policygen

package
v1.9.6 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Apr 20, 2021 License: Apache-2.0 Imports: 20 Imported by: 0

Documentation

Overview

Copyright 2017 Authors of Cilium

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Index

Constants

View Source
const (
	HTTP        = "HTTP"
	HTTPPrivate = "HTTPPrivate"
	Ping        = "Ping"
	UDP         = "UDP"
)

Variables

View Source
var (
	ConnTests              = []string{Ping, HTTP, HTTPPrivate}
	ConnTestsFailedResults = []ResultType{
		ResultTimeout,
		ResultAuth,
	}
	ConnTestsActions = map[string]func(srcPod string, dest TargetDetails, kub *helpers.Kubectl) ResultType{
		Ping:        PingAction,
		HTTP:        HTTPActionPublic,
		HTTPPrivate: HTTPActionPrivate,
	}

	ConnResultAllOK = ConnTestSpec{
		HTTP:        ResultOK,
		HTTPPrivate: ResultOK,
		Ping:        ResultOK,
		UDP:         ResultOK,
	}

	ConnResultAllTimeout = ConnTestSpec{
		HTTP:        ResultTimeout,
		HTTPPrivate: ResultTimeout,
		Ping:        ResultTimeout,
		UDP:         ResultTimeout,
	}

	ConnResultOnlyHTTP = ConnTestSpec{
		HTTP:        ResultOK,
		HTTPPrivate: ResultOK,
		Ping:        ResultTimeout,
		UDP:         ResultTimeout,
	}

	ConnResultOnlyHTTPPrivate = ConnTestSpec{
		HTTP:        ResultAuth,
		HTTPPrivate: ResultOK,
		Ping:        ResultTimeout,
		UDP:         ResultTimeout,
	}

	DestinationsTypes = []Target{
		{Kind: service},
		{Kind: nodePort},
		{Kind: direct},
	}

	NodePortStart = 10000

	ResultTimeout = ResultType{"timeout", false}
	ResultAuth    = ResultType{"reply", false}
	ResultOK      = ResultType{"reply", true}
)

Functions

This section is empty.

Types

type ConnTestSpec

type ConnTestSpec struct {
	HTTP        ResultType
	HTTPPrivate ResultType
	Ping        ResultType
	UDP         ResultType
}

ConnTestSpec Connectivity Test Specification. This structs contains the mapping of all protocols tested and the expected result based on the context of each test case

func (*ConnTestSpec) GetField

func (conn *ConnTestSpec) GetField(field string) ResultType

GetField method to retrieve the value of any type of the struct. It is used by `TestSpec` to created expected results

type PolicyTestKind

type PolicyTestKind struct {
	// contains filtered or unexported fields
}

PolicyTestKind is utilized to describe a new TestCase It needs a described name, the kind of the test (Egrees or Ingress) and the expected result of `ConnTestSpec` Template field is used to render the cilium network policy.

func (*PolicyTestKind) SetTemplate

func (pol *PolicyTestKind) SetTemplate(result *map[string]interface{}, spec *TestSpec) error

SetTemplate renders the template field from the PolicyTest struct using go templates. The result will be stored in the result parameter. The spec parameters is needed to retrieve the source and destination pods and pass the information to the go template.

type PolicyTestSuite

type PolicyTestSuite struct {
	// contains filtered or unexported fields
}

PolicyTestSuite groups together L3, L4, and L7 policy-related tests.

type ResultType

type ResultType struct {
	// contains filtered or unexported fields
}

ResultType defines the expected result for a connectivity test.

func HTTPAction

func HTTPAction(srcPod string, target string, kub *helpers.Kubectl) ResultType

HTTPAction runs a helpers.CurlFail from specified pod to a specified target. It needs a `helpers.Kubectl` instance to run the command in the pod. It returns a ResultType struct.

func HTTPActionPrivate

func HTTPActionPrivate(srcPod string, dest TargetDetails, kub *helpers.Kubectl) ResultType

HTTPActionPrivate runs a HTTPAction to /private/ using destTargetDetails

func HTTPActionPublic

func HTTPActionPublic(srcPod string, dest TargetDetails, kub *helpers.Kubectl) ResultType

HTTPActionPublic runs a CurlAction to /public/ using destTargetDetails

func NetPerfAction

func NetPerfAction(srcPod string, dest TargetDetails, kub *helpers.Kubectl) ResultType

NetPerfAction TODO make this function (GH-2029)

func PingAction

func PingAction(srcPod string, dest TargetDetails, kub *helpers.Kubectl) ResultType

PingAction executes a ping from the `srcPod` to the dest using Kubectl object. Returns a ResultType corresponding to the exit code of the ping command.

func (ResultType) String

func (res ResultType) String() string

String returns the ResultType in humman readable format

type Target

type Target struct {
	Kind       string // serviceL3, serviceL4, NodePort, Direct
	PortNumber int
}

Target defines the destination for traffic when running tests

func (*Target) CreateApplyManifest

func (t *Target) CreateApplyManifest(spec *TestSpec, base string) error

CreateApplyManifest creates the manifest for the type of the target and applies it in kubernetes. It will fail if the service manifest cannot be created correctly or applied to Kubernetes

func (*Target) GetManifestName

func (t *Target) GetManifestName(spec *TestSpec) string

GetManifestName returns the manifest filename for the target using the spec parameter

func (*Target) GetManifestPath

func (t *Target) GetManifestPath(spec *TestSpec, base string) string

GetManifestPath returns the manifest path for the target using the spec parameter

func (*Target) GetServiceName

func (t *Target) GetServiceName(spec *TestSpec) string

GetServiceName returns the prefix of spec prefixed with the kind of the the target

func (*Target) GetTarget

func (t *Target) GetTarget(spec *TestSpec) (*TargetDetails, error)

GetTarget returns a `TargetDetails` with the IP and Port to run the tests in spec. It needs the `TestSpec` parameter to be able to retrieve the service name. It'll return an error if the service is not defined or cannot be retrieved. This function only returns the first port mapped in the service; It'll not work with multiple ports.

func (*Target) SetPortNumber

func (t *Target) SetPortNumber() int

SetPortNumber returns an unused port on the host to use in a Kubernetes NodePort service

type TargetDetails

type TargetDetails net.TCPAddr

TargetDetails represents the address of a TCP end point.

func (TargetDetails) String

func (target TargetDetails) String() string

String combines host and port into a network address of the form "host:port" or, if host contains a colon or a percent sign, "[host]:port".

type TestSpec

type TestSpec struct {
	SrcPod      string
	DestPod     string
	Prefix      string
	Destination Target
	Kub         *helpers.Kubectl
	// contains filtered or unexported fields
}

TestSpec defined a new test specification. It contains three different rules (l3, l4, l7) and a destination and source pod in which test will run. Each testSpec has a prefix, which is a label used to group all resources created by the TestSpec. Each test is executed using a type of Destination which is defined under Target struct. This struct needs a `*helpers.Kubectl` to run the needed commands

func GeneratedTestSpec

func GeneratedTestSpec() []TestSpec

GeneratedTestSpec returns a `TestSpec` array with all the policies possibilities based on all combinations of `policiesTestSuite`

func GetBasicTestSpec

func GetBasicTestSpec() TestSpec

GetBasicTestSpec returns a very simple TestSpec with a L4 and L7 policy that allow traffic only to /private/

func (*TestSpec) ApplyManifest

func (t *TestSpec) ApplyManifest(base string) (string, error)

ApplyManifest applies a new deployment manifest into the Kubernetes cluster. Returns an error if the manifest cannot be applied correctly

func (*TestSpec) CreateCiliumNetworkPolicy

func (t *TestSpec) CreateCiliumNetworkPolicy() (string, error)

CreateCiliumNetworkPolicy returns a CiliumNetworkPolicy based on the `TestSpec` l3, l4 and l7 rules. Returns an error if any of the `PolicyTest` set Template fails or if spec cannot be dump as string

func (*TestSpec) CreateManifests

func (t *TestSpec) CreateManifests() error

CreateManifests creates a new pod manifest. It sets a random prefix for the `TestCase` and creates two new pods (srcPod and DestPod). Returns an error if the manifest cannot be created

func (*TestSpec) Destroy

func (t *TestSpec) Destroy(delay time.Duration, base string) error

Destroy deletes the pods, CiliumNetworkPolicies and Destinations created by `TestSpec` after specified delay. The delay parameter is used to have the pod running for a while and keep Cilium and Kubernetes with a consider load.

func (*TestSpec) ExecTest

func (t *TestSpec) ExecTest() error

ExecTest runs the connectivityTest for the expected `PolicyTest`. It will assert using gomega.

func (*TestSpec) GetManifestName

func (t *TestSpec) GetManifestName() string

GetManifestName returns a string with the `TestSpec` manifest name

func (*TestSpec) GetManifestsPath

func (t *TestSpec) GetManifestsPath(base string) string

GetManifestsPath returns the `TestSpec` manifest path

func (*TestSpec) GetPodMetadata

func (t *TestSpec) GetPodMetadata() (map[string]string, error)

GetPodMetadata returns a map with the pod name and the IP for the pods used by the `TestSpec`. Returns an error in case that the pod info cannot be retrieved correctly.

func (*TestSpec) GetTestExpects

func (t *TestSpec) GetTestExpects() map[string]ResultType

GetTestExpects returns a map with the connTestType and the expected result based on the `testExpect`

func (*TestSpec) InvalidNetworkPolicyApply

func (t *TestSpec) InvalidNetworkPolicyApply(base string) (*cnpv2.CiliumNetworkPolicy, error)

InvalidNetworkPolicyApply it writes the policy and applies to Kubernetes, but instead of apply the policy, this return the CNP status for the TestSpec policy. This function is only used when a invalid combination of policies are created, where we need to test that the error is present.

func (*TestSpec) IsPolicyInvalid

func (t *TestSpec) IsPolicyInvalid() bool

IsPolicyInvalid validates that the policy combination does not match with testSpec.exclude information. That means that if a policy cannot be installed we know that the combination is invalid.

func (*TestSpec) NetworkPolicyApply

func (t *TestSpec) NetworkPolicyApply(base string) error

NetworkPolicyApply applies the CiliumNetworkPolicy in Kubernetes and wait until the statuses of all pods have been updated. Returns an error if the status of the pods did not update or if the policy was unable to be applied

func (*TestSpec) NetworkPolicyName

func (t *TestSpec) NetworkPolicyName() string

NetworkPolicyName returns the name of the NetworkPolicy

func (*TestSpec) RunTest

func (t *TestSpec) RunTest(kub *helpers.Kubectl)

RunTest runs all the `TestSpec` methods and makes the needed assertions for Ginkgo tests. This method will create pods, wait for pods to be ready, apply a new CiliumNetworkPolicy and create a new Destination (Service, NodePort) if needed. Then it will execute `connectivityTest` and compare the results with the expected results within the test specification

func (TestSpec) String

func (t TestSpec) String() string

String return the testSpec definition on human-readable format

type TestSpecsGroup

type TestSpecsGroup []*TestSpec

TestSpecsGroup is a group of different TestSpec

func (TestSpecsGroup) ConnectivityTest

func (tg TestSpecsGroup) ConnectivityTest()

ConnectivityTest runs the Connectivity test per each TestSpec defined into the TestSpecsGroup

func (TestSpecsGroup) CreateAndApplyCNP

func (tg TestSpecsGroup) CreateAndApplyCNP(kub *helpers.Kubectl)

CreateAndApplyCNP creates all Cilium Network Policies and it applies those manifests to the given Kubernetes instance.

func (TestSpecsGroup) CreateAndApplyManifests

func (tg TestSpecsGroup) CreateAndApplyManifests(kub *helpers.Kubectl)

CreateAndApplyManifests creates all of the pods manifests and applies those manifest to the given kubernetes instance.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL