Skip to content

Commit 23e4bc0

Browse files
tssuryatssurya
committed
Add egress traffic conformance tests for SCTP protocol
This commit tests .Spec.Egress specifically. We test deny, allow and pass actions. We test SCTP protocol with and without port combination. TODO: In future add test for port range and named ports. Signed-off-by: Surya Seetharaman <[email protected]>
1 parent 00a9797 commit 23e4bc0

File tree

2 files changed

+291
-0
lines changed

2 files changed

+291
-0
lines changed

‎conformance/tests/admin-network-policy-core-egress-sctp-rules.go

Lines changed: 219 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,219 @@
1+
/*
2+
Copyright 2022 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package tests
18+
19+
import (
20+
"context"
21+
"testing"
22+
23+
"github.com/stretchr/testify/assert"
24+
v1 "k8s.io/api/core/v1"
25+
"k8s.io/kubernetes/test/e2e/framework"
26+
"sigs.k8s.io/controller-runtime/pkg/client"
27+
28+
"sigs.k8s.io/network-policy-api/apis/v1alpha1"
29+
"sigs.k8s.io/network-policy-api/conformance/utils/kubernetes"
30+
"sigs.k8s.io/network-policy-api/conformance/utils/suite"
31+
)
32+
33+
func init() {
34+
ConformanceTests = append(ConformanceTests,
35+
AdminNetworkPolicyEgressSCTP,
36+
)
37+
}
38+
39+
var AdminNetworkPolicyEgressSCTP = suite.ConformanceTest{
40+
ShortName: "AdminNetworkPolicyEgressSCTP",
41+
Description: "Tests support for egress traffic (SCTP protocol) using admin network policy API based on a server and client model",
42+
Features: []suite.SupportedFeature{
43+
suite.SupportAdminNetworkPolicy,
44+
},
45+
Manifests: []string{"tests/admin-network-policy-core-egress-sctp-rules_base.yaml"},
46+
Test: func(t *testing.T, s *suite.ConformanceTestSuite) {
47+
48+
t.Run("Should support an 'allow-egress' policy for SCTP protocol; ensure rule ordering is respected", func(t *testing.T) {
49+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
50+
defer cancel()
51+
// This test uses `egress-sctp` ANP
52+
// harry-potter-0 is our server pod in gryffindor namespace
53+
clientPod := &v1.Pod{}
54+
err := s.Client.Get(ctx, client.ObjectKey{
55+
Namespace: "network-policy-conformance-gryffindor",
56+
Name: "harry-potter-0",
57+
}, clientPod)
58+
framework.ExpectNoError(err, "unable to fetch the server pod")
59+
// luna-lovegood-0 is our client pod in ravenclaw namespace
60+
// ensure egress is ALLOWED to gryffindor from ravenclaw
61+
// egressRule at index0 will take precedence over egressRule at index1; thus ALLOW takes precedence over DENY since rules are ordered
62+
success := kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-0", "sctp",
63+
clientPod.Status.PodIP, int32(9003), s.TimeoutConfig.RequestTimeout, true)
64+
assert.Equal(t, true, success)
65+
// luna-lovegood-1 is our client pod in ravenclaw namespace
66+
success = kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-1", "sctp",
67+
clientPod.Status.PodIP, int32(9005), s.TimeoutConfig.RequestTimeout, true)
68+
assert.Equal(t, true, success)
69+
})
70+
71+
t.Run("Should support an 'allow-egress' policy for SCTP protocol at the specified port", func(t *testing.T) {
72+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
73+
defer cancel()
74+
// This test uses `egress-sctp` ANP
75+
// cedric-diggory-1 is our server pod in hufflepuff namespace
76+
clientPod := &v1.Pod{}
77+
err := s.Client.Get(ctx, client.ObjectKey{
78+
Namespace: "network-policy-conformance-hufflepuff",
79+
Name: "cedric-diggory-1",
80+
}, clientPod)
81+
framework.ExpectNoError(err, "unable to fetch the server pod")
82+
// luna-lovegood-0 is our client pod in ravenclaw namespace
83+
// ensure egress is ALLOWED to hufflepuff from ravenclaw at port 9003; egressRule at index5
84+
success := kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-0", "sctp",
85+
clientPod.Status.PodIP, int32(9003), s.TimeoutConfig.RequestTimeout, true)
86+
assert.Equal(t, true, success)
87+
// luna-lovegood-1 is our client pod in ravenclaw namespace
88+
// ensure egress is DENIED to hufflepuff from ravenclaw for rest of the traffic; egressRule at index6
89+
success = kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-1", "sctp",
90+
clientPod.Status.PodIP, int32(9005), s.TimeoutConfig.RequestTimeout, false)
91+
assert.Equal(t, true, success)
92+
})
93+
94+
t.Run("Should support an 'deny-egress' policy for SCTP protocol; ensure rule ordering is respected", func(t *testing.T) {
95+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
96+
defer cancel()
97+
// This test uses `egress-sctp` ANP
98+
// harry-potter-0 is our server pod in gryffindor namespace
99+
clientPod := &v1.Pod{}
100+
err := s.Client.Get(ctx, client.ObjectKey{
101+
Namespace: "network-policy-conformance-gryffindor",
102+
Name: "harry-potter-1",
103+
}, clientPod)
104+
framework.ExpectNoError(err, "unable to fetch the server pod")
105+
anp := &v1alpha1.AdminNetworkPolicy{}
106+
err = s.Client.Get(ctx, client.ObjectKey{
107+
Name: "egress-sctp",
108+
}, anp)
109+
framework.ExpectNoError(err, "unable to fetch the admin network policy")
110+
// swap rules at index0 and index1
111+
allowRule := anp.DeepCopy().Spec.Egress[0]
112+
anp.Spec.Egress[0] = anp.DeepCopy().Spec.Egress[1]
113+
anp.Spec.Egress[1] = allowRule
114+
err = s.Client.Update(ctx, anp)
115+
framework.ExpectNoError(err, "unable to update the admin network policy")
116+
// luna-lovegood-0 is our client pod in gryffindor namespace
117+
// ensure egress is DENIED to gryffindor from ravenclaw
118+
// egressRule at index0 will take precedence over egressRule at index1; thus DENY takes precedence over ALLOW since rules are ordered
119+
success := kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-0", "sctp",
120+
clientPod.Status.PodIP, int32(9003), s.TimeoutConfig.RequestTimeout, false)
121+
assert.Equal(t, true, success)
122+
// luna-lovegood-1 is our client pod in ravenclaw namespace
123+
success = kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-1", "sctp",
124+
clientPod.Status.PodIP, int32(9005), s.TimeoutConfig.RequestTimeout, false)
125+
assert.Equal(t, true, success)
126+
})
127+
128+
t.Run("Should support a 'deny-egress' policy for SCTP protocol at the specified port", func(t *testing.T) {
129+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
130+
defer cancel()
131+
// This test uses `egress-sctp` ANP
132+
// draco-malfoy-0 is our server pod in slytherin namespace
133+
clientPod := &v1.Pod{}
134+
err := s.Client.Get(ctx, client.ObjectKey{
135+
Namespace: "network-policy-conformance-slytherin",
136+
Name: "draco-malfoy-0",
137+
}, clientPod)
138+
framework.ExpectNoError(err, "unable to fetch the server pod")
139+
// luna-lovegood-0 is our client pod in ravenclaw namespace
140+
// ensure egress to slytherin is DENIED from ravenclaw at port 9003; egressRule at index3
141+
success := kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-0", "sctp",
142+
clientPod.Status.PodIP, int32(9003), s.TimeoutConfig.RequestTimeout, false)
143+
assert.Equal(t, true, success)
144+
// luna-lovegood-1 is our client pod in ravenclaw namespace
145+
// ensure egress to slytherin is ALLOWED from ravenclaw for rest of the traffic; matches no rules hence allowed
146+
success = kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-1", "sctp",
147+
clientPod.Status.PodIP, int32(9005), s.TimeoutConfig.RequestTimeout, true)
148+
assert.Equal(t, true, success)
149+
})
150+
151+
t.Run("Should support an 'pass-egress' policy for SCTP protocol; ensure rule ordering is respected", func(t *testing.T) {
152+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
153+
defer cancel()
154+
// This test uses `egress-sctp` ANP
155+
// harry-potter-0 is our server pod in gryffindor namespace
156+
clientPod := &v1.Pod{}
157+
err := s.Client.Get(ctx, client.ObjectKey{
158+
Namespace: "network-policy-conformance-gryffindor",
159+
Name: "harry-potter-1",
160+
}, clientPod)
161+
framework.ExpectNoError(err, "unable to fetch the server pod")
162+
anp := &v1alpha1.AdminNetworkPolicy{}
163+
err = s.Client.Get(ctx, client.ObjectKey{
164+
Name: "egress-sctp",
165+
}, anp)
166+
framework.ExpectNoError(err, "unable to fetch the admin network policy")
167+
// swap rules at index0 and index2
168+
denyRule := anp.DeepCopy().Spec.Egress[0]
169+
anp.Spec.Egress[0] = anp.DeepCopy().Spec.Egress[2]
170+
anp.Spec.Egress[2] = denyRule
171+
err = s.Client.Update(ctx, anp)
172+
framework.ExpectNoError(err, "unable to update the admin network policy")
173+
// luna-lovegood-0 is our client pod in ravenclaw namespace
174+
// ensure egress is PASSED from gryffindor to ravenclaw
175+
// egressRule at index0 will take precedence over egressRule at index1&index2; thus PASS takes precedence over ALLOW/DENY since rules are ordered
176+
success := kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-0", "sctp",
177+
clientPod.Status.PodIP, int32(9003), s.TimeoutConfig.RequestTimeout, true)
178+
assert.Equal(t, true, success)
179+
// luna-lovegood-1 is our client pod in ravenclaw namespace
180+
success = kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-1", "sctp",
181+
clientPod.Status.PodIP, int32(9005), s.TimeoutConfig.RequestTimeout, true)
182+
assert.Equal(t, true, success)
183+
})
184+
185+
t.Run("Should support a 'pass-egress' policy for SCTP protocol at the specified port", func(t *testing.T) {
186+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
187+
defer cancel()
188+
// This test uses `egress-sctp` ANP
189+
// draco-malfoy-0 is our server pod in slytherin namespace
190+
clientPod := &v1.Pod{}
191+
err := s.Client.Get(ctx, client.ObjectKey{
192+
Namespace: "network-policy-conformance-slytherin",
193+
Name: "draco-malfoy-0",
194+
}, clientPod)
195+
framework.ExpectNoError(err, "unable to fetch the server pod")
196+
anp := &v1alpha1.AdminNetworkPolicy{}
197+
err = s.Client.Get(ctx, client.ObjectKey{
198+
Name: "egress-sctp",
199+
}, anp)
200+
framework.ExpectNoError(err, "unable to fetch the admin network policy")
201+
// swap rules at index3 and index4
202+
denyRule := anp.DeepCopy().Spec.Egress[3]
203+
anp.Spec.Egress[3] = anp.DeepCopy().Spec.Egress[4]
204+
anp.Spec.Egress[4] = denyRule
205+
err = s.Client.Update(ctx, anp)
206+
framework.ExpectNoError(err, "unable to update the admin network policy")
207+
// luna-lovegood-0 is our client pod in ravenclaw namespace
208+
// ensure egress to slytherin is PASSED from ravenclaw at port 9003; egressRule at index3
209+
success := kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-0", "sctp",
210+
clientPod.Status.PodIP, int32(9003), s.TimeoutConfig.RequestTimeout, true)
211+
assert.Equal(t, true, success)
212+
// luna-lovegood-1 is our client pod in ravenclaw namespace
213+
// ensure egress to slytherin is ALLOWED from ravenclaw for rest of the traffic; matches no rules hence allowed
214+
success = kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-1", "sctp",
215+
clientPod.Status.PodIP, int32(9005), s.TimeoutConfig.RequestTimeout, true)
216+
assert.Equal(t, true, success)
217+
})
218+
},
219+
}

‎conformance/tests/admin-network-policy-core-egress-sctp-rules_base.yaml

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
apiVersion: policy.networking.k8s.io/v1alpha1
2+
kind: AdminNetworkPolicy
3+
metadata:
4+
name: egress-sctp
5+
spec:
6+
priority: 8
7+
subject:
8+
namespaces:
9+
matchLabels:
10+
kubernetes.io/metadata.name: network-policy-conformance-ravenclaw
11+
egress:
12+
- name: "allow-to-gryffindor-everything"
13+
action: "Allow"
14+
to:
15+
- namespaces:
16+
namespaceSelector:
17+
matchLabels:
18+
kubernetes.io/metadata.name: network-policy-conformance-gryffindor
19+
- name: "deny-to-gryffindor-everything"
20+
action: "Deny"
21+
to:
22+
- namespaces:
23+
namespaceSelector:
24+
matchLabels:
25+
kubernetes.io/metadata.name: network-policy-conformance-gryffindor
26+
- name: "pass-to-gryffindor-everything"
27+
action: "Pass"
28+
to:
29+
- namespaces:
30+
namespaceSelector:
31+
matchLabels:
32+
kubernetes.io/metadata.name: network-policy-conformance-gryffindor
33+
- name: "deny-to-slytherin-at-port-9003"
34+
action: "Deny"
35+
to:
36+
- namespaces:
37+
namespaceSelector:
38+
matchLabels:
39+
kubernetes.io/metadata.name: network-policy-conformance-slytherin
40+
ports:
41+
- portNumber:
42+
protocol: SCTP
43+
port: 9003
44+
- name: "pass-to-slytherin-at-port-9003"
45+
action: "Pass"
46+
to:
47+
- namespaces:
48+
namespaceSelector:
49+
matchLabels:
50+
kubernetes.io/metadata.name: network-policy-conformance-slytherin
51+
ports:
52+
- portNumber:
53+
protocol: SCTP
54+
port: 9003
55+
- name: "allow-to-hufflepuff-at-port-9003"
56+
action: "Allow"
57+
to:
58+
- namespaces:
59+
namespaceSelector:
60+
matchLabels:
61+
kubernetes.io/metadata.name: network-policy-conformance-hufflepuff
62+
ports:
63+
- portNumber:
64+
protocol: SCTP
65+
port: 9003
66+
- name: "deny-to-hufflepuff-everything-else"
67+
action: "Deny"
68+
to:
69+
- namespaces:
70+
namespaceSelector:
71+
matchLabels:
72+
kubernetes.io/metadata.name: network-policy-conformance-hufflepuff

0 commit comments

Comments
 (0)