Skip to content

Commit

Permalink
Fix L7 NetworkPolicy e2e test failure
Browse files Browse the repository at this point in the history
Fix antrea-io#6129

In the failure tests, the following function is called to
verify whether a connection should be allowed or denied.
To verify a connection should be denied, it requires 5 seconds.

```
func probeClientIPFromPod(data *TestData, pod, container string, baseUrl string) (string, error) {
	url := fmt.Sprintf("%s/%s", baseUrl, "clientip")
	hostPort, _, err := data.runWgetCommandFromTestPodWithRetry(pod, data.testNamespace, container, url, 5)
	if err != nil {
		return "", err
	}
	host, _, err := net.SplitHostPort(hostPort)
	return host, err
}
```

Before antrea-io#5843, these e2e tests utilized the function PollImmediate
from k8s.io/apimachinery/pkg/util/wait, which immediately calls an
anonymous function including the above function. Since the timeout
is 5 seconds, and the ticker time is 1 second, and the anonymous
function runs immediately, the 5-second timeout is sufficient to
verify the denied state of a connection as mentioned above. However,
after antrea-io#5843, the function `Eventually` from github.com/stretchr/testify/assert
is used with the same parameters, which implies that the anonymous
function runs after the first ticker time, leaving 4 seconds. 4 seconds
are insufficient to verify the denied state of a connection.

To resolve the issue, the timeout should be adjusted to be more than
5 seconds.

Signed-off-by: Hongliang Liu <lhongliang@vmware.com>
  • Loading branch information
hongliangl committed Mar 22, 2024
1 parent df82b76 commit 0bf62c9
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions test/e2e/l7networkpolicy_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -134,7 +134,7 @@ func probeL7NetworkPolicyHTTP(t *testing.T, data *TestData, serverPodName, clien
return false
}
return true
}, 5*time.Second, time.Second)
}, 10*time.Second, time.Second)

// Verify that access to path /hostname is as expected.
assert.Eventually(t, func() bool {
Expand All @@ -146,7 +146,7 @@ func probeL7NetworkPolicyHTTP(t *testing.T, data *TestData, serverPodName, clien
return false
}
return true
}, 5*time.Second, time.Second)
}, 10*time.Second, time.Second)

// For IPv4, non-HTTP connections should be rejected by Suricata. For IPv6, there is an issue that reject
// packet cannot be generated by Suricata and sent back to client.
Expand Down

0 comments on commit 0bf62c9

Please sign in to comment.