- Use netutils.IsIPv6(ip) instead of manual nil/To4 check
- Remove unnecessary ip.To16() call since IPv6 is already 16 bytes
- Remove ipFamily from grep pattern since IP format ensures correctness
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
The /proc/net/nf_conntrack file uses fully expanded IPv6 addresses
with leading zeros in each 16-bit group. For example:
fc00:f853:ccd:e793::3 -> fc00:f853:0ccd:e793:0000:0000:0000:0003
Add expandIPv6ForConntrack() helper function to expand IPv6 addresses
to the format used by /proc/net/nf_conntrack before using them in
the grep pattern.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
The distroless-iptables image no longer includes the conntrack binary
as of v0.8.7 (removed in kubernetes/release#4223 since kube-proxy no
longer needs it after kubernetes#126847).
Update the KubeProxy CLOSE_WAIT timeout test to read /proc/net/nf_conntrack
directly instead of using the conntrack command. The file contains the
same connection tracking data and is accessible from the privileged
host-network pod.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
Finalizers do not work as expected when an informer with a field
selector is used. Any time a pod changing its state gets excluded by the
field selector a synthetic delete event is issues even though the pod
with a finalizer set is still present. Thus, making the scheduler
schedule the high and medium priority pods before any of the low
priority pod finalizers is removed. Instead, rely on preStop hook and
TerminationGracePeriodSeconds to keep all low priority pods long enough
included by the field selector so all high priority pods can set their
.status.nominatedNodeName field.
Also, update the check for how many medium priority pods are expected to
be scheduled. Each node can accept 10 pods of the given extended
resources. Given there's 5 high priority created per node, there's
always 5 times number of nodes spots left for the medium priority pods.
The controller is available only with SELinuxChangePolicy FG enabled.
Kubernetes e2e jobs do the right --focus & --skip explicitly in the SELinux
jobs, this just helps other test runners to figure out what FGs are needed
to run the tests.
When at it, I noticed SELinuxMountReadWriteOncePod tag is always required, so
add it on the common level and not in each test.
The existing TrafficDistribution test didn't really distinguish "same
zone" from "same node". Add another test that makes sure there are at
least 2 nodes in each zone so it can do that.
(Keep the original test as well to avoid losing coverage in CI systems
with single-schedulable-node-per-zone clusters.)
Split the logic of creating the clients and the servers apart from the
logic of checking which clients connect to which servers. Add some
extra complexity to support additional use cases (like multiple
endpoints on the same node).
Remove endpointSlicesHaveSameZoneHints check. We are testing that
connections end up at the right endpoints. We don't need to validate
_why_ they go to the right endpoints, which is already tested by other
tests anyway. (Also, validating the hints becomes more complicated in
the same-node case, where there may or may not also be same-zone hints
depending on cluster configuration.)
Remove DeferCleanup calls; we don't need to delete anything manually
because namespaced resources will automatically be deleted when the
test case's namespace is deleted.
Remove a setting of pod.NodeName that was redundant with
e2epod.SetNodeSelection().
