Skip to content

Commit c43707a

Browse files
tssuryatssurya
committed
Add conformance test for .spec.Priority
This commit adds tests that check if the .spec.Priority field is respected and works as expected. Note that we use `Pods` field to express Subject and Peers so that we test that aspect unlike the rest of the tests so far which have always used `Namespaces` aspect. Signed-off-by: Surya Seetharaman <[email protected]>
1 parent fdf177d commit c43707a

File tree

4 files changed

+263
-3
lines changed

4 files changed

+263
-3
lines changed

‎conformance/base/admin_network_policy/core-priority-field.yaml

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
apiVersion: policy.networking.k8s.io/v1alpha1
2+
kind: AdminNetworkPolicy
3+
metadata:
4+
name: priority-50-example
5+
spec:
6+
priority: 50
7+
subject:
8+
pods:
9+
namespaceSelector:
10+
matchLabels:
11+
conformance-house: gryffindor
12+
podSelector:
13+
matchLabels:
14+
conformance-house: gryffindor
15+
ingress:
16+
- name: "deny-all-ingress-from-slytherin"
17+
action: "Deny"
18+
from:
19+
- pods:
20+
namespaces:
21+
namespaceSelector:
22+
matchLabels:
23+
conformance-house: slytherin
24+
podSelector:
25+
matchLabels:
26+
conformance-house: slytherin
27+
egress:
28+
- name: "deny-all-egress-to-slytherin"
29+
action: "Deny"
30+
to:
31+
- pods:
32+
namespaces:
33+
namespaceSelector:
34+
matchLabels:
35+
conformance-house: slytherin
36+
podSelector:
37+
matchLabels:
38+
conformance-house: slytherin
39+
---
40+
apiVersion: policy.networking.k8s.io/v1alpha1
41+
kind: AdminNetworkPolicy
42+
metadata:
43+
name: old-priority-60-new-priority-40-example
44+
spec:
45+
priority: 60 # will be updated to 40 in the tests thus taking higher precedence over the deny at priority 50
46+
subject:
47+
pods:
48+
namespaceSelector:
49+
matchLabels:
50+
conformance-house: gryffindor
51+
podSelector:
52+
matchLabels:
53+
conformance-house: gryffindor
54+
ingress:
55+
- name: "pass-all-ingress-from-slytherin"
56+
action: "Pass"
57+
from:
58+
- pods:
59+
namespaces:
60+
namespaceSelector:
61+
matchLabels:
62+
conformance-house: slytherin
63+
podSelector:
64+
matchLabels:
65+
conformance-house: slytherin
66+
egress:
67+
- name: "pass-all-egress-to-slytherin"
68+
action: "Pass"
69+
to:
70+
- pods:
71+
namespaces:
72+
namespaceSelector:
73+
matchLabels:
74+
conformance-house: slytherin
75+
podSelector:
76+
matchLabels:
77+
conformance-house: slytherin
78+
---
79+
apiVersion: policy.networking.k8s.io/v1alpha1
80+
kind: BaselineAdminNetworkPolicy
81+
metadata:
82+
name: default
83+
spec:
84+
subject:
85+
pods:
86+
namespaceSelector:
87+
matchLabels:
88+
conformance-house: gryffindor
89+
podSelector:
90+
matchLabels:
91+
conformance-house: gryffindor
92+
ingress:
93+
- name: "allow-all-ingress-from-slytherin"
94+
action: "Allow"
95+
from:
96+
- pods:
97+
namespaces:
98+
namespaceSelector:
99+
matchLabels:
100+
conformance-house: slytherin
101+
podSelector:
102+
matchLabels:
103+
conformance-house: slytherin
104+
egress:
105+
- name: "allow-all-egress-to-slytherin"
106+
action: "Allow"
107+
to:
108+
- pods:
109+
namespaces:
110+
namespaceSelector:
111+
matchLabels:
112+
conformance-house: slytherin
113+
podSelector:
114+
matchLabels:
115+
conformance-house: slytherin

‎conformance/tests/admin-network-policy-core-integration_base.yaml renamed to ‎conformance/base/api_integration/core-anp-np-banp.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ spec:
1717
matchLabels:
1818
conformance-house: slytherin
1919
egress:
20-
- name: "deny-all-egress-from-slytherin" # test will update to pass
20+
- name: "deny-all-egress-to-slytherin" # test will update to pass
2121
action: "Deny" # test will update to pass
2222
to:
2323
- namespaces:
@@ -64,7 +64,7 @@ spec:
6464
matchLabels:
6565
conformance-house: slytherin
6666
egress:
67-
- name: "deny-all-egress-from-slytherin"
67+
- name: "deny-all-egress-to-slytherin"
6868
action: "Deny"
6969
to:
7070
- namespaces:

‎conformance/tests/admin-network-policy-core-integration.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,9 @@ var AdminNetworkPolicyIntegration = suite.ConformanceTest{
4242
Description: "Tests integration support for gress traffic between ANP, NP and BANP using PASS action based on a server and client model",
4343
Features: []suite.SupportedFeature{
4444
suite.SupportAdminNetworkPolicy,
45+
suite.SupportBaselineAdminNetworkPolicy,
4546
},
46-
Manifests: []string{"tests/admin-network-policy-core-integration_base.yaml"},
47+
Manifests: []string{"base/api_integration/core-anp-np-banp.yaml"},
4748
Test: func(t *testing.T, s *suite.ConformanceTestSuite) {
4849

4950
t.Run("Should Deny traffic from slytherin to gryffindor respecting ANP", func(t *testing.T) {

‎conformance/tests/admin-network-policy-core-priority.go

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
/*
2+
Copyright 2022 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package tests
18+
19+
import (
20+
"context"
21+
"testing"
22+
23+
"github.com/stretchr/testify/assert"
24+
v1 "k8s.io/api/core/v1"
25+
"k8s.io/kubernetes/test/e2e/framework"
26+
"sigs.k8s.io/controller-runtime/pkg/client"
27+
28+
"sigs.k8s.io/network-policy-api/apis/v1alpha1"
29+
"sigs.k8s.io/network-policy-api/conformance/utils/kubernetes"
30+
"sigs.k8s.io/network-policy-api/conformance/utils/suite"
31+
)
32+
33+
func init() {
34+
ConformanceTests = append(ConformanceTests,
35+
AdminNetworkPolicyPriorityField,
36+
)
37+
}
38+
39+
var AdminNetworkPolicyPriorityField = suite.ConformanceTest{
40+
ShortName: "AdminNetworkPolicyPriorityField",
41+
Description: "Tests support for admin network policy API's .spec.priority field based on a server and client model",
42+
Features: []suite.SupportedFeature{
43+
suite.SupportAdminNetworkPolicy,
44+
suite.SupportBaselineAdminNetworkPolicy, // priority change of ANP should play well with existing BANP's
45+
},
46+
Manifests: []string{"base/admin_network_policy/core-priority-field.yaml"},
47+
Test: func(t *testing.T, s *suite.ConformanceTestSuite) {
48+
49+
t.Run("Should Deny traffic from slytherin to gryffindor respecting ANP", func(t *testing.T) {
50+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
51+
defer cancel()
52+
// This test uses `priority-50-example` ANP; takes precedence over old-priority-60-new-priority-40-example ANP
53+
// harry-potter-0 is our server pod in gryffindor namespace
54+
clientPod := &v1.Pod{}
55+
err := s.Client.Get(ctx, client.ObjectKey{
56+
Namespace: "network-policy-conformance-gryffindor",
57+
Name: "harry-potter-0",
58+
}, clientPod)
59+
framework.ExpectNoError(err, "unable to fetch the server pod")
60+
// draco-malfoy-0 is our client pod in slytherin namespace
61+
// ensure ingress is DENIED to gryffindor from slytherin
62+
// inressRule at index0 will take effect
63+
success := kubernetes.PokeServer(t, "network-policy-conformance-slytherin", "draco-malfoy-0", "tcp",
64+
clientPod.Status.PodIP, int32(80), s.TimeoutConfig.RequestTimeout, false)
65+
assert.Equal(t, true, success)
66+
// draco-malfoy-1 is our client pod in slytherin namespace
67+
success = kubernetes.PokeServer(t, "network-policy-conformance-slytherin", "draco-malfoy-1", "tcp",
68+
clientPod.Status.PodIP, int32(8080), s.TimeoutConfig.RequestTimeout, false)
69+
assert.Equal(t, true, success)
70+
})
71+
72+
t.Run("Should Deny traffic to slytherin from gryffindor respecting ANP", func(t *testing.T) {
73+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
74+
defer cancel()
75+
// This test uses `priority-50-example` ANP; takes precedence over old-priority-60-new-priority-40-example ANP
76+
// draco-malfoy-0 is our server pod in slytherin namespace
77+
clientPod := &v1.Pod{}
78+
err := s.Client.Get(ctx, client.ObjectKey{
79+
Namespace: "network-policy-conformance-slytherin",
80+
Name: "draco-malfoy-0",
81+
}, clientPod)
82+
framework.ExpectNoError(err, "unable to fetch the server pod")
83+
// harry-potter-0 is our client pod in gryffindor namespace
84+
// ensure ingress is DENIED to gryffindor from slytherin
85+
// egressRule at index0 will take effect
86+
success := kubernetes.PokeServer(t, "network-policy-conformance-gryffindor", "harry-potter-0", "tcp",
87+
clientPod.Status.PodIP, int32(80), s.TimeoutConfig.RequestTimeout, false)
88+
assert.Equal(t, true, success)
89+
// harry-potter-1 is our client pod in gryffindor namespace
90+
success = kubernetes.PokeServer(t, "network-policy-conformance-gryffindor", "harry-potter-1", "tcp",
91+
clientPod.Status.PodIP, int32(8080), s.TimeoutConfig.RequestTimeout, false)
92+
assert.Equal(t, true, success)
93+
})
94+
95+
t.Run("Should respect ANP priority field; thus passing both ingress and egress traffic over to BANP", func(t *testing.T) {
96+
ctx, cancel := context.WithTimeout(context.Background(), s.TimeoutConfig.GetTimeout)
97+
defer cancel()
98+
// This test uses `old-priority-60-new-priority-40-example` ANP
99+
anp := &v1alpha1.AdminNetworkPolicy{}
100+
err := s.Client.Get(ctx, client.ObjectKey{
101+
Name: "old-priority-60-new-priority-40-example",
102+
}, anp)
103+
framework.ExpectNoError(err, "unable to fetch the admin network policy")
104+
// change priority from 60 to 40
105+
anp.Spec.Priority = 40
106+
err = s.Client.Update(ctx, anp)
107+
framework.ExpectNoError(err, "unable to update the admin network policy")
108+
// harry-potter-0 is our server pod in gryffindor namespace
109+
clientPod := &v1.Pod{}
110+
err = s.Client.Get(ctx, client.ObjectKey{
111+
Namespace: "network-policy-conformance-gryffindor",
112+
Name: "harry-potter-0",
113+
}, clientPod)
114+
framework.ExpectNoError(err, "unable to fetch the server pod")
115+
// draco-malfoy-0 is our client pod in slytherin namespace
116+
// ensure ingress is PASSED to gryffindor from slytherin - the baseline admin network policy ALLOW should take effect
117+
// inressRule at index0 will take effect
118+
success := kubernetes.PokeServer(t, "network-policy-conformance-slytherin", "draco-malfoy-0", "tcp",
119+
clientPod.Status.PodIP, int32(80), s.TimeoutConfig.RequestTimeout, true)
120+
assert.Equal(t, true, success)
121+
// draco-malfoy-1 is our client pod in slytherin namespace
122+
success = kubernetes.PokeServer(t, "network-policy-conformance-slytherin", "draco-malfoy-1", "tcp",
123+
clientPod.Status.PodIP, int32(8080), s.TimeoutConfig.RequestTimeout, true)
124+
assert.Equal(t, true, success)
125+
126+
// draco-malfoy-0 is our server pod in slytherin namespace
127+
err = s.Client.Get(ctx, client.ObjectKey{
128+
Namespace: "network-policy-conformance-slytherin",
129+
Name: "draco-malfoy-0",
130+
}, clientPod)
131+
framework.ExpectNoError(err, "unable to fetch the server pod")
132+
// harry-potter-0 is our client pod in gryffindor namespace
133+
// ensure ingress is PASSED to gryffindor from slytherin - the baseline admin network policy ALLOW should take effect
134+
// egressRule at index0 will take effect
135+
success = kubernetes.PokeServer(t, "network-policy-conformance-gryffindor", "harry-potter-0", "tcp",
136+
clientPod.Status.PodIP, int32(80), s.TimeoutConfig.RequestTimeout, true)
137+
assert.Equal(t, true, success)
138+
// harry-potter-1 is our client pod in gryffindor namespace
139+
success = kubernetes.PokeServer(t, "network-policy-conformance-gryffindor", "harry-potter-1", "tcp",
140+
clientPod.Status.PodIP, int32(8080), s.TimeoutConfig.RequestTimeout, true)
141+
assert.Equal(t, true, success)
142+
})
143+
},
144+
}

0 commit comments

Comments
 (0)