name: "default",
107+
}, banp)
108+
framework.ExpectNoError(err, "unable to fetch the admin network policy")
109+
// swap rules at index0 and index1
110+
allowRule := banp.DeepCopy().Spec.Ingress[0]
111+
banp.Spec.Ingress[0] = banp.DeepCopy().Spec.Ingress[1]
112+
banp.Spec.Ingress[1] = allowRule
113+
err = s.Client.Update(ctx, banp)
114+
framework.ExpectNoError(err, "unable to update the admin network policy")
115+
// luna-lovegood-0 is our client pod in ravenclaw namespace
116+
// ensure ingress is DENIED from ravenclaw to hufflepuff
117+
// ingressRule at index0 will take precedence over ingressRule at index1; thus DENY takes precedence over ALLOW since rules are ordered
118+
success := kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-0", "udp",
119+
clientPod.Status.PodIP, int32(53), s.TimeoutConfig.RequestTimeout, false)
120+
assert.Equal(t, true, success)
121+
// luna-lovegood-1 is our client pod in ravenclaw namespace
122+
success = kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-1", "udp",
123+
clientPod.Status.PodIP, int32(5353), s.TimeoutConfig.RequestTimeout, false)
124+
assert.Equal(t, true, success)
125+
})
126+
127+
t.Run("Should support a 'deny-ingress' policy for UDP protocol at the specified port", func(t *testing.T) {
128+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
129+
defer cancel()
130+
// This test uses `default` BANP
131+
// cedric-diggory-0 is our server pod in hufflepuff namespace
132+
clientPod := &v1.Pod{}
133+
err := s.Client.Get(ctx, client.ObjectKey{
134+
Namespace: "network-policy-conformance-hufflepuff",
135+
Name: "cedric-diggory-0",
136+
}, clientPod)
137+
framework.ExpectNoError(err, "unable to fetch the server pod")
138+
// draco-malfoy-0 is our client pod in slytherin namespace
139+
// ensure ingress from slytherin is DENIED to hufflepuff at port 80; ingressRule at index3
140+
success := kubernetes.PokeServer(t, "network-policy-conformance-slytherin", "draco-malfoy-0", "udp",
141+
clientPod.Status.PodIP, int32(5353), s.TimeoutConfig.RequestTimeout, false)
142+
assert.Equal(t, true, success)
143+
// draco-malfoy-1 is our client pod in slytherin namespace
144+
// ensure ingress from slytherin is ALLOWED to hufflepuff for rest of the traffic; matches no rules hence allowed
145+
success = kubernetes.PokeServer(t, "network-policy-conformance-slytherin", "draco-malfoy-1", "udp",
146+
clientPod.Status.PodIP, int32(53), s.TimeoutConfig.RequestTimeout, true)
147+
assert.Equal(t, true, success)
148+
})
149+
},
150+
}

‎conformance/tests/baseline-admin-network-policy-core-ingress-udp-rules_base.yaml

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
apiVersion: policy.networking.k8s.io/v1alpha1
2+
kind: BaselineAdminNetworkPolicy
3+
metadata:
4+
name: default
5+
spec:
6+
subject:
7+
namespaces:
8+
matchLabels:
9+
kubernetes.io/metadata.name: network-policy-conformance-hufflepuff
10+
ingress:
11+
- name: "allow-from-ravenclaw-everything"
12+
action: "Allow"
13+
from:
14+
- namespaces:
15+
namespaceSelector:
16+
matchLabels:
17+
kubernetes.io/metadata.name: network-policy-conformance-ravenclaw
18+
- name: "deny-from-ravenclaw-everything"
19+
action: "Deny"
20+
from:
21+
- namespaces:
22+
namespaceSelector:
23+
matchLabels:
24+
kubernetes.io/metadata.name: network-policy-conformance-ravenclaw
25+
- name: "deny-from-slytherin-at-port-5353"
26+
action: "Deny"
27+
from:
28+
- namespaces:
29+
namespaceSelector:
30+
matchLabels:
31+
kubernetes.io/metadata.name: network-policy-conformance-slytherin
32+
ports:
33+
- portNumber:
34+
protocol: UDP
35+
port: 5353
36+
- name: "allow-from-gryffindor-at-port-53"
37+
action: "Allow"
38+
from:
39+
- namespaces:
40+
namespaceSelector:
41+
matchLabels:
42+
kubernetes.io/metadata.name: network-policy-conformance-gryffindor
43+
ports:
44+
- portNumber:
45+
protocol: UDP
46+
port: 53
47+
- name: "deny-from-gryffindor-everything-else"
48+
action: "Deny"
49+
from:
50+
- namespaces:
51+
namespaceSelector:
52+
matchLabels:
53+
kubernetes.io/metadata.name: network-policy-conformance-gryffindor

0 commit comments

Comments
 (0)