@@ -385,52 +385,50 @@ var _ = Describe("Network Segmentation", feature.NetworkSegmentation, func() {
385385 }, 10 * time .Second , 1 * time .Second ).Should (BeTrue ())
386386 Expect (udnPod .Status .ContainerStatuses [0 ].RestartCount ).To (Equal (int32 (0 )))
387387
388- if ! isUDNHostIsolationDisabled () {
389- By ("checking default network hostNetwork pod and non-kubelet host process can't reach the UDN pod" )
390- hostNetPod , err := createPod (f , "host-net-pod" , nodeName ,
391- defaultNetNamespace , []string {}, nil , func (pod * v1.Pod ) {
392- pod .Spec .HostNetwork = true
393- })
394- Expect (err ).NotTo (HaveOccurred ())
388+ By ("checking default network hostNetwork pod and non-kubelet host process can't reach the UDN pod" )
389+ hostNetPod , err := createPod (f , "host-net-pod" , nodeName ,
390+ defaultNetNamespace , []string {}, nil , func (pod * v1.Pod ) {
391+ pod .Spec .HostNetwork = true
392+ })
393+ Expect (err ).NotTo (HaveOccurred ())
395394
396- // positive check for reachable default network pod
397- for _ , destIP := range []string {defaultIPv4 , defaultIPv6 } {
398- if destIP == "" {
399- continue
400- }
401- By ("checking the default network hostNetwork can reach default pod on IP " + destIP )
402- Eventually (func () bool {
403- return connectToServer (podConfiguration {namespace : hostNetPod .Namespace , name : hostNetPod .Name }, destIP , podClusterNetDefaultPort ) == nil
404- }).Should (BeTrue ())
405- By ("checking the non-kubelet host process can reach default pod on IP " + destIP )
406- Eventually (func () bool {
407- _ , err := infraprovider .Get ().ExecK8NodeCommand (nodeName , []string {
408- "curl" , "--connect-timeout" , "2" ,
409- net .JoinHostPort (destIP , fmt .Sprintf ("%d" , podClusterNetDefaultPort )),
395+ // positive check for reachable default network pod
396+ for _ , destIP := range []string {defaultIPv4 , defaultIPv6 } {
397+ if destIP == "" {
398+ continue
399+ }
400+ By ("checking the default network hostNetwork can reach default pod on IP " + destIP )
401+ Eventually (func () bool {
402+ return connectToServer (podConfiguration {namespace : hostNetPod .Namespace , name : hostNetPod .Name }, destIP , podClusterNetDefaultPort ) == nil
403+ }).Should (BeTrue ())
404+ By ("checking the non-kubelet host process can reach default pod on IP " + destIP )
405+ Eventually (func () bool {
406+ _ , err := infraprovider .Get ().ExecK8NodeCommand (nodeName , []string {
407+ "curl" , "--connect-timeout" , "2" ,
408+ net .JoinHostPort (destIP , fmt .Sprintf ("%d" , podClusterNetDefaultPort )),
410409 })
411- return err == nil
412- }).Should (BeTrue ())
410+ return err == nil
411+ }).Should (BeTrue ())
412+ }
413+ // negative check for UDN pod
414+ for _ , destIP := range []string {udnIPv4 , udnIPv6 } {
415+ if destIP == "" {
416+ continue
413417 }
414- // negative check for UDN pod
415- for _ , destIP := range []string {udnIPv4 , udnIPv6 } {
416- if destIP == "" {
417- continue
418- }
419418
420- By ("checking the default network hostNetwork pod can't reach UDN pod on IP " + destIP )
421- Consistently (func () bool {
422- return connectToServer (podConfiguration {namespace : hostNetPod .Namespace , name : hostNetPod .Name }, destIP , podClusterNetPort ) != nil
423- }, 5 * time .Second ).Should (BeTrue ())
419+ By ("checking the default network hostNetwork pod can't reach UDN pod on IP " + destIP )
420+ Consistently (func () bool {
421+ return connectToServer (podConfiguration {namespace : hostNetPod .Namespace , name : hostNetPod .Name }, destIP , podClusterNetPort ) != nil
422+ }, 5 * time .Second ).Should (BeTrue ())
424423
425- By ("checking the non-kubelet host process can't reach UDN pod on IP " + destIP )
426- Consistently (func () bool {
427- _ , err := infraprovider .Get ().ExecK8NodeCommand (nodeName , []string {
428- "curl" , "--connect-timeout" , "2" ,
429- net .JoinHostPort (destIP , fmt .Sprintf ("%d" , podClusterNetPort )),
424+ By ("checking the non-kubelet host process can't reach UDN pod on IP " + destIP )
425+ Consistently (func () bool {
426+ _ , err := infraprovider .Get ().ExecK8NodeCommand (nodeName , []string {
427+ "curl" , "--connect-timeout" , "2" ,
428+ net .JoinHostPort (destIP , fmt .Sprintf ("%d" , podClusterNetPort )),
430429 })
431- return err != nil
432- }, 5 * time .Second ).Should (BeTrue ())
433- }
430+ return err != nil
431+ }, 5 * time .Second ).Should (BeTrue ())
434432 }
435433
436434 By ("asserting UDN pod can reach the kapi service in the default network" )
@@ -1646,12 +1644,10 @@ spec:
16461644 return connectToServer (podConfiguration {namespace : defaultClientPod .Namespace , name : defaultClientPod .Name }, destIP , podClusterNetPort ) != nil
16471645 }, 5 * time .Second ).Should (BeTrue ())
16481646
1649- if ! isUDNHostIsolationDisabled () {
1650- By ("checking the default hostNetwork pod can't reach UDN pod on IP " + destIP )
1651- Consistently (func () bool {
1652- return connectToServer (podConfiguration {namespace : hostNetPod .Namespace , name : hostNetPod .Name }, destIP , podClusterNetPort ) != nil
1653- }, 5 * time .Second ).Should (BeTrue ())
1654- }
1647+ By ("checking the default hostNetwork pod can't reach UDN pod on IP " + destIP )
1648+ Consistently (func () bool {
1649+ return connectToServer (podConfiguration {namespace : hostNetPod .Namespace , name : hostNetPod .Name }, destIP , podClusterNetPort ) != nil
1650+ }, 5 * time .Second ).Should (BeTrue ())
16551651 }
16561652
16571653 By ("Open UDN pod port" )
@@ -1696,12 +1692,10 @@ spec:
16961692 return connectToServer (podConfiguration {namespace : defaultClientPod .Namespace , name : defaultClientPod .Name }, destIP , podClusterNetPort ) != nil
16971693 }, 5 * time .Second ).Should (BeTrue ())
16981694
1699- if ! isUDNHostIsolationDisabled () {
1700- By ("checking the default hostNetwork pod can't reach UDN pod on IP " + destIP )
1701- Eventually (func () bool {
1702- return connectToServer (podConfiguration {namespace : hostNetPod .Namespace , name : hostNetPod .Name }, destIP , podClusterNetPort ) != nil
1703- }, 5 * time .Second ).Should (BeTrue ())
1704- }
1695+ By ("checking the default hostNetwork pod can't reach UDN pod on IP " + destIP )
1696+ Eventually (func () bool {
1697+ return connectToServer (podConfiguration {namespace : hostNetPod .Namespace , name : hostNetPod .Name }, destIP , podClusterNetPort ) != nil
1698+ }, 5 * time .Second ).Should (BeTrue ())
17051699 }
17061700 By ("Verify syntax error is reported via event" )
17071701 events , err := cs .CoreV1 ().Events (udnPod .Namespace ).List (context .Background (), metav1.ListOptions {})
0 commit comments