Skip to content

Commit 530b42a

Browse files
zeekezeeke
committed
e2e: Multiple namespaces
A networkpolicy can refer to multiple NADs, which can be in different namespaces. Create an end2end test case that involves pods from multiple namespaces. Signed-off-by: Andrea Panattoni <[email protected]>
1 parent 42bf16c commit 530b42a

File tree

2 files changed

+240
-0
lines changed

2 files changed

+240
-0
lines changed

‎e2e/tests/multi-namespace-multinet.bats‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
#!/usr/bin/env bats
2+
3+
# Note:
4+
# This test case creates two namespaces, each with a different NetworkAttachmentDefinition
5+
# and two pods per namespace. It tests that MultiNetworkPolicy works correctly across
6+
# different namespaces with different network configurations.
7+
8+
setup() {
9+
cd $BATS_TEST_DIRNAME
10+
load "common"
11+
pod_a1_net1=$(get_net1_ip "test-namespace-a" "pod-a-1")
12+
pod_a2_net1=$(get_net1_ip "test-namespace-a" "pod-a-2")
13+
14+
pod_b1_net1=$(get_net1_ip "test-namespace-b" "pod-b-1")
15+
pod_b2_net1=$(get_net1_ip "test-namespace-b" "pod-b-2")
16+
17+
}
18+
19+
@test "setup multi-namespace test environments" {
20+
# create test manifests
21+
kubectl create -f multi-namespace-multinet.yml
22+
23+
# verify all pods in namespace A are available
24+
run kubectl -n test-namespace-a wait --all --for=condition=ready pod --timeout=${kubewait_timeout}
25+
[ "$status" -eq "0" ]
26+
27+
# verify all pods in namespace B are available
28+
run kubectl -n test-namespace-b wait --all --for=condition=ready pod --timeout=${kubewait_timeout}
29+
[ "$status" -eq "0" ]
30+
31+
# wait for the iptables to be synced
32+
sleep 3
33+
}
34+
35+
@test "Allowed connectivity" {
36+
run kubectl -n test-namespace-b exec pod-b-1 -- sh -c "echo x | nc -w 1 ${pod_a1_net1} 5555"
37+
[ "$status" -eq "0" ]
38+
39+
run kubectl -n test-namespace-a exec pod-a-1 -- sh -c "echo x | nc -w 1 ${pod_b2_net1} 5555"
40+
[ "$status" -eq "0" ]
41+
}
42+
43+
@test "Denied connectivity" {
44+
run kubectl -n test-namespace-a exec pod-a-1 -- sh -c "echo x | nc -w 1 ${pod_a2_net1} 5555"
45+
[ "$status" -eq "1" ]
46+
47+
run kubectl -n test-namespace-a exec pod-a-1 -- sh -c "echo x | nc -w 1 ${pod_b1_net1} 5555"
48+
[ "$status" -eq "1" ]
49+
50+
run kubectl -n test-namespace-b exec pod-a-2 -- sh -c "echo x | nc -w 1 ${pod_a1_net1} 5555"
51+
[ "$status" -eq "1" ]
52+
53+
run kubectl -n test-namespace-b exec pod-b-2 -- sh -c "echo x | nc -w 1 ${pod_a1_net1} 5555"
54+
[ "$status" -eq "1" ]
55+
}
56+
57+
@test "Allowed by policy absence" {
58+
run kubectl -n test-namespace-a exec pod-a-2 -- sh -c "echo x | nc -w 1 ${pod_b1_net1} 5555"
59+
[ "$status" -eq "0" ]
60+
61+
run kubectl -n test-namespace-b exec pod-b-1 -- sh -c "echo x | nc -w 1 ${pod_a2_net1} 5555"
62+
[ "$status" -eq "0" ]
63+
64+
run kubectl -n test-namespace-a exec pod-a-2 -- sh -c "echo x | nc -w 1 ${pod_b2_net1} 5555"
65+
[ "$status" -eq "0" ]
66+
67+
run kubectl -n test-namespace-b exec pod-b-1 -- sh -c "echo x | nc -w 1 ${pod_b2_net1} 5555"
68+
[ "$status" -eq "0" ]
69+
70+
run kubectl -n test-namespace-b exec pod-b-1 -- sh -c "echo x | nc -w 1 ${pod_b2_net1} 5555"
71+
[ "$status" -eq "0" ]
72+
73+
run kubectl -n test-namespace-b exec pod-b-2 -- sh -c "echo x | nc -w 1 ${pod_b1_net1} 5555"
74+
[ "$status" -eq "0" ]
75+
}
76+
77+
@test "cleanup environments" {
78+
# remove test manifests
79+
kubectl delete -f multi-namespace-multinet.yml
80+
run kubectl -n test-namespace-a wait --all --for=delete pod --timeout=${kubewait_timeout}
81+
[ "$status" -eq "0" ]
82+
run kubectl -n test-namespace-b wait --all --for=delete pod --timeout=${kubewait_timeout}
83+
[ "$status" -eq "0" ]
84+
85+
sleep 5
86+
# check that no iptables files in pod-iptables
87+
pod_name=$(kubectl -n kube-system get pod -o wide | grep 'kind-worker' | grep multi-net | cut -f 1 -d ' ')
88+
run kubectl -n kube-system exec ${pod_name} -- \
89+
sh -c "find /var/lib/multi-networkpolicy/iptables/ -name '*.iptables' | wc -l"
90+
[ "$output" = "0" ]
91+
}

‎e2e/tests/multi-namespace-multinet.yml‎

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: test-namespace-a
5+
---
6+
apiVersion: v1
7+
kind: Namespace
8+
metadata:
9+
name: test-namespace-b
10+
---
11+
apiVersion: "k8s.cni.cncf.io/v1"
12+
kind: NetworkAttachmentDefinition
13+
metadata:
14+
namespace: test-namespace-a
15+
name: macvlan1-namespace-a
16+
spec:
17+
config: '{
18+
"cniVersion": "0.3.1",
19+
"name": "macvlan1-namespace-a",
20+
"plugins": [
21+
{
22+
"type": "macvlan",
23+
"mode": "bridge",
24+
"ipam":{
25+
"type":"host-local",
26+
"subnet":"2.2.10.0/24",
27+
"rangeStart":"2.2.10.10",
28+
"rangeEnd":"2.2.10.19"
29+
}
30+
}]
31+
}'
32+
---
33+
apiVersion: "k8s.cni.cncf.io/v1"
34+
kind: NetworkAttachmentDefinition
35+
metadata:
36+
namespace: test-namespace-b
37+
name: macvlan1-namespace-b
38+
spec:
39+
config: '{
40+
"cniVersion": "0.3.1",
41+
"name": "macvlan1-namespace-b",
42+
"plugins": [
43+
{
44+
"type": "macvlan",
45+
"mode": "bridge",
46+
"ipam":{
47+
"type":"host-local",
48+
"subnet":"2.2.10.0/24",
49+
"rangeStart":"2.2.10.20",
50+
"rangeEnd":"2.2.10.29"
51+
}
52+
}]
53+
}'
54+
---
55+
56+
# Pods in namespace A
57+
apiVersion: v1
58+
kind: Pod
59+
metadata:
60+
name: pod-a-1
61+
namespace: test-namespace-a
62+
annotations:
63+
k8s.v1.cni.cncf.io/networks: macvlan1-namespace-a
64+
labels:
65+
name: pod-a-1
66+
spec:
67+
containers:
68+
- name: macvlan-worker1
69+
image: ghcr.io/k8snetworkplumbingwg/multi-networkpolicy-iptables:e2e-test
70+
command: ["nc", "-klp", "5555"]
71+
securityContext:
72+
privileged: true
73+
---
74+
apiVersion: v1
75+
kind: Pod
76+
metadata:
77+
name: pod-a-2
78+
namespace: test-namespace-a
79+
annotations:
80+
k8s.v1.cni.cncf.io/networks: macvlan1-namespace-a
81+
labels:
82+
name: pod-a-2
83+
spec:
84+
containers:
85+
- name: macvlan-worker1
86+
image: ghcr.io/k8snetworkplumbingwg/multi-networkpolicy-iptables:e2e-test
87+
command: ["nc", "-klp", "5555"]
88+
securityContext:
89+
privileged: true
90+
---
91+
# Pods in namespace B
92+
apiVersion: v1
93+
kind: Pod
94+
metadata:
95+
name: pod-b-1
96+
namespace: test-namespace-b
97+
annotations:
98+
k8s.v1.cni.cncf.io/networks: macvlan1-namespace-b
99+
labels:
100+
name: pod-b-1
101+
spec:
102+
containers:
103+
- name: macvlan-worker1
104+
image: ghcr.io/k8snetworkplumbingwg/multi-networkpolicy-iptables:e2e-test
105+
command: ["nc", "-klp", "5555"]
106+
securityContext:
107+
privileged: true
108+
---
109+
apiVersion: v1
110+
kind: Pod
111+
metadata:
112+
name: pod-b-2
113+
namespace: test-namespace-b
114+
annotations:
115+
k8s.v1.cni.cncf.io/networks: macvlan1-namespace-b
116+
labels:
117+
name: pod-b-2
118+
spec:
119+
containers:
120+
- name: macvlan-worker1
121+
image: ghcr.io/k8snetworkplumbingwg/multi-networkpolicy-iptables:e2e-test
122+
command: ["nc", "-klp", "5555"]
123+
securityContext:
124+
privileged: true
125+
---
126+
apiVersion: k8s.cni.cncf.io/v1beta1
127+
kind: MultiNetworkPolicy
128+
metadata:
129+
name: test-multinetwork-policy-namespace-a
130+
namespace: test-namespace-a
131+
annotations:
132+
k8s.v1.cni.cncf.io/policy-for: test-namespace-a/macvlan1-namespace-a,test-namespace-b/macvlan1-namespace-b
133+
spec:
134+
podSelector:
135+
matchLabels:
136+
name: pod-a-1
137+
ingress:
138+
- from:
139+
- podSelector:
140+
matchLabels:
141+
name: pod-b-1
142+
egress:
143+
- to:
144+
- podSelector:
145+
matchLabels:
146+
name: pod-b-2
147+
policyTypes:
148+
- Ingress
149+
- Egress

0 commit comments

Comments
 (0)