Skip to content

Commit a52c92e

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #375 from anthonyrtong/main
Add namespace selector changes to conformance tests
2 parents 1c9af17 + 371fc24 commit a52c92e

3 files changed

Lines changed: 74 additions & 0 deletions

File tree

‎conformance/tests/admin-network-policy-standard-egress-inline-cidr-rules.go‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,34 @@ var CNPAdminTierEgressInlineCIDRPeers = suite.ConformanceTest{
7373
serverPod.Status.PodIP, int32(53), s.TimeoutConfig, true)
7474
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "sctp",
7575
serverPod.Status.PodIP, int32(9003), s.TimeoutConfig, true)
76+
77+
// update namespace label for slytherin to "conformance-house": "denied-namespace-label" to no longer match ingressRule at index0
78+
namespace := kubernetes.GetNamespace(t, s.Client, "network-policy-conformance-slytherin", s.TimeoutConfig.GetTimeout)
79+
mutateNamespace := namespace.DeepCopy()
80+
mutateNamespace.SetLabels(map[string]string{"conformance-house": "denied-namespace-label"})
81+
kubernetes.PatchNamespace(t, s.Client, namespace, mutateNamespace, s.TimeoutConfig.GetTimeout)
82+
83+
// ensure traffic is no longer allowed to slytherin since the namespace label no longer matches
84+
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "tcp",
85+
serverPod.Status.PodIP, int32(80), s.TimeoutConfig, false)
86+
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "udp",
87+
serverPod.Status.PodIP, int32(53), s.TimeoutConfig, false)
88+
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "sctp",
89+
serverPod.Status.PodIP, int32(9003), s.TimeoutConfig, false)
90+
91+
// update namespace label for slytherin back to "conformance-house": "slytherin" to match ingressRule at index0 again
92+
namespace = kubernetes.GetNamespace(t, s.Client, "network-policy-conformance-slytherin", s.TimeoutConfig.GetTimeout)
93+
mutateNamespace = namespace.DeepCopy()
94+
mutateNamespace.SetLabels(map[string]string{"conformance-house": "slytherin"})
95+
kubernetes.PatchNamespace(t, s.Client, namespace, mutateNamespace, s.TimeoutConfig.GetTimeout)
96+
97+
// ensure traffic is allowed to slytherin again since the namespace label matches again
98+
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "tcp",
99+
serverPod.Status.PodIP, int32(80), s.TimeoutConfig, true)
100+
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "udp",
101+
serverPod.Status.PodIP, int32(53), s.TimeoutConfig, true)
102+
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "sctp",
103+
serverPod.Status.PodIP, int32(9003), s.TimeoutConfig, true)
76104
})
77105
// To test allow CIDR rule, insert the following rule at index0
78106
//- name: "allow-egress-to-specific-podIPs"

‎conformance/tests/baseline-admin-network-policy-standard-egress-inline-cidr-rules.go‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,34 @@ var CNPBaselineTierEgressInlineCIDRPeers = suite.ConformanceTest{
7272
serverPod.Status.PodIP, int32(53), s.TimeoutConfig, true)
7373
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "sctp",
7474
serverPod.Status.PodIP, int32(9003), s.TimeoutConfig, true)
75+
76+
// update namespace label for slytherin to "conformance-house": "denied-namespace-label" to no longer match ingressRule at index0
77+
namespace := kubernetes.GetNamespace(t, s.Client, "network-policy-conformance-slytherin", s.TimeoutConfig.GetTimeout)
78+
mutateNamespace := namespace.DeepCopy()
79+
mutateNamespace.SetLabels(map[string]string{"conformance-house": "denied-namespace-label"})
80+
kubernetes.PatchNamespace(t, s.Client, namespace, mutateNamespace, s.TimeoutConfig.GetTimeout)
81+
82+
// ensure traffic is no longer allowed to slytherin since the namespace label no longer matches
83+
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "tcp",
84+
serverPod.Status.PodIP, int32(80), s.TimeoutConfig, false)
85+
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "udp",
86+
serverPod.Status.PodIP, int32(53), s.TimeoutConfig, false)
87+
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "sctp",
88+
serverPod.Status.PodIP, int32(9003), s.TimeoutConfig, false)
89+
90+
// update namespace label for slytherin back to "conformance-house": "slytherin" to match ingressRule at index0 again
91+
namespace = kubernetes.GetNamespace(t, s.Client, "network-policy-conformance-slytherin", s.TimeoutConfig.GetTimeout)
92+
mutateNamespace = namespace.DeepCopy()
93+
mutateNamespace.SetLabels(map[string]string{"conformance-house": "slytherin"})
94+
kubernetes.PatchNamespace(t, s.Client, namespace, mutateNamespace, s.TimeoutConfig.GetTimeout)
95+
96+
// ensure traffic is allowed to slytherin again since the namespace label matches again
97+
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "tcp",
98+
serverPod.Status.PodIP, int32(80), s.TimeoutConfig, true)
99+
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "udp",
100+
serverPod.Status.PodIP, int32(53), s.TimeoutConfig, true)
101+
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "sctp",
102+
serverPod.Status.PodIP, int32(9003), s.TimeoutConfig, true)
75103
})
76104
// To test allow CIDR rule, insert the following rule at index0
77105
//- name: "allow-egress-to-specific-podIPs"

‎conformance/utils/kubernetes/helper.go‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,24 @@ func GetPod(t *testing.T, c client.Client, namespace string, name string, timeou
156156
return pod
157157
}
158158

159+
func GetNamespace(t *testing.T, c client.Client, name string, timeout time.Duration) *v1.Namespace {
160+
namespace := &v1.Namespace{}
161+
ctx, cancel := context.WithTimeout(context.Background(), timeout)
162+
defer cancel()
163+
err := c.Get(ctx, client.ObjectKey{
164+
Name: name,
165+
}, namespace)
166+
require.NoErrorf(t, err, "unable to fetch namespace %s", name)
167+
return namespace
168+
}
169+
170+
func PatchNamespace(t *testing.T, c client.Client, from *v1.Namespace, to *v1.Namespace, timeout time.Duration) {
171+
ctx, cancel := context.WithTimeout(context.Background(), timeout)
172+
defer cancel()
173+
err := c.Patch(ctx, to, client.MergeFrom(from))
174+
require.NoErrorf(t, err, "unable to patch namespace %s", from.Name)
175+
}
176+
159177
func GetClusterNetworkPolicy(t *testing.T, c client.Client, name string, timeout time.Duration) *api.ClusterNetworkPolicy {
160178
cnp := &api.ClusterNetworkPolicy{}
161179
ctx, cancel := context.WithTimeout(context.Background(), timeout)

0 commit comments

Comments
 (0)