Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

k8sT/Egress: fixes #17581

Merged
merged 6 commits into from
Oct 18, 2021
Merged

k8sT/Egress: fixes #17581

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
98225f3
test: revert GenerateNamespaceForTest change
kkourt Oct 12, 2021
6fad8fc
k8sT/Egress: do kernel test at the beginning
kkourt Oct 12, 2021
09e36bb
k8sT/Egress: comment about deploying cilium twice
kkourt Oct 12, 2021
803af0c
k8sT/Egress: helper function for setting Context
kkourt Oct 12, 2021
37b1bdf
k8sT/Egress: simplify egress-ip-deployment.yaml
kkourt Oct 12, 2021
7e14347
k8sT/Egress: print egress list and nat table on fail
kkourt Oct 14, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
1 change: 0 additions & 1 deletion test/helpers/kubectl.go
View file
Open in desktop
Expand Up @@ -4297,7 +4297,6 @@ func GenerateNamespaceForTest(seed string) string {
replaced := strings.Replace(lowered, " ", "", -1)
replaced = strings.Replace(replaced, "_", "", -1)
replaced = strings.Replace(replaced, "/", "", -1)
replaced = strings.Replace(replaced, "-", "", -1)

timestamped := time.Now().Format("200601021504") + seed + replaced

Expand Down
175 changes: 63 additions & 112 deletions test/k8sT/Egress.go
View file
Open in desktop
Expand Up @@ -25,7 +25,7 @@ import (
)

var _ = SkipDescribeIf(func() bool {
return helpers.RunsOnEKS() || helpers.RunsOnGKE() || !helpers.RunsOn419OrLaterKernel() || helpers.DoesNotExistNodeWithoutCilium()
return helpers.RunsOnEKS() || helpers.RunsOnGKE() || helpers.DoesNotRunWithKubeProxyReplacement() || helpers.DoesNotExistNodeWithoutCilium()
}, "K8sEgressGatewayTest", func() {
var (
kubectl *helpers.Kubectl
Expand Down Expand Up @@ -77,9 +77,6 @@ var _ = SkipDescribeIf(func() bool {
}

BeforeAll(func() {
if helpers.DoesNotRunWithKubeProxyReplacement() {
Skip("EgressGatewayTest requires KubeProxyReplacement")
}

kubectl = helpers.CreateKubectl(helpers.K8s1VMName(), logger)

Expand All @@ -91,6 +88,8 @@ var _ = SkipDescribeIf(func() bool {

deploymentManager.SetKubectl(kubectl)

// We deploy cilium, to run the echo server and assign egress IP, and redeploy with
// different configurations for the tests.
ciliumFilename = helpers.TimestampFilename("cilium.yaml")
DeployCiliumAndDNS(kubectl, ciliumFilename)

Expand Down Expand Up @@ -166,127 +165,79 @@ var _ = SkipDescribeIf(func() bool {
Expect(res).Should(helpers.CMDSuccess(), "unable to apply %s", policyYAML)
}

Context("tunnel disabled with endpoint routes enabled", func() {
BeforeAll(func() {
DeployCiliumOptionsAndDNS(kubectl, ciliumFilename, map[string]string{
"egressGateway.enabled": "true",
"tunnel": "disabled",
"autoDirectNodeRoutes": "true",
"bpf.masquerade": "true",
"endpointRoutes.enabled": "true",
doContext := func(name string, ciliumOpts map[string]string) {
Context(name, func() {
BeforeAll(func() {
DeployCiliumOptionsAndDNS(kubectl, ciliumFilename, ciliumOpts)
randomNamespace = deploymentManager.DeployRandomNamespaceShared(DemoDaemonSet)
kubectl.NamespaceLabel(randomNamespace, namespaceSelector)
deploymentManager.WaitUntilReady()
})

randomNamespace = deploymentManager.DeployRandomNamespaceShared(DemoDaemonSet)
kubectl.NamespaceLabel(randomNamespace, namespaceSelector)
deploymentManager.WaitUntilReady()

})

AfterAll(func() {
deploymentManager.DeleteAll()
DeployCiliumAndDNS(kubectl, ciliumFilename)
})

It("Checks connectivity works without policy", func() {
testConnectivity(false)
testConnectivity(true)
})

It("Checks egress policy and basic connectivity both work", func() {
applyEgressPolicy()
kubectl.WaitForEgressPolicyEntry(k8s1IP, outsideIP)
kubectl.WaitForEgressPolicyEntry(k8s2IP, outsideIP)

defer kubectl.Delete(policyYAML)

testEgressGateway(true)
testEgressGateway(false)
testConnectivity(true)
testConnectivity(false)
})

})

Context("tunnel disabled with endpoint routes disabled", func() {

BeforeAll(func() {
DeployCiliumOptionsAndDNS(kubectl, ciliumFilename, map[string]string{
"egressGateway.enabled": "true",
"tunnel": "disabled",
"autoDirectNodeRoutes": "true",
"bpf.masquerade": "true",
"endpointRoutes.enabled": "false",
AfterAll(func() {
deploymentManager.DeleteAll()
DeployCiliumAndDNS(kubectl, ciliumFilename)
})

randomNamespace = deploymentManager.DeployRandomNamespaceShared(DemoDaemonSet)
kubectl.NamespaceLabel(randomNamespace, namespaceSelector)
deploymentManager.WaitUntilReady()
})

AfterAll(func() {
deploymentManager.DeleteAll()
DeployCiliumAndDNS(kubectl, ciliumFilename)
})

It("Checks connectivity works without policy", func() {
testConnectivity(false)
testConnectivity(true)
})

It("Checks egress policy and basic connectivity both work", func() {
applyEgressPolicy()
kubectl.WaitForEgressPolicyEntry(k8s1IP, outsideIP)
kubectl.WaitForEgressPolicyEntry(k8s2IP, outsideIP)

defer kubectl.Delete(policyYAML)

testEgressGateway(false)
testEgressGateway(true)
testConnectivity(false)
testConnectivity(true)
})

})

Context("tunnel vxlan", func() {

BeforeAll(func() {
DeployCiliumOptionsAndDNS(kubectl, ciliumFilename, map[string]string{
"egressGateway.enabled": "true",
"bpf.masquerade": "true",
"tunnel": "vxlan",
It("Checks connectivity works without policy", func() {
testConnectivity(false)
testConnectivity(true)
})

randomNamespace = deploymentManager.DeployRandomNamespaceShared(DemoDaemonSet)
kubectl.NamespaceLabel(randomNamespace, namespaceSelector)
deploymentManager.WaitUntilReady()
})
It("Checks egress policy and basic connectivity both work", func() {
applyEgressPolicy()
kubectl.WaitForEgressPolicyEntry(k8s1IP, outsideIP)
kubectl.WaitForEgressPolicyEntry(k8s2IP, outsideIP)

AfterAll(func() {
deploymentManager.DeleteAll()
DeployCiliumAndDNS(kubectl, ciliumFilename)
})
defer kubectl.Delete(policyYAML)

It("Checks connectivity works without policy", func() {
testConnectivity(false)
testConnectivity(true)
testEgressGateway(false)
testEgressGateway(true)
testConnectivity(false)
testConnectivity(true)
})
})
}

It("Checks egress policy and basic connectivity both work", func() {
applyEgressPolicy()
kubectl.WaitForEgressPolicyEntry(k8s1IP, outsideIP)
kubectl.WaitForEgressPolicyEntry(k8s2IP, outsideIP)

defer kubectl.Delete(policyYAML)
doContext("tunnel disabled with endpointRoutes enabled",
map[string]string{
"egressGateway.enabled": "true",
"bpf.masquerade": "true",
"tunnel": "disabled",
"autoDirectNodeRoutes": "true",
"endpointRoutes.enabled": "true",
},
)

testEgressGateway(false)
testEgressGateway(true)
testConnectivity(false)
testConnectivity(true)
})
doContext("tunnel disabled with endpointRoutes disabled",
map[string]string{
"egressGateway.enabled": "true",
"bpf.masquerade": "true",
"tunnel": "disabled",
"autoDirectNodeRoutes": "true",
"endpointRoutes.enabled": "false",
},
)

})
doContext("tunnel vxlan with endpointRoutes enabled",
map[string]string{
"egressGateway.enabled": "true",
"bpf.masquerade": "true",
"tunnel": "vxlan",
"autoDirectNodeRoutes": "false",
pchaigno marked this conversation as resolved.
Show resolved Hide resolved
"endpointRoutes.enabled": "true",
},
)

doContext("tunnel vxlan with endpointRoutes disabled",
map[string]string{
"egressGateway.enabled": "true",
"bpf.masquerade": "true",
"tunnel": "vxlan",
"autoDirectNodeRoutes": "false",
"endpointRoutes.enabled": "false",
},
)
})

// Use x.x.x.100 as the egress IP
Expand Down