diff --git a/tests/integration/kubernetes/k8s-ip6tables.bats b/tests/integration/kubernetes/k8s-ip6tables.bats new file mode 100644 index 0000000000..4b9e10a4b8 --- /dev/null +++ b/tests/integration/kubernetes/k8s-ip6tables.bats @@ -0,0 +1,47 @@ +#!/usr/bin/env bats +# +# Copyright (c) 2025 Microsoft Corporation +# +# SPDX-License-Identifier: Apache-2.0 + +load "${BATS_TEST_DIRNAME}/lib.sh" +load "${BATS_TEST_DIRNAME}/../../common.bash" +load "${BATS_TEST_DIRNAME}/tests_common.sh" + +setup() { + [ "$(uname -m)" == "ppc64le" ] && skip "ip6tables tests for ppc64le" + + setup_common + pod_name="pod-istio" + get_pod_config_dir + + yaml_file="${pod_config_dir}/pod-istio.yaml" + policy_settings_dir="$(create_tmp_policy_settings_dir "${pod_config_dir}")" + add_requests_to_policy_settings "${policy_settings_dir}" "ReadStreamRequest" + auto_generate_policy "${policy_settings_dir}" "${yaml_file}" +} + +@test "Pod that performs ip6tables setup" { + kubectl apply -f "${yaml_file}" + + # Check pod completion + kubectl wait --for=jsonpath="status.containerStatuses[0].state.terminated.reason"=Completed --timeout=$timeout pod "$pod_name" + + # Verify that the job is completed + cmd="kubectl get pods -o jsonpath='{.items[*].status.phase}' | grep Succeeded" + waitForProcess "$wait_time" "$sleep_time" "$cmd" + + # Verify the output of the pod + success_criterion="COMMIT" + kubectl logs "$pod_name" | grep "$success_criterion" +} + +teardown() { + [ "$(uname -m)" == "ppc64le" ] && skip "ip6tables tests for ppc64le" + + # Debugging information + kubectl logs "$pod_name" + + delete_tmp_policy_settings_dir "${policy_settings_dir}" + teardown_common "${node}" "${node_start_time:-}" +} diff --git a/tests/integration/kubernetes/run_kubernetes_tests.sh b/tests/integration/kubernetes/run_kubernetes_tests.sh index 162bd4808a..aee600c408 100755 --- a/tests/integration/kubernetes/run_kubernetes_tests.sh +++ b/tests/integration/kubernetes/run_kubernetes_tests.sh @@ -61,6 +61,7 @@ else "k8s-file-volume.bats" \ "k8s-hostname.bats" \ "k8s-inotify.bats" \ + "k8s-ip6tables.bats" \ "k8s-job.bats" \ "k8s-kill-all-process-in-container.bats" \ "k8s-limit-range.bats" \ diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-istio.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-istio.yaml new file mode 100644 index 0000000000..7e3fb7ee06 --- /dev/null +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-istio.yaml @@ -0,0 +1,39 @@ +# +# Copyright (c) 2025 Microsoft Corporation +# +# SPDX-License-Identifier: Apache-2.0 +# +apiVersion: v1 +kind: Pod +metadata: + name: pod-istio +spec: + restartPolicy: Never + containers: + - name: test-container + image: quay.io/kata-containers/istio/proxyv2:1.26.3 + args: + - istio-iptables + - -p + - "15001" + - -z + - "15006" + - -u + - "1337" + - -m + - REDIRECT + - -i + - "*" + - -x + - "" + - -b + - "*" + - -d + - "15090,15021,15020" + - --log_output_level=default:info + securityContext: + capabilities: + add: ["NET_ADMIN", "NET_RAW"] + drop: ["ALL"] + runtimeClassName: kata +