BPF Masquerade test #2384
Draft
BPF Masquerade test #2384
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This will be used for implementing bpf-masquerade tests in subsequent commits. Signed-off-by: Tom Hadlaw <tom.hadlaw@isovalent.com>
The new echoserver server test image will echo back the remote client ip when requesting GET /echo. When running a node without Ciliu, we use this to implement a masquerading connectivity test to curl out to the external node to find out if the correct client remote IP was used. Signed-off-by: Tom Hadlaw <tom.hadlaw@isovalent.com>
Currently, the node based json-mock server is used for creating test servers for running various tests. Unfortunately this has some shortcomings, namely: * Mock image is built outside of CLI repo thus making it difficult to make changes to. * JSON Mock is designed to provide a server that returns some static schema of data. Cilium connectivity tests don't really this functionality, (we only really need to define some extra http routes to test route based policy). Instead a more flexible implementation would make it easier to adapt to future use cases. * JSON Mock doesn't log on the index server as it's not really part of the schema. Better logging from the servers would be useful for diagosing test l7 failures/flakes (ex. cilium/cilium#27762) as it would let us correlate timestamped events on the server side. This adds a new standalone server called "echoserver" which is a small Go http server with the following routes: GET / -> Index route, used for general l4/l7 connectivity testing. GET /private -> Private route, used for l7 network policy. GET /public -> Private route, used for l7 network policy. GET /echo -> Responds with a json payload the remote address (i.e. <ip>:<client_port>) and timestamp. These routes will cover existing test cases, with the latter being used to implement a bpf masquerade connectivity test. Signed-off-by: Tom Hadlaw <tom.hadlaw@isovalent.com>
Previous commits introduced a Go based implementation of the echoserver. This also provides more detailed request logging, this may be useful when debugging connectivity tests. This adds a set of sysdump steps that are run when invoked from 'cilium connectivity test' which will dump logs from test namespace echo server Pods (i.e. label:kind=echo). Signed-off-by: Tom Hadlaw <tom.hadlaw@isovalent.com>
|
Neat! We could extend this test to cover not only BPF masq, but also the connectivity to outside. Currently, by default, we use 1.1.1.1 as the endpoint to outside, which is flaky. We could use that echo server as the endpoint. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Adds test coverage for bpf-masquerade (as well as any other IP masquerading mode) via connectivity tests. Currently this is done via Ginkgo runtime tests in cilium/cilium.
To accommodate this, and to improve overall test debugging this also replaces the normal json-mock based echo server implementation, used by connectivity tests, with a Go based implementation.
Currently, the node based json-mock server is used for creating test servers for running various tests.
Unfortunately this has some shortcomings, namely:
This adds a new standalone server called "echoserver" which is a small Go http server with the following routes:
GET / -> Index route, used for general l4/l7 connectivity testing.
GET /private -> Private route, used for l7 network policy.
GET /public -> Private route, used for l7 network policy.
GET /echo -> Responds with a json payload the remote address (i.e. :<client_port>) and timestamp.
These routes will cover existing test cases, with the latter being used to implement a bpf masquerade connectivity test.