Skip to content

Commit b8440dd

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #105 from tssurya/add-conformance-integration-tests
Add conformance integration tests between ANP/NP/BANP
2 parents 377a148 + de7de99 commit b8440dd

File tree

2 files changed

+287
-0
lines changed

2 files changed

+287
-0
lines changed

‎conformance/tests/admin-network-policy-core-integration.go

Lines changed: 214 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,214 @@
1+
/*
2+
Copyright 2022 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package tests
18+
19+
import (
20+
"context"
21+
"testing"
22+
23+
"github.com/stretchr/testify/assert"
24+
v1 "k8s.io/api/core/v1"
25+
networkingv1 "k8s.io/api/networking/v1"
26+
"k8s.io/kubernetes/test/e2e/framework"
27+
"sigs.k8s.io/controller-runtime/pkg/client"
28+
29+
"sigs.k8s.io/network-policy-api/apis/v1alpha1"
30+
"sigs.k8s.io/network-policy-api/conformance/utils/kubernetes"
31+
"sigs.k8s.io/network-policy-api/conformance/utils/suite"
32+
)
33+
34+
func init() {
35+
ConformanceTests = append(ConformanceTests,
36+
AdminNetworkPolicyIntegration,
37+
)
38+
}
39+
40+
var AdminNetworkPolicyIntegration = suite.ConformanceTest{
41+
ShortName: "AdminNetworkPolicyIntegration",
42+
Description: "Tests integration support for gress traffic between ANP, NP and BANP using PASS action based on a server and client model",
43+
Features: []suite.SupportedFeature{
44+
suite.SupportAdminNetworkPolicy,
45+
},
46+
Manifests: []string{"tests/admin-network-policy-core-integration_base.yaml"},
47+
Test: func(t *testing.T, s *suite.ConformanceTestSuite) {
48+
49+
t.Run("Should Deny traffic from slytherin to gryffindor respecting ANP", func(t *testing.T) {
50+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
51+
defer cancel()
52+
// This test uses `pass-example` ANP
53+
// harry-potter-0 is our server pod in gryffindor namespace
54+
clientPod := &v1.Pod{}
55+
err := s.Client.Get(ctx, client.ObjectKey{
56+
Namespace: "network-policy-conformance-gryffindor",
57+
Name: "harry-potter-0",
58+
}, clientPod)
59+
framework.ExpectNoError(err, "unable to fetch the server pod")
60+
// draco-malfoy-0 is our client pod in slytherin namespace
61+
// ensure ingress is DENIED to gryffindor from slytherin
62+
// inressRule at index0 will take effect
63+
success := kubernetes.PokeServer(t, "network-policy-conformance-slytherin", "draco-malfoy-0", "tcp",
64+
clientPod.Status.PodIP, int32(80), s.TimeoutConfig.RequestTimeout, false)
65+
assert.Equal(t, true, success)
66+
// draco-malfoy-1 is our client pod in slytherin namespace
67+
success = kubernetes.PokeServer(t, "network-policy-conformance-slytherin", "draco-malfoy-1", "tcp",
68+
clientPod.Status.PodIP, int32(8080), s.TimeoutConfig.RequestTimeout, false)
69+
assert.Equal(t, true, success)
70+
})
71+
72+
t.Run("Should Deny traffic to slytherin from gryffindor respecting ANP", func(t *testing.T) {
73+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
74+
defer cancel()
75+
// This test uses `pass-example` ANP
76+
// draco-malfoy-0 is our server pod in slytherin namespace
77+
clientPod := &v1.Pod{}
78+
err := s.Client.Get(ctx, client.ObjectKey{
79+
Namespace: "network-policy-conformance-slytherin",
80+
Name: "draco-malfoy-0",
81+
}, clientPod)
82+
framework.ExpectNoError(err, "unable to fetch the server pod")
83+
// harry-potter-0 is our client pod in gryffindor namespace
84+
// ensure ingress is DENIED to gryffindor from slytherin
85+
// egressRule at index0 will take effect
86+
success := kubernetes.PokeServer(t, "network-policy-conformance-gryffindor", "harry-potter-0", "tcp",
87+
clientPod.Status.PodIP, int32(80), s.TimeoutConfig.RequestTimeout, false)
88+
assert.Equal(t, true, success)
89+
// harry-potter-1 is our client pod in gryffindor namespace
90+
success = kubernetes.PokeServer(t, "network-policy-conformance-gryffindor", "harry-potter-1", "tcp",
91+
clientPod.Status.PodIP, int32(8080), s.TimeoutConfig.RequestTimeout, false)
92+
assert.Equal(t, true, success)
93+
})
94+
95+
t.Run("Should support a 'pass-ingress' policy for ANP and respect the match for network policy", func(t *testing.T) {
96+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
97+
defer cancel()
98+
// This test uses `pass example` ANP
99+
anp := &v1alpha1.AdminNetworkPolicy{}
100+
err := s.Client.Get(ctx, client.ObjectKey{
101+
Name: "pass-example",
102+
}, anp)
103+
framework.ExpectNoError(err, "unable to fetch the admin network policy")
104+
// change ingress rule from "deny" to "pass"
105+
anp.Spec.Ingress[0].Action = v1alpha1.AdminNetworkPolicyRuleActionPass
106+
err = s.Client.Update(ctx, anp)
107+
framework.ExpectNoError(err, "unable to update the admin network policy")
108+
// harry-potter-0 is our server pod in gryffindor namespace
109+
clientPod := &v1.Pod{}
110+
err = s.Client.Get(ctx, client.ObjectKey{
111+
Namespace: "network-policy-conformance-gryffindor",
112+
Name: "harry-potter-0",
113+
}, clientPod)
114+
framework.ExpectNoError(err, "unable to fetch the server pod")
115+
// draco-malfoy-0 is our client pod in slytherin namespace
116+
// ensure ingress is PASSED to gryffindor from slytherin - the network policy ALLOW should take effect
117+
// inressRule at index0 will take effect
118+
success := kubernetes.PokeServer(t, "network-policy-conformance-slytherin", "draco-malfoy-0", "tcp",
119+
clientPod.Status.PodIP, int32(80), s.TimeoutConfig.RequestTimeout, true)
120+
assert.Equal(t, true, success)
121+
// draco-malfoy-1 is our client pod in slytherin namespace
122+
success = kubernetes.PokeServer(t, "network-policy-conformance-slytherin", "draco-malfoy-1", "tcp",
123+
clientPod.Status.PodIP, int32(8080), s.TimeoutConfig.RequestTimeout, true)
124+
assert.Equal(t, true, success)
125+
})
126+
127+
t.Run("Should support a 'pass-egress' policy for ANP and respect the match for network policy", func(t *testing.T) {
128+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
129+
defer cancel()
130+
// This test uses `pass example` ANP
131+
anp := &v1alpha1.AdminNetworkPolicy{}
132+
err := s.Client.Get(ctx, client.ObjectKey{
133+
Name: "pass-example",
134+
}, anp)
135+
framework.ExpectNoError(err, "unable to fetch the admin network policy")
136+
// change egress rule from "deny" to "pass"
137+
anp.Spec.Egress[0].Action = v1alpha1.AdminNetworkPolicyRuleActionPass
138+
err = s.Client.Update(ctx, anp)
139+
framework.ExpectNoError(err, "unable to update the admin network policy")
140+
// draco-malfoy-0 is our server pod in slytherin namespace
141+
clientPod := &v1.Pod{}
142+
err = s.Client.Get(ctx, client.ObjectKey{
143+
Namespace: "network-policy-conformance-slytherin",
144+
Name: "draco-malfoy-0",
145+
}, clientPod)
146+
framework.ExpectNoError(err, "unable to fetch the server pod")
147+
// harry-potter-0 is our client pod in gryffindor namespace
148+
// ensure ingress is PASSED to gryffindor from slytherin - the underlying network policy ALLOW should take effect
149+
// egressRule at index0 will take effect
150+
success := kubernetes.PokeServer(t, "network-policy-conformance-gryffindor", "harry-potter-0", "tcp",
151+
clientPod.Status.PodIP, int32(80), s.TimeoutConfig.RequestTimeout, true)
152+
assert.Equal(t, true, success)
153+
// harry-potter-1 is our client pod in gryffindor namespace
154+
success = kubernetes.PokeServer(t, "network-policy-conformance-gryffindor", "harry-potter-1", "tcp",
155+
clientPod.Status.PodIP, int32(8080), s.TimeoutConfig.RequestTimeout, true)
156+
assert.Equal(t, true, success)
157+
})
158+
159+
t.Run("Should support a 'pass-ingress' policy for ANP and respect the match for baseline admin network policy", func(t *testing.T) {
160+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
161+
defer cancel()
162+
// This test uses `default` BANP
163+
np := &networkingv1.NetworkPolicy{}
164+
err := s.Client.Get(ctx, client.ObjectKey{
165+
Namespace: "network-policy-conformance-gryffindor",
166+
Name: "allow-gress-from-to-slytherin-to-gryffindor",
167+
}, np)
168+
framework.ExpectNoError(err, "unable to fetch the network policy")
169+
// delete network policy so that BANP takes effect
170+
err = s.Client.Delete(ctx, np)
171+
framework.ExpectNoError(err, "unable to delete the network policy")
172+
// harry-potter-0 is our server pod in gryffindor namespace
173+
clientPod := &v1.Pod{}
174+
err = s.Client.Get(ctx, client.ObjectKey{
175+
Namespace: "network-policy-conformance-gryffindor",
176+
Name: "harry-potter-0",
177+
}, clientPod)
178+
framework.ExpectNoError(err, "unable to fetch the server pod")
179+
// draco-malfoy-0 is our client pod in slytherin namespace
180+
// ensure ingress is PASSED to gryffindor from slytherin - the baseline admin network policy DENY should take effect
181+
// inressRule at index0 will take effect
182+
success := kubernetes.PokeServer(t, "network-policy-conformance-slytherin", "draco-malfoy-0", "tcp",
183+
clientPod.Status.PodIP, int32(80), s.TimeoutConfig.RequestTimeout, false)
184+
assert.Equal(t, true, success)
185+
// draco-malfoy-1 is our client pod in slytherin namespace
186+
success = kubernetes.PokeServer(t, "network-policy-conformance-slytherin", "draco-malfoy-1", "tcp",
187+
clientPod.Status.PodIP, int32(8080), s.TimeoutConfig.RequestTimeout, false)
188+
assert.Equal(t, true, success)
189+
})
190+
191+
t.Run("Should support a 'pass-egress' policy for ANP and respect the match for baseline admin network policy", func(t *testing.T) {
192+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
193+
defer cancel()
194+
// This test uses `default` BANP
195+
// draco-malfoy-0 is our server pod in slytherin namespace
196+
clientPod := &v1.Pod{}
197+
err := s.Client.Get(ctx, client.ObjectKey{
198+
Namespace: "network-policy-conformance-slytherin",
199+
Name: "draco-malfoy-0",
200+
}, clientPod)
201+
framework.ExpectNoError(err, "unable to fetch the server pod")
202+
// harry-potter-0 is our client pod in gryffindor namespace
203+
// ensure ingress is PASSED to gryffindor from slytherin - the underlying baseline admin network policy DENY should take effect
204+
// egressRule at index0 will take effect
205+
success := kubernetes.PokeServer(t, "network-policy-conformance-gryffindor", "harry-potter-0", "tcp",
206+
clientPod.Status.PodIP, int32(80), s.TimeoutConfig.RequestTimeout, false)
207+
assert.Equal(t, true, success)
208+
// harry-potter-1 is our client pod in gryffindor namespace
209+
success = kubernetes.PokeServer(t, "network-policy-conformance-gryffindor", "harry-potter-1", "tcp",
210+
clientPod.Status.PodIP, int32(8080), s.TimeoutConfig.RequestTimeout, false)
211+
assert.Equal(t, true, success)
212+
})
213+
},
214+
}

‎conformance/tests/admin-network-policy-core-integration_base.yaml

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
apiVersion: policy.networking.k8s.io/v1alpha1
2+
kind: AdminNetworkPolicy
3+
metadata:
4+
name: pass-example
5+
spec:
6+
priority: 10
7+
subject:
8+
namespaces:
9+
matchLabels:
10+
conformance-house: gryffindor
11+
ingress:
12+
- name: "deny-all-ingress-from-slytherin" # test will update to pass
13+
action: "Deny" # test will update to pass
14+
from:
15+
- namespaces:
16+
namespaceSelector:
17+
matchLabels:
18+
conformance-house: slytherin
19+
egress:
20+
- name: "deny-all-egress-from-slytherin" # test will update to pass
21+
action: "Deny" # test will update to pass
22+
to:
23+
- namespaces:
24+
namespaceSelector:
25+
matchLabels:
26+
conformance-house: slytherin
27+
---
28+
apiVersion: networking.k8s.io/v1
29+
kind: NetworkPolicy
30+
metadata:
31+
name: allow-gress-from-to-slytherin-to-gryffindor
32+
namespace: network-policy-conformance-gryffindor
33+
spec:
34+
podSelector:
35+
policyTypes:
36+
- Ingress
37+
- Egress
38+
ingress:
39+
- from:
40+
- namespaceSelector:
41+
matchLabels:
42+
conformance-house: slytherin
43+
egress:
44+
- to:
45+
- namespaceSelector:
46+
matchLabels:
47+
conformance-house: slytherin
48+
---
49+
apiVersion: policy.networking.k8s.io/v1alpha1
50+
kind: BaselineAdminNetworkPolicy
51+
metadata:
52+
name: default
53+
spec:
54+
subject:
55+
namespaces:
56+
matchLabels:
57+
conformance-house: gryffindor
58+
ingress:
59+
- name: "deny-all-ingress-from-slytherin"
60+
action: "Deny"
61+
from:
62+
- namespaces:
63+
namespaceSelector:
64+
matchLabels:
65+
conformance-house: slytherin
66+
egress:
67+
- name: "deny-all-egress-from-slytherin"
68+
action: "Deny"
69+
to:
70+
- namespaces:
71+
namespaceSelector:
72+
matchLabels:
73+
conformance-house: slytherin

0 commit comments

Comments
 (0)