mirror of
https://github.com/rancher/k3k.git
synced 2026-08-18 03:46:31 +00:00
Enrico CandinoandGitHub
3a89a4d53b
* Refactor E2E tests to use a matrix strategy and update labels for better organization * Enhance E2E test labels for better categorization and clarity * Refactor E2E test labels for improved clarity and organization
131 lines
4.4 KiB
Go
131 lines
4.4 KiB
Go
package k3k_test
|
|
|
|
import (
|
|
"context"
|
|
|
|
"sigs.k8s.io/controller-runtime/pkg/client"
|
|
|
|
networkingv1 "k8s.io/api/networking/v1"
|
|
|
|
k3kcontroller "github.com/rancher/k3k/pkg/controller"
|
|
"github.com/rancher/k3k/pkg/controller/policy"
|
|
fwk3k "github.com/rancher/k3k/tests/framework/k3k"
|
|
|
|
. "github.com/onsi/ginkgo/v2"
|
|
. "github.com/onsi/gomega"
|
|
)
|
|
|
|
var _ = When("two virtual clusters are installed", Label(networkingTestsLabel), Label(slowTestsLabel), func() {
|
|
var (
|
|
cluster1 *VirtualCluster
|
|
cluster2 *VirtualCluster
|
|
)
|
|
|
|
BeforeEach(func() {
|
|
clusters := NewVirtualClusters(2)
|
|
cluster1 = clusters[0]
|
|
cluster2 = clusters[1]
|
|
})
|
|
|
|
AfterEach(func() {
|
|
fwk3k.DeleteNamespaces(k8s, cluster1.Cluster.Namespace, cluster2.Cluster.Namespace)
|
|
})
|
|
|
|
It("can create pods in each of them that are isolated", func() {
|
|
pod1Cluster1, pod1Cluster1IP := cluster1.NewNginxPod("")
|
|
pod2Cluster1, pod2Cluster1IP := cluster1.NewNginxPod("")
|
|
pod1Cluster2, pod1Cluster2IP := cluster2.NewNginxPod("")
|
|
|
|
var (
|
|
stdout string
|
|
curlCmd string
|
|
err error
|
|
)
|
|
|
|
By("Checking that Pods can reach themselves")
|
|
|
|
curlCmd = "curl --no-progress-meter " + pod1Cluster1IP
|
|
stdout, _, err = cluster1.ExecCmd(pod1Cluster1, curlCmd)
|
|
Expect(err).To(Not(HaveOccurred()))
|
|
Expect(stdout).To(ContainSubstring("Welcome to nginx!"))
|
|
|
|
curlCmd = "curl --no-progress-meter " + pod2Cluster1IP
|
|
stdout, _, err = cluster1.ExecCmd(pod2Cluster1, curlCmd)
|
|
Expect(err).To(Not(HaveOccurred()))
|
|
Expect(stdout).To(ContainSubstring("Welcome to nginx!"))
|
|
|
|
curlCmd = "curl --no-progress-meter " + pod1Cluster2IP
|
|
stdout, _, err = cluster2.ExecCmd(pod1Cluster2, curlCmd)
|
|
Expect(err).To(Not(HaveOccurred()))
|
|
Expect(stdout).To(ContainSubstring("Welcome to nginx!"))
|
|
|
|
// Pods in the same Virtual Cluster should be able to reach each other
|
|
// Pod1 should be able to call Pod2, and viceversa
|
|
|
|
By("Checking that Pods in the same virtual clusters can reach each other")
|
|
|
|
curlCmd = "curl --no-progress-meter " + pod2Cluster1IP
|
|
stdout, _, err = cluster1.ExecCmd(pod1Cluster1, curlCmd)
|
|
Expect(err).To(Not(HaveOccurred()))
|
|
Expect(stdout).To(ContainSubstring("Welcome to nginx!"))
|
|
|
|
curlCmd = "curl --no-progress-meter " + pod1Cluster1IP
|
|
stdout, _, err = cluster1.ExecCmd(pod2Cluster1, curlCmd)
|
|
Expect(err).To(Not(HaveOccurred()))
|
|
Expect(stdout).To(ContainSubstring("Welcome to nginx!"))
|
|
|
|
By("Checking that Pods in the different virtual clusters cannot reach each other")
|
|
|
|
// Pods in Cluster 1 should not be able to reach the Pod in Cluster 2
|
|
|
|
curlCmd = "curl --no-progress-meter " + pod1Cluster2IP
|
|
stdout, _, err = cluster1.ExecCmd(pod1Cluster1, curlCmd)
|
|
Expect(err).Should(HaveOccurred())
|
|
Expect(stdout).To(Not(ContainSubstring("Welcome to nginx!")))
|
|
|
|
curlCmd = "curl --no-progress-meter " + pod1Cluster2IP
|
|
stdout, _, err = cluster1.ExecCmd(pod2Cluster1, curlCmd)
|
|
Expect(err).To(HaveOccurred())
|
|
Expect(stdout).To(Not(ContainSubstring("Welcome to nginx!")))
|
|
|
|
// Pod in Cluster 2 should not be able to reach Pods in Cluster 1
|
|
|
|
curlCmd = "curl --no-progress-meter " + pod1Cluster1IP
|
|
stdout, _, err = cluster2.ExecCmd(pod1Cluster2, curlCmd)
|
|
Expect(err).To(HaveOccurred())
|
|
Expect(stdout).To(Not(ContainSubstring("Welcome to nginx!")))
|
|
|
|
curlCmd = "curl --no-progress-meter " + pod2Cluster1IP
|
|
stdout, _, err = cluster2.ExecCmd(pod1Cluster2, curlCmd)
|
|
Expect(err).To(HaveOccurred())
|
|
Expect(stdout).To(Not(ContainSubstring("Welcome to nginx!")))
|
|
})
|
|
|
|
It("excludes the real host pod CIDR from the isolation NetworkPolicy, not a hardcoded guess", func(ctx context.Context) {
|
|
// compute the same value the controller should have derived from the live host
|
|
// Nodes, so this assertion doesn't rely on the host's real pod CIDR coincidentally
|
|
// matching a hardcoded constant
|
|
expectedCIDRs, err := policy.FindPodCIDRs(ctx, k8sClient, "")
|
|
Expect(err).NotTo(HaveOccurred())
|
|
Expect(expectedCIDRs).NotTo(BeEmpty())
|
|
|
|
for _, vc := range []*VirtualCluster{cluster1, cluster2} {
|
|
var networkPolicy networkingv1.NetworkPolicy
|
|
|
|
key := client.ObjectKey{
|
|
Name: k3kcontroller.SafeConcatNameWithPrefix(vc.Cluster.Name),
|
|
Namespace: vc.Cluster.Namespace,
|
|
}
|
|
|
|
Expect(k8sClient.Get(ctx, key, &networkPolicy)).To(Succeed())
|
|
|
|
Expect(networkPolicy.Spec.Egress[0].To).To(ContainElement(networkingv1.NetworkPolicyPeer{
|
|
IPBlock: &networkingv1.IPBlock{
|
|
CIDR: "0.0.0.0/0",
|
|
Except: expectedCIDRs,
|
|
},
|
|
}))
|
|
}
|
|
})
|
|
})
|