Enforcing Service external IPs (#161)

e2e/allowed_external_ips_test.go

@@ -0,0 +1,155 @@
+//+build e2e
+
+/*
+Copyright 2020 Clastix Labs.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e
+
+import (
+	"context"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+
+	"github.com/clastix/capsule/api/v1alpha1"
+)
+
+var _ = Describe("enforcing an allowed set of Service External IPs", func() {
+	tnt := &v1alpha1.Tenant{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "allowed-external-ip",
+		},
+		Spec: v1alpha1.TenantSpec{
+			Owner: v1alpha1.OwnerSpec{
+				Name: "google",
+				Kind: "User",
+			},
+			ExternalServiceIPs: &v1alpha1.ExternalServiceIPs{
+				Allowed: []v1alpha1.AllowedIp{
+					"10.20.0.0/16",
+					"192.168.1.2/32",
+				},
+			},
+		},
+	}
+	JustBeforeEach(func() {
+		EventuallyCreation(func() error {
+			return k8sClient.Create(context.TODO(), tnt.DeepCopy())
+		}).Should(Succeed())
+	})
+	JustAfterEach(func() {
+		Expect(k8sClient.Delete(context.TODO(), tnt.DeepCopy())).Should(Succeed())
+	})
+	It("should fail creating an evil service", func() {
+		ns := NewNamespace("evil-service")
+		NamespaceCreation(ns, tnt, defaultTimeoutInterval).Should(Succeed())
+
+		svc := &corev1.Service{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "my-evil-dns-server",
+			},
+			Spec: corev1.ServiceSpec{
+				Ports: []corev1.ServicePort{
+					{
+						Name:       "dns",
+						Protocol:   "UDP",
+						Port:       53,
+						TargetPort: intstr.FromInt(9053),
+					},
+				},
+				Selector: map[string]string{
+					"app": "my-evil-dns-server",
+				},
+				ExternalIPs: []string{
+					"8.8.8.8",
+					"8.8.4.4",
+				},
+			},
+		}
+		EventuallyCreation(func() error {
+			cs := ownerClient(tnt)
+			_, err := cs.CoreV1().Services(ns.Name).Create(context.Background(), svc, metav1.CreateOptions{})
+			return err
+		}).ShouldNot(Succeed())
+	})
+	It("should allow the first CIDR block", func() {
+		ns := NewNamespace("allowed-service-cidr")
+		NamespaceCreation(ns, tnt, defaultTimeoutInterval).Should(Succeed())
+
+		svc := &corev1.Service{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "dns-server",
+			},
+			Spec: corev1.ServiceSpec{
+				Ports: []corev1.ServicePort{
+					{
+						Name:       "dns",
+						Protocol:   "UDP",
+						Port:       53,
+						TargetPort: intstr.FromInt(9053),
+					},
+				},
+				Selector: map[string]string{
+					"app": "dns-server",
+				},
+				ExternalIPs: []string{
+					"10.20.0.0",
+					"10.20.255.255",
+				},
+			},
+		}
+		EventuallyCreation(func() error {
+			cs := ownerClient(tnt)
+			_, err := cs.CoreV1().Services(ns.Name).Create(context.Background(), svc, metav1.CreateOptions{})
+			return err
+		}).Should(Succeed())
+	})
+
+	It("should allow the /32 CIDR block", func() {
+		ns := NewNamespace("allowed-service-strict")
+		NamespaceCreation(ns, tnt, defaultTimeoutInterval).Should(Succeed())
+
+		svc := &corev1.Service{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "dns-server",
+			},
+			Spec: corev1.ServiceSpec{
+				Ports: []corev1.ServicePort{
+					{
+						Name:       "dns",
+						Protocol:   "UDP",
+						Port:       53,
+						TargetPort: intstr.FromInt(9053),
+					},
+				},
+				Selector: map[string]string{
+					"app": "dns-server",
+				},
+				ExternalIPs: []string{
+					"192.168.1.2",
+				},
+			},
+		}
+		EventuallyCreation(func() error {
+			cs := ownerClient(tnt)
+			_, err := cs.CoreV1().Services(ns.Name).Create(context.Background(), svc, metav1.CreateOptions{})
+			return err
+		}).Should(Succeed())
+	})
+})