Add basic kube-apiserver policy matching e2e test by christarazi · Pull Request #18333 · cilium/cilium

christarazi · 2021-12-23T19:38:03Z

test/helpers: Clarify expected usage of variadic params
test/k8sT: Reduce code duplication in Policies suite
test/k8sT: add e2e test for kube-apiserver policy matching

Updates: #17829

It was not clear that the Curl*() helpers were expecting the first parameter to be a format string (fmt.Sprintf()) if multiple parameters are passed (for additional args to `curl`). Signed-off-by: Chris Tarazi <chris@isovalent.com>

christarazi · 2021-12-23T19:45:03Z

/test

Job 'Cilium-PR-K8s-1.21-kernel-5.4' failed and has not been observed before, so may be related to your PR:

Click to show.

Test Name

K8sDatapathConfig AutoDirectNodeRoutes Check connectivity with sockops and direct routing

Failure Output

FAIL: Error creating resource /home/jenkins/workspace/Cilium-PR-K8s-1.21-kernel-5.4/src/github.com/cilium/cilium/test/k8sT/manifests/l3-policy-demo.yaml: Cannot retrieve cilium pod cilium-5hkgq policy revision: cannot get revision from json output 'Defaulted container "cilium-agent" out of: cilium-agent, mount-cgroup (init), clean-cilium-state (init)

If it is a flake, comment /mlh new-flake Cilium-PR-K8s-1.21-kernel-5.4 so I can create a new GitHub issue to track it.

Job 'Cilium-PR-K8s-1.23-kernel-net-next' failed and has not been observed before, so may be related to your PR:

Click to show.

Test Name

K8sPolicyTestExtended Validate toEntities KubeAPIServer Allows connection to KubeAPIServer

Failure Output

FAIL: k8s3 host unexpectedly connected to service "10.0.0.241", it should fail

If it is a flake, comment /mlh new-flake Cilium-PR-K8s-1.23-kernel-net-next so I can create a new GitHub issue to track it.

christarazi · 2021-12-28T01:15:16Z

/test

Job 'Cilium-PR-K8s-1.21-kernel-5.4' failed and has not been observed before, so may be related to your PR:

Click to show.

Test Name

K8sPolicyTestExtended Validate toEntities KubeAPIServer Allows connection to KubeAPIServer

Failure Output

FAIL: HTTP ingress connectivity to pod "10.0.1.230" from remote node

If it is a flake, comment /mlh new-flake Cilium-PR-K8s-1.21-kernel-5.4 so I can create a new GitHub issue to track it.

Job 'Cilium-PR-K8s-1.22-kernel-4.19' failed and has not been observed before, so may be related to your PR:

Click to show.

Test Name

K8sPolicyTestExtended Validate toEntities KubeAPIServer Allows connection to KubeAPIServer

Failure Output

FAIL: HTTP ingress connectivity to pod "10.0.1.164" from remote node

If it is a flake, comment /mlh new-flake Cilium-PR-K8s-1.22-kernel-4.19 so I can create a new GitHub issue to track it.

christarazi · 2021-12-28T03:23:40Z

/test

Job 'Cilium-PR-K8s-GKE' failed and has not been observed before, so may be related to your PR:

Click to show.

Test Name

K8sPolicyTestExtended Validate toEntities KubeAPIServer Allows connection to KubeAPIServer

Failure Output

FAIL: HTTP ingress connectivity to pod "10.204.2.112" from remote node

If it is a flake, comment /mlh new-flake Cilium-PR-K8s-GKE so I can create a new GitHub issue to track it.

Job 'Cilium-PR-K8s-1.23-kernel-net-next' failed and has not been observed before, so may be related to your PR:

Click to show.

Test Name

K8sPolicyTestExtended Validate toEntities KubeAPIServer Allows connection to KubeAPIServer

Failure Output

FAIL: failed to ensure kubectl version: failed to run kubectl version

If it is a flake, comment /mlh new-flake Cilium-PR-K8s-1.23-kernel-net-next so I can create a new GitHub issue to track it.

This commit makes a few changes to the Policies suite which will be useful in the subsequent commit. * Extract common functions from Policies suite to be used outside of the Describe block * Converge existing testCurlFromOutside() usage from the Services suite Signed-off-by: Chris Tarazi <chris@isovalent.com>

christarazi · 2021-12-28T07:24:53Z

/test

Job 'Cilium-PR-Runtime-net-next' failed and has not been observed before, so may be related to your PR:

Click to show.

Test Name

RuntimeKVStoreTest KVStore tests Etcd KVStore

Failure Output

FAIL: Endpoints are not ready after timeout

If it is a flake, comment /mlh new-flake Cilium-PR-Runtime-net-next so I can create a new GitHub issue to track it.

Job 'Cilium-PR-K8s-1.16-kernel-4.9' failed and has not been observed before, so may be related to your PR:

Click to show.

Test Name

K8sChaosTest Connectivity demo application Endpoint can still connect while Cilium is not running

Failure Output

FAIL: Timed out after 240.001s.

If it is a flake, comment /mlh new-flake Cilium-PR-K8s-1.16-kernel-4.9 so I can create a new GitHub issue to track it.

christarazi · 2021-12-28T19:33:25Z

/test

pchaigno

Only minor comments from me.

pchaigno · 2022-01-03T14:41:47Z

Why are those three configs needed?

I can speak for the last two, but not the first. The last two will help with the sysdump investigation if a test fails. These are the same options configured in the first Describe block as well.

Not specific to this PR then, but maybe we should enable those options for all tests in helpers/kubectl.go rather than in specific Describes. hubble.enabled=true is already the default there. debug.verbose is sneakily set to flow in the definition of helper function DeployCiliumAndDNS 😬

Good point, I didn't notice this. I'll followup to clean this up when #18431 is merged. (If that merged before this one, then I'll rebase, otherwise it'll just be another followup PR.)

christarazi · 2022-01-04T21:50:16Z

/test

Job 'Cilium-PR-K8s-GKE' failed and has not been observed before, so may be related to your PR:

Click to show.

Test Name

K8sDemosTest Tests Star Wars Demo

Failure Output

FAIL: unable to access deathstar.default.svc.cluster.local/v1/exhaust-port when policy allows it; 000

If it is a flake, comment /mlh new-flake Cilium-PR-K8s-GKE so I can create a new GitHub issue to track it.

christarazi · 2022-01-05T00:06:34Z

/mlh new-flake Cilium-PR-K8s-GKE

👍 created #18374

jrajahalme

Small nit on a comment only :-)

This test covers both cases where the kube-apiserver is within the cluster or outside of the cluster. This commit adds a second Describe block to the Policies, see comment on top of the second Describe block for why. Signed-off-by: Chris Tarazi <chris@isovalent.com>

christarazi · 2022-01-10T22:49:57Z

Pushed only a change to the comment as mentioned by #18333 (comment). No need to re-run CI. Marking ready to merge.

christarazi requested a review from a team as a code owner December 23, 2021 19:38

christarazi requested a review from a team December 23, 2021 19:38

christarazi requested a review from pchaigno December 23, 2021 19:38

maintainer-s-little-helper Bot added dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. and removed dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. labels Dec 23, 2021

christarazi requested a review from jrajahalme December 23, 2021 19:38

maintainer-s-little-helper Bot assigned pchaigno and jrajahalme Dec 23, 2021

christarazi changed the title ~~pr/christarazi/kube apiserver policy e2e~~ Add basic kube-apiserver policy matching e2e test Dec 23, 2021

christarazi mentioned this pull request Dec 23, 2021

Add e2e coverage of apiserver policy functionality #17829

Open

7 tasks

christarazi added the needs-backport/1.11 label Dec 23, 2021

christarazi force-pushed the pr/christarazi/kube-apiserver-policy-e2e branch from 7547b98 to 7c22439 Compare December 28, 2021 01:10

christarazi force-pushed the pr/christarazi/kube-apiserver-policy-e2e branch from 7c22439 to ab7b7d5 Compare December 28, 2021 03:05

christarazi force-pushed the pr/christarazi/kube-apiserver-policy-e2e branch from ab7b7d5 to 256bb94 Compare December 28, 2021 07:17

christarazi force-pushed the pr/christarazi/kube-apiserver-policy-e2e branch from 256bb94 to 731a78c Compare December 28, 2021 18:48

pchaigno reviewed Jan 3, 2022

View reviewed changes

christarazi force-pushed the pr/christarazi/kube-apiserver-policy-e2e branch from be1b0a1 to c9ff7d3 Compare January 4, 2022 21:49

christarazi requested a review from pchaigno January 4, 2022 21:50

pchaigno approved these changes Jan 5, 2022

View reviewed changes

maintainer-s-little-helper Bot unassigned pchaigno Jan 5, 2022

jrajahalme approved these changes Jan 10, 2022

View reviewed changes

Comment thread test/k8sT/Policies.go Outdated

maintainer-s-little-helper Bot unassigned jrajahalme Jan 10, 2022

christarazi mentioned this pull request Jan 10, 2022

Set debug.verbose to "flow" as a default for all CI runs #18431

Merged

christarazi force-pushed the pr/christarazi/kube-apiserver-policy-e2e branch from c9ff7d3 to e4b670c Compare January 10, 2022 22:49

christarazi added the ready-to-merge This PR has passed all tests and received consensus from code owners to merge. label Jan 10, 2022

pchaigno merged commit a6f9905 into cilium:master Jan 11, 2022

pchaigno mentioned this pull request Jan 11, 2022

v1.11 backports 2022-01-11 #18444

Merged

pchaigno added backport-pending/1.11 and removed needs-backport/1.11 labels Jan 11, 2022

christarazi deleted the pr/christarazi/kube-apiserver-policy-e2e branch January 11, 2022 19:01

christarazi mentioned this pull request Jan 12, 2022

[v1.11] Backport of #18333 #18464

Merged

aditighag mentioned this pull request Jan 14, 2022

v1.11 backports 2022-01-14 #18488

Merged

aditighag added backport-pending/1.11 and removed needs-backport/1.11 labels Jan 14, 2022

christarazi added backport-done/1.11 The backport for Cilium 1.11.x for this PR is done. and removed backport-pending/1.11 labels Jan 17, 2022

joestringer mentioned this pull request Jan 18, 2022

Prepare for release v1.11.1 #18535

Merged

Conversation

christarazi commented Dec 23, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

christarazi commented Dec 23, 2021 • edited by maintainer-s-little-helper Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Name

Failure Output

Test Name

Failure Output

Uh oh!

christarazi commented Dec 28, 2021 • edited by maintainer-s-little-helper Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Name

Failure Output

Test Name

Failure Output

Uh oh!

christarazi commented Dec 28, 2021 • edited by maintainer-s-little-helper Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Name

Failure Output

Test Name

Failure Output

Uh oh!

christarazi commented Dec 28, 2021 • edited by maintainer-s-little-helper Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Name

Failure Output

Test Name

Failure Output

Uh oh!

christarazi commented Dec 28, 2021

Uh oh!

pchaigno left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

pchaigno Jan 3, 2022

Choose a reason for hiding this comment

Uh oh!

christarazi Jan 3, 2022

Choose a reason for hiding this comment

Uh oh!

pchaigno Jan 5, 2022

Choose a reason for hiding this comment

Uh oh!

christarazi Jan 10, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

christarazi commented Jan 4, 2022 • edited by maintainer-s-little-helper Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Name

Failure Output

Uh oh!

christarazi commented Jan 5, 2022 • edited by maintainer-s-little-helper Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jrajahalme left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

christarazi commented Jan 10, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

christarazi commented Dec 23, 2021 •

edited

Loading

christarazi commented Dec 23, 2021 •

edited by maintainer-s-little-helper Bot

Loading

christarazi commented Dec 28, 2021 •

edited by maintainer-s-little-helper Bot

Loading

christarazi commented Dec 28, 2021 •

edited by maintainer-s-little-helper Bot

Loading

christarazi commented Dec 28, 2021 •

edited by maintainer-s-little-helper Bot

Loading

christarazi Jan 10, 2022 •

edited

Loading

christarazi commented Jan 4, 2022 •

edited by maintainer-s-little-helper Bot

Loading

christarazi commented Jan 5, 2022 •

edited by maintainer-s-little-helper Bot

Loading

christarazi commented Jan 10, 2022 •

edited

Loading