Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

k8sT/Egress: fixes #17581

Merged
merged 6 commits into from
Oct 18, 2021
Merged

k8sT/Egress: fixes #17581

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
98225f3
test: revert GenerateNamespaceForTest change
kkourt Oct 12, 2021
6fad8fc
k8sT/Egress: do kernel test at the beginning
kkourt Oct 12, 2021
09e36bb
k8sT/Egress: comment about deploying cilium twice
kkourt Oct 12, 2021
803af0c
k8sT/Egress: helper function for setting Context
kkourt Oct 12, 2021
37b1bdf
k8sT/Egress: simplify egress-ip-deployment.yaml
kkourt Oct 12, 2021
7e14347
k8sT/Egress: print egress list and nat table on fail
kkourt Oct 14, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
1 change: 0 additions & 1 deletion test/helpers/kubectl.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4297,7 +4297,6 @@ func GenerateNamespaceForTest(seed string) string {
replaced := strings.Replace(lowered, " ", "", -1)
replaced = strings.Replace(replaced, "_", "", -1)
replaced = strings.Replace(replaced, "/", "", -1)
replaced = strings.Replace(replaced, "-", "", -1)

timestamped := time.Now().Format("200601021504") + seed + replaced

Expand Down
177 changes: 64 additions & 113 deletions test/k8sT/Egress.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ import (
)

var _ = SkipDescribeIf(func() bool {
return helpers.RunsOnEKS() || helpers.RunsOnGKE() || !helpers.RunsOn419OrLaterKernel() || helpers.DoesNotExistNodeWithoutCilium()
return helpers.RunsOnEKS() || helpers.RunsOnGKE() || helpers.DoesNotRunWithKubeProxyReplacement() || helpers.DoesNotExistNodeWithoutCilium()
}, "K8sEgressGatewayTest", func() {
var (
kubectl *helpers.Kubectl
Expand Down Expand Up @@ -77,9 +77,6 @@ var _ = SkipDescribeIf(func() bool {
}

BeforeAll(func() {
if helpers.DoesNotRunWithKubeProxyReplacement() {
Skip("EgressGatewayTest requires KubeProxyReplacement")
}

kubectl = helpers.CreateKubectl(helpers.K8s1VMName(), logger)

Expand All @@ -91,6 +88,8 @@ var _ = SkipDescribeIf(func() bool {

deploymentManager.SetKubectl(kubectl)

// We deploy cilium, to run the echo server and assign egress IP, and redeploy with
// different configurations for the tests.
ciliumFilename = helpers.TimestampFilename("cilium.yaml")
DeployCiliumAndDNS(kubectl, ciliumFilename)

Expand All @@ -107,7 +106,7 @@ var _ = SkipDescribeIf(func() bool {

AfterFailed(func() {
// Especially check if there are duplicated address allocated on cilium_host
kubectl.CiliumReport("ip addr")
kubectl.CiliumReport("ip addr", "cilium bpf egress list", "cilium bpf nat list")
})

testEgressGateway := func(fromGateway bool) {
Expand Down Expand Up @@ -166,127 +165,79 @@ var _ = SkipDescribeIf(func() bool {
Expect(res).Should(helpers.CMDSuccess(), "unable to apply %s", policyYAML)
}

Context("tunnel disabled with endpoint routes enabled", func() {
BeforeAll(func() {
DeployCiliumOptionsAndDNS(kubectl, ciliumFilename, map[string]string{
"egressGateway.enabled": "true",
"tunnel": "disabled",
"autoDirectNodeRoutes": "true",
"bpf.masquerade": "true",
"endpointRoutes.enabled": "true",
doContext := func(name string, ciliumOpts map[string]string) {
Context(name, func() {
BeforeAll(func() {
DeployCiliumOptionsAndDNS(kubectl, ciliumFilename, ciliumOpts)
randomNamespace = deploymentManager.DeployRandomNamespaceShared(DemoDaemonSet)
kubectl.NamespaceLabel(randomNamespace, namespaceSelector)
deploymentManager.WaitUntilReady()
})

randomNamespace = deploymentManager.DeployRandomNamespaceShared(DemoDaemonSet)
kubectl.NamespaceLabel(randomNamespace, namespaceSelector)
deploymentManager.WaitUntilReady()

})

AfterAll(func() {
deploymentManager.DeleteAll()
DeployCiliumAndDNS(kubectl, ciliumFilename)
})

It("Checks connectivity works without policy", func() {
testConnectivity(false)
testConnectivity(true)
})

It("Checks egress policy and basic connectivity both work", func() {
applyEgressPolicy()
kubectl.WaitForEgressPolicyEntry(k8s1IP, outsideIP)
kubectl.WaitForEgressPolicyEntry(k8s2IP, outsideIP)

defer kubectl.Delete(policyYAML)

testEgressGateway(true)
testEgressGateway(false)
testConnectivity(true)
testConnectivity(false)
})

})

Context("tunnel disabled with endpoint routes disabled", func() {

BeforeAll(func() {
DeployCiliumOptionsAndDNS(kubectl, ciliumFilename, map[string]string{
"egressGateway.enabled": "true",
"tunnel": "disabled",
"autoDirectNodeRoutes": "true",
"bpf.masquerade": "true",
"endpointRoutes.enabled": "false",
AfterAll(func() {
deploymentManager.DeleteAll()
DeployCiliumAndDNS(kubectl, ciliumFilename)
})

randomNamespace = deploymentManager.DeployRandomNamespaceShared(DemoDaemonSet)
kubectl.NamespaceLabel(randomNamespace, namespaceSelector)
deploymentManager.WaitUntilReady()
})

AfterAll(func() {
deploymentManager.DeleteAll()
DeployCiliumAndDNS(kubectl, ciliumFilename)
})

It("Checks connectivity works without policy", func() {
testConnectivity(false)
testConnectivity(true)
})

It("Checks egress policy and basic connectivity both work", func() {
applyEgressPolicy()
kubectl.WaitForEgressPolicyEntry(k8s1IP, outsideIP)
kubectl.WaitForEgressPolicyEntry(k8s2IP, outsideIP)

defer kubectl.Delete(policyYAML)

testEgressGateway(false)
testEgressGateway(true)
testConnectivity(false)
testConnectivity(true)
})

})

Context("tunnel vxlan", func() {

BeforeAll(func() {
DeployCiliumOptionsAndDNS(kubectl, ciliumFilename, map[string]string{
"egressGateway.enabled": "true",
"bpf.masquerade": "true",
"tunnel": "vxlan",
It("Checks connectivity works without policy", func() {
testConnectivity(false)
testConnectivity(true)
})

randomNamespace = deploymentManager.DeployRandomNamespaceShared(DemoDaemonSet)
kubectl.NamespaceLabel(randomNamespace, namespaceSelector)
deploymentManager.WaitUntilReady()
})
It("Checks egress policy and basic connectivity both work", func() {
applyEgressPolicy()
kubectl.WaitForEgressPolicyEntry(k8s1IP, outsideIP)
kubectl.WaitForEgressPolicyEntry(k8s2IP, outsideIP)

AfterAll(func() {
deploymentManager.DeleteAll()
DeployCiliumAndDNS(kubectl, ciliumFilename)
})
defer kubectl.Delete(policyYAML)

It("Checks connectivity works without policy", func() {
testConnectivity(false)
testConnectivity(true)
testEgressGateway(false)
testEgressGateway(true)
testConnectivity(false)
testConnectivity(true)
})
})
}

It("Checks egress policy and basic connectivity both work", func() {
applyEgressPolicy()
kubectl.WaitForEgressPolicyEntry(k8s1IP, outsideIP)
kubectl.WaitForEgressPolicyEntry(k8s2IP, outsideIP)

defer kubectl.Delete(policyYAML)
doContext("tunnel disabled with endpointRoutes enabled",
map[string]string{
"egressGateway.enabled": "true",
"bpf.masquerade": "true",
"tunnel": "disabled",
"autoDirectNodeRoutes": "true",
"endpointRoutes.enabled": "true",
},
)

testEgressGateway(false)
testEgressGateway(true)
testConnectivity(false)
testConnectivity(true)
})
doContext("tunnel disabled with endpointRoutes disabled",
map[string]string{
"egressGateway.enabled": "true",
"bpf.masquerade": "true",
"tunnel": "disabled",
"autoDirectNodeRoutes": "true",
"endpointRoutes.enabled": "false",
},
)

})
doContext("tunnel vxlan with endpointRoutes enabled",
map[string]string{
"egressGateway.enabled": "true",
"bpf.masquerade": "true",
"tunnel": "vxlan",
"autoDirectNodeRoutes": "false",
pchaigno marked this conversation as resolved.
Show resolved Hide resolved
"endpointRoutes.enabled": "true",
},
)

doContext("tunnel vxlan with endpointRoutes disabled",
map[string]string{
"egressGateway.enabled": "true",
"bpf.masquerade": "true",
"tunnel": "vxlan",
"autoDirectNodeRoutes": "false",
"endpointRoutes.enabled": "false",
},
)
})

// Use x.x.x.100 as the egress IP
Expand Down
6 changes: 3 additions & 3 deletions test/k8sT/manifests/egress-ip-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,14 +25,14 @@ spec:
securityContext:
privileged: true
env:
- name: EGRESS_IPS
- name: EGRESS_IP
value: "INPUT_EGRESS_IP/24"
args:
- "for i in $EGRESS_IPS; do ip address add $i dev enp0s8; done; sleep 10000000"
- "ip address add $EGRESS_IP dev enp0s8; sleep inf"
lifecycle:
preStop:
exec:
command:
- "/bin/sh"
- "-c"
- "for i in $EGRESS_IPS; do ip address del $i dev enp0s8; done"
- "ip address del $EGRESS_IP dev enp0s8"