Add conformance file and fix issues

Signed-off-by: Dyanngg <[email protected]>
antrea-io · Jul 12, 2023 · a4cc497 · a4cc497
1 parent fa8fff2
commit a4cc497
Show file tree

Hide file tree

Showing 6 changed files with 896 additions and 27 deletions.
diff --git a/cmd/antrea-controller/controller.go b/cmd/antrea-controller/controller.go
@@ -108,6 +108,7 @@ var allowedPaths = []string{
 	"/validate/acnp",
 	"/validate/annp",
 	"/validate/anp",
+	"/validate/banp",
 	"/validate/clustergroup",
 	"/validate/externalippool",
 	"/validate/egress",

diff --git a/pkg/agent/controller/networkpolicy/reconciler.go b/pkg/agent/controller/networkpolicy/reconciler.go
@@ -38,6 +38,7 @@ import (
 
 var (
 	baselineTierPriority int32 = 253
+	banpTierPriority     int32 = 254
 )
 
 type ruleType int
@@ -365,9 +366,12 @@ func (r *reconciler) getOFRuleTable(rule *CompletedRule) uint8 {
 		} else {
 			ruleTables = openflow.GetAntreaPolicyEgressTables()
 		}
-		if *rule.TierPriority != baselineTierPriority {
+		klog.Infof("Reconciling rule %v which has tier priority %v", rule.Name, *rule.TierPriority)
+		if *rule.TierPriority != baselineTierPriority && *rule.TierPriority != banpTierPriority {
+			klog.Info("hit1")
 			return ruleTables[0].GetID()
 		}
+		klog.Info("hit2")
 		tableID = ruleTables[1].GetID()
 	case igmp:
 		if rule.Direction == v1beta2.DirectionIn {

diff --git a/pkg/controller/networkpolicy/validate.go b/pkg/controller/networkpolicy/validate.go
@@ -1121,37 +1121,15 @@ func (g *groupValidator) deleteValidate(oldObj interface{}, userInfo authenticat
 }
 
 func (a *adminPolicyValidator) validateAdminNP(anp *v1alpha1.AdminNetworkPolicy) (string, bool) {
-	for _, r := range anp.Spec.Ingress {
-		for _, peer := range r.From {
-			if peer.Namespaces.SameLabels != nil || peer.Namespaces.NotSameLabels != nil {
-				return fmt.Sprintf("SameLabels and NotSameLabels namespace selection are not yet supported by Antrea"), false
-			}
-		}
-	}
-	for _, r := range anp.Spec.Egress {
-		for _, peer := range r.To {
-			if peer.Namespaces.SameLabels != nil || peer.Namespaces.NotSameLabels != nil {
-				return fmt.Sprintf("SameLabels and NotSameLabels namespace selection are not yet supported by Antrea"), false
-			}
-		}
+	if anpHasNamespaceLabelRule(anp) {
+		return fmt.Sprintf("SameLabels and NotSameLabels namespace selection are not yet supported by Antrea"), false
 	}
 	return "", true
 }
 
 func (a *adminPolicyValidator) validateBANP(banp *v1alpha1.BaselineAdminNetworkPolicy) (string, bool) {
-	for _, r := range banp.Spec.Ingress {
-		for _, peer := range r.From {
-			if peer.Namespaces.SameLabels != nil || peer.Namespaces.NotSameLabels != nil {
-				return fmt.Sprintf("SameLabels and NotSameLabels namespace selection are not yet supported by Antrea"), false
-			}
-		}
-	}
-	for _, r := range banp.Spec.Egress {
-		for _, peer := range r.To {
-			if peer.Namespaces.SameLabels != nil || peer.Namespaces.NotSameLabels != nil {
-				return fmt.Sprintf("SameLabels and NotSameLabels namespace selection are not yet supported by Antrea"), false
-			}
-		}
+	if banpHasNamespaceLabelRule(banp) {
+		return fmt.Sprintf("SameLabels and NotSameLabels namespace selection are not yet supported by Antrea"), false
 	}
 	return "", true
 }

diff --git a/test/conformance/adminnetworkpolicy_test.go b/test/conformance/adminnetworkpolicy_test.go
@@ -0,0 +1,80 @@
+// Copyright 2023 Antrea Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package conformance
+
+import (
+	"flag"
+	"fmt"
+	"testing"
+	"time"
+
+	"k8s.io/kubernetes/test/e2e/framework"
+	e2econfig "k8s.io/kubernetes/test/e2e/framework/config"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/config"
+	netpolv1alpha1 "sigs.k8s.io/network-policy-api/apis/v1alpha1"
+	"sigs.k8s.io/network-policy-api/conformance/tests"
+	netpolv1config "sigs.k8s.io/network-policy-api/conformance/utils/config"
+	"sigs.k8s.io/network-policy-api/conformance/utils/suite"
+)
+
+const (
+	showDebug                  = true
+	shouldCleanup              = true
+	enableAllSupportedFeatures = true
+	NetworkPolicyAPIRepoURL    = "https://raw.githubusercontent.com/kubernetes-sigs/network-policy-api/v0.1.1"
+)
+
+var conformanceTestsBaseManifests = fmt.Sprintf("%s/conformance/base/manifests.yaml", NetworkPolicyAPIRepoURL)
+
+func TestNetworkPolicyV2Conformance(t *testing.T) {
+	t.Log("Configuring environment for network policy API conformance tests")
+	cfg, err := config.GetConfig()
+	if err != nil {
+		t.Fatalf("Error loading Kubernetes config: %v", err)
+	}
+	c, err := client.New(cfg, client.Options{})
+	if err != nil {
+		t.Fatalf("Error initializing Kubernetes client: %v", err)
+	}
+	err = netpolv1alpha1.AddToScheme(c.Scheme())
+	if err != nil {
+		t.Fatalf("Error initializing API scheme: %v", err)
+	}
+
+	// Register test flags, then parse flags.
+	handleFlags()
+
+	t.Log("Starting the network policy conformance test suite")
+	// Depending on the tests some of them take longer and end up timing
+	// out on context, let's bump the GetTimeout to 300 seconds here.
+	cSuite := suite.New(suite.Options{
+		Client:                     c,
+		Debug:                      showDebug,
+		CleanupBaseResources:       shouldCleanup,
+		EnableAllSupportedFeatures: enableAllSupportedFeatures,
+		BaseManifests:              conformanceTestsBaseManifests,
+		TimeoutConfig:              netpolv1config.TimeoutConfig{GetTimeout: 300 * time.Second},
+	})
+	cSuite.Setup(t)
+	cSuite.Run(t, tests.ConformanceTests)
+}
+
+// handleFlags sets up all flags and parses the command line.
+func handleFlags() {
+	e2econfig.CopyFlags(e2econfig.Flags, flag.CommandLine)
+	framework.RegisterCommonFlags(flag.CommandLine)
+	flag.Parse()
+}
diff --git a/test/conformance/go.mod b/test/conformance/go.mod
@@ -0,0 +1,97 @@
+module antrea.io/antrea/test/conformance
+
+go 1.19
+
+require (
+	k8s.io/kubernetes v1.26.0
+	sigs.k8s.io/controller-runtime v0.14.6
+	sigs.k8s.io/network-policy-api v0.1.1
+)
+
+require (
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/blang/semver/v4 v4.0.0 // indirect
+	github.com/cenkalti/backoff/v4 v4.1.3 // indirect
+	github.com/cespare/xxhash/v2 v2.1.2 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/docker/distribution v2.8.1+incompatible // indirect
+	github.com/emicklei/go-restful/v3 v3.9.0 // indirect
+	github.com/evanphx/json-patch v4.12.0+incompatible // indirect
+	github.com/evanphx/json-patch/v5 v5.6.0 // indirect
+	github.com/felixge/httpsnoop v1.0.3 // indirect
+	github.com/go-logr/logr v1.2.3 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-openapi/jsonpointer v0.19.6 // indirect
+	github.com/go-openapi/jsonreference v0.20.1 // indirect
+	github.com/go-openapi/swag v0.22.3 // indirect
+	github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/google/gnostic v0.5.7-v3refs // indirect
+	github.com/google/go-cmp v0.5.9 // indirect
+	github.com/google/gofuzz v1.1.0 // indirect
+	github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 // indirect
+	github.com/google/uuid v1.3.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0 // indirect
+	github.com/imdario/mergo v0.3.6 // indirect
+	github.com/inconshreveable/mousetrap v1.0.1 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.2 // indirect
+	github.com/moby/spdystream v0.2.0 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/onsi/ginkgo/v2 v2.9.1 // indirect
+	github.com/onsi/gomega v1.27.4 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/prometheus/client_golang v1.14.0 // indirect
+	github.com/prometheus/client_model v0.3.0 // indirect
+	github.com/prometheus/common v0.37.0 // indirect
+	github.com/prometheus/procfs v0.8.0 // indirect
+	github.com/spf13/cobra v1.6.1 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/stretchr/testify v1.8.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.35.0 // indirect
+	go.opentelemetry.io/otel v1.10.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.10.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.10.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.10.0 // indirect
+	go.opentelemetry.io/otel/metric v0.31.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.10.0 // indirect
+	go.opentelemetry.io/otel/trace v1.10.0 // indirect
+	go.opentelemetry.io/proto/otlp v0.19.0 // indirect
+	golang.org/x/net v0.8.0 // indirect
+	golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b // indirect
+	golang.org/x/sys v0.6.0 // indirect
+	golang.org/x/term v0.6.0 // indirect
+	golang.org/x/text v0.8.0 // indirect
+	golang.org/x/time v0.3.0 // indirect
+	golang.org/x/tools v0.7.0 // indirect
+	google.golang.org/appengine v1.6.7 // indirect
+	google.golang.org/genproto v0.0.0-20220502173005-c8bf987b8c21 // indirect
+	google.golang.org/grpc v1.49.0 // indirect
+	google.golang.org/protobuf v1.28.1 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	k8s.io/api v0.26.1 // indirect
+	k8s.io/apimachinery v0.26.1 // indirect
+	k8s.io/apiserver v0.26.1 // indirect
+	k8s.io/client-go v0.26.1 // indirect
+	k8s.io/component-base v0.26.1 // indirect
+	k8s.io/component-helpers v0.26.0 // indirect
+	k8s.io/klog/v2 v2.90.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 // indirect
+	k8s.io/kubectl v0.26.0 // indirect
+	k8s.io/pod-security-admission v0.26.0 // indirect
+	k8s.io/utils v0.0.0-20230209194617-a36077c30491 // indirect
+	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.35 // indirect
+	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
+	sigs.k8s.io/yaml v1.3.0 // indirect
+)