Introduce host firewall connectivity tests #2306
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
giorio94
force-pushed
the
mio/host-firewall-tests
branch
from
67e43fd to
f40e89c
Compare
Let's make use of generics to uniform the logic in charge of parsing yaml files into the various types of policies, both to reduce code duplication and simplify the extension to other types (e.g., CCNPs). While being there, let's also export it, so that it can be leveraged by external hooks as well. Signed-off-by: Marco Iorio <[email protected]>
Let's make use of generics to uniform the logic in charge of creating or updating the different types of policies, to ensure consistent behavior, reduce code duplication and simplify the extension to other types (e.g., CCNPs). While being there, let's also export it, so that it can be leveraged by external hooks as well. Signed-off-by: Marco Iorio <[email protected]>
Let's make use of generics to uniform the registration of the policies necessary for a given test, to reduce code duplication and simplify the extension to other type (e.g., CCNPs). We do no longer check if the policy is nil, as tricky, but that was already pointless as accessed early, triggering a panic if nil. While being there, let's also export it, so that it can be leveraged by external hooks as well. Signed-off-by: Marco Iorio <[email protected]>
Extract the logic adapting the namepace configured inside CiliumNetworkPolicy rules, so that it can be reused for CCNPs as well. Signed-off-by: Marco Iorio <[email protected]>
So that it can be easily reused for CCNPs as well. Signed-off-by: Marco Iorio <[email protected]>
Create the infrastructure to allow defining tests which require the creation of CiliumClusterwideNetworkPolicies, such as in the host firewall case. Signed-off-by: Marco Iorio <[email protected]>
Currently, we configure both the timeout (-W) and the deadline (-w) for the ping command, with defaults respectively 2 and 10 seconds. Yet, it appears that the deadline always takes precedence if both are set, which leads the test to require by default 10 seconds when a network policy preventing connectivity is in place. Hence, let's configure only the timeout, so that we stop waiting after two seconds. This is consistent with the behavior for the curl operations when connectivity is blocked. Signed-off-by: Marco Iorio <[email protected]>
Introduce two new tests covering the host firewall functionality, i.e., asserting that both ingress and egress CiliumClusterwideNetworkPolicies specifying a NodeSelector correctly block the expected traffic. The tests are executed only when the unsafe tests are enabled, as potentially disruptive if executed against a live cluster. Signed-off-by: Marco Iorio <[email protected]>
giorio94
force-pushed
the
mio/host-firewall-tests
branch
from
f40e89c to
55f95de
Compare
nathanjsweet
approved these changes
Feb 23, 2024
maintainer-s-little-helper
bot
added
the
ready-to-merge
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Introduce two new tests covering the host firewall functionality, i.e., asserting that both ingress and egress CiliumClusterwideNetworkPolicies specifying a NodeSelector correctly block the expected traffic. The
tests are executed only when the unsafe tests are enabled, as potentially disruptive if executed against a live cluster.
The initial five commits are refactor and generalize the logic in charge of parsing, registering and creating/updating the policies used during the tests, to uniform it, reduce code duplication, and in preparation for the support for CCNPs. The sixth commit introduces the actual support for CCNPs in connectivity test. The last commit introduces the actual tests.
Please review commit by commit, and refer to the commit messages for additional details.