CFE-853: e2e test case for DNSNameResolver and EgressFirewall integra…

…tion

test/extended/networking/egress_firewall.go

@@ -22,9 +22,11 @@ import (
 const (
 	egressFWTestPod      = "egressfirewall"
 	egressFWE2E          = "egress-firewall-e2e"
+	wcEgressFWE2E        = "wildcard-egress-firewall-e2e"
 	noEgressFWE2E        = "no-egress-firewall-e2e"
 	egressFWTestImage    = "registry.k8s.io/e2e-test-images/agnhost:2.47"
 	oVNKManifest         = "ovnk-egressfirewall-test.yaml"
+	oVNKWCManifest       = "ovnk-egressfirewall-wildcard-test.yaml"
 	openShiftSDNManifest = "sdn-egressnetworkpolicy-test.yaml"
 )
 
@@ -49,6 +51,25 @@ var _ = g.Describe("[sig-network][Feature:EgressFirewall]", func() {
 			})
 		},
 	)
+
+	// When OVNKubernetes subnet and coredns-ocp-dnsnameresolver plugins are enabled.
+	// coredns-ocp-dnsnameresolver plugin is a TechPreview feature.
+	// TODO:
+	// - Remove TechPreview check when feature is GA.
+	// - Merge oVNKManifest & oVNKWCManifest contents.
+	// - Update doEgressFwTest and sendEgressFwTraffic functions.
+	wcEgFwOc := exutil.NewCLIWithPodSecurityLevel(wcEgressFWE2E, admissionapi.LevelPrivileged)
+	wcEgFwF := wcEgFwOc.KubeFramework()
+	if exutil.IsTechPreviewNoUpgrade(egFwoc) {
+		InOVNKubernetesContext(
+			func() {
+				g.It("should ensure egressfirewall with wildcard dns rules is created", func() {
+					doEgressFwTest(wcEgFwF, wcEgFwOc, oVNKWCManifest, true)
+				})
+			},
+		)
+	}
+
 	noegFwoc := exutil.NewCLIWithPodSecurityLevel(noEgressFWE2E, admissionapi.LevelBaseline)
 	noegFwf := noegFwoc.KubeFramework()
 	g.It("egressFirewall should have no impact outside its namespace", func() {
@@ -128,6 +149,21 @@ func sendEgressFwTraffic(f *e2e.Framework, oc *exutil.CLI, pod string, nodeSelec
 	_, err = oc.Run("exec").Args(pod, "--", "curl", "-q", "-s", "-I", "-m3", "https://docs.openshift.com").Output()
 	expectNoError(err)
 
+	// TODO:
+	// - Check for coredns-ocp-dnsnameresolver plugin.
+	// - Remove TechPreview check when feature is GA.
+	if networkPluginName() == OVNKubernetesPluginName && exutil.IsTechPreviewNoUpgrade(oc) {
+		// Test curl to `www.google.com` and `translate.google.com` should pass
+		// because we have allow dns rule for `*.google.com`.
+		g.By("sending traffic to `www.google.com` that matches allow dns rule for `*.google.com`")
+		_, err = oc.Run("exec").Args(pod, "--", "curl", "-q", "-s", "-I", "-m3", "https://www.google.com").Output()
+		expectNoError(err)
+
+		g.By("sending traffic to `translate.google.com` that matches allow dns rule for `*.google.com`")
+		_, err = oc.Run("exec").Args(pod, "--", "curl", "-q", "-s", "-I", "-m3", "https://translate.google.com").Output()
+		expectNoError(err)
+	}
+
 	// Test curl to www.google.com:80 should fail
 	// because we don't have allow dns rule for www.google.com:80
 	g.By("sending traffic that does not match allow dns rule")

test/extended/testdata/egress-firewall/ovnk-egressfirewall-wildcard-test.yaml

@@ -0,0 +1,23 @@
+apiVersion: k8s.ovn.org/v1
+kind: EgressFirewall
+metadata:
+  name: default
+spec:
+  egress:
+  - type: Allow
+    to:
+      dnsName: docs.openshift.com
+  - type: Allow
+    to:
+      dnsName: "*.google.com"
+  - type: Allow
+    to:
+      cidrSelector: 8.8.8.8/32
+  - type: Allow
+    to:
+      nodeSelector:
+        matchLabels:
+          node-role.kubernetes.io/control-plane: ''
+  - type: Deny
+    to:
+      cidrSelector: 0.0.0.0/0