connectivity: add test for accessing NodePort from outside with L7 po…

…licy

This test case covers cilium/cilium#21954. The
test is for accessing NodePort from outside with L7 policy."

The echo-ingress-l7-http policy is updated to allow HTTP GET from outside,
instead of only from 'other' client pods.

Use `cilium connectivity test --test north-south-loadbalancing --datapath`
to run this test.

Signed-off-by: Zhichuan Liang <[email protected]>

connectivity/manifests/echo-ingress-l7-http.yaml

@@ -9,9 +9,11 @@ spec:
     matchLabels:
       kind: echo
   ingress:
-  # Only allow 'other' client to make a GET /public requests.
+  # Only allow 'other' client or world to make a GET /public requests.
   # Allow GET /private' only if a particular HTTP header is set.
   # Disallow L3 traffic for now, flow matcher doesn't yet support L7 drops.
+  - fromEntities:
+    - world
   - fromEndpoints:
     - matchLabels:
         other: client

connectivity/suite.go

@@ -192,6 +192,12 @@ func Run(ctx context.Context, ct *check.ConnectivityTest) error {
 			WithScenarios(
 				tests.OutsideToNodePort(),
 			)
+		ct.NewTest("north-south-loadbalancing-with-l7-policy").
+			WithFeatureRequirements(check.RequireFeatureEnabled(check.FeatureNodeWithoutCilium)).
+			WithCiliumPolicy(echoIngressL7HTTPPolicyYAML).
+			WithScenarios(
+				tests.OutsideToNodePort(),
+			)
 		ct.NewTest("pod-to-pod-encryption").
 			WithFeatureRequirements(check.RequireFeatureEnabled(check.FeatureEncryptionPod)).
 			WithScenarios(