Skip to content

Commit 42095fb

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #113 from tssurya/anp-conformance-priority
Add conformance test for `.spec.Priority` field in ANP
2 parents fdf177d + c43707a commit 42095fb

File tree

4 files changed

+263
-3
lines changed

4 files changed

+263
-3
lines changed

‎conformance/base/admin_network_policy/core-priority-field.yaml

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
apiVersion: policy.networking.k8s.io/v1alpha1
2+
kind: AdminNetworkPolicy
3+
metadata:
4+
name: priority-50-example
5+
spec:
6+
priority: 50
7+
subject:
8+
pods:
9+
namespaceSelector:
10+
matchLabels:
11+
conformance-house: gryffindor
12+
podSelector:
13+
matchLabels:
14+
conformance-house: gryffindor
15+
ingress:
16+
- name: "deny-all-ingress-from-slytherin"
17+
action: "Deny"
18+
from:
19+
- pods:
20+
namespaces:
21+
namespaceSelector:
22+
matchLabels:
23+
conformance-house: slytherin
24+
podSelector:
25+
matchLabels:
26+
conformance-house: slytherin
27+
egress:
28+
- name: "deny-all-egress-to-slytherin"
29+
action: "Deny"
30+
to:
31+
- pods:
32+
namespaces:
33+
namespaceSelector:
34+
matchLabels:
35+
conformance-house: slytherin
36+
podSelector:
37+
matchLabels:
38+
conformance-house: slytherin
39+
---
40+
apiVersion: policy.networking.k8s.io/v1alpha1
41+
kind: AdminNetworkPolicy
42+
metadata:
43+
name: old-priority-60-new-priority-40-example
44+
spec:
45+
priority: 60 # will be updated to 40 in the tests thus taking higher precedence over the deny at priority 50
46+
subject:
47+
pods:
48+
namespaceSelector:
49+
matchLabels:
50+
conformance-house: gryffindor
51+
podSelector:
52+
matchLabels:
53+
conformance-house: gryffindor
54+
ingress:
55+
- name: "pass-all-ingress-from-slytherin"
56+
action: "Pass"
57+
from:
58+
- pods:
59+
namespaces:
60+
namespaceSelector:
61+
matchLabels:
62+
conformance-house: slytherin
63+
podSelector:
64+
matchLabels:
65+
conformance-house: slytherin
66+
egress:
67+
- name: "pass-all-egress-to-slytherin"
68+
action: "Pass"
69+
to:
70+
- pods:
71+
namespaces:
72+
namespaceSelector:
73+
matchLabels:
74+
conformance-house: slytherin
75+
podSelector:
76+
matchLabels:
77+
conformance-house: slytherin
78+
---
79+
apiVersion: policy.networking.k8s.io/v1alpha1
80+
kind: BaselineAdminNetworkPolicy
81+
metadata:
82+
name: default
83+
spec:
84+
subject:
85+
pods:
86+
namespaceSelector:
87+
matchLabels:
88+
conformance-house: gryffindor
89+
podSelector:
90+
matchLabels:
91+
conformance-house: gryffindor
92+
ingress:
93+
- name: "allow-all-ingress-from-slytherin"
94+
action: "Allow"
95+
from:
96+
- pods:
97+
namespaces:
98+
namespaceSelector:
99+
matchLabels:
100+
conformance-house: slytherin
101+
podSelector:
102+
matchLabels:
103+
conformance-house: slytherin
104+
egress:
105+
- name: "allow-all-egress-to-slytherin"
106+
action: "Allow"
107+
to:
108+
- pods:
109+
namespaces:
110+
namespaceSelector:
111+
matchLabels:
112+
conformance-house: slytherin
113+
podSelector:
114+
matchLabels:
115+
conformance-house: slytherin

‎conformance/tests/admin-network-policy-core-integration_base.yaml renamed to ‎conformance/base/api_integration/core-anp-np-banp.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ spec:
1717
matchLabels:
1818
conformance-house: slytherin
1919
egress:
20-
- name: "deny-all-egress-from-slytherin" # test will update to pass
20+
- name: "deny-all-egress-to-slytherin" # test will update to pass
2121
action: "Deny" # test will update to pass
2222
to:
2323
- namespaces:
@@ -64,7 +64,7 @@ spec:
6464
matchLabels:
6565
conformance-house: slytherin
6666
egress:
67-
- name: "deny-all-egress-from-slytherin"
67+
- name: "deny-all-egress-to-slytherin"
6868
action: "Deny"
6969
to:
7070
- namespaces:

‎conformance/tests/admin-network-policy-core-integration.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,9 @@ var AdminNetworkPolicyIntegration = suite.ConformanceTest{
4242
Description: "Tests integration support for gress traffic between ANP, NP and BANP using PASS action based on a server and client model",
4343
Features: []suite.SupportedFeature{
4444
suite.SupportAdminNetworkPolicy,
45+
suite.SupportBaselineAdminNetworkPolicy,
4546
},
46-
Manifests: []string{"tests/admin-network-policy-core-integration_base.yaml"},
47+
Manifests: []string{"base/api_integration/core-anp-np-banp.yaml"},
4748
Test: func(t *testing.T, s *suite.ConformanceTestSuite) {
4849

4950
t.Run("Should Deny traffic from slytherin to gryffindor respecting ANP", func(t *testing.T) {

‎conformance/tests/admin-network-policy-core-priority.go

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
/*
2+
Copyright 2022 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package tests
18+
19+
import (
20+
"context"
21+
"testing"
22+
23+
"github.com/stretchr/testify/assert"
24+
v1 "k8s.io/api/core/v1"
25+
"k8s.io/kubernetes/test/e2e/framework"
26+
"sigs.k8s.io/controller-runtime/pkg/client"
27+
28+
"sigs.k8s.io/network-policy-api/apis/v1alpha1"
29+
"sigs.k8s.io/network-policy-api/conformance/utils/kubernetes"
30+
"sigs.k8s.io/network-policy-api/conformance/utils/suite"
31+
)
32+
33+
func init() {
34+
ConformanceTests = append(ConformanceTests,
35+
AdminNetworkPolicyPriorityField,
36+
)
37+
}
38+
39+
var AdminNetworkPolicyPriorityField = suite.ConformanceTest{
40+
ShortName: "AdminNetworkPolicyPriorityField",
41+
Description: "Tests support for admin network policy API's .spec.priority field based on a server and client model",
42+
Features: []suite.SupportedFeature{
43+
suite.SupportAdminNetworkPolicy,
44+
suite.SupportBaselineAdminNetworkPolicy, // priority change of ANP should play well with existing BANP's
45+
},
46+
Manifests: []string{"base/admin_network_policy/core-priority-field.yaml"},
47+
Test: func(t *testing.T, s *suite.ConformanceTestSuite) {
48+
49+
t.Run("Should Deny traffic from slytherin to gryffindor respecting ANP", func(t *testing.T) {
50+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
51+
defer cancel()
52+
// This test uses `priority-50-example` ANP; takes precedence over old-priority-60-new-priority-40-example ANP
53+
// harry-potter-0 is our server pod in gryffindor namespace
54+
clientPod := &v1.Pod{}
55+
err := s.Client.Get(ctx, client.ObjectKey{
56+
Namespace: "network-policy-conformance-gryffindor",
57+
Name: "harry-potter-0",
58+
}, clientPod)
59+
framework.ExpectNoError(err, "unable to fetch the server pod")
60+
// draco-malfoy-0 is our client pod in slytherin namespace
61+
// ensure ingress is DENIED to gryffindor from slytherin
62+
// inressRule at index0 will take effect
63+
success := kubernetes.PokeServer(t, "network-policy-conformance-slytherin", "draco-malfoy-0", "tcp",
64+
clientPod.Status.PodIP, int32(80), s.TimeoutConfig.RequestTimeout, false)
65+
assert.Equal(t, true, success)
66+
// draco-malfoy-1 is our client pod in slytherin namespace
67+
success = kubernetes.PokeServer(t, "network-policy-conformance-slytherin", "draco-malfoy-1", "tcp",
68+
clientPod.Status.PodIP, int32(8080), s.TimeoutConfig.RequestTimeout, false)
69+
assert.Equal(t, true, success)
70+
})
71+
72+
t.Run("Should Deny traffic to slytherin from gryffindor respecting ANP", func(t *testing.T) {
73+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
74+
defer cancel()
75+
// This test uses `priority-50-example` ANP; takes precedence over old-priority-60-new-priority-40-example ANP
76+
// draco-malfoy-0 is our server pod in slytherin namespace
77+
clientPod := &v1.Pod{}
78+
err := s.Client.Get(ctx, client.ObjectKey{
79+
Namespace: "network-policy-conformance-slytherin",
80+
Name: "draco-malfoy-0",
81+
}, clientPod)
82+
framework.ExpectNoError(err, "unable to fetch the server pod")
83+
// harry-potter-0 is our client pod in gryffindor namespace
84+
// ensure ingress is DENIED to gryffindor from slytherin
85+
// egressRule at index0 will take effect
86+
success := kubernetes.PokeServer(t, "network-policy-conformance-gryffindor", "harry-potter-0", "tcp",
87+
clientPod.Status.PodIP, int32(80), s.TimeoutConfig.RequestTimeout, false)
88+
assert.Equal(t, true, success)
89+
// harry-potter-1 is our client pod in gryffindor namespace
90+
success = kubernetes.PokeServer(t, "network-policy-conformance-gryffindor", "harry-potter-1", "tcp",
91+
clientPod.Status.PodIP, int32(8080), s.TimeoutConfig.RequestTimeout, false)
92+
assert.Equal(t, true, success)
93+
})
94+
95+
t.Run("Should respect ANP priority field; thus passing both ingress and egress traffic over to BANP", func(t *testing.T) {
96+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
97+
defer cancel()
98+
// This test uses `old-priority-60-new-priority-40-example` ANP
99+
anp := &v1alpha1.AdminNetworkPolicy{}
100+
err := s.Client.Get(ctx, client.ObjectKey{
101+
Name: "old-priority-60-new-priority-40-example",
102+
}, anp)
103+
framework.ExpectNoError(err, "unable to fetch the admin network policy")
104+
// change priority from 60 to 40
105+
anp.Spec.Priority = 40
106+
err = s.Client.Update(ctx, anp)
107+
framework.ExpectNoError(err, "unable to update the admin network policy")
108+
// harry-potter-0 is our server pod in gryffindor namespace
109+
clientPod := &v1.Pod{}
110+
err = s.Client.Get(ctx, client.ObjectKey{
111+
Namespace: "network-policy-conformance-gryffindor",
112+
Name: "harry-potter-0",
113+
}, clientPod)
114+
framework.ExpectNoError(err, "unable to fetch the server pod")
115+
// draco-malfoy-0 is our client pod in slytherin namespace
116+
// ensure ingress is PASSED to gryffindor from slytherin - the baseline admin network policy ALLOW should take effect
117+
// inressRule at index0 will take effect
118+
success := kubernetes.PokeServer(t, "network-policy-conformance-slytherin", "draco-malfoy-0", "tcp",
119+
clientPod.Status.PodIP, int32(80), s.TimeoutConfig.RequestTimeout, true)
120+
assert.Equal(t, true, success)
121+
// draco-malfoy-1 is our client pod in slytherin namespace
122+
success = kubernetes.PokeServer(t, "network-policy-conformance-slytherin", "draco-malfoy-1", "tcp",
123+
clientPod.Status.PodIP, int32(8080), s.TimeoutConfig.RequestTimeout, true)
124+
assert.Equal(t, true, success)
125+
126+
// draco-malfoy-0 is our server pod in slytherin namespace
127+
err = s.Client.Get(ctx, client.ObjectKey{
128+
Namespace: "network-policy-conformance-slytherin",
129+
Name: "draco-malfoy-0",
130+
}, clientPod)
131+
framework.ExpectNoError(err, "unable to fetch the server pod")
132+
// harry-potter-0 is our client pod in gryffindor namespace
133+
// ensure ingress is PASSED to gryffindor from slytherin - the baseline admin network policy ALLOW should take effect
134+
// egressRule at index0 will take effect
135+
success = kubernetes.PokeServer(t, "network-policy-conformance-gryffindor", "harry-potter-0", "tcp",
136+
clientPod.Status.PodIP, int32(80), s.TimeoutConfig.RequestTimeout, true)
137+
assert.Equal(t, true, success)
138+
// harry-potter-1 is our client pod in gryffindor namespace
139+
success = kubernetes.PokeServer(t, "network-policy-conformance-gryffindor", "harry-potter-1", "tcp",
140+
clientPod.Status.PodIP, int32(8080), s.TimeoutConfig.RequestTimeout, true)
141+
assert.Equal(t, true, success)
142+
})
143+
},
144+
}

0 commit comments

Comments
 (0)