Skip to content

Commit 591f6d1

Browse files
dougbtvdougbtv
committed
Subdirectory CNI chain loading e2e tests
Adds a test for plain subdirectory chaining and also using passthru CNI with auxiliaryCNIChainName
1 parent 7d0327c commit 591f6d1

7 files changed

Lines changed: 310 additions & 0 deletions

‎.github/workflows/kind-e2e.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,14 @@ jobs:
8989
# working-directory: ./e2e
9090
# run: ./test-dra-integration.sh
9191

92+
- name: Test subdirectory CNI chaining
93+
working-directory: ./e2e
94+
run: ./test-subdirectory-chaining.sh
95+
96+
- name: Test subdirectory CNI chaining with passthru CNI / auxiliaryCNIChainName
97+
working-directory: ./e2e
98+
run: ./test-subdirectory-chaining-passthru.sh
99+
92100
- name: Export kind logs
93101
if: always()
94102
run: |

‎e2e/templates/subdirectory-chain-passthru-configupdate.yml.j2‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
kind: ConfigMap
3+
apiVersion: v1
4+
metadata:
5+
name: multus-daemon-config
6+
namespace: kube-system
7+
labels:
8+
tier: node
9+
app: multus
10+
data:
11+
daemon-config.json: |
12+
{
13+
"chrootDir": "/hostroot",
14+
"cniVersion": "{{ CNI_VERSION }}",
15+
"logLevel": "verbose",
16+
"logToStderr": true,
17+
"cniConfigDir": "/host/etc/cni/net.d",
18+
"multusAutoconfigDir": "/host/etc/cni/net.d",
19+
"multusConfigFile": "auto",
20+
"socketDir": "/host/run/multus/",
21+
"auxiliaryCNIChainName": "vendor-cni-chain"
22+
}

‎e2e/templates/subdirectory-chaining-passthru.yml.j2‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
---
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: cni-setup-script
6+
namespace: default
7+
data:
8+
setup.sh: |
9+
#!/bin/bash
10+
set -euxo pipefail
11+
12+
DEFAULT_NETWORK_CNI_NAME="vendor-cni-chain"
13+
14+
cleanup() {
15+
echo "Cleaning up..."
16+
rm -f /host/etc/cni/net.d/${DEFAULT_NETWORK_CNI_NAME}/sysctltwiddle.conf
17+
if [ $? -ne 0 ]; then
18+
echo "Failed to remove sysctltwiddle.conf" >&2
19+
exit 1
20+
fi
21+
echo "Cleanup completed successfully"
22+
}
23+
trap cleanup EXIT
24+
25+
# Create the chained CNI directory if it doesn't exist
26+
mkdir -p /host/etc/cni/net.d/${DEFAULT_NETWORK_CNI_NAME}
27+
if [ $? -ne 0 ]; then
28+
echo "Failed to create directory /host/etc/cni/net.d/${DEFAULT_NETWORK_CNI_NAME}" >&2
29+
exit 1
30+
fi
31+
32+
# Write the chained tuning CNI config
33+
cat <<EOF > /host/etc/cni/net.d/${DEFAULT_NETWORK_CNI_NAME}/sysctltwiddle.conf
34+
{
35+
"cniVersion": "{{ CNI_VERSION }}",
36+
"name": "sysctltwiddle",
37+
"type": "tuning",
38+
"sysctl": {
39+
"net.ipv4.conf.eth0.arp_filter": "1"
40+
}
41+
}
42+
EOF
43+
44+
if [ $? -ne 0 ]; then
45+
echo "Failed to create chained CNI config" >&2
46+
exit 1
47+
fi
48+
49+
echo "CNI chained setup completed successfully."
50+
sleep infinity
51+
---
52+
apiVersion: apps/v1
53+
kind: DaemonSet
54+
metadata:
55+
name: cni-setup-daemonset
56+
namespace: default
57+
labels:
58+
app: cni-setup
59+
spec:
60+
selector:
61+
matchLabels:
62+
app: cni-setup
63+
template:
64+
metadata:
65+
labels:
66+
app: cni-setup
67+
spec:
68+
tolerations:
69+
- operator: Exists
70+
effect: NoSchedule
71+
- operator: Exists
72+
effect: NoExecute
73+
containers:
74+
- name: setup
75+
image: quay.io/fedora/fedora:40
76+
securityContext:
77+
privileged: true
78+
volumeMounts:
79+
- name: cni-config
80+
mountPath: /host/etc/cni/net.d
81+
- name: script-volume
82+
mountPath: /scripts
83+
command: ["/bin/bash", "/scripts/setup.sh"]
84+
volumes:
85+
- name: cni-config
86+
hostPath:
87+
path: /etc/cni/net.d
88+
type: Directory
89+
- name: script-volume
90+
configMap:
91+
name: cni-setup-script
92+
items:
93+
- key: setup.sh
94+
path: setup.sh

‎e2e/templates/subdirectory-chaining-pod.yml.j2‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: sysctl-modified
5+
spec:
6+
containers:
7+
- name: sysctl
8+
image: quay.io/dosmith/fedora-procps
9+
command: ["/bin/bash", "-c", "trap : TERM INT; sleep infinity & wait"]
10+
securityContext:
11+
privileged: true

‎e2e/templates/subdirectory-chaining.yml.j2‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
---
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: cni-setup-script
6+
namespace: default
7+
data:
8+
setup.sh: |
9+
#!/bin/bash
10+
set -euxo pipefail
11+
12+
DEFAULT_NETWORK_CNI_NAME="kindnet"
13+
14+
cleanup() {
15+
echo "Cleaning up..."
16+
rm -f /host/etc/cni/net.d/${DEFAULT_NETWORK_CNI_NAME}/sysctltwiddle.conf
17+
if [ $? -ne 0 ]; then
18+
echo "Failed to remove sysctltwiddle.conf" >&2
19+
exit 1
20+
fi
21+
echo "Cleanup completed successfully"
22+
}
23+
trap cleanup EXIT
24+
25+
# Create the chained CNI directory if it doesn't exist
26+
mkdir -p /host/etc/cni/net.d/${DEFAULT_NETWORK_CNI_NAME}
27+
if [ $? -ne 0 ]; then
28+
echo "Failed to create directory /host/etc/cni/net.d/${DEFAULT_NETWORK_CNI_NAME}" >&2
29+
exit 1
30+
fi
31+
32+
# Write the chained tuning CNI config
33+
cat <<EOF > /host/etc/cni/net.d/${DEFAULT_NETWORK_CNI_NAME}/sysctltwiddle.conf
34+
{
35+
"cniVersion": "{{ CNI_VERSION }}",
36+
"name": "sysctltwiddle",
37+
"type": "tuning",
38+
"sysctl": {
39+
"net.ipv4.conf.IFNAME.arp_filter": "1"
40+
}
41+
}
42+
EOF
43+
44+
if [ $? -ne 0 ]; then
45+
echo "Failed to create chained CNI config" >&2
46+
exit 1
47+
fi
48+
49+
echo "CNI chained setup completed successfully."
50+
sleep infinity
51+
---
52+
apiVersion: apps/v1
53+
kind: DaemonSet
54+
metadata:
55+
name: cni-setup-daemonset
56+
namespace: default
57+
labels:
58+
app: cni-setup
59+
spec:
60+
selector:
61+
matchLabels:
62+
app: cni-setup
63+
template:
64+
metadata:
65+
labels:
66+
app: cni-setup
67+
spec:
68+
tolerations:
69+
- operator: Exists
70+
effect: NoSchedule
71+
- operator: Exists
72+
effect: NoExecute
73+
containers:
74+
- name: setup
75+
image: quay.io/fedora/fedora:40
76+
securityContext:
77+
privileged: true
78+
volumeMounts:
79+
- name: cni-config
80+
mountPath: /host/etc/cni/net.d
81+
- name: script-volume
82+
mountPath: /scripts
83+
command: ["/bin/bash", "/scripts/setup.sh"]
84+
volumes:
85+
- name: cni-config
86+
hostPath:
87+
path: /etc/cni/net.d
88+
type: Directory
89+
- name: script-volume
90+
configMap:
91+
name: cni-setup-script
92+
items:
93+
- key: setup.sh
94+
path: setup.sh

‎e2e/test-subdirectory-chaining-passthru.sh‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
#!/bin/sh
2+
set -o errexit
3+
4+
export PATH=${PATH}:./bin
5+
6+
TEST_POD_NAME="sysctl-modified"
7+
8+
# Reconfigure multus
9+
kubectl apply -f yamls/subdirectory-chain-passthru-configupdate.yml
10+
11+
# Restart the multus daemonset to pick up the new config
12+
kubectl rollout restart daemonset kube-multus-ds -n kube-system
13+
kubectl rollout status daemonset/kube-multus-ds -n kube-system
14+
15+
# Deploy the daemonset that will lay down the chained CNI config
16+
kubectl apply -f yamls/subdirectory-chaining-passthru.yml
17+
18+
# Wait for the daemonset pods to be ready (make sure they set up CNI config)
19+
kubectl rollout status daemonset/cni-setup-daemonset
20+
21+
# Deploy a test pod that will get chained CNI applied
22+
kubectl apply -f yamls/subdirectory-chaining-pod.yml
23+
24+
# Wait for the pod to be Ready
25+
kubectl wait --for=condition=ready pod/sysctl-modified --timeout=300s
26+
27+
# Check that the sysctl got set
28+
echo "Verifying sysctl arp_filter is set to 1 on eth0"
29+
30+
SYSCTL_VALUE=$(kubectl exec sysctl-modified -- sysctl -n net.ipv4.conf.eth0.arp_filter)
31+
32+
if [ "$SYSCTL_VALUE" != "1" ]; then
33+
echo "FAIL: net.ipv4.conf.eth0.arp_filter is not set to 1, got ${SYSCTL_VALUE}" >&2
34+
exit 1
35+
else
36+
echo "SUCCESS: net.ipv4.conf.eth0.arp_filter is set correctly."
37+
fi
38+
39+
# Remove the rest...
40+
echo "Cleaning up test resources"
41+
kubectl delete -f yamls/subdirectory-chaining-pod.yml
42+
kubectl delete -f yamls/subdirectory-chaining-passthru.yml
43+
44+
exit 0

‎e2e/test-subdirectory-chaining.sh‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
#!/bin/sh
2+
set -o errexit
3+
4+
export PATH=${PATH}:./bin
5+
6+
TEST_POD_NAME="sysctl-modified"
7+
8+
# Deploy the daemonset that will lay down the chained CNI config
9+
kubectl apply -f yamls/subdirectory-chaining.yml
10+
11+
# Wait for the daemonset pods to be ready (we need the config to be laid down)
12+
kubectl rollout status daemonset/cni-setup-daemonset
13+
14+
# Deploy a test pod that will get chained CNI applied
15+
kubectl apply -f yamls/subdirectory-chaining-pod.yml
16+
17+
# Wait for the pod to be Ready
18+
kubectl wait --for=condition=ready pod/sysctl-modified --timeout=300s
19+
20+
# Check that the sysctl got set properly inside the pod's eth0 interface
21+
echo "Verifying sysctl arp_filter is set to 1 on eth0"
22+
23+
SYSCTL_VALUE=$(kubectl exec sysctl-modified -- sysctl -n net.ipv4.conf.eth0.arp_filter)
24+
25+
if [ "$SYSCTL_VALUE" != "1" ]; then
26+
echo "FAIL: net.ipv4.conf.eth0.arp_filter is not set to 1, got ${SYSCTL_VALUE}" >&2
27+
exit 1
28+
else
29+
echo "SUCCESS: net.ipv4.conf.eth0.arp_filter is set correctly."
30+
fi
31+
32+
# 6. Clean up
33+
echo "Cleaning up test resources"
34+
kubectl delete -f yamls/subdirectory-chaining-pod.yml
35+
kubectl delete -f yamls/subdirectory-chaining.yml
36+
37+
exit 0

0 commit comments

Comments
 (0)