Closed
Conversation
The host firewall is only enabled in CI if label ci/host-firewall is set. The goal is to have default CI options closer to common user environments and host firewall is not enabled by default in those. Signed-off-by: Paul Chaignon <paul@cilium.io>
This commit extends the existing fromCIDR+toPorts policy test to test the same kind of policy for the host firewall. To that end, it: 1. Enables the host firewall. The issue in comment is not relevant anymore since masquerading is disabled. 2. Introduce a helper to get the ID of the host endpoint. This helper will likely be needed for other host firewall tests as well. 3. Load a new DaemonSet to instanciate a host-networking pod on each k8s node. This pod serves as the target for host firewall connectivity tests. 4. Extend the existing test cases with CCNP tests. Signed-off-by: Paul Chaignon <paul@cilium.io>
This commit adds new tests, identical to NodePort tests under vxlan tunneling and direct routing, but with an ingress+egress host policy applied. The host policy only allow communications between nodes and to specific endpoints for readiness probes. Signed-off-by: Paul Chaignon <paul@cilium.io>
Member
Author
|
test-me-please |
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.