mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-08-03 09:22:44 +00:00
proxy/iptables: remove redundant test
We originally had one HealthCheckNodePort test that used assertIPTablesRulesEqual() and one that didn't, but later I went through and made all the tests use assertIPTablesRulesEqual() and didn't notice that this resulted in there now being two nearly-identical HealthCheckNodePort tests.
This commit is contained in:
Dan Winship
parent
df1a3ddc98
commit
261f4f9e2d
@ -3900,115 +3900,6 @@ func TestEndpointSliceE2E(t *testing.T) {
|
|||||||
assertIPTablesRulesNotEqual(t, getLine(), expectedIPTablesWithSlice, fp.iptablesData.String())
|
assertIPTablesRulesNotEqual(t, getLine(), expectedIPTablesWithSlice, fp.iptablesData.String())
|
||||||
}
|
}
|
||||||
|
|
||||||
func TestHealthCheckNodePortE2E(t *testing.T) {
|
|
||||||
expectedIPTables := dedent.Dedent(`
|
|
||||||
*filter
|
|
||||||
:KUBE-EXTERNAL-SERVICES - [0:0]
|
|
||||||
:KUBE-FORWARD - [0:0]
|
|
||||||
:KUBE-NODEPORTS - [0:0]
|
|
||||||
:KUBE-SERVICES - [0:0]
|
|
||||||
-A KUBE-NODEPORTS -m comment --comment "ns1/svc1 health check node port" -m tcp -p tcp --dport 30000 -j ACCEPT
|
|
||||||
-A KUBE-FORWARD -m conntrack --ctstate INVALID -j DROP
|
|
||||||
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding rules" -m mark --mark 0x4000/0x4000 -j ACCEPT
|
|
||||||
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding conntrack rule" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
|
||||||
COMMIT
|
|
||||||
*nat
|
|
||||||
:KUBE-EXT-AQI2S6QIMU7PVVRP - [0:0]
|
|
||||||
:KUBE-MARK-MASQ - [0:0]
|
|
||||||
:KUBE-NODEPORTS - [0:0]
|
|
||||||
:KUBE-POSTROUTING - [0:0]
|
|
||||||
:KUBE-SEP-3JOIVZTXZZRGORX4 - [0:0]
|
|
||||||
:KUBE-SEP-IO5XOSKPAXIFQXAJ - [0:0]
|
|
||||||
:KUBE-SEP-XGJFVO3L2O5SRFNT - [0:0]
|
|
||||||
:KUBE-SERVICES - [0:0]
|
|
||||||
:KUBE-SVC-AQI2S6QIMU7PVVRP - [0:0]
|
|
||||||
:KUBE-SVL-AQI2S6QIMU7PVVRP - [0:0]
|
|
||||||
-A KUBE-NODEPORTS -m comment --comment ns1/svc1 -m tcp -p tcp --dport 30010 -j KUBE-EXT-AQI2S6QIMU7PVVRP
|
|
||||||
-A KUBE-SERVICES -m comment --comment "kubernetes service nodeports; NOTE: this must be the last rule in this chain" -m addrtype --dst-type LOCAL -j KUBE-NODEPORTS
|
|
||||||
-A KUBE-SERVICES -m comment --comment "ns1/svc1 cluster IP" -m tcp -p tcp -d 172.30.1.1 --dport 0 -j KUBE-SVC-AQI2S6QIMU7PVVRP
|
|
||||||
-A KUBE-EXT-AQI2S6QIMU7PVVRP -m comment --comment "pod traffic for ns1/svc1 external destinations" -s 10.0.0.0/8 -j KUBE-SVC-AQI2S6QIMU7PVVRP
|
|
||||||
-A KUBE-EXT-AQI2S6QIMU7PVVRP -m comment --comment "masquerade LOCAL traffic for ns1/svc1 external destinations" -m addrtype --src-type LOCAL -j KUBE-MARK-MASQ
|
|
||||||
-A KUBE-EXT-AQI2S6QIMU7PVVRP -m comment --comment "route LOCAL traffic for ns1/svc1 external destinations" -m addrtype --src-type LOCAL -j KUBE-SVC-AQI2S6QIMU7PVVRP
|
|
||||||
-A KUBE-EXT-AQI2S6QIMU7PVVRP -j KUBE-SVL-AQI2S6QIMU7PVVRP
|
|
||||||
-A KUBE-MARK-MASQ -j MARK --or-mark 0x4000
|
|
||||||
-A KUBE-POSTROUTING -m mark ! --mark 0x4000/0x4000 -j RETURN
|
|
||||||
-A KUBE-POSTROUTING -j MARK --xor-mark 0x4000
|
|
||||||
-A KUBE-POSTROUTING -m comment --comment "kubernetes service traffic requiring SNAT" -j MASQUERADE
|
|
||||||
-A KUBE-SEP-3JOIVZTXZZRGORX4 -m comment --comment ns1/svc1 -s 10.0.1.1 -j KUBE-MARK-MASQ
|
|
||||||
-A KUBE-SEP-3JOIVZTXZZRGORX4 -m comment --comment ns1/svc1 -m tcp -p tcp -j DNAT --to-destination 10.0.1.1:80
|
|
||||||
-A KUBE-SEP-IO5XOSKPAXIFQXAJ -m comment --comment ns1/svc1 -s 10.0.1.2 -j KUBE-MARK-MASQ
|
|
||||||
-A KUBE-SEP-IO5XOSKPAXIFQXAJ -m comment --comment ns1/svc1 -m tcp -p tcp -j DNAT --to-destination 10.0.1.2:80
|
|
||||||
-A KUBE-SEP-XGJFVO3L2O5SRFNT -m comment --comment ns1/svc1 -s 10.0.1.3 -j KUBE-MARK-MASQ
|
|
||||||
-A KUBE-SEP-XGJFVO3L2O5SRFNT -m comment --comment ns1/svc1 -m tcp -p tcp -j DNAT --to-destination 10.0.1.3:80
|
|
||||||
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment "ns1/svc1 cluster IP" -m tcp -p tcp -d 172.30.1.1 --dport 0 ! -s 10.0.0.0/8 -j KUBE-MARK-MASQ
|
|
||||||
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment "ns1/svc1 -> 10.0.1.1:80" -m statistic --mode random --probability 0.3333333333 -j KUBE-SEP-3JOIVZTXZZRGORX4
|
|
||||||
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment "ns1/svc1 -> 10.0.1.2:80" -m statistic --mode random --probability 0.5000000000 -j KUBE-SEP-IO5XOSKPAXIFQXAJ
|
|
||||||
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment "ns1/svc1 -> 10.0.1.3:80" -j KUBE-SEP-XGJFVO3L2O5SRFNT
|
|
||||||
-A KUBE-SVL-AQI2S6QIMU7PVVRP -m comment --comment "ns1/svc1 -> 10.0.1.1:80" -j KUBE-SEP-3JOIVZTXZZRGORX4
|
|
||||||
COMMIT
|
|
||||||
`)
|
|
||||||
|
|
||||||
ipt := iptablestest.NewFake()
|
|
||||||
fp := NewFakeProxier(ipt)
|
|
||||||
fp.OnServiceSynced()
|
|
||||||
fp.OnEndpointSlicesSynced()
|
|
||||||
|
|
||||||
serviceName := "svc1"
|
|
||||||
namespaceName := "ns1"
|
|
||||||
|
|
||||||
svc := &v1.Service{
|
|
||||||
ObjectMeta: metav1.ObjectMeta{Name: serviceName, Namespace: namespaceName},
|
|
||||||
Spec: v1.ServiceSpec{
|
|
||||||
ClusterIP: "172.30.1.1",
|
|
||||||
Selector: map[string]string{"foo": "bar"},
|
|
||||||
Ports: []v1.ServicePort{{Name: "", TargetPort: intstr.FromInt(80), NodePort: 30010, Protocol: v1.ProtocolTCP}},
|
|
||||||
Type: "LoadBalancer",
|
|
||||||
HealthCheckNodePort: 30000,
|
|
||||||
ExternalTrafficPolicy: v1.ServiceExternalTrafficPolicyTypeLocal,
|
|
||||||
},
|
|
||||||
}
|
|
||||||
fp.OnServiceAdd(svc)
|
|
||||||
|
|
||||||
tcpProtocol := v1.ProtocolTCP
|
|
||||||
endpointSlice := &discovery.EndpointSlice{
|
|
||||||
ObjectMeta: metav1.ObjectMeta{
|
|
||||||
Name: fmt.Sprintf("%s-1", serviceName),
|
|
||||||
Namespace: namespaceName,
|
|
||||||
Labels: map[string]string{discovery.LabelServiceName: serviceName},
|
|
||||||
},
|
|
||||||
Ports: []discovery.EndpointPort{{
|
|
||||||
Name: utilpointer.StringPtr(""),
|
|
||||||
Port: utilpointer.Int32Ptr(80),
|
|
||||||
Protocol: &tcpProtocol,
|
|
||||||
}},
|
|
||||||
AddressType: discovery.AddressTypeIPv4,
|
|
||||||
Endpoints: []discovery.Endpoint{{
|
|
||||||
Addresses: []string{"10.0.1.1"},
|
|
||||||
Conditions: discovery.EndpointConditions{Ready: utilpointer.BoolPtr(true)},
|
|
||||||
NodeName: utilpointer.StringPtr(testHostname),
|
|
||||||
}, {
|
|
||||||
Addresses: []string{"10.0.1.2"},
|
|
||||||
Conditions: discovery.EndpointConditions{Ready: utilpointer.BoolPtr(true)},
|
|
||||||
NodeName: utilpointer.StringPtr("node2"),
|
|
||||||
}, {
|
|
||||||
Addresses: []string{"10.0.1.3"},
|
|
||||||
Conditions: discovery.EndpointConditions{Ready: utilpointer.BoolPtr(true)},
|
|
||||||
NodeName: utilpointer.StringPtr("node3"),
|
|
||||||
}, {
|
|
||||||
Addresses: []string{"10.0.1.4"},
|
|
||||||
Conditions: discovery.EndpointConditions{Ready: utilpointer.BoolPtr(false)},
|
|
||||||
NodeName: utilpointer.StringPtr("node4"),
|
|
||||||
}},
|
|
||||||
}
|
|
||||||
fp.OnEndpointSliceAdd(endpointSlice)
|
|
||||||
fp.syncProxyRules()
|
|
||||||
assertIPTablesRulesEqual(t, getLine(), expectedIPTables, fp.iptablesData.String())
|
|
||||||
|
|
||||||
fp.OnServiceDelete(svc)
|
|
||||||
fp.syncProxyRules()
|
|
||||||
assertIPTablesRulesNotEqual(t, getLine(), expectedIPTables, fp.iptablesData.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestHealthCheckNodePortWhenTerminating tests that health check node ports are not enabled when all local endpoints are terminating
|
// TestHealthCheckNodePortWhenTerminating tests that health check node ports are not enabled when all local endpoints are terminating
|
||||||
func TestHealthCheckNodePortWhenTerminating(t *testing.T) {
|
func TestHealthCheckNodePortWhenTerminating(t *testing.T) {
|
||||||
ipt := iptablestest.NewFake()
|
ipt := iptablestest.NewFake()
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user