Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[ST] Add NetworkPolicies for OpenTelemetryST when running on OCP #9793

Merged
merged 1 commit into from
Mar 7, 2024
Merged

[ST] Add NetworkPolicies for OpenTelemetryST when running on OCP #9793

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
1 change: 1 addition & 0 deletions systemtest/src/main/java/io/strimzi/systemtest/TestConstants.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,6 +118,7 @@ public interface TestConstants {
* Deployment labels related constants
*/
String APP_POD_LABEL = "app";
String APP_KUBERNETES_INSTANCE_LABEL = "app.kubernetes.io/instance";

/**
* Label selectors for our resources
Expand Down
17 changes: 17 additions & 0 deletions systemtest/src/main/java/io/strimzi/systemtest/resources/jaeger/SetupJaeger.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@
import io.strimzi.systemtest.resources.NamespaceManager;
import io.strimzi.systemtest.resources.ResourceItem;
import io.strimzi.systemtest.resources.ResourceManager;
import io.strimzi.systemtest.resources.kubernetes.NetworkPolicyResource;
import io.strimzi.systemtest.utils.kubeUtils.controllers.DeploymentUtils;
import io.strimzi.test.TestUtils;
import io.strimzi.test.logs.CollectorElement;
Expand All @@ -20,6 +21,7 @@
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.Map;
import java.util.Stack;

import static io.strimzi.systemtest.TestConstants.JAEGER_DEPLOYMENT_POLL;
Expand All @@ -43,6 +45,8 @@ public class SetupJaeger {
private static final String CERT_MANAGER_PATH = TestUtils.USER_PATH + "/../systemtest/src/test/resources/tracing/cert-manager.yaml";
private static final String JAEGER_INSTANCE_PATH = TestUtils.USER_PATH + "/../systemtest/src/test/resources/tracing/jaeger-instance.yaml";
private static final String JAEGER_OPERATOR_PATH = TestUtils.USER_PATH + "/../systemtest/src/test/resources/tracing/jaeger-operator.yaml";
private static final String CERT_MANAGER = "cert-manager";
private static final String JAEGER = "jaeger";

/**
* Delete Jaeger instance
Expand All @@ -56,7 +60,17 @@ private static void deleteJaeger(String yamlContent) {
*/
public static void deployJaegerOperatorAndCertManager() {
deployAndWaitForCertManager();
allowNetworkPolicySettingsForCertManagerWebhook();
deployJaegerOperator();
allowNetworkPolicySettingsForJaegerOperator();
}

public static void allowNetworkPolicySettingsForJaegerOperator() {
NetworkPolicyResource.allowNetworkPolicySettingsForWebhook(Environment.TEST_SUITE_NAMESPACE, JAEGER_OPERATOR_DEPLOYMENT_NAME, Map.of("name", JAEGER_OPERATOR_DEPLOYMENT_NAME));
}

public static void allowNetworkPolicySettingsForCertManagerWebhook() {
NetworkPolicyResource.allowNetworkPolicySettingsForWebhook(CERT_MANAGER_NAMESPACE, CERT_MANAGER, Map.of(TestConstants.APP_KUBERNETES_INSTANCE_LABEL, CERT_MANAGER));
}

/**
Expand Down Expand Up @@ -165,5 +179,8 @@ public static void deployJaegerInstance(String namespaceName) {
ResourceManager.STORED_RESOURCES.get(ResourceManager.getTestContext().getDisplayName()).push(new ResourceItem<>(() -> cmdKubeClient(namespaceName).deleteContent(instanceYamlContent)));

DeploymentUtils.waitForDeploymentAndPodsReady(namespaceName, JAEGER_INSTANCE_NAME, 1);

NetworkPolicyResource.allowNetworkPolicyBetweenScraperPodAndMatchingLabel(namespaceName, JAEGER_INSTANCE_NAME + "-allow", Map.of(TestConstants.APP_POD_LABEL, JAEGER));
NetworkPolicyResource.allowNetworkPolicyAllIngressForMatchingLabel(namespaceName, JAEGER_INSTANCE_NAME + "-traces-allow", Map.of(TestConstants.APP_POD_LABEL, JAEGER));
}
}
30 changes: 3 additions & 27 deletions systemtest/src/main/java/io/strimzi/systemtest/resources/keycloak/SetupKeycloak.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,12 +9,12 @@
import io.fabric8.kubernetes.api.model.Secret;
import io.fabric8.kubernetes.api.model.SecretBuilder;
import io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicy;
import io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicyBuilder;
import io.strimzi.systemtest.Environment;
import io.strimzi.systemtest.TestConstants;
import io.strimzi.systemtest.keycloak.KeycloakInstance;
import io.strimzi.systemtest.resources.ResourceItem;
import io.strimzi.systemtest.resources.ResourceManager;
import io.strimzi.systemtest.resources.kubernetes.NetworkPolicyResource;
import io.strimzi.systemtest.templates.kubernetes.NetworkPolicyTemplates;
import io.strimzi.systemtest.utils.kubeUtils.controllers.DeploymentUtils;
import io.strimzi.systemtest.utils.kubeUtils.controllers.StatefulSetUtils;
Expand All @@ -33,6 +33,7 @@
import java.nio.file.Path;
import java.util.Base64;
import java.util.List;
import java.util.Map;

import static io.strimzi.test.k8s.KubeClusterResource.cmdKubeClient;
import static io.strimzi.test.k8s.KubeClusterResource.kubeClient;
Expand Down Expand Up @@ -80,7 +81,7 @@ public static KeycloakInstance deployKeycloakAndImportRealms(String namespaceNam
deployKeycloak(namespaceName);

KeycloakInstance keycloakInstance = createKeycloakInstance(namespaceName);
allowNetworkPolicySettingsForKeycloak(namespaceName);
NetworkPolicyResource.allowNetworkPolicyAllIngressForMatchingLabel(namespaceName, KEYCLOAK + "-allow", Map.of(TestConstants.APP_POD_LABEL, KEYCLOAK));
importRealms(namespaceName, keycloakInstance);

return keycloakInstance;
Expand Down Expand Up @@ -177,31 +178,6 @@ public static void allowNetworkPolicyBetweenKeycloakAndPostgres(String namespace
}
}

public static void allowNetworkPolicySettingsForKeycloak(String namespaceName) {
if (Environment.DEFAULT_TO_DENY_NETWORK_POLICIES) {
LOGGER.info("Apply NetworkPolicy access to {} from all Pods", KEYCLOAK);

NetworkPolicy networkPolicy = new NetworkPolicyBuilder()
.withApiVersion("networking.k8s.io/v1")
.withKind(TestConstants.NETWORK_POLICY)
.withNewMetadata()
.withName(KEYCLOAK + "-allow")
.withNamespace(namespaceName)
.endMetadata()
.editSpec()
// keeping ingress empty to allow all connections to the Keycloak Pod
.addNewIngress()
.endIngress()
.withNewPodSelector()
.addToMatchLabels(TestConstants.APP_POD_LABEL, KEYCLOAK)
.endPodSelector()
.endSpec()
.build();

ResourceManager.getInstance().createResourceWithWait(networkPolicy);
}
}

private static void deleteKeycloak(String namespaceName) {
LOGGER.info("Deleting Keycloak in Namespace: {}", namespaceName);
cmdKubeClient(namespaceName).delete(KEYCLOAK_INSTANCE_FILE_PATH);
Expand Down
74 changes: 74 additions & 0 deletions ...mtest/src/main/java/io/strimzi/systemtest/resources/kubernetes/NetworkPolicyResource.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@
import org.junit.jupiter.api.extension.ExtensionContext;

import java.util.List;
import java.util.Map;

import static io.strimzi.api.ResourceLabels.STRIMZI_KIND_LABEL;
import static io.strimzi.api.ResourceLabels.STRIMZI_NAME_LABEL;
Expand Down Expand Up @@ -130,6 +131,79 @@ public static void allowNetworkPolicySettingsForBridgeScraper(String namespace,
LOGGER.info("Network policy for LabelSelector {} successfully created", scraperLabelSelector);
}

public static void allowNetworkPolicyBetweenScraperPodAndMatchingLabel(String namespaceName, String policyName, Map<String, String> matchLabels) {
if (Environment.DEFAULT_TO_DENY_NETWORK_POLICIES) {
LabelSelector scraperLabelSelector = new LabelSelectorBuilder()
.addToMatchLabels(TestConstants.SCRAPER_LABEL_KEY, TestConstants.SCRAPER_LABEL_VALUE)
.build();

LOGGER.info("Apply NetworkPolicy access to matching Pods: {} from Scraper Pod", matchLabels.toString());

NetworkPolicy networkPolicy = NetworkPolicyTemplates.networkPolicyBuilder(namespaceName, policyName, scraperLabelSelector)
.editSpec()
.withNewPodSelector()
.addToMatchLabels(matchLabels)
.endPodSelector()
.endSpec()
.build();

ResourceManager.getInstance().createResourceWithWait(networkPolicy);
}
}

public static void allowNetworkPolicyAllIngressForMatchingLabel(String namespaceName, String policyName, Map<String, String> matchLabels) {
if (Environment.DEFAULT_TO_DENY_NETWORK_POLICIES) {
LOGGER.info("Apply NetworkPolicy with Ingress to accept all connections to the Pods matching labels: {}", matchLabels.toString());

NetworkPolicy networkPolicy = new NetworkPolicyBuilder()
.withApiVersion("networking.k8s.io/v1")
.withKind(TestConstants.NETWORK_POLICY)
.withNewMetadata()
.withName(policyName)
.withNamespace(namespaceName)
.endMetadata()
.editSpec()
// keeping ingress empty to allow all connections
.addNewIngress()
.endIngress()
.withNewPodSelector()
.addToMatchLabels(matchLabels)
.endPodSelector()
.endSpec()
.build();

ResourceManager.getInstance().createResourceWithWait(networkPolicy);
}
}

public static void allowNetworkPolicySettingsForWebhook(String namespaceName, String name, Map<String, String> matchLabels) {
if (Environment.DEFAULT_TO_DENY_NETWORK_POLICIES) {
LOGGER.info("Apply NetworkPolicy access to {} from all Pods", matchLabels.toString());

NetworkPolicy networkPolicy = new NetworkPolicyBuilder()
.withApiVersion("networking.k8s.io/v1")
.withKind(TestConstants.NETWORK_POLICY)
.withNewMetadata()
.withName(name)
.withNamespace(namespaceName)
.endMetadata()
.editSpec()
// keeping ingress empty to allow all connections to the Keycloak Pod
.addNewIngress()
.addNewFrom()
.withNamespaceSelector(new LabelSelector())
.endFrom()
.endIngress()
.withNewPodSelector()
.addToMatchLabels(matchLabels)
.endPodSelector()
.endSpec()
.build();

ResourceManager.getInstance().createResourceWithWait(networkPolicy);
}
}

/**
* Method for allowing network policies for Connect
* @param resource mean Connect resource
Expand Down