connectivity: test accessing NodePort from outside with L7 policy

This test case covers cilium/cilium#21954. A new policy `echo-ingress-l7-policy-from-anywhere` is added to allow HTTP GET / on echo pods from outside. Use `cilium connectivity test --test north-south-loadbalancing --datapath` to run this test. Signed-off-by: Zhichuan Liang <[email protected]>
cilium · Apr 27, 2023 · 4ac1a48 · 4ac1a48
1 parent cbbecbb
commit 4ac1a48
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 0 deletions.
diff --git a/connectivity/manifests/echo-ingress-l7-http-from-anywhere.yaml b/connectivity/manifests/echo-ingress-l7-http-from-anywhere.yaml
@@ -0,0 +1,19 @@
+---
+apiVersion: "cilium.io/v2"
+kind: CiliumNetworkPolicy
+metadata:
+  name: "echo-ingress-l7-http-from-anywhere"
+spec:
+  description: "Allow all to GET / on echo"
+  endpointSelector:
+    matchLabels:
+      kind: echo
+  ingress:
+  - toPorts:
+    - ports:
+      - port: "8080"
+        protocol: TCP
+      rules:
+        http:
+          - method: "GET"
+            path: "/$"
diff --git a/connectivity/suite.go b/connectivity/suite.go
@@ -125,6 +125,9 @@ var (
 	//go:embed manifests/echo-ingress-l7-http.yaml
 	echoIngressL7HTTPPolicyYAML string
 
+	//go:embed manifests/echo-ingress-l7-http-from-anywhere.yaml
+	echoIngressL7HTTPFromAnywherePolicyYAML string
+
 	//go:embed manifests/echo-ingress-l7-http-named-port.yaml
 	echoIngressL7HTTPNamedPortPolicyYAML string
 
@@ -192,6 +195,12 @@ func Run(ctx context.Context, ct *check.ConnectivityTest) error {
 			WithScenarios(
 				tests.OutsideToNodePort(),
 			)
+		ct.NewTest("north-south-loadbalancing-with-l7-policy").
+			WithFeatureRequirements(check.RequireFeatureEnabled(check.FeatureNodeWithoutCilium)).
+			WithCiliumPolicy(echoIngressL7HTTPFromAnywherePolicyYAML).
+			WithScenarios(
+				tests.OutsideToNodePort(),
+			)
 		ct.NewTest("pod-to-pod-encryption").
 			WithFeatureRequirements(check.RequireFeatureEnabled(check.FeatureEncryptionPod)).
 			WithScenarios(