@@ -103,4 +103,92 @@ var _ = Describe("Network Segmentation: Default network multus annotation", func
103103 mac : "02:A1:B2:C3:D4:E5" ,
104104 }),
105105 )
106+
107+ Context ("ValidatingAdmissionPolicy protection" , func () {
108+ It ("should prevent adding, modifying and removing the default-network annotation on existing pods" , func () {
109+ if ! isPreConfiguredUdnAddressesEnabled () {
110+ Skip ("ENABLE_PRE_CONF_UDN_ADDR not configured" )
111+ }
112+
113+ namespace , err := f .CreateNamespace (context .TODO (), f .BaseName , map [string ]string {
114+ "e2e-framework" : f .BaseName ,
115+ RequiredUDNNamespaceLabel : "" ,
116+ })
117+ Expect (err ).NotTo (HaveOccurred (), "Should create namespace for test" )
118+ f .Namespace = namespace
119+
120+ udnClient , err := udnclientset .NewForConfig (f .ClientConfig ())
121+ Expect (err ).NotTo (HaveOccurred (), "Should create UDN client" )
122+
123+ // Create a UserDefinedNetwork for the test
124+ udn := & udnv1.UserDefinedNetwork {
125+ ObjectMeta : metav1.ObjectMeta {
126+ Name : "test-network" ,
127+ Namespace : f .Namespace .Name ,
128+ },
129+ Spec : udnv1.UserDefinedNetworkSpec {
130+ Topology : udnv1 .NetworkTopologyLayer2 ,
131+ Layer2 : & udnv1.Layer2Config {
132+ Role : udnv1 .NetworkRolePrimary ,
133+ Subnets : filterDualStackCIDRs (f .ClientSet , []udnv1.CIDR {
134+ "103.0.0.0/16" ,
135+ "2014:100:200::0/60" ,
136+ }),
137+ },
138+ },
139+ }
140+
141+ By ("Creating a UserDefinedNetwork" )
142+ udn , err = udnClient .K8sV1 ().UserDefinedNetworks (f .Namespace .Name ).Create (context .TODO (), udn , metav1.CreateOptions {})
143+ Expect (err ).NotTo (HaveOccurred (), "Should create UserDefinedNetwork" )
144+ Eventually (userDefinedNetworkReadyFunc (f .DynamicClient , udn .Namespace , udn .Name ), 5 * time .Second , time .Second ).Should (Succeed ())
145+
146+ By ("Creating a pod without the default-network annotation" )
147+ podWithoutAnnotation := e2epod .NewAgnhostPod (f .Namespace .Name , "pod-without-annotation" , nil , nil , nil )
148+ podWithoutAnnotation .Spec .Containers [0 ].Command = []string {"sleep" , "infinity" }
149+ podWithoutAnnotation = e2epod .NewPodClient (f ).CreateSync (context .TODO (), podWithoutAnnotation )
150+
151+ By ("Creating a pod with the default-network annotation" )
152+
153+ nse := []nadapi.NetworkSelectionElement {{
154+ Name : "default" ,
155+ Namespace : "ovn-kubernetes" ,
156+ IPRequest : []string {"103.0.0.3/16" , "2014:100:200::3/60" },
157+ MacRequest : "02:A1:B2:C3:D4:E5" ,
158+ }}
159+ marshalledNSE , err := json .Marshal (nse )
160+ Expect (err ).NotTo (HaveOccurred (), "Should marshal network selection element" )
161+
162+ podWithAnnotation := e2epod .NewAgnhostPod (f .Namespace .Name , "pod-with-annotation" , nil , nil , nil )
163+ podWithAnnotation .Annotations = map [string ]string {
164+ "v1.multus-cni.io/default-network" : string (marshalledNSE ),
165+ }
166+ podWithAnnotation .Spec .Containers [0 ].Command = []string {"sleep" , "infinity" }
167+ podWithAnnotation = e2epod .NewPodClient (f ).CreateSync (context .TODO (), podWithAnnotation )
168+
169+ By ("Attempting to add the default-network annotation to the pod without annotation" )
170+ podWithoutAnnotation .Annotations = map [string ]string {
171+ "v1.multus-cni.io/default-network" : string (marshalledNSE ),
172+ }
173+
174+ _ , err = f .ClientSet .CoreV1 ().Pods (f .Namespace .Name ).Update (context .TODO (), podWithoutAnnotation , metav1.UpdateOptions {})
175+ Expect (err ).To (HaveOccurred (), "Should fail to add default-network annotation to existing pod" )
176+ Expect (err ).To (MatchError (ContainSubstring ("The 'v1.multus-cni.io/default-network' annotation cannot be changed after the pod was created" )))
177+
178+ By ("Attempting to modify the default-network annotation from the pod with annotation" )
179+ updatedPodWithAnnotation := podWithAnnotation .DeepCopy ()
180+ updatedPodWithAnnotation .Annotations ["v1.multus-cni.io/default-network" ] = `[{}]`
181+
182+ _ , err = f .ClientSet .CoreV1 ().Pods (f .Namespace .Name ).Update (context .TODO (), updatedPodWithAnnotation , metav1.UpdateOptions {})
183+ Expect (err ).To (HaveOccurred (), "Should fail to modify default-network annotation from existing pod" )
184+ Expect (err ).To (MatchError (ContainSubstring ("The 'v1.multus-cni.io/default-network' annotation cannot be changed after the pod was created" )))
185+
186+ By ("Attempting to remove the default-network annotation from the pod with annotation" )
187+ delete (podWithAnnotation .Annotations , "v1.multus-cni.io/default-network" )
188+
189+ _ , err = f .ClientSet .CoreV1 ().Pods (f .Namespace .Name ).Update (context .TODO (), podWithAnnotation , metav1.UpdateOptions {})
190+ Expect (err ).To (HaveOccurred (), "Should fail to remove default-network annotation from existing pod" )
191+ Expect (err ).To (MatchError (ContainSubstring ("The 'v1.multus-cni.io/default-network' annotation cannot be changed after the pod was created" )))
192+ })
193+ })
106194})
0 commit comments