Skip to content

Commit 6aada39

Browse files
tssuryatssurya
committed
Add ingress traffic conformance tests for TCP protocol
This commit tests .Spec.Ingress specifically. We test deny, allow and pass actions. We test TCP protocol with and without port combination. TODO: In future add test for port range and named ports. Signed-off-by: Surya Seetharaman <[email protected]>
1 parent 0a797fb commit 6aada39

File tree

3 files changed

+345
-0
lines changed

3 files changed

+345
-0
lines changed

‎conformance/tests/admin-network-policy-core-ingress-tcp-rules.go

Lines changed: 218 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,218 @@
1+
/*
2+
Copyright 2022 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package tests
18+
19+
import (
20+
"context"
21+
"testing"
22+
23+
"github.com/stretchr/testify/assert"
24+
v1 "k8s.io/api/core/v1"
25+
"k8s.io/kubernetes/test/e2e/framework"
26+
"sigs.k8s.io/controller-runtime/pkg/client"
27+
28+
"sigs.k8s.io/network-policy-api/apis/v1alpha1"
29+
"sigs.k8s.io/network-policy-api/conformance/utils/kubernetes"
30+
"sigs.k8s.io/network-policy-api/conformance/utils/suite"
31+
)
32+
33+
func init() {
34+
ConformanceTests = append(ConformanceTests,
35+
AdminNetworkPolicyIngressTCP,
36+
)
37+
}
38+
39+
var AdminNetworkPolicyIngressTCP = suite.ConformanceTest{
40+
ShortName: "AdminNetworkPolicyIngressTCP",
41+
Description: "Tests support for ingress traffic (TCP protocol) using admin network policy API based on a server and client model",
42+
Features: []suite.SupportedFeature{
43+
suite.SupportAdminNetworkPolicy,
44+
},
45+
Manifests: []string{"tests/admin-network-policy-core-ingress-tcp-rules_base.yaml"},
46+
Test: func(t *testing.T, s *suite.ConformanceTestSuite) {
47+
48+
t.Run("Should support an 'allow-ingress' policy for TCP protocol; ensure rule ordering is respected", func(t *testing.T) {
49+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
50+
defer cancel()
51+
// This test uses `ingress-tcp` ANP
52+
// harry-potter-0 is our server pod in gryffindor namespace
53+
clientPod := &v1.Pod{}
54+
err := s.Client.Get(ctx, client.ObjectKey{
55+
Namespace: "network-policy-conformance-gryffindor",
56+
Name: "harry-potter-0",
57+
}, clientPod)
58+
framework.ExpectNoError(err, "unable to fetch the server pod")
59+
// luna-lovegood-0 is our client pod in ravenclaw namespace
60+
// ensure ingress is ALLOWED from ravenclaw to gryffindor
61+
// ingressRule at index0 will take precedence over ingressRule at index1; thus ALLOW takes precedence over DENY since rules are ordered
62+
success := kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-0", "tcp",
63+
clientPod.Status.PodIP, int32(80), s.TimeoutConfig.RequestTimeout, true)
64+
assert.Equal(t, true, success)
65+
success = kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-1", "tcp",
66+
clientPod.Status.PodIP, int32(8080), s.TimeoutConfig.RequestTimeout, true)
67+
assert.Equal(t, true, success)
68+
})
69+
70+
t.Run("Should support an 'allow-ingress' policy for TCP protocol at the specified port", func(t *testing.T) {
71+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
72+
defer cancel()
73+
// This test uses `ingress-tcp` ANP
74+
// harry-potter-1 is our server pod in gryffindor namespace
75+
clientPod := &v1.Pod{}
76+
err := s.Client.Get(ctx, client.ObjectKey{
77+
Namespace: "network-policy-conformance-gryffindor",
78+
Name: "harry-potter-1",
79+
}, clientPod)
80+
framework.ExpectNoError(err, "unable to fetch the server pod")
81+
// cedric-diggory-0 is our client pod in hufflepuff namespace
82+
// ensure ingress is ALLOWED from hufflepuff to gryffindor at port 80; ingressRule at index5
83+
success := kubernetes.PokeServer(t, "network-policy-conformance-hufflepuff", "cedric-diggory-0", "tcp",
84+
clientPod.Status.PodIP, int32(80), s.TimeoutConfig.RequestTimeout, true)
85+
assert.Equal(t, true, success)
86+
// cedric-diggory-1 is our client pod in hufflepuff namespace
87+
// ensure ingress is DENIED from hufflepuff to gryffindor for rest of the traffic; ingressRule at index6
88+
success = kubernetes.PokeServer(t, "network-policy-conformance-hufflepuff", "cedric-diggory-1", "tcp",
89+
clientPod.Status.PodIP, int32(8080), s.TimeoutConfig.RequestTimeout, false)
90+
assert.Equal(t, true, success)
91+
})
92+
93+
t.Run("Should support an 'deny-ingress' policy for TCP protocol; ensure rule ordering is respected", func(t *testing.T) {
94+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
95+
defer cancel()
96+
// This test uses `ingress-tcp` ANP
97+
// harry-potter-1 is our server pod in gryffindor namespace
98+
clientPod := &v1.Pod{}
99+
err := s.Client.Get(ctx, client.ObjectKey{
100+
Namespace: "network-policy-conformance-gryffindor",
101+
Name: "harry-potter-1",
102+
}, clientPod)
103+
framework.ExpectNoError(err, "unable to fetch the server pod")
104+
anp := &v1alpha1.AdminNetworkPolicy{}
105+
err = s.Client.Get(ctx, client.ObjectKey{
106+
Name: "ingress-tcp",
107+
}, anp)
108+
framework.ExpectNoError(err, "unable to fetch the admin network policy")
109+
// swap rules at index0 and index1
110+
allowRule := anp.DeepCopy().Spec.Ingress[0]
111+
anp.Spec.Ingress[0] = anp.DeepCopy().Spec.Ingress[1]
112+
anp.Spec.Ingress[1] = allowRule
113+
err = s.Client.Update(ctx, anp)
114+
framework.ExpectNoError(err, "unable to update the admin network policy")
115+
// luna-lovegood-0 is our client pod in ravenclaw namespace
116+
// ensure ingress is DENIED from ravenclaw to gryffindor
117+
// ingressRule at index0 will take precedence over ingressRule at index1; thus DENY takes precedence over ALLOW since rules are ordered
118+
success := kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-0", "tcp",
119+
clientPod.Status.PodIP, int32(80), s.TimeoutConfig.RequestTimeout, false)
120+
assert.Equal(t, true, success)
121+
// luna-lovegood-1 is our client pod in ravenclaw namespace
122+
success = kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-1", "tcp",
123+
clientPod.Status.PodIP, int32(8080), s.TimeoutConfig.RequestTimeout, false)
124+
assert.Equal(t, true, success)
125+
})
126+
127+
t.Run("Should support a 'deny-ingress' policy for TCP protocol at the specified port", func(t *testing.T) {
128+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
129+
defer cancel()
130+
// This test uses `ingress-tcp` ANP
131+
// harry-potter-0 is our server pod in gryffindor namespace
132+
clientPod := &v1.Pod{}
133+
err := s.Client.Get(ctx, client.ObjectKey{
134+
Namespace: "network-policy-conformance-gryffindor",
135+
Name: "harry-potter-0",
136+
}, clientPod)
137+
framework.ExpectNoError(err, "unable to fetch the server pod")
138+
// draco-malfoy-0 is our client pod in slytherin namespace
139+
// ensure ingress from slytherin is DENIED to gryffindor at port 80; ingressRule at index3
140+
success := kubernetes.PokeServer(t, "network-policy-conformance-slytherin", "draco-malfoy-0", "tcp",
141+
clientPod.Status.PodIP, int32(80), s.TimeoutConfig.RequestTimeout, false)
142+
assert.Equal(t, true, success)
143+
// draco-malfoy-1 is our client pod in slytherin namespace
144+
// ensure ingress from slytherin is ALLOWED to gryffindor for rest of the traffic; matches no rules hence allowed
145+
success = kubernetes.PokeServer(t, "network-policy-conformance-slytherin", "draco-malfoy-1", "tcp",
146+
clientPod.Status.PodIP, int32(8080), s.TimeoutConfig.RequestTimeout, true)
147+
assert.Equal(t, true, success)
148+
})
149+
150+
t.Run("Should support an 'pass-ingress' policy for TCP protocol; ensure rule ordering is respected", func(t *testing.T) {
151+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
152+
defer cancel()
153+
// This test uses `ingress-tcp` ANP
154+
// harry-potter-0 is our server pod in gryffindor namespace
155+
clientPod := &v1.Pod{}
156+
err := s.Client.Get(ctx, client.ObjectKey{
157+
Namespace: "network-policy-conformance-gryffindor",
158+
Name: "harry-potter-0",
159+
}, clientPod)
160+
framework.ExpectNoError(err, "unable to fetch the server pod")
161+
anp := &v1alpha1.AdminNetworkPolicy{}
162+
err = s.Client.Get(ctx, client.ObjectKey{
163+
Name: "ingress-tcp",
164+
}, anp)
165+
framework.ExpectNoError(err, "unable to fetch the admin network policy")
166+
// swap rules at index0 and index2
167+
denyRule := anp.DeepCopy().Spec.Ingress[0]
168+
anp.Spec.Ingress[0] = anp.DeepCopy().Spec.Ingress[2]
169+
anp.Spec.Ingress[2] = denyRule
170+
err = s.Client.Update(ctx, anp)
171+
framework.ExpectNoError(err, "unable to update the admin network policy")
172+
// luna-lovegood-0 is our client pod in ravenclaw namespace
173+
// ensure ingress is PASSED from ravenclaw to gryffindor
174+
// ingressRule at index0 will take precedence over ingressRule at index1&index2; thus PASS takes precedence over ALLOW/DENY since rules are ordered
175+
success := kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-0", "tcp",
176+
clientPod.Status.PodIP, int32(80), s.TimeoutConfig.RequestTimeout, true)
177+
assert.Equal(t, true, success)
178+
// luna-lovegood-1 is our client pod in ravenclaw namespace
179+
success = kubernetes.PokeServer(t, "network-policy-conformance-ravenclaw", "luna-lovegood-1", "tcp",
180+
clientPod.Status.PodIP, int32(8080), s.TimeoutConfig.RequestTimeout, true)
181+
assert.Equal(t, true, success)
182+
})
183+
184+
t.Run("Should support a 'pass-ingress' policy for TCP protocol at the specified port", func(t *testing.T) {
185+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
186+
defer cancel()
187+
// This test uses `ingress-tcp` ANP
188+
// harry-potter-0 is our server pod in gryffindor namespace
189+
clientPod := &v1.Pod{}
190+
err := s.Client.Get(ctx, client.ObjectKey{
191+
Namespace: "network-policy-conformance-gryffindor",
192+
Name: "harry-potter-0",
193+
}, clientPod)
194+
framework.ExpectNoError(err, "unable to fetch the server pod")
195+
anp := &v1alpha1.AdminNetworkPolicy{}
196+
err = s.Client.Get(ctx, client.ObjectKey{
197+
Name: "ingress-tcp",
198+
}, anp)
199+
framework.ExpectNoError(err, "unable to fetch the admin network policy")
200+
// swap rules at index3 and index4
201+
denyRule := anp.DeepCopy().Spec.Ingress[3]
202+
anp.Spec.Ingress[3] = anp.DeepCopy().Spec.Ingress[4]
203+
anp.Spec.Ingress[4] = denyRule
204+
err = s.Client.Update(ctx, anp)
205+
framework.ExpectNoError(err, "unable to update the admin network policy")
206+
// draco-malfoy-0 is our client pod in slytherin namespace
207+
// ensure ingress from slytherin is PASSED to gryffindor at port 9003; ingressRule at index3
208+
success := kubernetes.PokeServer(t, "network-policy-conformance-slytherin", "draco-malfoy-0", "tcp",
209+
clientPod.Status.PodIP, int32(80), s.TimeoutConfig.RequestTimeout, true)
210+
assert.Equal(t, true, success)
211+
// draco-malfoy-1 is our client pod in slytherin namespace
212+
// ensure ingress from slytherin is ALLOWED to gryffindor for rest of the traffic; matches no rules hence allowed
213+
success = kubernetes.PokeServer(t, "network-policy-conformance-slytherin", "draco-malfoy-1", "tcp",
214+
clientPod.Status.PodIP, int32(8080), s.TimeoutConfig.RequestTimeout, true)
215+
assert.Equal(t, true, success)
216+
})
217+
},
218+
}

‎conformance/tests/admin-network-policy-core-ingress-tcp-rules_base.yaml

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
apiVersion: policy.networking.k8s.io/v1alpha1
2+
kind: AdminNetworkPolicy
3+
metadata:
4+
name: ingress-tcp
5+
spec:
6+
priority: 3
7+
subject:
8+
namespaces:
9+
matchLabels:
10+
kubernetes.io/metadata.name: network-policy-conformance-gryffindor
11+
ingress:
12+
- name: "allow-from-ravenclaw-everything"
13+
action: "Allow"
14+
from:
15+
- namespaces:
16+
namespaceSelector:
17+
matchLabels:
18+
kubernetes.io/metadata.name: network-policy-conformance-ravenclaw
19+
- name: "deny-from-ravenclaw-everything"
20+
action: "Deny"
21+
from:
22+
- namespaces:
23+
namespaceSelector:
24+
matchLabels:
25+
kubernetes.io/metadata.name: network-policy-conformance-ravenclaw
26+
- name: "pass-from-ravenclaw-everything"
27+
action: "Pass"
28+
from:
29+
- namespaces:
30+
namespaceSelector:
31+
matchLabels:
32+
kubernetes.io/metadata.name: network-policy-conformance-ravenclaw
33+
- name: "deny-from-slytherin-at-port-80"
34+
action: "Deny"
35+
from:
36+
- namespaces:
37+
namespaceSelector:
38+
matchLabels:
39+
kubernetes.io/metadata.name: network-policy-conformance-slytherin
40+
ports:
41+
- portNumber:
42+
protocol: TCP
43+
port: 80
44+
- name: "pass-from-slytherin-at-port-80"
45+
action: "Pass"
46+
from:
47+
- namespaces:
48+
namespaceSelector:
49+
matchLabels:
50+
kubernetes.io/metadata.name: network-policy-conformance-slytherin
51+
ports:
52+
- portNumber:
53+
protocol: TCP
54+
port: 80
55+
- name: "allow-from-hufflepuff-at-port-80"
56+
action: "Allow"
57+
from:
58+
- namespaces:
59+
namespaceSelector:
60+
matchLabels:
61+
kubernetes.io/metadata.name: network-policy-conformance-hufflepuff
62+
ports:
63+
- portNumber:
64+
protocol: TCP
65+
port: 80
66+
- name: "deny-from-hufflepuff-everything-else"
67+
action: "Deny"
68+
from:
69+
- namespaces:
70+
namespaceSelector:
71+
matchLabels:
72+
kubernetes.io/metadata.name: network-policy-conformance-hufflepuff

‎conformance/utils/kubernetes/helper.go

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,18 +2,73 @@ package kubernetes
22

33
import (
44
"context"
5+
"fmt"
6+
"net"
57
"strings"
68
"testing"
79
"time"
810

911
"github.com/stretchr/testify/require"
1012
v1 "k8s.io/api/core/v1"
1113
"k8s.io/apimachinery/pkg/util/wait"
14+
"k8s.io/kubernetes/test/e2e/framework"
15+
e2ekubectl "k8s.io/kubernetes/test/e2e/framework/kubectl"
1216
"sigs.k8s.io/controller-runtime/pkg/client"
1317

1418
"sigs.k8s.io/network-policy-api/conformance/utils/config"
1519
)
1620

21+
// PokeServer is a utility function that checks if the connection from the provided clientPod in clientNamespace towards the targetHost:targetPort
22+
// using the provided protocol can be established or not and returns the result based on if the expectation is shouldConnect or !shouldConnect
23+
func PokeServer(t *testing.T, clientNamespace, clientPod, protocol, targetHost string, targetPort int32, timeout time.Duration, shouldConnect bool) bool {
24+
t.Helper()
25+
cmd := []string{"exec", clientPod, "--"} // command is to be run inside a pod
26+
timeoutArg := fmt.Sprintf("--timeout=%v", timeout)
27+
protocolArg := fmt.Sprintf("--protocol=%s", protocol)
28+
ipPortArg := net.JoinHostPort(targetHost, fmt.Sprintf("%d", targetPort))
29+
30+
// we leverage the dial connect from agnhost, that is already supporting multiple protocols
31+
connectCommand := strings.Split(fmt.Sprintf("/agnhost connect %s %s %s",
32+
timeoutArg,
33+
protocolArg,
34+
ipPortArg), " ")
35+
36+
cmd = append(cmd, connectCommand...)
37+
var res string
38+
var err error
39+
res, err = e2ekubectl.RunKubectl(clientNamespace, cmd...)
40+
// TODO(tssurya): Improve the error matching to be more specific (https://pkg.go.dev/k8s.io/kubernetes/test/images/agnhost#readme-connect)
41+
// A connection error looks like this and we need to improve the parsing to be more accurate:
42+
// Command stdout:
43+
// stderr:
44+
// TIMEOUT
45+
// command terminated with exit code 1
46+
// error:
47+
// exit status 1
48+
// TODO(tssurya): See if we need to add a wait&retry mechanism to test connectivity
49+
// See https://github.com/kubernetes-sigs/network-policy-api/issues/108 for details.
50+
if shouldConnect && (err != nil || len(res) > 0) {
51+
framework.Logf("FAILED Command was %s", connectCommand)
52+
framework.Logf("FAILED Response was %v, expected connection to succeed from %s to %s, "+
53+
"but instead it miserably failed: %v", res, clientPod, targetHost, err.Error())
54+
return false
55+
} else if !shouldConnect {
56+
if err == nil && len(res) == 0 {
57+
framework.Logf("FAILED Command was %s", connectCommand)
58+
framework.Logf("FAILED Response was %v, expected connection to fail from %s to %s, "+
59+
"but instead it successfully connected", res, clientPod, targetHost)
60+
return false
61+
} else if strings.Contains(err.Error(), "TIMEOUT") {
62+
framework.Logf("error contained 'TIMEOUT', as expected: %s", err.Error())
63+
return true
64+
} else {
65+
framework.Logf("error didn't contain 'TIMEOUT', as expected: %s", err.Error())
66+
return false
67+
}
68+
}
69+
return true
70+
}
71+
1772
// NamespacesMustBeReady waits until all Pods are marked Ready. This will
1873
// cause the test to halt if the specified timeout is exceeded.
1974
func NamespacesMustBeReady(t *testing.T, c client.Client, timeoutConfig config.TimeoutConfig, namespaces []string) {

0 commit comments

Comments
 (0)