Skip to content

Commit 377a148

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #99 from tssurya/add-conformance-tests
Add ANP conformance tests for `.Spec.Ingress` and `.Spec.Egress` fields
2 parents 0a797fb + 23e4bc0 commit 377a148

13 files changed

+1797
-0
lines changed

‎conformance/tests/admin-network-policy-core-egress-sctp-rules.go

Lines changed: 219 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,219 @@
1+
/*
2+
Copyright 2022 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package tests
18+
19+
import (
20+
"context"
21+
"testing"
22+
23+
"github.com/stretchr/testify/assert"
24+
v1 "k8s.io/api/core/v1"
25+
"k8s.io/kubernetes/test/e2e/framework"
26+
"sigs.k8s.io/controller-runtime/pkg/client"
27+
28+
"sigs.k8s.io/network-policy-api/apis/v1alpha1"
29+
"sigs.k8s.io/network-policy-api/conformance/utils/kubernetes"
30+
"sigs.k8s.io/network-policy-api/conformance/utils/suite"
31+
)
32+
33+
func init() {
34+
ConformanceTests = append(ConformanceTests,
35+
AdminNetworkPolicyEgressSCTP,
36+
)
37+
}
38+
39+
var AdminNetworkPolicyEgressSCTP = suite.ConformanceTest{
40+
ShortName: "AdminNetworkPolicyEgressSCTP",
41+
Description: "Tests support for egress traffic (SCTP protocol) using admin network policy API based on a server and client model",
42+
Features: []suite.SupportedFeature{
43+
suite.SupportAdminNetworkPolicy,
44+
},
45+
Manifests: []string{"tests/admin-network-policy-core-egress-sctp-rules_base.yaml"},
46+
Test: func(t *testing.T, s *suite.ConformanceTestSuite) {
47+
48+
t.Run("Should support an 'allow-egress' policy for SCTP protocol; ensure rule ordering is respected", func(t *testing.T) {
49+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
50+
defer cancel()
51+
// This test uses `egress-sctp` ANP
52+
// harry-potter-0 is our server pod in gryffindor namespace
53+
clientPod := &v1.Pod{}
54+
err := s.Client.Get(ctx, client.ObjectKey{
55+
Namespace: "network-policy-conformance-gryffindor",
56+
Name: "harry-potter-0",
57+
}, clientPod)
58+
framework.ExpectNoError(err, "unable to fetch the server pod")
59+
// luna-lovegood-0 is our client pod in ravenclaw namespace
60+
// ensure egress is ALLOWED to gryffindor from ravenclaw
61+
// egressRule at index0 will take precedence over egressRule at index1; thus ALLOW takes precedence over DENY since rules are ordered
62+
success := kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-0", "sctp",
63+
clientPod.Status.PodIP, int32(9003), s.TimeoutConfig.RequestTimeout, true)
64+
assert.Equal(t, true, success)
65+
// luna-lovegood-1 is our client pod in ravenclaw namespace
66+
success = kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-1", "sctp",
67+
clientPod.Status.PodIP, int32(9005), s.TimeoutConfig.RequestTimeout, true)
68+
assert.Equal(t, true, success)
69+
})
70+
71+
t.Run("Should support an 'allow-egress' policy for SCTP protocol at the specified port", func(t *testing.T) {
72+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
73+
defer cancel()
74+
// This test uses `egress-sctp` ANP
75+
// cedric-diggory-1 is our server pod in hufflepuff namespace
76+
clientPod := &v1.Pod{}
77+
err := s.Client.Get(ctx, client.ObjectKey{
78+
Namespace: "network-policy-conformance-hufflepuff",
79+
Name: "cedric-diggory-1",
80+
}, clientPod)
81+
framework.ExpectNoError(err, "unable to fetch the server pod")
82+
// luna-lovegood-0 is our client pod in ravenclaw namespace
83+
// ensure egress is ALLOWED to hufflepuff from ravenclaw at port 9003; egressRule at index5
84+
success := kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-0", "sctp",
85+
clientPod.Status.PodIP, int32(9003), s.TimeoutConfig.RequestTimeout, true)
86+
assert.Equal(t, true, success)
87+
// luna-lovegood-1 is our client pod in ravenclaw namespace
88+
// ensure egress is DENIED to hufflepuff from ravenclaw for rest of the traffic; egressRule at index6
89+
success = kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-1", "sctp",
90+
clientPod.Status.PodIP, int32(9005), s.TimeoutConfig.RequestTimeout, false)
91+
assert.Equal(t, true, success)
92+
})
93+
94+
t.Run("Should support an 'deny-egress' policy for SCTP protocol; ensure rule ordering is respected", func(t *testing.T) {
95+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
96+
defer cancel()
97+
// This test uses `egress-sctp` ANP
98+
// harry-potter-0 is our server pod in gryffindor namespace
99+
clientPod := &v1.Pod{}
100+
err := s.Client.Get(ctx, client.ObjectKey{
101+
Namespace: "network-policy-conformance-gryffindor",
102+
Name: "harry-potter-1",
103+
}, clientPod)
104+
framework.ExpectNoError(err, "unable to fetch the server pod")
105+
anp := &v1alpha1.AdminNetworkPolicy{}
106+
err = s.Client.Get(ctx, client.ObjectKey{
107+
Name: "egress-sctp",
108+
}, anp)
109+
framework.ExpectNoError(err, "unable to fetch the admin network policy")
110+
// swap rules at index0 and index1
111+
allowRule := anp.DeepCopy().Spec.Egress[0]
112+
anp.Spec.Egress[0] = anp.DeepCopy().Spec.Egress[1]
113+
anp.Spec.Egress[1] = allowRule
114+
err = s.Client.Update(ctx, anp)
115+
framework.ExpectNoError(err, "unable to update the admin network policy")
116+
// luna-lovegood-0 is our client pod in gryffindor namespace
117+
// ensure egress is DENIED to gryffindor from ravenclaw
118+
// egressRule at index0 will take precedence over egressRule at index1; thus DENY takes precedence over ALLOW since rules are ordered
119+
success := kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-0", "sctp",
120+
clientPod.Status.PodIP, int32(9003), s.TimeoutConfig.RequestTimeout, false)
121+
assert.Equal(t, true, success)
122+
// luna-lovegood-1 is our client pod in ravenclaw namespace
123+
success = kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-1", "sctp",
124+
clientPod.Status.PodIP, int32(9005), s.TimeoutConfig.RequestTimeout, false)
125+
assert.Equal(t, true, success)
126+
})
127+
128+
t.Run("Should support a 'deny-egress' policy for SCTP protocol at the specified port", func(t *testing.T) {
129+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
130+
defer cancel()
131+
// This test uses `egress-sctp` ANP
132+
// draco-malfoy-0 is our server pod in slytherin namespace
133+
clientPod := &v1.Pod{}
134+
err := s.Client.Get(ctx, client.ObjectKey{
135+
Namespace: "network-policy-conformance-slytherin",
136+
Name: "draco-malfoy-0",
137+
}, clientPod)
138+
framework.ExpectNoError(err, "unable to fetch the server pod")
139+
// luna-lovegood-0 is our client pod in ravenclaw namespace
140+
// ensure egress to slytherin is DENIED from ravenclaw at port 9003; egressRule at index3
141+
success := kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-0", "sctp",
142+
clientPod.Status.PodIP, int32(9003), s.TimeoutConfig.RequestTimeout, false)
143+
assert.Equal(t, true, success)
144+
// luna-lovegood-1 is our client pod in ravenclaw namespace
145+
// ensure egress to slytherin is ALLOWED from ravenclaw for rest of the traffic; matches no rules hence allowed
146+
success = kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-1", "sctp",
147+
clientPod.Status.PodIP, int32(9005), s.TimeoutConfig.RequestTimeout, true)
148+
assert.Equal(t, true, success)
149+
})
150+
151+
t.Run("Should support an 'pass-egress' policy for SCTP protocol; ensure rule ordering is respected", func(t *testing.T) {
152+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
153+
defer cancel()
154+
// This test uses `egress-sctp` ANP
155+
// harry-potter-0 is our server pod in gryffindor namespace
156+
clientPod := &v1.Pod{}
157+
err := s.Client.Get(ctx, client.ObjectKey{
158+
Namespace: "network-policy-conformance-gryffindor",
159+
Name: "harry-potter-1",
160+
}, clientPod)
161+
framework.ExpectNoError(err, "unable to fetch the server pod")
162+
anp := &v1alpha1.AdminNetworkPolicy{}
163+
err = s.Client.Get(ctx, client.ObjectKey{
164+
Name: "egress-sctp",
165+
}, anp)
166+
framework.ExpectNoError(err, "unable to fetch the admin network policy")
167+
// swap rules at index0 and index2
168+
denyRule := anp.DeepCopy().Spec.Egress[0]
169+
anp.Spec.Egress[0] = anp.DeepCopy().Spec.Egress[2]
170+
anp.Spec.Egress[2] = denyRule
171+
err = s.Client.Update(ctx, anp)
172+
framework.ExpectNoError(err, "unable to update the admin network policy")
173+
// luna-lovegood-0 is our client pod in ravenclaw namespace
174+
// ensure egress is PASSED from gryffindor to ravenclaw
175+
// egressRule at index0 will take precedence over egressRule at index1&index2; thus PASS takes precedence over ALLOW/DENY since rules are ordered
176+
success := kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-0", "sctp",
177+
clientPod.Status.PodIP, int32(9003), s.TimeoutConfig.RequestTimeout, true)
178+
assert.Equal(t, true, success)
179+
// luna-lovegood-1 is our client pod in ravenclaw namespace
180+
success = kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-1", "sctp",
181+
clientPod.Status.PodIP, int32(9005), s.TimeoutConfig.RequestTimeout, true)
182+
assert.Equal(t, true, success)
183+
})
184+
185+
t.Run("Should support a 'pass-egress' policy for SCTP protocol at the specified port", func(t *testing.T) {
186+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
187+
defer cancel()
188+
// This test uses `egress-sctp` ANP
189+
// draco-malfoy-0 is our server pod in slytherin namespace
190+
clientPod := &v1.Pod{}
191+
err := s.Client.Get(ctx, client.ObjectKey{
192+
Namespace: "network-policy-conformance-slytherin",
193+
Name: "draco-malfoy-0",
194+
}, clientPod)
195+
framework.ExpectNoError(err, "unable to fetch the server pod")
196+
anp := &v1alpha1.AdminNetworkPolicy{}
197+
err = s.Client.Get(ctx, client.ObjectKey{
198+
Name: "egress-sctp",
199+
}, anp)
200+
framework.ExpectNoError(err, "unable to fetch the admin network policy")
201+
// swap rules at index3 and index4
202+
denyRule := anp.DeepCopy().Spec.Egress[3]
203+
anp.Spec.Egress[3] = anp.DeepCopy().Spec.Egress[4]
204+
anp.Spec.Egress[4] = denyRule
205+
err = s.Client.Update(ctx, anp)
206+
framework.ExpectNoError(err, "unable to update the admin network policy")
207+
// luna-lovegood-0 is our client pod in ravenclaw namespace
208+
// ensure egress to slytherin is PASSED from ravenclaw at port 9003; egressRule at index3
209+
success := kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-0", "sctp",
210+
clientPod.Status.PodIP, int32(9003), s.TimeoutConfig.RequestTimeout, true)
211+
assert.Equal(t, true, success)
212+
// luna-lovegood-1 is our client pod in ravenclaw namespace
213+
// ensure egress to slytherin is ALLOWED from ravenclaw for rest of the traffic; matches no rules hence allowed
214+
success = kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-1", "sctp",
215+
clientPod.Status.PodIP, int32(9005), s.TimeoutConfig.RequestTimeout, true)
216+
assert.Equal(t, true, success)
217+
})
218+
},
219+
}

‎conformance/tests/admin-network-policy-core-egress-sctp-rules_base.yaml

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
apiVersion: policy.networking.k8s.io/v1alpha1
2+
kind: AdminNetworkPolicy
3+
metadata:
4+
name: egress-sctp
5+
spec:
6+
priority: 8
7+
subject:
8+
namespaces:
9+
matchLabels:
10+
kubernetes.io/metadata.name: network-policy-conformance-ravenclaw
11+
egress:
12+
- name: "allow-to-gryffindor-everything"
13+
action: "Allow"
14+
to:
15+
- namespaces:
16+
namespaceSelector:
17+
matchLabels:
18+
kubernetes.io/metadata.name: network-policy-conformance-gryffindor
19+
- name: "deny-to-gryffindor-everything"
20+
action: "Deny"
21+
to:
22+
- namespaces:
23+
namespaceSelector:
24+
matchLabels:
25+
kubernetes.io/metadata.name: network-policy-conformance-gryffindor
26+
- name: "pass-to-gryffindor-everything"
27+
action: "Pass"
28+
to:
29+
- namespaces:
30+
namespaceSelector:
31+
matchLabels:
32+
kubernetes.io/metadata.name: network-policy-conformance-gryffindor
33+
- name: "deny-to-slytherin-at-port-9003"
34+
action: "Deny"
35+
to:
36+
- namespaces:
37+
namespaceSelector:
38+
matchLabels:
39+
kubernetes.io/metadata.name: network-policy-conformance-slytherin
40+
ports:
41+
- portNumber:
42+
protocol: SCTP
43+
port: 9003
44+
- name: "pass-to-slytherin-at-port-9003"
45+
action: "Pass"
46+
to:
47+
- namespaces:
48+
namespaceSelector:
49+
matchLabels:
50+
kubernetes.io/metadata.name: network-policy-conformance-slytherin
51+
ports:
52+
- portNumber:
53+
protocol: SCTP
54+
port: 9003
55+
- name: "allow-to-hufflepuff-at-port-9003"
56+
action: "Allow"
57+
to:
58+
- namespaces:
59+
namespaceSelector:
60+
matchLabels:
61+
kubernetes.io/metadata.name: network-policy-conformance-hufflepuff
62+
ports:
63+
- portNumber:
64+
protocol: SCTP
65+
port: 9003
66+
- name: "deny-to-hufflepuff-everything-else"
67+
action: "Deny"
68+
to:
69+
- namespaces:
70+
namespaceSelector:
71+
matchLabels:
72+
kubernetes.io/metadata.name: network-policy-conformance-hufflepuff

0 commit comments

Comments
 (0)