-
Notifications
You must be signed in to change notification settings - Fork 744
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
WIP: Partal commit minor change SNAT test changes WIP: Partal commit minor change Added SNAT tests for validating AWS_VPC_K8S_CNI_EXTERNALSNAT AWS_VPC_K8S_CNI_RANDOMIZESNAT AWS_VPC_K8S_CNI_EXCLUDE_SNAT_CIDRS ref: https://quip-amazon.com/4oG5AcaS2VaP/CNI-Automation-Plan#s:CTQ9CAuByTC;CTQ9CAd8OVS Moved env_vars_test file under cni code cleanup Added snat-utils for the agent code cleanup
- Loading branch information
Chinmay Gadgil
committed
Jun 17, 2021
1 parent
93edc95
commit 33ccdf0
Showing
16 changed files
with
701 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,93 @@ | ||
| package main | ||
|
|
||
| import ( | ||
| "flag" | ||
| "fmt" | ||
| "log" | ||
| "net/http" | ||
| "strings" | ||
| "time" | ||
|
|
||
| "github.com/coreos/go-iptables/iptables" | ||
| ) | ||
|
|
||
| func main() { | ||
| var testIPTableRules bool | ||
| var testExternalDomainConnectivity bool | ||
| var randomizedSNATValue string | ||
| var url string | ||
|
|
||
| flag.BoolVar(&testIPTableRules, "testIPTableRules", false, "bool flag when set to true tests validate if IPTable has required rules") | ||
| flag.StringVar(&randomizedSNATValue, "randomizedSNATValue", "prng", "value for AWS_VPC_K8S_CNI_RANDOMIZESNAT") | ||
| flag.BoolVar(&testExternalDomainConnectivity, "testExternalDomainConnectivity", false, "bool flag when set to true tests if the pod has internet access") | ||
| flag.StringVar(&url, "url", "https://aws.amazon.com/", "url to check for connectivity") | ||
|
|
||
| flag.Parse() | ||
|
|
||
| if testIPTableRules { | ||
| err := validateIPTableRules(randomizedSNATValue) | ||
| if err != nil { | ||
| log.Fatal(err) | ||
| } | ||
| log.Printf("Randomized SNAT test passed for AWS_VPC_K8S_CNI_RANDOMIZESNAT: %s\n", randomizedSNATValue) | ||
| } | ||
|
|
||
| if testExternalDomainConnectivity { | ||
| err := validateExternalDomainConnectivity(url) | ||
| if err != nil { | ||
| log.Fatal(err) | ||
| } | ||
| log.Println("External Domain Connectivity test passed") | ||
| } | ||
| } | ||
|
|
||
| func validateExternalDomainConnectivity(url string) error { | ||
| timeout := time.Duration(120 * time.Second) | ||
| client := http.Client{ | ||
| Timeout: timeout, | ||
| } | ||
| resp, err := client.Get(url) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| if resp.StatusCode != 200 { | ||
| return fmt.Errorf("%s returned response code: %d", url, resp.StatusCode) | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| func validateIPTableRules(randomizedSNATValue string) error { | ||
| // Check IPTable rules corresponding to AWS_VPC_K8S_CNI_RANDOMIZESNAT | ||
| expectedString := "random-fully" | ||
| iptables, err := iptables.New() | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| if !iptables.HasRandomFully() || randomizedSNATValue == "hashrandom" { | ||
| expectedString = "random" | ||
| } | ||
|
|
||
| chains, err := iptables.List("nat", "AWS-SNAT-CHAIN-1") | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| containsExpectedString := false | ||
| rule := "" | ||
| for _, chain := range chains { | ||
| if strings.Contains(chain, expectedString) { | ||
| rule = chain | ||
| containsExpectedString = true | ||
| break | ||
| } | ||
| } | ||
|
|
||
| if randomizedSNATValue == "none" && containsExpectedString { | ||
| return fmt.Errorf("failed: found unexpected %s for SNAT rule: %s", expectedString, rule) | ||
| } else if randomizedSNATValue != "none" && !containsExpectedString { | ||
| return fmt.Errorf("failed: did not find expected %s for any of the SNAT rules", expectedString) | ||
| } | ||
| return nil | ||
| } |
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.