WIP: E2E test case for Kmesh L4 authorization by YaoZengzeng · Pull Request #641 · kmesh-net/kmesh

YaoZengzeng · 2024-07-27T08:01:36Z

What type of PR is this?

/kind enhancement

What this PR does / why we need it:

Which issue(s) this PR fixes:
Fixes #492

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

codecov · 2024-07-27T09:08:43Z

Codecov Report

Attention: Patch coverage is 0% with 17 lines in your changes missing coverage. Please review.

Project coverage is 45.23%. Comparing base (2eb3f92) to head (335cb2a).
Report is 176 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/status/status_server.go	0.00%	17 Missing ⚠️

Files with missing lines	Coverage Δ
pkg/status/status_server.go	`34.93% <0.00%> (-0.96%)`	⬇️

... and 2 files with indirect coverage changes

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 724789d...335cb2a. Read the comment docs.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

YaoZengzeng · 2024-07-27T09:24:18Z

/test

kmesh-bot · 2024-07-27T09:24:24Z

@YaoZengzeng: No presubmit jobs available for kmesh-net/kmesh@main

Details

In response to this:

/test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

YaoZengzeng · 2024-07-27T09:26:16Z

/retest

hzxuzhonghu · 2024-07-30T08:10:23Z

test/e2e/baseline_test.go

+			if len(apps.ServiceWithWaypointAtServiceGranularity) == 0 {
+				t.Fatal(fmt.Errorf("need at least 1 instance of apps.ServiceWithWaypointAtServiceGranularity"))
+			}
+			src := apps.ServiceWithWaypointAtServiceGranularity[0]


why do you choose this special workload as a src client

There is no specific choice, any workload managed by Kmesh is OK.

hzxuzhonghu · 2024-07-30T08:10:59Z

test/e2e/baseline_test.go

+
+			addresses := clients.Addresses()
+			if len(addresses) < 2 {
+				t.Fatal(fmt.Errorf("need at least 2 clients"))


? why require at least 2 addresses

One for allow and one for deny.

hzxuzhonghu · 2024-07-30T08:12:40Z

test/e2e/baseline_test.go

+	check.ErrorContains("EOF"),                                // TCP envoy
+	check.ErrorContains("read: connection reset by peer"),     // TCP Kmesh
+	check.NoErrorAndStatus(http.StatusForbidden),              // HTTP
+	check.NoErrorAndStatus(http.StatusServiceUnavailable),     // HTTP client, TCP server


This is too wide, for tcp authz, can we only check reset?

hzxuzhonghu · 2024-07-30T08:15:31Z

test/e2e/baseline_test.go

+  selector:
+    matchLabels:
+      app: "{{.Destination}}"
+`+tc.spec+`


A hacky way, would prefer using fmt.Sprintf or golang template

hzxuzhonghu · 2025-01-13T09:00:46Z

authz offloading is disabled by default, the only way to enable it is kmeshctl authx enable

kmesh-bot · 2025-01-26T02:43:08Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign bitcoffeeiux for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

weli-l · 2025-02-17T08:05:33Z

/retest

hzxuzhonghu · 2025-02-17T08:59:19Z

/test all

kmesh-bot · 2025-02-17T08:59:27Z

@hzxuzhonghu: No presubmit jobs available for kmesh-net/kmesh@main

Details

In response to this:

/test all

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Signed-off-by: YaoZengzeng <yaozengzeng@huawei.com>

YaoZengzeng · 2025-02-19T03:01:56Z

/test all

kmesh-bot · 2025-02-19T03:02:03Z

@YaoZengzeng: No presubmit jobs available for kmesh-net/kmesh@main

Details

In response to this:

/test all

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Signed-off-by: YaoZengzeng <yaozengzeng@huawei.com>

YaoZengzeng · 2025-02-19T06:19:50Z

/retest

hzxuzhonghu

Fogot to submit comments

hzxuzhonghu · 2025-02-18T11:10:57Z

bpf/kmesh/workload/xdp.c

 int xdp_authz(struct xdp_md *ctx)
 {
    if (!is_authz_offload_enabled()) {
+        BPF_LOG(INFO, XDP, "offload authorization is DISABLED");


hzxuzhonghu · 2025-02-18T11:11:05Z

bpf/kmesh/workload/xdp.c

        bpf_tail_call(ctx, &map_of_xdp_tailcall, TAIL_CALL_AUTH_IN_USER_SPACE);
        return XDP_PASS;
    }
+    BPF_LOG(INFO, XDP, "offload authorization is ENABLED");


hzxuzhonghu · 2025-02-18T11:14:17Z

test/e2e/baseline_test.go

 	})
 }

+func TestAuthorizationL4(t *testing.T) {


nit: we can split test cases by the functionalities

hzxuzhonghu · 2025-02-18T11:17:16Z

test/e2e/baseline_test.go

+
+			count := 0
+			workloads := dst.WorkloadsOrFail(t)
+			for _, client := range workloads {


hmm, this is the server instance

hzxuzhonghu · 2025-02-18T11:18:07Z

test/e2e/baseline_test.go

+				ticker := time.NewTicker(500 * time.Millisecond)
+				defer ticker.Stop()
+			InnerLoop:
+				for {


there is retry.Until that can be used

hzxuzhonghu · 2025-02-18T11:20:10Z

test/e2e/baseline_test.go

+					opt.Check = chooseChecker(tc.name, client.Address())
+
+					t.NewSubTestf("%v", name).Run(func(t framework.TestContext) {
+						src.WithWorkloads(client).CallOrFail(t, opt)


shoudn't you wait until the policy has been populated? I cannot understand how you make it

YaoZengzeng · 2025-04-28T11:26:27Z

replace by #1349

kmesh-bot added do-not-merge/work-in-progress kind/enhancement New feature or request labels Jul 27, 2024

kmesh-bot requested review from hzxuzhonghu and kevin-wangzefeng July 27, 2024 08:01

kmesh-bot added the size/M label Jul 27, 2024

YaoZengzeng force-pushed the e2e-auth branch from cefaabb to eb76910 Compare July 27, 2024 08:04

kmesh-bot added size/L and removed size/M labels Jul 27, 2024

YaoZengzeng force-pushed the e2e-auth branch from 0f783b8 to 4a419f2 Compare July 29, 2024 01:38

hzxuzhonghu reviewed Jul 30, 2024

View reviewed changes

YaoZengzeng force-pushed the e2e-auth branch from 4a419f2 to 406cda9 Compare January 13, 2025 08:27

YaoZengzeng mentioned this pull request Jan 21, 2025

kmeshctl authz can't trigger offload authorization enable #1207

Closed

kmesh-bot added size/XXL and removed size/L labels Jan 26, 2025

YaoZengzeng force-pushed the e2e-auth branch from 22a3fb4 to 88e54bf Compare February 15, 2025 09:20

hzxuzhonghu force-pushed the e2e-auth branch from 60d92b8 to 0f86845 Compare February 17, 2025 09:01

YaoZengzeng added 2 commits February 17, 2025 12:21

e2e test for L4 authorization

722aff8

Signed-off-by: YaoZengzeng <yaozengzeng@huawei.com>

pass allow scenario

a668f69

Signed-off-by: YaoZengzeng <yaozengzeng@huawei.com>

YaoZengzeng added 9 commits February 17, 2025 12:21

add deny scenario

43a7fde

Signed-off-by: YaoZengzeng <yaozengzeng@huawei.com>

fix comments

d927b90

Signed-off-by: YaoZengzeng <yaozengzeng@huawei.com>

adjust call timeout

f45941c

Signed-off-by: YaoZengzeng <yaozengzeng@huawei.com>

kmeshctl control authz

820b570

Signed-off-by: YaoZengzeng <yaozengzeng@huawei.com>

fix codespell

fc95d15

Signed-off-by: YaoZengzeng <yaozengzeng@huawei.com>

more fix

2cab055

Signed-off-by: YaoZengzeng <yaozengzeng@huawei.com>

optimize kmeshctl authz

c10f1f2

Signed-off-by: YaoZengzeng <yaozengzeng@huawei.com>

fix flaky

a2e5ba7

Signed-off-by: YaoZengzeng <yaozengzeng@huawei.com>

fix authz

b4775df

Signed-off-by: YaoZengzeng <yaozengzeng@huawei.com>

YaoZengzeng force-pushed the e2e-auth branch from 0f86845 to b4775df Compare February 17, 2025 12:22

kmesh-bot added size/L and removed size/XXL labels Feb 17, 2025

delte go backup file

335cb2a

Signed-off-by: YaoZengzeng <yaozengzeng@huawei.com>

YaoZengzeng force-pushed the e2e-auth branch from 93b7fff to 335cb2a Compare February 19, 2025 03:05

hzxuzhonghu reviewed Feb 19, 2025

View reviewed changes

YaoZengzeng closed this Apr 28, 2025

Conversation

YaoZengzeng commented Jul 27, 2024

Uh oh!

codecov bot commented Jul 27, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

YaoZengzeng commented Jul 27, 2024

Uh oh!

kmesh-bot commented Jul 27, 2024

Uh oh!

YaoZengzeng commented Jul 27, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hzxuzhonghu commented Jan 13, 2025

Uh oh!

kmesh-bot commented Jan 26, 2025

Uh oh!

weli-l commented Feb 17, 2025

Uh oh!

hzxuzhonghu commented Feb 17, 2025

Uh oh!

kmesh-bot commented Feb 17, 2025

Uh oh!

YaoZengzeng commented Feb 19, 2025

Uh oh!

kmesh-bot commented Feb 19, 2025

Uh oh!

YaoZengzeng commented Feb 19, 2025

Uh oh!

hzxuzhonghu left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

YaoZengzeng commented Apr 28, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

codecov bot commented Jul 27, 2024 •

edited

Loading