diff --git a/test/e2e/network/netpol/kubemanager.go b/test/e2e/network/netpol/kubemanager.go index e9270ad23f7..2ed9b0de166 100644 --- a/test/e2e/network/netpol/kubemanager.go +++ b/test/e2e/network/netpol/kubemanager.go @@ -80,7 +80,7 @@ func (k *kubeManager) initializeClusterFromModel(ctx context.Context, model *Mod var createdPods []*v1.Pod for _, ns := range model.Namespaces { // no labels needed, we just need the default kubernetes.io/metadata.name label - namespace, err := k.framework.CreateNamespace(ctx, ns.BaseName, nil) + namespace, err := k.framework.CreateNamespace(ctx, ns.Name, nil) if err != nil { return err } diff --git a/test/e2e/network/netpol/model.go b/test/e2e/network/netpol/model.go index 60d93a1bd42..b62f7ea1a0d 100644 --- a/test/e2e/network/netpol/model.go +++ b/test/e2e/network/netpol/model.go @@ -35,20 +35,15 @@ type Model struct { Protocols []v1.Protocol } -// NewWindowsModel returns a model specific to windows testing. -func NewWindowsModel(namespaceBaseNames []string, podNames []string, ports []int32) *Model { - return NewModel(namespaceBaseNames, podNames, ports, []v1.Protocol{v1.ProtocolTCP, v1.ProtocolUDP}) -} - // NewModel instantiates a model based on: -// - namespaceBaseNames +// - namespaceNames // - pods // - ports to listen on // - protocols to listen on // The total number of pods is the number of namespaces x the number of pods per namespace. // The number of containers per pod is the number of ports x the number of protocols. // The *total* number of containers is namespaces x pods x ports x protocols. -func NewModel(namespaceBaseNames []string, podNames []string, ports []int32, protocols []v1.Protocol) *Model { +func NewModel(namespaceNames []string, podNames []string, ports []int32, protocols []v1.Protocol) *Model { model := &Model{ PodNames: podNames, Ports: ports, @@ -57,7 +52,7 @@ func NewModel(namespaceBaseNames []string, podNames []string, ports []int32, pro // build the entire "model" for the overall test, which means, building // namespaces, pods, containers for each protocol. - for _, ns := range namespaceBaseNames { + for _, ns := range namespaceNames { var pods []*Pod for _, podName := range podNames { var containers []*Container @@ -75,8 +70,8 @@ func NewModel(namespaceBaseNames []string, podNames []string, ports []int32, pro }) } model.Namespaces = append(model.Namespaces, &Namespace{ - BaseName: ns, - Pods: pods, + Name: ns, + Pods: pods, }) } return model @@ -85,8 +80,8 @@ func NewModel(namespaceBaseNames []string, podNames []string, ports []int32, pro // Namespace is the abstract representation of what matters to network policy // tests for a namespace; i.e. it ignores kube implementation details type Namespace struct { - BaseName string - Pods []*Pod + Name string + Pods []*Pod } // Pod is the abstract representation of what matters to network policy tests for diff --git a/test/e2e/network/netpol/network_policy.go b/test/e2e/network/netpol/network_policy.go index a527cf6b935..afd485ee2b5 100644 --- a/test/e2e/network/netpol/network_policy.go +++ b/test/e2e/network/netpol/network_policy.go @@ -146,11 +146,12 @@ var _ = common.SIGDescribe("Netpol", func() { }) f.It("should support a 'default-deny-all' policy", feature.NetworkPolicy, func(ctx context.Context) { - policy := GenNetworkPolicyWithNameAndPodSelector("deny-all", metav1.LabelSelector{}, SetSpecIngressRules(), SetSpecEgressRules()) protocols := []v1.Protocol{protocolTCP} ports := []int32{80} k8s = initializeResources(ctx, f, protocols, ports) nsX, _, _ := getK8sNamespaces(k8s) + + policy := GenNetworkPolicyWithNameAndPodSelector("deny-all", metav1.LabelSelector{}, SetSpecIngressRules(), SetSpecEgressRules()) CreatePolicy(ctx, k8s, policy, nsX) reachability := NewReachability(k8s.AllPodStrings(), true) @@ -161,6 +162,11 @@ var _ = common.SIGDescribe("Netpol", func() { }) f.It("should enforce policy to allow traffic from pods within server namespace based on PodSelector", feature.NetworkPolicy, func(ctx context.Context) { + protocols := []v1.Protocol{protocolTCP} + ports := []int32{80} + k8s = initializeResources(ctx, f, protocols, ports) + nsX, _, _ := getK8sNamespaces(k8s) + allowedPods := metav1.LabelSelector{ MatchLabels: map[string]string{ "pod": "b", @@ -169,11 +175,6 @@ var _ = common.SIGDescribe("Netpol", func() { ingressRule := networkingv1.NetworkPolicyIngressRule{} ingressRule.From = append(ingressRule.From, networkingv1.NetworkPolicyPeer{PodSelector: &allowedPods}) policy := GenNetworkPolicyWithNameAndPodMatchLabel("x-a-allows-x-b", map[string]string{"pod": "a"}, SetSpecIngressRules(ingressRule)) - - protocols := []v1.Protocol{protocolTCP} - ports := []int32{80} - k8s = initializeResources(ctx, f, protocols, ports) - nsX, _, _ := getK8sNamespaces(k8s) CreatePolicy(ctx, k8s, policy, nsX) reachability := NewReachability(k8s.AllPodStrings(), true) @@ -188,11 +189,11 @@ var _ = common.SIGDescribe("Netpol", func() { ports := []int32{80} k8s = initializeResources(ctx, f, protocols, ports) nsX, _, _ := getK8sNamespaces(k8s) - ginkgo.By("having a deny all ingress policy", func() { - // Deny all Ingress traffic policy to pods on namespace nsX - policy := GenNetworkPolicyWithNameAndPodSelector("deny-all", metav1.LabelSelector{}, SetSpecIngressRules()) - CreatePolicy(ctx, k8s, policy, nsX) - }) + + ginkgo.By("having a deny all ingress policy") + // Deny all Ingress traffic policy to pods on namespace nsX + policy := GenNetworkPolicyWithNameAndPodSelector("deny-all", metav1.LabelSelector{}, SetSpecIngressRules()) + CreatePolicy(ctx, k8s, policy, nsX) // Allow Ingress traffic only to pod x/a from any pod ingressRule := networkingv1.NetworkPolicyIngressRule{} @@ -213,6 +214,7 @@ var _ = common.SIGDescribe("Netpol", func() { ports := []int32{80} k8s = initializeResources(ctx, f, protocols, ports) nsX, _, _ := getK8sNamespaces(k8s) + ingressRule := networkingv1.NetworkPolicyIngressRule{} ingressRule.From = append(ingressRule.From, networkingv1.NetworkPolicyPeer{NamespaceSelector: &metav1.LabelSelector{MatchLabels: map[string]string{}}}) policy := GenNetworkPolicyWithNameAndPodMatchLabel("allow-from-another-ns", map[string]string{"pod": "a"}, SetSpecIngressRules(ingressRule)) @@ -227,6 +229,7 @@ var _ = common.SIGDescribe("Netpol", func() { ports := []int32{80} k8s = initializeResources(ctx, f, protocols, ports) nsX, nsY, nsZ := getK8sNamespaces(k8s) + ingressRule := networkingv1.NetworkPolicyIngressRule{} ingressRule.From = append(ingressRule.From, networkingv1.NetworkPolicyPeer{NamespaceSelector: &metav1.LabelSelector{MatchLabels: map[string]string{namespaceLabelKey: nsY}}}) policy := GenNetworkPolicyWithNameAndPodMatchLabel("allow-client-a-via-ns-selector", map[string]string{"pod": "a"}, SetSpecIngressRules(ingressRule)) @@ -241,6 +244,11 @@ var _ = common.SIGDescribe("Netpol", func() { }) f.It("should enforce policy based on PodSelector with MatchExpressions", feature.NetworkPolicy, func(ctx context.Context) { + protocols := []v1.Protocol{protocolTCP} + ports := []int32{80} + k8s = initializeResources(ctx, f, protocols, ports) + nsX, _, _ := getK8sNamespaces(k8s) + allowedPods := metav1.LabelSelector{ MatchExpressions: []metav1.LabelSelectorRequirement{{ Key: "pod", @@ -251,11 +259,6 @@ var _ = common.SIGDescribe("Netpol", func() { ingressRule := networkingv1.NetworkPolicyIngressRule{} ingressRule.From = append(ingressRule.From, networkingv1.NetworkPolicyPeer{PodSelector: &allowedPods}) policy := GenNetworkPolicyWithNameAndPodMatchLabel("x-a-allows-x-b", map[string]string{"pod": "a"}, SetSpecIngressRules(ingressRule)) - - protocols := []v1.Protocol{protocolTCP} - ports := []int32{80} - k8s = initializeResources(ctx, f, protocols, ports) - nsX, _, _ := getK8sNamespaces(k8s) CreatePolicy(ctx, k8s, policy, nsX) reachability := NewReachability(k8s.AllPodStrings(), true) @@ -270,6 +273,7 @@ var _ = common.SIGDescribe("Netpol", func() { ports := []int32{80} k8s = initializeResources(ctx, f, protocols, ports) nsX, nsY, nsZ := getK8sNamespaces(k8s) + allowedNamespaces := &metav1.LabelSelector{ MatchExpressions: []metav1.LabelSelectorRequirement{{ Key: namespaceLabelKey, @@ -295,6 +299,7 @@ var _ = common.SIGDescribe("Netpol", func() { ports := []int32{80} k8s = initializeResources(ctx, f, protocols, ports) nsX, _, _ := getK8sNamespaces(k8s) + allowedNamespaces := &metav1.LabelSelector{ MatchExpressions: []metav1.LabelSelectorRequirement{{ Key: namespaceLabelKey, @@ -324,6 +329,7 @@ var _ = common.SIGDescribe("Netpol", func() { ports := []int32{80} k8s = initializeResources(ctx, f, protocols, ports) nsX, nsY, nsZ := getK8sNamespaces(k8s) + allowedNamespaces := &metav1.LabelSelector{ MatchExpressions: []metav1.LabelSelectorRequirement{{ Key: namespaceLabelKey, @@ -354,6 +360,7 @@ var _ = common.SIGDescribe("Netpol", func() { ports := []int32{80} k8s = initializeResources(ctx, f, protocols, ports) nsX, nsY, nsZ := getK8sNamespaces(k8s) + allowedNamespaces := &metav1.LabelSelector{ MatchExpressions: []metav1.LabelSelectorRequirement{{ Key: namespaceLabelKey, @@ -368,7 +375,6 @@ var _ = common.SIGDescribe("Netpol", func() { Values: []string{"b", "c"}, }}, } - ingressRule := networkingv1.NetworkPolicyIngressRule{} ingressRule.From = append(ingressRule.From, networkingv1.NetworkPolicyPeer{NamespaceSelector: allowedNamespaces, PodSelector: allowedPod}) policy := GenNetworkPolicyWithNameAndPodMatchLabel("allow-ns-y-z-pod-b-c", map[string]string{"pod": "a"}, SetSpecIngressRules(ingressRule)) @@ -387,6 +393,7 @@ var _ = common.SIGDescribe("Netpol", func() { ports := []int32{80} k8s = initializeResources(ctx, f, protocols, ports) nsX, _, _ := getK8sNamespaces(k8s) + ingressRule := networkingv1.NetworkPolicyIngressRule{} for _, label := range []map[string]string{{"pod": "b"}, {"pod": "c"}} { ingressRule.From = append(ingressRule.From, networkingv1.NetworkPolicyPeer{PodSelector: &metav1.LabelSelector{MatchLabels: label}}) @@ -409,6 +416,7 @@ var _ = common.SIGDescribe("Netpol", func() { ports := []int32{80} k8s = initializeResources(ctx, f, protocols, ports) nsX, nsY, _ := getK8sNamespaces(k8s) + allowedNamespaces := &metav1.LabelSelector{ MatchLabels: map[string]string{ namespaceLabelKey: nsY, @@ -432,11 +440,12 @@ var _ = common.SIGDescribe("Netpol", func() { }) f.It("should enforce policy based on Ports", feature.NetworkPolicy, func(ctx context.Context) { - ginkgo.By("Creating a network allowPort81Policy which only allows allow listed namespaces (y) to connect on exactly one port (81)") protocols := []v1.Protocol{protocolTCP} ports := []int32{81} k8s = initializeResources(ctx, f, protocols, ports) nsX, nsY, nsZ := getK8sNamespaces(k8s) + + ginkgo.By("Creating a network allowPort81Policy which only allows allow listed namespaces (y) to connect on exactly one port (81)") allowedLabels := &metav1.LabelSelector{ MatchLabels: map[string]string{ namespaceLabelKey: nsY, @@ -457,11 +466,12 @@ var _ = common.SIGDescribe("Netpol", func() { }) f.It("should enforce multiple, stacked policies with overlapping podSelectors", feature.NetworkPolicy, func(ctx context.Context) { - ginkgo.By("Creating a network allowPort81Policy which only allows allow listed namespaces (y) to connect on exactly one port (81)") protocols := []v1.Protocol{protocolTCP} ports := []int32{80, 81} k8s = initializeResources(ctx, f, protocols, ports) nsX, nsY, nsZ := getK8sNamespaces(k8s) + + ginkgo.By("Creating a network allowPort81Policy which only allows allow listed namespaces (y) to connect on exactly one port (81)") allowedLabels := &metav1.LabelSelector{ MatchLabels: map[string]string{ namespaceLabelKey: nsY, @@ -490,7 +500,6 @@ var _ = common.SIGDescribe("Netpol", func() { ingressRule = networkingv1.NetworkPolicyIngressRule{} ingressRule.From = append(ingressRule.From, networkingv1.NetworkPolicyPeer{NamespaceSelector: allowedLabels}) ingressRule.Ports = append(ingressRule.Ports, networkingv1.NetworkPolicyPort{Port: &intstr.IntOrString{IntVal: 80}, Protocol: &protocolTCP}) - allowPort80Policy := GenNetworkPolicyWithNameAndPodMatchLabel("allow-client-a-via-ns-selector-80", map[string]string{"pod": "a"}, SetSpecIngressRules(ingressRule)) CreatePolicy(ctx, k8s, allowPort80Policy, nsX) @@ -499,12 +508,13 @@ var _ = common.SIGDescribe("Netpol", func() { }) f.It("should support allow-all policy", feature.NetworkPolicy, func(ctx context.Context) { - ginkgo.By("Creating a network policy which allows all traffic.") - policy := GenNetworkPolicyWithNameAndPodMatchLabel("allow-all", map[string]string{}, SetSpecIngressRules(networkingv1.NetworkPolicyIngressRule{})) protocols := []v1.Protocol{protocolTCP} ports := []int32{80, 81} k8s = initializeResources(ctx, f, protocols, ports) nsX, _, _ := getK8sNamespaces(k8s) + + ginkgo.By("Creating a network policy which allows all traffic.") + policy := GenNetworkPolicyWithNameAndPodMatchLabel("allow-all", map[string]string{}, SetSpecIngressRules(networkingv1.NetworkPolicyIngressRule{})) CreatePolicy(ctx, k8s, policy, nsX) ginkgo.By("Testing pods can connect to both ports when an 'allow-all' policy is present.") @@ -514,16 +524,16 @@ var _ = common.SIGDescribe("Netpol", func() { }) f.It("should allow ingress access on one named port", feature.NetworkPolicy, func(ctx context.Context) { - IngressRules := networkingv1.NetworkPolicyIngressRule{} - IngressRules.Ports = append(IngressRules.Ports, networkingv1.NetworkPolicyPort{Port: &intstr.IntOrString{Type: intstr.String, StrVal: "serve-81-tcp"}}) - policy := GenNetworkPolicyWithNameAndPodMatchLabel("allow-all", map[string]string{}, SetSpecIngressRules(IngressRules)) protocols := []v1.Protocol{protocolTCP} ports := []int32{80, 81} k8s = initializeResources(ctx, f, protocols, ports) nsX, _, _ := getK8sNamespaces(k8s) - CreatePolicy(ctx, k8s, policy, nsX) ginkgo.By("Blocking all ports other then 81 in the entire namespace") + IngressRules := networkingv1.NetworkPolicyIngressRule{} + IngressRules.Ports = append(IngressRules.Ports, networkingv1.NetworkPolicyPort{Port: &intstr.IntOrString{Type: intstr.String, StrVal: "serve-81-tcp"}}) + policy := GenNetworkPolicyWithNameAndPodMatchLabel("allow-all", map[string]string{}, SetSpecIngressRules(IngressRules)) + CreatePolicy(ctx, k8s, policy, nsX) reachabilityPort81 := NewReachability(k8s.AllPodStrings(), true) ValidateOrFail(k8s, &TestCase{ToPort: 81, Protocol: v1.ProtocolTCP, Reachability: reachabilityPort81}) @@ -539,6 +549,7 @@ var _ = common.SIGDescribe("Netpol", func() { ports := []int32{80, 81} k8s = initializeResources(ctx, f, protocols, ports) nsX, nsY, nsZ := getK8sNamespaces(k8s) + allowedLabels := &metav1.LabelSelector{ MatchLabels: map[string]string{ namespaceLabelKey: nsY, @@ -565,15 +576,14 @@ var _ = common.SIGDescribe("Netpol", func() { }) f.It("should allow egress access on one named port", feature.NetworkPolicy, func(ctx context.Context) { - ginkgo.By("validating egress from port 81 to port 80") - egressRule := networkingv1.NetworkPolicyEgressRule{} - egressRule.Ports = append(egressRule.Ports, networkingv1.NetworkPolicyPort{Port: &intstr.IntOrString{Type: intstr.String, StrVal: "serve-80-tcp"}}) - policy := GenNetworkPolicyWithNameAndPodMatchLabel("allow-egress", map[string]string{}, SetSpecEgressRules(egressRule)) - protocols := []v1.Protocol{protocolTCP} ports := []int32{80, 81} k8s = initializeResources(ctx, f, protocols, ports) nsX, _, _ := getK8sNamespaces(k8s) + + egressRule := networkingv1.NetworkPolicyEgressRule{} + egressRule.Ports = append(egressRule.Ports, networkingv1.NetworkPolicyPort{Port: &intstr.IntOrString{Type: intstr.String, StrVal: "serve-80-tcp"}}) + policy := GenNetworkPolicyWithNameAndPodMatchLabel("allow-egress", map[string]string{}, SetSpecEgressRules(egressRule)) CreatePolicy(ctx, k8s, policy, nsX) reachabilityPort80 := NewReachability(k8s.AllPodStrings(), true) @@ -586,13 +596,14 @@ var _ = common.SIGDescribe("Netpol", func() { }) f.It("should enforce updated policy", feature.NetworkPolicy, func(ctx context.Context) { - ginkgo.By("Using the simplest possible mutation: start with allow all, then switch to deny all") - // part 1) allow all - policy := GenNetworkPolicyWithNameAndPodMatchLabel("allow-all-mutate-to-deny-all", map[string]string{}, SetSpecIngressRules(networkingv1.NetworkPolicyIngressRule{})) protocols := []v1.Protocol{protocolTCP} ports := []int32{81} k8s = initializeResources(ctx, f, protocols, ports) nsX, _, _ := getK8sNamespaces(k8s) + + ginkgo.By("Using the simplest possible mutation: start with allow all, then switch to deny all") + // part 1) allow all + policy := GenNetworkPolicyWithNameAndPodMatchLabel("allow-all-mutate-to-deny-all", map[string]string{}, SetSpecIngressRules(networkingv1.NetworkPolicyIngressRule{})) CreatePolicy(ctx, k8s, policy, nsX) reachability := NewReachability(k8s.AllPodStrings(), true) @@ -672,6 +683,7 @@ var _ = common.SIGDescribe("Netpol", func() { ports := []int32{80} k8s = initializeResources(ctx, f, protocols, ports) nsX, nsY, nsZ := getK8sNamespaces(k8s) + IngressRules := networkingv1.NetworkPolicyIngressRule{} IngressRules.From = append(IngressRules.From, networkingv1.NetworkPolicyPeer{PodSelector: &metav1.LabelSelector{MatchLabels: map[string]string{}}}) policy := GenNetworkPolicyWithNameAndPodSelector("deny-empty-policy", metav1.LabelSelector{}, SetSpecIngressRules(IngressRules)) @@ -711,6 +723,7 @@ var _ = common.SIGDescribe("Netpol", func() { ports := []int32{80} k8s = initializeResources(ctx, f, protocols, ports) nsX, _, _ := getK8sNamespaces(k8s) + policy := GenNetworkPolicyWithNameAndPodSelector("deny-egress-pod-a", metav1.LabelSelector{MatchLabels: map[string]string{"pod": "a"}}, SetSpecEgressRules()) CreatePolicy(ctx, k8s, policy, nsX) @@ -725,6 +738,7 @@ var _ = common.SIGDescribe("Netpol", func() { ports := []int32{80} k8s = initializeResources(ctx, f, protocols, ports) nsX, _, _ := getK8sNamespaces(k8s) + policy := GenNetworkPolicyWithNameAndPodSelector("deny-egress-ns-x", metav1.LabelSelector{}, SetSpecEgressRules()) CreatePolicy(ctx, k8s, policy, nsX) @@ -735,6 +749,11 @@ var _ = common.SIGDescribe("Netpol", func() { }) f.It("should work with Ingress, Egress specified together", feature.NetworkPolicy, func(ctx context.Context) { + protocols := []v1.Protocol{protocolTCP} + ports := []int32{80, 81} + k8s = initializeResources(ctx, f, protocols, ports) + nsX, _, _ := getK8sNamespaces(k8s) + allowedPodLabels := &metav1.LabelSelector{MatchLabels: map[string]string{"pod": "b"}} ingressRule := networkingv1.NetworkPolicyIngressRule{} ingressRule.From = append(ingressRule.From, networkingv1.NetworkPolicyPeer{PodSelector: allowedPodLabels}) @@ -752,10 +771,6 @@ var _ = common.SIGDescribe("Netpol", func() { }, } policy.Spec.PolicyTypes = []networkingv1.PolicyType{networkingv1.PolicyTypeEgress, networkingv1.PolicyTypeIngress} - protocols := []v1.Protocol{protocolTCP} - ports := []int32{80, 81} - k8s = initializeResources(ctx, f, protocols, ports) - nsX, _, _ := getK8sNamespaces(k8s) CreatePolicy(ctx, k8s, policy, nsX) reachabilityPort80 := NewReachability(k8s.AllPodStrings(), true) @@ -873,6 +888,7 @@ var _ = common.SIGDescribe("Netpol", func() { ports := []int32{80} k8s = initializeResources(ctx, f, protocols, ports) nsX, nsY, _ := getK8sNamespaces(k8s) + allowedNamespaces := &metav1.LabelSelector{ MatchLabels: map[string]string{ namespaceLabelKey: nsY, @@ -899,6 +915,7 @@ var _ = common.SIGDescribe("Netpol", func() { ports := []int32{80} k8s = initializeResources(ctx, f, protocols, ports) nsX, _, _ := getK8sNamespaces(k8s) + ingressRule := networkingv1.NetworkPolicyIngressRule{} ingressRule.Ports = append(ingressRule.Ports, networkingv1.NetworkPolicyPort{Protocol: &protocolTCP}) policy := GenNetworkPolicyWithNameAndPodMatchLabel("allow-ingress-by-proto", map[string]string{"pod": "a"}, SetSpecIngressRules(ingressRule)) @@ -917,6 +934,7 @@ var _ = common.SIGDescribe("Netpol", func() { ports := []int32{81} k8s = initializeResources(ctx, f, protocols, ports) nsX, _, _ := getK8sNamespaces(k8s) + IngressRules := networkingv1.NetworkPolicyIngressRule{} IngressRules.Ports = append(IngressRules.Ports, networkingv1.NetworkPolicyPort{Port: &intstr.IntOrString{Type: intstr.Int, IntVal: 80}}) policyAllowOnlyPort80 := GenNetworkPolicyWithNameAndPodMatchLabel("allow-ingress-port-80", map[string]string{}, SetSpecIngressRules(IngressRules)) @@ -938,13 +956,14 @@ var _ = common.SIGDescribe("Netpol", func() { }) f.It("should enforce multiple egress policies with egress allow-all policy taking precedence", feature.NetworkPolicy, func(ctx context.Context) { - egressRule := networkingv1.NetworkPolicyEgressRule{} - egressRule.Ports = append(egressRule.Ports, networkingv1.NetworkPolicyPort{Port: &intstr.IntOrString{Type: intstr.Int, IntVal: 80}}) - policyAllowPort80 := GenNetworkPolicyWithNameAndPodMatchLabel("allow-egress-port-80", map[string]string{}, SetSpecEgressRules(egressRule)) protocols := []v1.Protocol{protocolTCP} ports := []int32{81} k8s = initializeResources(ctx, f, protocols, ports) nsX, _, _ := getK8sNamespaces(k8s) + + egressRule := networkingv1.NetworkPolicyEgressRule{} + egressRule.Ports = append(egressRule.Ports, networkingv1.NetworkPolicyPort{Port: &intstr.IntOrString{Type: intstr.Int, IntVal: 80}}) + policyAllowPort80 := GenNetworkPolicyWithNameAndPodMatchLabel("allow-egress-port-80", map[string]string{}, SetSpecEgressRules(egressRule)) CreatePolicy(ctx, k8s, policyAllowPort80, nsX) ginkgo.By("Making sure ingress doesn't work other than port 80") @@ -963,14 +982,14 @@ var _ = common.SIGDescribe("Netpol", func() { }) f.It("should stop enforcing policies after they are deleted", feature.NetworkPolicy, func(ctx context.Context) { - ginkgo.By("Creating a network policy for the server which denies all traffic.") - - // Deny all traffic into and out of "x". - policy := GenNetworkPolicyWithNameAndPodSelector("deny-all", metav1.LabelSelector{}, SetSpecIngressRules(), SetSpecEgressRules()) protocols := []v1.Protocol{protocolTCP} ports := []int32{80} k8s = initializeResources(ctx, f, protocols, ports) nsX, _, _ := getK8sNamespaces(k8s) + + ginkgo.By("Creating a network policy for the server which denies all traffic.") + // Deny all traffic into and out of "x". + policy := GenNetworkPolicyWithNameAndPodSelector("deny-all", metav1.LabelSelector{}, SetSpecIngressRules(), SetSpecEgressRules()) CreatePolicy(ctx, k8s, policy, nsX) reachability := NewReachability(k8s.AllPodStrings(), true) @@ -996,6 +1015,7 @@ var _ = common.SIGDescribe("Netpol", func() { ports := []int32{80} k8s = initializeResources(ctx, f, protocols, ports) nsX, nsY, _ := getK8sNamespaces(k8s) + podList, err := f.ClientSet.CoreV1().Pods(nsY).List(ctx, metav1.ListOptions{LabelSelector: "pod=b"}) framework.ExpectNoError(err, "Failing to list pods in namespace y") pod := podList.Items[0] @@ -1018,12 +1038,12 @@ var _ = common.SIGDescribe("Netpol", func() { }) f.It("should enforce except clause while egress access to server in CIDR block", feature.NetworkPolicy, func(ctx context.Context) { - // Getting podServer's status to get podServer's IP, to create the CIDR with except clause protocols := []v1.Protocol{protocolTCP} ports := []int32{80} k8s = initializeResources(ctx, f, protocols, ports) nsX, _, _ := getK8sNamespaces(k8s) + // Getting podServer's status to get podServer's IP, to create the CIDR with except clause podList, err := f.ClientSet.CoreV1().Pods(nsX).List(ctx, metav1.ListOptions{LabelSelector: "pod=b"}) framework.ExpectNoError(err, "Failing to find pod x/b") podB := podList.Items[0] @@ -1051,12 +1071,12 @@ var _ = common.SIGDescribe("Netpol", func() { }) f.It("should ensure an IP overlapping both IPBlock.CIDR and IPBlock.Except is allowed", feature.NetworkPolicy, func(ctx context.Context) { - // Getting podServer's status to get podServer's IP, to create the CIDR with except clause protocols := []v1.Protocol{protocolTCP} ports := []int32{80} k8s = initializeResources(ctx, f, protocols, ports) nsX, _, _ := getK8sNamespaces(k8s) + // Getting podServer's status to get podServer's IP, to create the CIDR with except clause podList, err := f.ClientSet.CoreV1().Pods(nsX).List(ctx, metav1.ListOptions{LabelSelector: "pod=b"}) framework.ExpectNoError(err, "Failing to find pod x/b") podB := podList.Items[0] @@ -1098,6 +1118,11 @@ var _ = common.SIGDescribe("Netpol", func() { }) f.It("should enforce policies to check ingress and egress policies can be controlled independently based on PodSelector", feature.NetworkPolicy, func(ctx context.Context) { + protocols := []v1.Protocol{protocolTCP} + ports := []int32{80} + k8s = initializeResources(ctx, f, protocols, ports) + nsX, _, _ := getK8sNamespaces(k8s) + /* Test steps: 1. Verify every pod in every namespace can talk to each other @@ -1112,10 +1137,6 @@ var _ = common.SIGDescribe("Netpol", func() { allowEgressPolicy := GenNetworkPolicyWithNameAndPodSelector("allow-egress-for-target", metav1.LabelSelector{MatchLabels: targetLabels}, SetSpecEgressRules(networkingv1.NetworkPolicyEgressRule{})) - protocols := []v1.Protocol{protocolTCP} - ports := []int32{80} - k8s = initializeResources(ctx, f, protocols, ports) - nsX, _, _ := getK8sNamespaces(k8s) CreatePolicy(ctx, k8s, allowEgressPolicy, nsX) allowEgressReachability := NewReachability(k8s.AllPodStrings(), true) @@ -1161,14 +1182,15 @@ var _ = common.SIGDescribe("Netpol", func() { // security hole if you fail this test, because you are allowing TCP // traffic that is supposed to be blocked. f.It("should properly isolate pods that are selected by a policy allowing SCTP, even if the plugin doesn't support SCTP", feature.NetworkPolicy, func(ctx context.Context) { - ginkgo.By("Creating a network policy for the server which allows traffic only via SCTP on port 80.") - ingressRule := networkingv1.NetworkPolicyIngressRule{} - ingressRule.Ports = append(ingressRule.Ports, networkingv1.NetworkPolicyPort{Port: &intstr.IntOrString{IntVal: 80}, Protocol: &protocolSCTP}) - policy := GenNetworkPolicyWithNameAndPodMatchLabel("allow-only-sctp-ingress-on-port-80", map[string]string{"pod": "a"}, SetSpecIngressRules(ingressRule)) protocols := []v1.Protocol{protocolTCP} ports := []int32{81} k8s = initializeResources(ctx, f, protocols, ports) nsX, _, _ := getK8sNamespaces(k8s) + + ginkgo.By("Creating a network policy for the server which allows traffic only via SCTP on port 80.") + ingressRule := networkingv1.NetworkPolicyIngressRule{} + ingressRule.Ports = append(ingressRule.Ports, networkingv1.NetworkPolicyPort{Port: &intstr.IntOrString{IntVal: 80}, Protocol: &protocolSCTP}) + policy := GenNetworkPolicyWithNameAndPodMatchLabel("allow-only-sctp-ingress-on-port-80", map[string]string{"pod": "a"}, SetSpecIngressRules(ingressRule)) CreatePolicy(ctx, k8s, policy, nsX) ginkgo.By("Trying to connect to TCP port 81, which should be blocked by implicit isolation.") @@ -1178,13 +1200,14 @@ var _ = common.SIGDescribe("Netpol", func() { }) f.It("should not allow access by TCP when a policy specifies only UDP", feature.NetworkPolicy, func(ctx context.Context) { - ingressRule := networkingv1.NetworkPolicyIngressRule{} - ingressRule.Ports = append(ingressRule.Ports, networkingv1.NetworkPolicyPort{Port: &intstr.IntOrString{IntVal: 81}, Protocol: &protocolUDP}) - policy := GenNetworkPolicyWithNameAndPodMatchLabel("allow-only-udp-ingress-on-port-81", map[string]string{"pod": "a"}, SetSpecIngressRules(ingressRule)) protocols := []v1.Protocol{protocolTCP} ports := []int32{81} k8s = initializeResources(ctx, f, protocols, ports) nsX, _, _ := getK8sNamespaces(k8s) + + ingressRule := networkingv1.NetworkPolicyIngressRule{} + ingressRule.Ports = append(ingressRule.Ports, networkingv1.NetworkPolicyPort{Port: &intstr.IntOrString{IntVal: 81}, Protocol: &protocolUDP}) + policy := GenNetworkPolicyWithNameAndPodMatchLabel("allow-only-udp-ingress-on-port-81", map[string]string{"pod": "a"}, SetSpecIngressRules(ingressRule)) CreatePolicy(ctx, k8s, policy, nsX) ginkgo.By("Creating a network policy for the server which allows traffic only via UDP on port 81.") @@ -1201,6 +1224,7 @@ var _ = common.SIGDescribe("Netpol", func() { ports := []int32{80} k8s = initializeResources(ctx, f, protocols, ports) nsX, nsY, nsZ := getK8sNamespaces(k8s) + allowedLabels := &metav1.LabelSelector{ MatchLabels: map[string]string{ v1.LabelMetadataName: nsY, @@ -1224,6 +1248,7 @@ var _ = common.SIGDescribe("Netpol", func() { ports := []int32{80} k8s = initializeResources(ctx, f, protocols, ports) nsX, nsY, _ := getK8sNamespaces(k8s) + allowedNamespaces := &metav1.LabelSelector{ MatchExpressions: []metav1.LabelSelectorRequirement{{ Key: v1.LabelMetadataName, @@ -1260,6 +1285,7 @@ var _ = common.SIGDescribe("Netpol [LinuxOnly]", func() { ports := []int32{80} k8s = initializeResources(ctx, f, protocols, ports) nsX, _, _ := getK8sNamespaces(k8s) + policy := GenNetworkPolicyWithNameAndPodSelector("deny-all", metav1.LabelSelector{}, SetSpecIngressRules()) CreatePolicy(ctx, k8s, policy, nsX) @@ -1270,17 +1296,17 @@ var _ = common.SIGDescribe("Netpol [LinuxOnly]", func() { }) f.It("should enforce policy based on Ports", feature.NetworkPolicy, func(ctx context.Context) { - ginkgo.By("Creating a network policy allowPort81Policy which only allows allow listed namespaces (y) to connect on exactly one port (81)") protocols := []v1.Protocol{protocolUDP} ports := []int32{81} k8s = initializeResources(ctx, f, protocols, ports) nsX, nsY, nsZ := getK8sNamespaces(k8s) + + ginkgo.By("Creating a network policy allowPort81Policy which only allows allow listed namespaces (y) to connect on exactly one port (81)") allowedLabels := &metav1.LabelSelector{ MatchLabels: map[string]string{ namespaceLabelKey: nsY, }, } - ingressRule := networkingv1.NetworkPolicyIngressRule{} ingressRule.From = append(ingressRule.From, networkingv1.NetworkPolicyPeer{NamespaceSelector: allowedLabels}) ingressRule.Ports = append(ingressRule.Ports, networkingv1.NetworkPolicyPort{Port: &intstr.IntOrString{IntVal: 81}, Protocol: &protocolUDP}) @@ -1299,6 +1325,7 @@ var _ = common.SIGDescribe("Netpol [LinuxOnly]", func() { ports := []int32{80} k8s = initializeResources(ctx, f, protocols, ports) nsX, nsY, _ := getK8sNamespaces(k8s) + allowedNamespaces := &metav1.LabelSelector{ MatchLabels: map[string]string{ namespaceLabelKey: nsY, @@ -1329,7 +1356,7 @@ var _ = common.SIGDescribe("Netpol", feature.SCTPConnectivity, "[LinuxOnly]", fu f.NamespacePodSecurityLevel = admissionapi.LevelBaseline var k8s *kubeManager ginkgo.BeforeEach(func() { - // Windows does not support network policies. + // Windows does not support SCTP e2eskipper.SkipIfNodeOSDistroIs("windows") }) @@ -1340,6 +1367,7 @@ var _ = common.SIGDescribe("Netpol", feature.SCTPConnectivity, "[LinuxOnly]", fu ports := []int32{80} k8s = initializeResources(ctx, f, protocols, ports) nsX, _, _ := getK8sNamespaces(k8s) + policy := GenNetworkPolicyWithNameAndPodSelector("deny-all", metav1.LabelSelector{}, SetSpecIngressRules()) CreatePolicy(ctx, k8s, policy, nsX) @@ -1350,11 +1378,12 @@ var _ = common.SIGDescribe("Netpol", feature.SCTPConnectivity, "[LinuxOnly]", fu }) f.It("should enforce policy based on Ports", feature.NetworkPolicy, func(ctx context.Context) { - ginkgo.By("Creating a network allowPort81Policy which only allows allow listed namespaces (y) to connect on exactly one port (81)") protocols := []v1.Protocol{protocolSCTP} ports := []int32{81} k8s = initializeResources(ctx, f, protocols, ports) nsX, nsY, nsZ := getK8sNamespaces(k8s) + + ginkgo.By("Creating a network allowPort81Policy which only allows allow listed namespaces (y) to connect on exactly one port (81)") allowedLabels := &metav1.LabelSelector{ MatchLabels: map[string]string{ namespaceLabelKey: nsY, @@ -1378,6 +1407,7 @@ var _ = common.SIGDescribe("Netpol", feature.SCTPConnectivity, "[LinuxOnly]", fu ports := []int32{80} k8s = initializeResources(ctx, f, protocols, ports) nsX, nsY, _ := getK8sNamespaces(k8s) + allowedNamespaces := &metav1.LabelSelector{ MatchLabels: map[string]string{ namespaceLabelKey: nsY, @@ -1402,10 +1432,10 @@ var _ = common.SIGDescribe("Netpol", feature.SCTPConnectivity, "[LinuxOnly]", fu }) }) -// getNamespaceBaseNames returns the set of base namespace names used by this test, taking a root ns as input. +// getNamespaceNames returns the set of base namespace names used by this test, taking a root ns as input. // The framework will also append a unique suffix when creating the namespaces. // This allows tests to run in parallel. -func getNamespaceBaseNames(rootNs string) []string { +func getNamespaceNames(rootNs string) []string { if rootNs != "" { rootNs += "-" } @@ -1418,9 +1448,6 @@ func getNamespaceBaseNames(rootNs string) []string { // defaultModel creates a new "model" pod system under namespaces (x,y,z) which has pods a, b, and c. Thus resulting in the // truth table matrix that is identical for all tests, comprising 81 total connections between 9 pods (x/a, x/b, x/c, ..., z/c). func defaultModel(namespaces []string, protocols []v1.Protocol, ports []int32) *Model { - if framework.NodeOSDistroIs("windows") { - return NewWindowsModel(namespaces, []string{"a", "b", "c"}, ports) - } return NewModel(namespaces, []string{"a", "b", "c"}, ports, protocols) } @@ -1436,9 +1463,9 @@ func initializeCluster(ctx context.Context, f *framework.Framework, protocols [] k8s := newKubeManager(f, dnsDomain) rootNs := f.BaseName - namespaceBaseNames := getNamespaceBaseNames(rootNs) + namespaceNames := getNamespaceNames(rootNs) - model := defaultModel(namespaceBaseNames, protocols, ports) + model := defaultModel(namespaceNames, protocols, ports) framework.Logf("initializing cluster: ensuring namespaces, pods and services exist and are ready")