github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-09-14 13:45:06 +00:00
Code Issues Projects Releases Wiki Activity

Basic port of NetworkPolicy test to v1 semantics

Browse Source
This commit is contained in:
Dan Winship
2017-05-30 11:26:52 -04:00
parent bc13aa5e60
commit a2cb516690
1 changed files with 22 additions and 94 deletions
Download Patch File Download Diff File Expand all files Collapse all files

116
test/e2e/network_policy.go
View File

@@ -41,7 +41,7 @@ failed or succesfully connected as expected.
var _ = framework.KubeDescribe("NetworkPolicy", func() {
f := framework.NewDefaultFramework("network-policy")
It("should support setting DefaultDeny namespace policy [Feature:NetworkPolicy]", func() {
It("should support a 'default-deny' policy [Feature:NetworkPolicy]", func() {
ns := f.Namespace
By("Create a simple server.")
@@ -52,11 +52,23 @@ var _ = framework.KubeDescribe("NetworkPolicy", func() {
Expect(err).NotTo(HaveOccurred())
// Create a pod with name 'client-can-connect', which should be able to communicate with server.
By("Creating client which will be able to contact the server since isolation is off.")
By("Creating client which will be able to contact the server since no policies are present.")
testCanConnect(f, ns, "client-can-connect", service, 80)
framework.Logf("Enabling network isolation.")
setNamespaceIsolation(f, ns, "DefaultDeny")
By("Creating a network policy denying all traffic.")
policy := &networking.NetworkPolicy{
ObjectMeta: metav1.ObjectMeta{
Name: "deny-all",
},
Spec: networking.NetworkPolicySpec{
PodSelector: metav1.LabelSelector{},
Ingress: []networking.NetworkPolicyIngressRule{},
},
}
policy, err = f.InternalClientset.Networking().NetworkPolicies(ns.Name).Create(policy)
Expect(err).NotTo(HaveOccurred())
defer cleanupNetworkPolicy(f, policy)
// Create a pod with name 'client-cannot-connect', which will attempt to comunicate with the server,
// but should not be able to now that isolation is on.
@@ -65,7 +77,6 @@ var _ = framework.KubeDescribe("NetworkPolicy", func() {
It("should enforce policy based on PodSelector [Feature:NetworkPolicy]", func() {
ns := f.Namespace
setNamespaceIsolation(f, ns, "DefaultDeny")
By("Creating a simple server.")
serverPod, service := createServerPodAndService(f, ns, "server", []int{80})
@@ -120,16 +131,10 @@ var _ = framework.KubeDescribe("NetworkPolicy", func() {
err := framework.WaitForPodRunningInNamespace(f.ClientSet, serverPod)
Expect(err).NotTo(HaveOccurred())
By("Testing pods can connect to both ports when isolation is off.")
By("Testing pods can connect to both ports when no policy is present.")
testCanConnect(f, ns, "basecase-reachable-80", service, 80)
testCanConnect(f, ns, "basecase-reachable-81", service, 81)
setNamespaceIsolation(f, ns, "DefaultDeny")
By("Testing pods cannot by default when isolation is turned on.")
testCannotConnect(f, ns, "basecase-unreachable-80", service, 80)
testCannotConnect(f, ns, "basecase-unreachable-81", service, 81)
By("Creating a network policy for the Service which allows traffic only to one port.")
policy := &networking.NetworkPolicy{
ObjectMeta: metav1.ObjectMeta{
@@ -154,53 +159,11 @@ var _ = framework.KubeDescribe("NetworkPolicy", func() {
Expect(err).NotTo(HaveOccurred())
defer cleanupNetworkPolicy(f, policy)
By("Testing pods can connect only to the port allowed by the policy.")
testCannotConnect(f, ns, "client-a", service, 80)
testCanConnect(f, ns, "client-b", service, 81)
})
It("shouldn't enforce policy when isolation is off [Feature:NetworkPolicy]", func() {
ns := f.Namespace
// Create Server with Service
By("Creating a simple server.")
serverPod, service := createServerPodAndService(f, ns, "server", []int{80, 81})
defer cleanupServerPodAndService(f, serverPod, service)
framework.Logf("Waiting for Server to come up.")
err := framework.WaitForPodRunningInNamespace(f.ClientSet, serverPod)
Expect(err).NotTo(HaveOccurred())
By("Testing pods can connect to both ports when isolation is off and no policy is defined.")
testCanConnect(f, ns, "basecase-reachable-a", service, 80)
testCanConnect(f, ns, "basecase-reachable-b", service, 81)
By("Creating a network policy for the Service which allows traffic only to one port.")
policy := &networking.NetworkPolicy{
ObjectMeta: metav1.ObjectMeta{
Name: "allow-ingress-on-port-81",
},
Spec: networking.NetworkPolicySpec{
// Apply to server
PodSelector: metav1.LabelSelector{
MatchLabels: map[string]string{
"pod-name": serverPod.Name,
},
},
// Allow traffic only to one port.
Ingress: []networking.NetworkPolicyIngressRule{{
Ports: []networking.NetworkPolicyPort{{
Port: &intstr.IntOrString{IntVal: 81},
}},
}},
},
}
policy, err = f.InternalClientset.Networking().NetworkPolicies(ns.Name).Create(policy)
Expect(err).NotTo(HaveOccurred())
defer cleanupNetworkPolicy(f, policy)
testCanConnect(f, ns, "client-a", service, 80)
testCanConnect(f, ns, "client-b", service, 81)
})
It("should enforce multiple, stacked policies with overlapping podSelectors [Feature:NetworkPolicy]", func() {
ns := f.Namespace
@@ -212,16 +175,10 @@ var _ = framework.KubeDescribe("NetworkPolicy", func() {
err := framework.WaitForPodRunningInNamespace(f.ClientSet, serverPod)
Expect(err).NotTo(HaveOccurred())
By("Testing pods can connect to both ports when isolation is off.")
By("Testing pods can connect to both ports when no policy is present.")
testCanConnect(f, ns, "test-a", service, 80)
testCanConnect(f, ns, "test-b", service, 81)
setNamespaceIsolation(f, ns, "DefaultDeny")
By("Testing pods cannot connect to either port when no policy is defined.")
testCannotConnect(f, ns, "test-a-2", service, 80)
testCannotConnect(f, ns, "test-b-2", service, 81)
By("Creating a network policy for the Service which allows traffic only to one port.")
policy := &networking.NetworkPolicy{
ObjectMeta: metav1.ObjectMeta{
@@ -270,6 +227,7 @@ var _ = framework.KubeDescribe("NetworkPolicy", func() {
Expect(err).NotTo(HaveOccurred())
defer cleanupNetworkPolicy(f, policy2)
By("Testing pods can connect to both ports when both policies are present.")
testCanConnect(f, ns, "client-a", service, 80)
testCanConnect(f, ns, "client-b", service, 81)
})
@@ -285,16 +243,10 @@ var _ = framework.KubeDescribe("NetworkPolicy", func() {
err := framework.WaitForPodRunningInNamespace(f.ClientSet, serverPod)
Expect(err).NotTo(HaveOccurred())
By("Testing pods can connect to both ports when isolation is off.")
By("Testing pods can connect to both ports when no policy is present.")
testCanConnect(f, ns, "test-a", service, 80)
testCanConnect(f, ns, "test-b", service, 81)
setNamespaceIsolation(f, ns, "DefaultDeny")
By("Testing pods cannot connect to either port when isolation is on.")
testCannotConnect(f, ns, "test-a", service, 80)
testCannotConnect(f, ns, "test-b", service, 81)
By("Creating a network policy which allows all traffic.")
policy := &networking.NetworkPolicy{
ObjectMeta: metav1.ObjectMeta{
@@ -312,6 +264,7 @@ var _ = framework.KubeDescribe("NetworkPolicy", func() {
Expect(err).NotTo(HaveOccurred())
defer cleanupNetworkPolicy(f, policy)
By("Testing pods can connect to both ports when an 'allow-all' policy is present.")
testCanConnect(f, ns, "client-a", service, 80)
testCanConnect(f, ns, "client-b", service, 81)
})
@@ -326,7 +279,6 @@ var _ = framework.KubeDescribe("NetworkPolicy", func() {
"ns-name": nsBName,
})
Expect(err).NotTo(HaveOccurred())
setNamespaceIsolation(f, nsA, "DefaultDeny")
// Create Server with Service in NS-B
By("Creating a webserver tied to a service.")
@@ -510,30 +462,6 @@ func createNetworkClientPod(f *framework.Framework, namespace *v1.Namespace, pod
return pod
}
// Configure namespace network isolation by setting the network-policy annotation
// on the namespace.
func setNamespaceIsolation(f *framework.Framework, namespace *v1.Namespace, ingressIsolation string) {
var annotations = map[string]string{}
if ingressIsolation != "" {
By(fmt.Sprintf("Enabling isolation through namespace annotations on namespace %v", namespace.Name))
policy := fmt.Sprintf(`{"ingress":{"isolation":"%s"}}`, ingressIsolation)
annotations["net.beta.kubernetes.io/network-policy"] = policy
} else {
By(fmt.Sprintf("Disabling isolation through namespace annotations on namespace %v", namespace.Name))
delete(annotations, "net.beta.kubernetes.io/network-policy")
}
// Update the namespace. We set the resource version to be an empty
// string, this forces the update. If we weren't to do this, we would
// either need to re-query the namespace, or update the namespace
// references with the one returned by the update. This approach
// requires less plumbing.
namespace.ObjectMeta.Annotations = annotations
namespace.ObjectMeta.ResourceVersion = ""
_, err := f.ClientSet.Core().Namespaces().Update(namespace)
Expect(err).NotTo(HaveOccurred())
}
func cleanupNetworkPolicy(f *framework.Framework, policy *networking.NetworkPolicy) {
By("Cleaning up the policy.")
if err := f.InternalClientset.Networking().NetworkPolicies(policy.Namespace).Delete(policy.Name, nil); err != nil {