Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SDN-5636: Udn hostnet isolation #29470

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

SDN-5636: Udn hostnet isolation #29470

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e2fc400
[test/networking] UDN: add host isolation test
npinaeva Jan 22, 2025
2b124e0
[test/networking] UDN: add host isolation + open ports test
npinaeva Jan 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
89 changes: 87 additions & 2 deletions test/extended/networking/network_segmentation.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@ import (
e2ekubectl "k8s.io/kubernetes/test/e2e/framework/kubectl"
frameworkpod "k8s.io/kubernetes/test/e2e/framework/pod"
admissionapi "k8s.io/pod-security-admission/api"
psapi "k8s.io/pod-security-admission/api"
utilnet "k8s.io/utils/net"
"k8s.io/utils/pointer"

Expand Down Expand Up @@ -215,6 +216,12 @@ var _ = Describe("[sig-network][OCPFeatureGate:NetworkSegmentation][Feature:User
_, err = cs.CoreV1().Namespaces().Create(context.Background(), &v1.Namespace{
ObjectMeta: metav1.ObjectMeta{
Name: defaultNetNamespace,
// labels are required to run a hostNetwork pod
Labels: map[string]string{
psapi.AuditLevelLabel: string(psapi.LevelPrivileged),
psapi.EnforceLevelLabel: string(psapi.LevelPrivileged),
psapi.WarnLevelLabel: string(psapi.LevelPrivileged),
},
},
}, metav1.CreateOptions{})
Expect(err).NotTo(HaveOccurred())
Expand Down Expand Up @@ -298,6 +305,8 @@ var _ = Describe("[sig-network][OCPFeatureGate:NetworkSegmentation][Feature:User
}
})

testNodeName := getPodNodeName(f.ClientSet, udnPod.Namespace, udnPod.Name)

const podGenerateName = "udn-test-pod-"
By("creating default network pod")
defaultPod := frameworkpod.CreateExecPodOrFail(
Expand All @@ -307,6 +316,7 @@ var _ = Describe("[sig-network][OCPFeatureGate:NetworkSegmentation][Feature:User
podGenerateName,
func(pod *v1.Pod) {
pod.Spec.Containers[0].Args = []string{"netexec"}
pod.Spec.NodeName = testNodeName
setRuntimeDefaultPSA(pod)
},
)
Expand All @@ -318,6 +328,7 @@ var _ = Describe("[sig-network][OCPFeatureGate:NetworkSegmentation][Feature:User
defaultNetNamespace,
podGenerateName,
func(pod *v1.Pod) {
pod.Spec.NodeName = testNodeName
setRuntimeDefaultPSA(pod)
},
)
Expand Down Expand Up @@ -371,8 +382,49 @@ var _ = Describe("[sig-network][OCPFeatureGate:NetworkSegmentation][Feature:User
// The pod should be ready
Expect(podutils.IsPodReady(udnPod)).To(BeTrue())

// TODO
//By("checking non-kubelet default network host process can't reach the UDN pod")
By("restarting kubelet, pod should stay ready")
err = oc.AsAdmin().Run("debug").Args("-n", f.Namespace.Name, "node/"+testNodeName, "--", "chroot", "/host", "/bin/bash", "-c", "systemctl restart kubelet").Execute()
Expect(err).NotTo(HaveOccurred())

By("asserting healthcheck still works (kubelet can access the UDN pod)")
// The pod should stay ready
Consistently(func() bool {
return podutils.IsPodReady(udnPod)
}, 10*time.Second, 1*time.Second).Should(BeTrue())
Expect(udnPod.Status.ContainerStatuses[0].RestartCount).To(Equal(int32(0)))

By("checking default network hostNetwork pod can't reach the UDN pod")
hostNetPod := frameworkpod.CreateExecPodOrFail(
context.Background(),
f.ClientSet,
defaultNetNamespace,
"host-net-pod",
func(pod *v1.Pod) {
pod.Spec.HostNetwork = true
pod.Spec.NodeName = testNodeName
})

// positive check for reachable default network pod
for _, destIP := range []string{defaultIPv4, defaultIPv6} {
if destIP == "" {
continue
}
By("checking the default network hostNetwork can reach default pod on IP " + destIP)
Eventually(func() bool {
return connectToServer(podConfiguration{namespace: hostNetPod.Namespace, name: hostNetPod.Name}, destIP, defaultPort) == nil
}).Should(BeTrue())
}
// negative check for UDN pod
for _, destIP := range []string{udnIPv4, udnIPv6} {
if destIP == "" {
continue
}

By("checking the default network hostNetwork pod can't reach UDN pod on IP " + destIP)
Consistently(func() bool {
return connectToServer(podConfiguration{namespace: hostNetPod.Namespace, name: hostNetPod.Name}, destIP, port) != nil
}, serverConnectPollTimeout, serverConnectPollInterval).Should(BeTrue())
}

By("asserting UDN pod can't reach host via default network interface")
// Now try to reach the host from the UDN pod
Expand Down Expand Up @@ -1196,6 +1248,12 @@ var _ = Describe("[sig-network][OCPFeatureGate:NetworkSegmentation][Feature:User
_, err := cs.CoreV1().Namespaces().Create(context.Background(), &v1.Namespace{
ObjectMeta: metav1.ObjectMeta{
Name: defaultNetNamespace,
// labels are required to run a hostNetwork pod
Labels: map[string]string{
psapi.AuditLevelLabel: string(psapi.LevelPrivileged),
psapi.EnforceLevelLabel: string(psapi.LevelPrivileged),
psapi.WarnLevelLabel: string(psapi.LevelPrivileged),
},
},
}, metav1.CreateOptions{})
Expect(err).NotTo(HaveOccurred())
Expand All @@ -1214,6 +1272,18 @@ var _ = Describe("[sig-network][OCPFeatureGate:NetworkSegmentation][Feature:User
setRuntimeDefaultPSA(pod)
},
)
testNodeName := getPodNodeName(f.ClientSet, udnPod.Namespace, udnPod.Name)

By("creating default network hostNetwork client pod")
hostNetPod := frameworkpod.CreateExecPodOrFail(
context.Background(),
f.ClientSet,
defaultNetNamespace,
"host-net-client-pod",
func(pod *v1.Pod) {
pod.Spec.HostNetwork = true
pod.Spec.NodeName = testNodeName
})

udnIPv4, udnIPv6, err := podIPsForDefaultNetwork(
cs,
Expand All @@ -1231,6 +1301,11 @@ var _ = Describe("[sig-network][OCPFeatureGate:NetworkSegmentation][Feature:User
Consistently(func() bool {
return connectToServer(podConfiguration{namespace: defaultClientPod.Namespace, name: defaultClientPod.Name}, destIP, port) != nil
}, serverConnectPollTimeout, serverConnectPollInterval).Should(BeTrue())

By("checking the default hostNetwork pod can't reach UDN pod on IP " + destIP)
Consistently(func() bool {
return connectToServer(podConfiguration{namespace: hostNetPod.Namespace, name: hostNetPod.Name}, destIP, port) != nil
}, serverConnectPollTimeout, serverConnectPollInterval).Should(BeTrue())
}

By("Open UDN pod port")
Expand All @@ -1249,6 +1324,11 @@ var _ = Describe("[sig-network][OCPFeatureGate:NetworkSegmentation][Feature:User
Eventually(func() bool {
return connectToServer(podConfiguration{namespace: defaultClientPod.Namespace, name: defaultClientPod.Name}, destIP, port) == nil
}, serverConnectPollTimeout, serverConnectPollInterval).Should(BeTrue())

By("checking the default hostNetwork pod can reach UDN pod on IP " + destIP)
Eventually(func() bool {
return connectToServer(podConfiguration{namespace: hostNetPod.Namespace, name: hostNetPod.Name}, destIP, port) == nil
}, serverConnectPollTimeout, serverConnectPollInterval).Should(BeTrue())
}

By("Update UDN pod port with the wrong syntax")
Expand All @@ -1268,6 +1348,11 @@ var _ = Describe("[sig-network][OCPFeatureGate:NetworkSegmentation][Feature:User
Eventually(func() bool {
return connectToServer(podConfiguration{namespace: defaultClientPod.Namespace, name: defaultClientPod.Name}, destIP, port) != nil
}, serverConnectPollTimeout, serverConnectPollInterval).Should(BeTrue())

By("checking the default hostNetwork pod can't reach UDN pod on IP " + destIP)
Eventually(func() bool {
return connectToServer(podConfiguration{namespace: hostNetPod.Namespace, name: hostNetPod.Name}, destIP, port) != nil
}, serverConnectPollTimeout, serverConnectPollInterval).Should(BeTrue())
}
By("Verify syntax error is reported via event")
events, err := cs.CoreV1().Events(udnPod.Namespace).List(context.Background(), metav1.ListOptions{})
Expand Down