Skip to content

Commit 28c8a2e

Browse files
nathanjsweetnathanjsweet
committed
connectivity: Add Port Range Tests
Add port range tests for all port based connectivity tests. Signed-off-by: Nate Sweet <[email protected]>
1 parent 50aa7f1 commit 28c8a2e

File tree

37 files changed

+858
-47
lines changed

37 files changed

+858
-47
lines changed

‎connectivity/builder/builder.go

+23-11
Original file line numberDiff line numberDiff line change
@@ -57,15 +57,24 @@ var (
5757
//go:embed manifests/client-egress-l7-http.yaml
5858
clientEgressL7HTTPPolicyYAML string
5959

60+
//go:embed manifests/client-egress-l7-http-port-range.yaml
61+
clientEgressL7HTTPPolicyPortRangeYAML string
62+
6063
//go:embed manifests/client-egress-l7-http-named-port.yaml
6164
clientEgressL7HTTPNamedPortPolicyYAML string
6265

6366
//go:embed manifests/client-egress-l7-tls.yaml
6467
clientEgressL7TLSPolicyYAML string
6568

69+
//go:embed manifests/client-egress-l7-tls-port-range.yaml
70+
clientEgressL7TLSPolicyPortRangeYAML string
71+
6672
//go:embed manifests/client-egress-l7-http-matchheader-secret.yaml
6773
clientEgressL7HTTPMatchheaderSecretYAML string
6874

75+
//go:embed manifests/client-egress-l7-http-matchheader-secret-port-range.yaml
76+
clientEgressL7HTTPMatchheaderSecretPortRangeYAML string
77+
6978
//go:embed manifests/echo-ingress-from-cidr.yaml
7079
echoIngressFromCIDRYAML string
7180
)
@@ -259,17 +268,20 @@ func finalTests(ct *check.ConnectivityTest) error {
259268

260269
func renderTemplates(param check.Parameters) (map[string]string, error) {
261270
templates := map[string]string{
262-
"clientEgressToCIDRExternalPolicyYAML": clientEgressToCIDRExternalPolicyYAML,
263-
"clientEgressToCIDRExternalPolicyKNPYAML": clientEgressToCIDRExternalPolicyKNPYAML,
264-
"clientEgressToCIDRNodeKNPYAML": clientEgressToCIDRNodeKNPYAML,
265-
"clientEgressToCIDRExternalDenyPolicyYAML": clientEgressToCIDRExternalDenyPolicyYAML,
266-
"clientEgressL7HTTPPolicyYAML": clientEgressL7HTTPPolicyYAML,
267-
"clientEgressL7HTTPNamedPortPolicyYAML": clientEgressL7HTTPNamedPortPolicyYAML,
268-
"clientEgressToFQDNsPolicyYAML": clientEgressToFQDNsPolicyYAML,
269-
"clientEgressL7TLSPolicyYAML": clientEgressL7TLSPolicyYAML,
270-
"clientEgressL7HTTPMatchheaderSecretYAML": clientEgressL7HTTPMatchheaderSecretYAML,
271-
"echoIngressFromCIDRYAML": echoIngressFromCIDRYAML,
272-
"denyCIDRPolicyYAML": denyCIDRPolicyYAML,
271+
"clientEgressToCIDRExternalPolicyYAML": clientEgressToCIDRExternalPolicyYAML,
272+
"clientEgressToCIDRExternalPolicyKNPYAML": clientEgressToCIDRExternalPolicyKNPYAML,
273+
"clientEgressToCIDRNodeKNPYAML": clientEgressToCIDRNodeKNPYAML,
274+
"clientEgressToCIDRExternalDenyPolicyYAML": clientEgressToCIDRExternalDenyPolicyYAML,
275+
"clientEgressL7HTTPPolicyYAML": clientEgressL7HTTPPolicyYAML,
276+
"clientEgressL7HTTPPolicyPortRangeYAML": clientEgressL7HTTPPolicyPortRangeYAML,
277+
"clientEgressL7HTTPNamedPortPolicyYAML": clientEgressL7HTTPNamedPortPolicyYAML,
278+
"clientEgressToFQDNsPolicyYAML": clientEgressToFQDNsPolicyYAML,
279+
"clientEgressL7TLSPolicyYAML": clientEgressL7TLSPolicyYAML,
280+
"clientEgressL7TLSPolicyPortRangeYAML": clientEgressL7TLSPolicyPortRangeYAML,
281+
"clientEgressL7HTTPMatchheaderSecretYAML": clientEgressL7HTTPMatchheaderSecretYAML,
282+
"clientEgressL7HTTPMatchheaderSecretPortRangeYAML": clientEgressL7HTTPMatchheaderSecretPortRangeYAML,
283+
"echoIngressFromCIDRYAML": echoIngressFromCIDRYAML,
284+
"denyCIDRPolicyYAML": denyCIDRPolicyYAML,
273285
}
274286
if param.K8sLocalHostTest {
275287
templates["clientEgressToCIDRCPHostPolicyYAML"] = clientEgressToCIDRCPHostPolicyYAML

‎connectivity/builder/client_egress_expression.go

+19-2
Original file line numberDiff line numberDiff line change
@@ -8,16 +8,33 @@ import (
88

99
"github.com/cilium/cilium-cli/connectivity/check"
1010
"github.com/cilium/cilium-cli/connectivity/tests"
11+
"github.com/cilium/cilium-cli/utils/features"
1112
)
1213

1314
//go:embed manifests/client-egress-to-echo-expression.yaml
1415
var clientEgressToEchoExpressionPolicyYAML string
1516

17+
//go:embed manifests/client-egress-to-echo-expression-port-range.yaml
18+
var clientEgressToEchoExpressionPolicyPortRangeYAML string
19+
1620
type clientEgressExpression struct{}
1721

1822
func (t clientEgressExpression) build(ct *check.ConnectivityTest, _ map[string]string) {
23+
clientEgressExpressionTest(ct, false)
24+
if ct.Features[features.PortRanges].Enabled {
25+
clientEgressExpressionTest(ct, true)
26+
}
27+
}
28+
29+
func clientEgressExpressionTest(ct *check.ConnectivityTest, portRanges bool) {
30+
testName := "client-egress-expression"
31+
policyYAML := clientEgressToEchoExpressionPolicyYAML
32+
if portRanges {
33+
testName = "client-egress-expression-port-range"
34+
policyYAML = clientEgressToEchoExpressionPolicyPortRangeYAML
35+
}
1936
// This policy allows port 8080 from client to echo (using label match expression, so this should succeed
20-
newTest("client-egress-expression", ct).
21-
WithCiliumPolicy(clientEgressToEchoExpressionPolicyYAML).
37+
newTest(testName, ct).
38+
WithCiliumPolicy(policyYAML).
2239
WithScenarios(tests.PodToPod())
2340
}

‎connectivity/builder/client_egress_expression_knp.go

+19-2
Original file line numberDiff line numberDiff line change
@@ -8,16 +8,33 @@ import (
88

99
"github.com/cilium/cilium-cli/connectivity/check"
1010
"github.com/cilium/cilium-cli/connectivity/tests"
11+
"github.com/cilium/cilium-cli/utils/features"
1112
)
1213

1314
//go:embed manifests/client-egress-to-echo-expression-knp.yaml
1415
var clientEgressToEchoExpressionPolicyKNPYAML string
1516

17+
//go:embed manifests/client-egress-to-echo-expression-knp-port-range.yaml
18+
var clientEgressToEchoExpressionPolicyKNPPortRangeYAML string
19+
1620
type clientEgressExpressionKnp struct{}
1721

1822
func (t clientEgressExpressionKnp) build(ct *check.ConnectivityTest, _ map[string]string) {
23+
clientEgressExpressionKnpTest(ct, false)
24+
if ct.Features[features.PortRanges].Enabled {
25+
clientEgressExpressionKnpTest(ct, true)
26+
}
27+
}
28+
29+
func clientEgressExpressionKnpTest(ct *check.ConnectivityTest, portRanges bool) {
30+
testName := "client-egress-expression-knp"
31+
policyYAML := clientEgressToEchoExpressionPolicyKNPYAML
32+
if portRanges {
33+
testName = "client-egress-expression-knp-port-range"
34+
policyYAML = clientEgressToEchoExpressionPolicyKNPPortRangeYAML
35+
}
1936
// This policy allows port 8080 from client to echo (using label match expression, so this should succeed
20-
newTest("client-egress-expression-knp", ct).
21-
WithK8SPolicy(clientEgressToEchoExpressionPolicyKNPYAML).
37+
newTest(testName, ct).
38+
WithK8SPolicy(policyYAML).
2239
WithScenarios(tests.PodToPod())
2340
}

‎connectivity/builder/client_egress_l7.go

+16-3
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,24 @@ import (
1212
type clientEgressL7 struct{}
1313

1414
func (t clientEgressL7) build(ct *check.ConnectivityTest, templates map[string]string) {
15+
clientEgressL7Test(ct, templates, false)
16+
if ct.Features[features.PortRanges].Enabled {
17+
clientEgressL7Test(ct, templates, true)
18+
}
19+
}
20+
21+
func clientEgressL7Test(ct *check.ConnectivityTest, templates map[string]string, portRanges bool) {
22+
testName := "client-egress-l7"
23+
templateName := "clientEgressL7HTTPPolicyYAML"
24+
if portRanges {
25+
testName = "client-egress-l7-port-range"
26+
templateName = "clientEgressL7HTTPPolicyPortRangeYAML"
27+
}
1528
// Test L7 HTTP introspection using an egress policy on the clients.
16-
newTest("client-egress-l7", ct).
29+
newTest(testName, ct).
1730
WithFeatureRequirements(features.RequireEnabled(features.L7Proxy)).
18-
WithCiliumPolicy(clientEgressOnlyDNSPolicyYAML). // DNS resolution only
19-
WithCiliumPolicy(templates["clientEgressL7HTTPPolicyYAML"]). // L7 allow policy with HTTP introspection
31+
WithCiliumPolicy(clientEgressOnlyDNSPolicyYAML). // DNS resolution only
32+
WithCiliumPolicy(templates[templateName]). // L7 allow policy with HTTP introspection
2033
WithScenarios(
2134
tests.PodToPod(),
2235
tests.PodToWorld(tests.WithRetryDestPort(80), tests.WithRetryPodLabel("other", "client")),

‎connectivity/builder/client_egress_l7_method.go

+19-3
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,30 @@ import (
1414
//go:embed manifests/client-egress-l7-http-method.yaml
1515
var clientEgressL7HTTPMethodPolicyYAML string
1616

17+
//go:embed manifests/client-egress-l7-http-method-port-range.yaml
18+
var clientEgressL7HTTPMethodPolicyPortRangeYAML string
19+
1720
type clientEgressL7Method struct{}
1821

1922
func (t clientEgressL7Method) build(ct *check.ConnectivityTest, _ map[string]string) {
23+
clientEgressL7MethodTest(ct, false)
24+
if ct.Features[features.PortRanges].Enabled {
25+
clientEgressL7MethodTest(ct, true)
26+
}
27+
}
28+
29+
func clientEgressL7MethodTest(ct *check.ConnectivityTest, portRanges bool) {
30+
testName := "client-egress-l7-method"
31+
yamlFile := clientEgressL7HTTPMethodPolicyYAML
32+
if portRanges {
33+
testName = "client-egress-l7-method-port-range"
34+
yamlFile = clientEgressL7HTTPMethodPolicyPortRangeYAML
35+
}
2036
// Test L7 HTTP with different methods introspection using an egress policy on the clients.
21-
newTest("client-egress-l7-method", ct).
37+
newTest(testName, ct).
2238
WithFeatureRequirements(features.RequireEnabled(features.L7Proxy)).
23-
WithCiliumPolicy(clientEgressOnlyDNSPolicyYAML). // DNS resolution only
24-
WithCiliumPolicy(clientEgressL7HTTPMethodPolicyYAML). // L7 allow policy with HTTP introspection (POST only)
39+
WithCiliumPolicy(clientEgressOnlyDNSPolicyYAML). // DNS resolution only
40+
WithCiliumPolicy(yamlFile). // L7 allow policy with HTTP introspection (POST only)
2541
WithScenarios(
2642
tests.PodToPodWithEndpoints(tests.WithMethod("POST"), tests.WithDestinationLabelsOption(map[string]string{"other": "echo"})),
2743
tests.PodToPodWithEndpoints(tests.WithDestinationLabelsOption(map[string]string{"first": "echo"})),

‎connectivity/builder/client_egress_l7_set_header.go

+15-2
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,21 @@ import (
1515
type clientEgressL7SetHeader struct{}
1616

1717
func (t clientEgressL7SetHeader) build(ct *check.ConnectivityTest, templates map[string]string) {
18+
clientEgressL7SetHeaderTest(ct, templates, false)
19+
if ct.Features[features.PortRanges].Enabled {
20+
clientEgressL7SetHeaderTest(ct, templates, true)
21+
}
22+
}
23+
24+
func clientEgressL7SetHeaderTest(ct *check.ConnectivityTest, templates map[string]string, portRanges bool) {
25+
testName := "client-egress-l7-set-header"
26+
templateName := "clientEgressL7HTTPMatchheaderSecretYAML"
27+
if portRanges {
28+
testName = "client-egress-l7-set-header-port-range"
29+
templateName = "clientEgressL7HTTPMatchheaderSecretPortRangeYAML"
30+
}
1831
// Test L7 HTTP with a header replace set in the policy
19-
newTest("client-egress-l7-set-header", ct).
32+
newTest(testName, ct).
2033
WithFeatureRequirements(features.RequireEnabled(features.L7Proxy)).
2134
WithFeatureRequirements(features.RequireEnabled(features.SecretBackendK8s)).
2235
WithSecret(&corev1.Secret{
@@ -27,7 +40,7 @@ func (t clientEgressL7SetHeader) build(ct *check.ConnectivityTest, templates map
2740
"value": []byte("Bearer 123456"),
2841
},
2942
}).
30-
WithCiliumPolicy(templates["clientEgressL7HTTPMatchheaderSecretYAML"]). // L7 allow policy with HTTP introspection (POST only)
43+
WithCiliumPolicy(templates[templateName]). // L7 allow policy with HTTP introspection (POST only)
3144
WithScenarios(
3245
tests.PodToPodWithEndpoints(tests.WithMethod("POST"), tests.WithPath("auth-header-required"), tests.WithDestinationLabelsOption(map[string]string{"other": "echo"})),
3346
tests.PodToPodWithEndpoints(tests.WithMethod("POST"), tests.WithPath("auth-header-required"), tests.WithDestinationLabelsOption(map[string]string{"first": "echo"})),

‎connectivity/builder/client_egress_l7_tls_headers.go

+15-2
Original file line numberDiff line numberDiff line change
@@ -12,13 +12,26 @@ import (
1212
type clientEgressL7TlsHeaders struct{}
1313

1414
func (t clientEgressL7TlsHeaders) build(ct *check.ConnectivityTest, templates map[string]string) {
15+
clientEgressL7TlsHeadersTest(ct, templates, false)
16+
if ct.Features[features.PortRanges].Enabled {
17+
clientEgressL7TlsHeadersTest(ct, templates, true)
18+
}
19+
}
20+
21+
func clientEgressL7TlsHeadersTest(ct *check.ConnectivityTest, templates map[string]string, portRanges bool) {
22+
testName := "client-egress-l7-tls-headers"
23+
yamlFile := templates["clientEgressL7TLSPolicyYAML"]
24+
if portRanges {
25+
testName = "client-egress-l7-tls-headers-port-range"
26+
yamlFile = templates["clientEgressL7TLSPolicyPortRangeYAML"]
27+
}
1528
// Test L7 HTTPS interception using an egress policy on the clients.
16-
newTest("client-egress-l7-tls-headers", ct).
29+
newTest(testName, ct).
1730
WithFeatureRequirements(features.RequireEnabled(features.L7Proxy)).
1831
WithFeatureRequirements(features.RequireEnabled(features.SecretBackendK8s)).
1932
WithCABundleSecret().
2033
WithCertificate("externaltarget-tls", ct.Params().ExternalTarget).
21-
WithCiliumPolicy(templates["clientEgressL7TLSPolicyYAML"]). // L7 allow policy with TLS interception
34+
WithCiliumPolicy(yamlFile). // L7 allow policy with TLS interception
2235
WithScenarios(tests.PodToWorldWithTLSIntercept("-H", "X-Very-Secret-Token: 42")).
2336
WithExpectations(func(_ *check.Action) (egress, ingress check.Result) {
2437
return check.ResultOK, check.ResultNone

‎connectivity/builder/client_egress_to_echo_deny.go

+21-4
Original file line numberDiff line numberDiff line change
@@ -8,19 +8,36 @@ import (
88

99
"github.com/cilium/cilium-cli/connectivity/check"
1010
"github.com/cilium/cilium-cli/connectivity/tests"
11+
"github.com/cilium/cilium-cli/utils/features"
1112
)
1213

1314
//go:embed manifests/client-egress-to-echo-deny.yaml
1415
var clientEgressToEchoDenyPolicyYAML string
1516

17+
//go:embed manifests/client-egress-to-echo-deny-port-range.yaml
18+
var clientEgressToEchoDenyPolicyPortRangeYAML string
19+
1620
type clientEgressToEchoDeny struct{}
1721

1822
func (t clientEgressToEchoDeny) build(ct *check.ConnectivityTest, _ map[string]string) {
23+
clientEgressToEchoDenyTest(ct, false)
24+
if ct.Features[features.PortRanges].Enabled {
25+
clientEgressToEchoDenyTest(ct, true)
26+
}
27+
}
28+
29+
func clientEgressToEchoDenyTest(ct *check.ConnectivityTest, portRanges bool) {
30+
testName := "client-egress-to-echo-deny"
31+
policyYAML := clientEgressToEchoDenyPolicyYAML
32+
if portRanges {
33+
testName = "client-egress-to-echo-deny-port-range"
34+
policyYAML = clientEgressToEchoDenyPolicyPortRangeYAML
35+
}
1936
// This policy denies port 8080 from client to echo
20-
newTest("client-egress-to-echo-deny", ct).
21-
WithCiliumPolicy(allowAllEgressPolicyYAML). // Allow all egress traffic
22-
WithCiliumPolicy(allowAllIngressPolicyYAML). // Allow all ingress traffic
23-
WithCiliumPolicy(clientEgressToEchoDenyPolicyYAML). // Deny client to echo traffic via port 8080
37+
newTest(testName, ct).
38+
WithCiliumPolicy(allowAllEgressPolicyYAML). // Allow all egress traffic
39+
WithCiliumPolicy(allowAllIngressPolicyYAML). // Allow all ingress traffic
40+
WithCiliumPolicy(policyYAML). // Deny client to echo traffic via port 8080
2441
WithScenarios(
2542
tests.ClientToClient(), // Client to client traffic should be allowed
2643
tests.PodToPod(), // Client to echo traffic should be denied

‎connectivity/builder/client_egress_to_echo_expression_deny.go

+19-2
Original file line numberDiff line numberDiff line change
@@ -8,19 +8,36 @@ import (
88

99
"github.com/cilium/cilium-cli/connectivity/check"
1010
"github.com/cilium/cilium-cli/connectivity/tests"
11+
"github.com/cilium/cilium-cli/utils/features"
1112
)
1213

1314
//go:embed manifests/client-egress-to-echo-expression-deny.yaml
1415
var clientEgressToEchoExpressionDenyPolicyYAML string
1516

17+
//go:embed manifests/client-egress-to-echo-expression-deny-port-range.yaml
18+
var clientEgressToEchoExpressionDenyPolicyPortRangeYAML string
19+
1620
type clientEgressToEchoExpressionDeny struct{}
1721

1822
func (t clientEgressToEchoExpressionDeny) build(ct *check.ConnectivityTest, _ map[string]string) {
23+
clientEgressToEchoExpressionDenyTest(ct, false)
24+
if ct.Features[features.PortRanges].Enabled {
25+
clientEgressToEchoExpressionDenyTest(ct, true)
26+
}
27+
}
28+
29+
func clientEgressToEchoExpressionDenyTest(ct *check.ConnectivityTest, portRanges bool) {
30+
testName := "client-egress-to-echo-expression-deny"
31+
policyYAML := clientEgressToEchoExpressionDenyPolicyYAML
32+
if portRanges {
33+
testName = "client-egress-to-echo-expression-deny-port-range"
34+
policyYAML = clientEgressToEchoExpressionDenyPolicyPortRangeYAML
35+
}
1936
// This policy denies port 8080 from client to echo (using label match expression), but allows traffic from client2
20-
newTest("client-egress-to-echo-expression-deny", ct).
37+
newTest(testName, ct).
2138
WithCiliumPolicy(allowAllEgressPolicyYAML). // Allow all egress traffic
2239
WithCiliumPolicy(allowAllIngressPolicyYAML). // Allow all ingress traffic
23-
WithCiliumPolicy(clientEgressToEchoExpressionDenyPolicyYAML).
40+
WithCiliumPolicy(policyYAML).
2441
WithScenarios(
2542
tests.PodToPod(tests.WithSourceLabelsOption(clientLabel)), // Client to echo should be denied
2643
tests.PodToPod(tests.WithSourceLabelsOption(client2Label)), // Client2 to echo should be allowed

‎connectivity/builder/client_egress_to_echo_service_account.go

+19-2
Original file line numberDiff line numberDiff line change
@@ -8,17 +8,34 @@ import (
88

99
"github.com/cilium/cilium-cli/connectivity/check"
1010
"github.com/cilium/cilium-cli/connectivity/tests"
11+
"github.com/cilium/cilium-cli/utils/features"
1112
)
1213

1314
//go:embed manifests/client-egress-to-echo-service-account.yaml
1415
var clientEgressToEchoServiceAccountPolicyYAML string
1516

17+
//go:embed manifests/client-egress-to-echo-service-account-port-range.yaml
18+
var clientEgressToEchoServiceAccountPolicyPortRangeYAML string
19+
1620
type clientEgressToEchoServiceAccount struct{}
1721

1822
func (t clientEgressToEchoServiceAccount) build(ct *check.ConnectivityTest, _ map[string]string) {
23+
clientEgressToEchoServiceAccountTest(ct, false)
24+
if ct.Features[features.PortRanges].Enabled {
25+
clientEgressToEchoServiceAccountTest(ct, true)
26+
}
27+
}
28+
29+
func clientEgressToEchoServiceAccountTest(ct *check.ConnectivityTest, portRanges bool) {
30+
testName := "client-egress-to-echo-service-account"
31+
policyYAML := clientEgressToEchoServiceAccountPolicyYAML
32+
if portRanges {
33+
testName = "client-egress-to-echo-service-account-port-range"
34+
policyYAML = clientEgressToEchoServiceAccountPolicyPortRangeYAML
35+
}
1936
// This policy allows port 8080 from client to endpoint with service account label as echo-same-node
20-
newTest("client-egress-to-echo-service-account", ct).
21-
WithCiliumPolicy(clientEgressToEchoServiceAccountPolicyYAML).
37+
newTest(testName, ct).
38+
WithCiliumPolicy(policyYAML).
2239
WithScenarios(
2340
tests.PodToPod(tests.WithSourceLabelsOption(map[string]string{"kind": "client"})),
2441
).

0 commit comments

Comments
 (0)