Skip to content

Commit c1d5777

Browse files
duanwei33duanwei33
committed
Add e2e tests for storage network policy labels
This commit adds comprehensive e2e tests to verify that storage-related operators and controllers have the required network policy labels and that NetworkPolicy resources exist with correct pod selectors. Changes: - Add namespace constants to helpers.go for reuse across storage tests - Add storage_networkpolicy.go with tests for CSO and CSI operators - Verify required network policy labels on deployments - Validate NetworkPolicy resources in storage namespaces - Skip these tests on MicroShift clusters where they are not applicable The tests check: 1. CSO operators: cluster-storage-operator, vsphere-problem-detector-operator, csi-snapshot-controller-operator, and csi-snapshot-controller 2. CSI operators: AWS EBS/EFS, Azure Disk/File, GCP PD/Filestore, vSphere, IBM VPC Block, OpenStack Cinder/Manila, and SMB drivers 3. NetworkPolicy resources in openshift-cluster-storage-operator and openshift-cluster-csi-drivers namespaces
1 parent 816619b commit c1d5777

File tree

2 files changed

+326
-0
lines changed

2 files changed

+326
-0
lines changed

‎test/extended/storage/helpers.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,13 @@ const (
2121
defaultPollingTime = 2 * time.Second
2222
)
2323

24+
// Storage operator and CSI driver namespace constants
25+
const (
26+
CSONamespace = "openshift-cluster-storage-operator" // Cluster Storage Operator namespace
27+
CSINamespace = "openshift-cluster-csi-drivers" // Default CSI driver operators namespace
28+
ManilaCSINamespace = "openshift-manila-csi-driver" // Manila CSI driver namespace (OpenStack only)
29+
)
30+
2431
// IsCSOHealthy checks whether the Cluster Storage Operator is healthy
2532
func IsCSOHealthy(oc *exutil.CLI) (bool, error) {
2633
// CSO healthyStatus:[degradedStatus:False, progressingStatus:False, availableStatus:True, upgradeableStatus:True]

‎test/extended/storage/storage_networkpolicy.go‎

Lines changed: 319 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,319 @@
1+
package storage
2+
3+
import (
4+
"context"
5+
"fmt"
6+
"strings"
7+
8+
g "github.com/onsi/ginkgo/v2"
9+
o "github.com/onsi/gomega"
10+
exutil "github.com/openshift/origin/test/extended/util"
11+
"k8s.io/apimachinery/pkg/api/errors"
12+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
13+
e2e "k8s.io/kubernetes/test/e2e/framework"
14+
)
15+
16+
type deploymentCheck struct {
17+
Namespace string
18+
Name string
19+
Platform string
20+
RequiredLabels map[string]string
21+
}
22+
23+
type npCheck struct {
24+
Namespace string
25+
Optional bool
26+
Policies map[string]map[string]string
27+
}
28+
29+
var (
30+
npLabelAPI = map[string]string{"openshift.storage.network-policy.api-server": "allow"}
31+
npLabelDNS = map[string]string{"openshift.storage.network-policy.dns": "allow"}
32+
npLabelOperatorMetrics = map[string]string{"openshift.storage.network-policy.operator-metrics": "allow"}
33+
npLabelOperatorMetricsRange = map[string]string{"openshift.storage.network-policy.operator-metrics-range": "allow"}
34+
npLabelMetricsRange = map[string]string{"openshift.storage.network-policy.metrics-range": "allow"}
35+
)
36+
37+
func mergeLabels(maps ...map[string]string) map[string]string {
38+
out := map[string]string{}
39+
for _, m := range maps {
40+
for k, v := range m {
41+
out[k] = v
42+
}
43+
}
44+
return out
45+
}
46+
47+
var (
48+
csoOperatorRequiredLabels = mergeLabels(npLabelAPI, npLabelDNS, npLabelOperatorMetrics)
49+
csoControllerRequiredLabels = mergeLabels(npLabelAPI, npLabelDNS)
50+
csiOperatorRequiredLabels = mergeLabels(npLabelAPI, npLabelDNS, npLabelOperatorMetricsRange)
51+
csiControllerRequiredLabels = mergeLabels(npLabelAPI, npLabelDNS, npLabelMetricsRange)
52+
)
53+
54+
var (
55+
npNameAPI = "allow-egress-to-api-server"
56+
npNameDNS = "allow-to-dns"
57+
npNameOperatorMetrics = "allow-ingress-to-operator-metrics"
58+
npNameMetricsRange = "allow-ingress-to-metrics-range"
59+
npNameOperatorMetricsRange = "allow-ingress-to-operator-metrics-range"
60+
)
61+
62+
var networkPolicyChecks = []npCheck{
63+
{
64+
Namespace: CSONamespace,
65+
Policies: map[string]map[string]string{
66+
npNameAPI: npLabelAPI,
67+
npNameDNS: npLabelDNS,
68+
npNameOperatorMetrics: npLabelOperatorMetrics,
69+
},
70+
},
71+
{
72+
Namespace: CSINamespace,
73+
Policies: map[string]map[string]string{
74+
npNameAPI: npLabelAPI,
75+
npNameDNS: npLabelDNS,
76+
npNameMetricsRange: npLabelMetricsRange,
77+
npNameOperatorMetricsRange: npLabelOperatorMetricsRange,
78+
},
79+
},
80+
{
81+
Namespace: ManilaCSINamespace,
82+
Optional: true,
83+
Policies: map[string]map[string]string{
84+
npNameAPI: npLabelAPI,
85+
npNameDNS: npLabelDNS,
86+
npNameMetricsRange: npLabelMetricsRange,
87+
npNameOperatorMetricsRange: npLabelOperatorMetricsRange,
88+
},
89+
},
90+
}
91+
92+
var _ = g.Describe("[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy", func() {
93+
defer g.GinkgoRecover()
94+
var (
95+
oc = exutil.NewCLI("storage-network-policy")
96+
currentPlatform = e2e.TestContext.Provider
97+
)
98+
99+
g.BeforeEach(func() {
100+
isMicroShift, err := exutil.IsMicroShiftCluster(oc.AdminKubeClient())
101+
o.Expect(err).NotTo(o.HaveOccurred())
102+
if isMicroShift {
103+
g.Skip("Storage Network Policy tests are not supported on MicroShift")
104+
}
105+
})
106+
107+
g.It("should verify required labels for CSO related Operators", func() {
108+
CSODeploymentsToCheck := []deploymentCheck{
109+
{
110+
Namespace: CSONamespace,
111+
Name: "cluster-storage-operator",
112+
Platform: "all",
113+
RequiredLabels: csoOperatorRequiredLabels,
114+
},
115+
{
116+
Namespace: CSONamespace,
117+
Name: "vsphere-problem-detector-operator",
118+
Platform: "vsphere",
119+
RequiredLabels: csoOperatorRequiredLabels,
120+
},
121+
{
122+
Namespace: CSONamespace,
123+
Name: "csi-snapshot-controller-operator",
124+
Platform: "all",
125+
RequiredLabels: csoOperatorRequiredLabels,
126+
},
127+
{
128+
Namespace: CSONamespace,
129+
Name: "csi-snapshot-controller",
130+
Platform: "all",
131+
RequiredLabels: csoControllerRequiredLabels,
132+
},
133+
}
134+
runDeploymentChecks(oc, CSODeploymentsToCheck, currentPlatform)
135+
})
136+
137+
g.It("should verify required labels for CSI related Operators", func() {
138+
CSIdeploymentsToCheck := []deploymentCheck{
139+
{
140+
Namespace: CSINamespace,
141+
Name: "aws-ebs-csi-driver-operator",
142+
Platform: "aws",
143+
RequiredLabels: csiOperatorRequiredLabels,
144+
},
145+
{
146+
Namespace: CSINamespace,
147+
Name: "aws-ebs-csi-driver-controller",
148+
Platform: "aws",
149+
RequiredLabels: csiControllerRequiredLabels,
150+
},
151+
{
152+
Namespace: CSINamespace,
153+
Name: "aws-efs-csi-driver-operator",
154+
Platform: "aws",
155+
RequiredLabels: csiOperatorRequiredLabels,
156+
},
157+
{
158+
Namespace: CSINamespace,
159+
Name: "azure-disk-csi-driver-operator",
160+
Platform: "azure",
161+
RequiredLabels: csiOperatorRequiredLabels,
162+
},
163+
{
164+
Namespace: CSINamespace,
165+
Name: "azure-disk-csi-driver-controller",
166+
Platform: "azure",
167+
RequiredLabels: csiControllerRequiredLabels,
168+
},
169+
{
170+
Namespace: CSINamespace,
171+
Name: "azure-file-csi-driver-operator",
172+
Platform: "azure",
173+
RequiredLabels: csiOperatorRequiredLabels,
174+
},
175+
{
176+
Namespace: CSINamespace,
177+
Name: "azure-file-csi-driver-controller",
178+
Platform: "azure",
179+
RequiredLabels: csiControllerRequiredLabels,
180+
},
181+
{
182+
Namespace: CSINamespace,
183+
Name: "gcp-pd-csi-driver-operator",
184+
Platform: "gcp",
185+
RequiredLabels: csiOperatorRequiredLabels,
186+
},
187+
{
188+
Namespace: CSINamespace,
189+
Name: "gcp-filestore-csi-driver-operator",
190+
Platform: "gcp",
191+
RequiredLabels: csiOperatorRequiredLabels,
192+
},
193+
{
194+
Namespace: CSINamespace,
195+
Name: "vmware-vsphere-csi-driver-operator",
196+
Platform: "vsphere",
197+
RequiredLabels: csiOperatorRequiredLabels,
198+
},
199+
{
200+
Namespace: CSINamespace,
201+
Name: "vmware-vsphere-csi-driver-controller",
202+
Platform: "vsphere",
203+
RequiredLabels: csiControllerRequiredLabels,
204+
},
205+
{
206+
Namespace: CSINamespace,
207+
Name: "ibm-vpc-block-csi-driver-operator",
208+
Platform: "ibmcloud",
209+
RequiredLabels: csiOperatorRequiredLabels,
210+
},
211+
{
212+
Namespace: CSINamespace,
213+
Name: "ibm-vpc-block-csi-controller",
214+
Platform: "ibmcloud",
215+
RequiredLabels: csiControllerRequiredLabels,
216+
},
217+
{
218+
Namespace: CSINamespace,
219+
Name: "openstack-cinder-csi-driver-operator",
220+
Platform: "openstack",
221+
RequiredLabels: csiOperatorRequiredLabels,
222+
},
223+
{
224+
Namespace: CSINamespace,
225+
Name: "openstack-cinder-csi-driver-controller",
226+
Platform: "openstack",
227+
RequiredLabels: csiControllerRequiredLabels,
228+
},
229+
{
230+
Namespace: CSINamespace,
231+
Name: "manila-csi-driver-operator",
232+
Platform: "openstack",
233+
RequiredLabels: csiOperatorRequiredLabels,
234+
},
235+
{
236+
Namespace: ManilaCSINamespace,
237+
Name: "openstack-manila-csi-controllerplugin",
238+
Platform: "openstack",
239+
RequiredLabels: csiControllerRequiredLabels,
240+
},
241+
{
242+
Namespace: CSINamespace,
243+
Name: "smb-csi-driver-operator",
244+
Platform: "all",
245+
RequiredLabels: csiOperatorRequiredLabels,
246+
},
247+
{
248+
Namespace: CSINamespace,
249+
Name: "smb-csi-driver-controller",
250+
Platform: "all",
251+
RequiredLabels: csiControllerRequiredLabels,
252+
},
253+
}
254+
runDeploymentChecks(oc, CSIdeploymentsToCheck, currentPlatform)
255+
})
256+
257+
g.It("should ensure required NetworkPolicies exist with correct labels", func() {
258+
for _, c := range networkPolicyChecks {
259+
_, err := oc.AdminKubeClient().CoreV1().Namespaces().Get(context.TODO(), c.Namespace, metav1.GetOptions{})
260+
if err != nil {
261+
if c.Optional {
262+
g.By(fmt.Sprintf("Skipping optional namespace %s (not found)", c.Namespace))
263+
continue
264+
}
265+
o.Expect(err).NotTo(o.HaveOccurred(), fmt.Sprintf("namespace %s should exist", c.Namespace))
266+
}
267+
268+
for npName, labels := range c.Policies {
269+
np, err := oc.AdminKubeClient().NetworkingV1().NetworkPolicies(c.Namespace).Get(context.TODO(), npName, metav1.GetOptions{})
270+
o.Expect(err).NotTo(o.HaveOccurred(), fmt.Sprintf("NetworkPolicy %s/%s should exist", c.Namespace, npName))
271+
272+
for key, val := range labels {
273+
gotVal, ok := np.Spec.PodSelector.MatchLabels[key]
274+
o.Expect(ok).To(o.BeTrue(), fmt.Sprintf("NetworkPolicy %s/%s missing label %s", c.Namespace, npName, key))
275+
o.Expect(gotVal).To(o.Equal(val), fmt.Sprintf("NetworkPolicy %s/%s label %s mismatch (got=%s, want=%s)", c.Namespace, npName, key, gotVal, val))
276+
}
277+
}
278+
}
279+
})
280+
})
281+
282+
func runDeploymentChecks(oc *exutil.CLI, deployments []deploymentCheck, currentPlatform string) {
283+
results := []string{}
284+
hasFail := false
285+
for _, dep := range deployments {
286+
if dep.Platform != "" && dep.Platform != currentPlatform && dep.Platform != "all" {
287+
results = append(results, fmt.Sprintf("[SKIP] %s/%s (platform mismatch: %s)", dep.Namespace, dep.Name, dep.Platform))
288+
continue
289+
}
290+
291+
deployment, err := oc.AdminKubeClient().AppsV1().Deployments(dep.Namespace).Get(context.TODO(), dep.Name, metav1.GetOptions{})
292+
if err != nil {
293+
if errors.IsNotFound(err) {
294+
results = append(results, fmt.Sprintf("[SKIP] %s/%s not found", dep.Namespace, dep.Name))
295+
continue
296+
}
297+
g.Fail(fmt.Sprintf("Error fetching deployment %s/%s: %v", dep.Namespace, dep.Name, err))
298+
}
299+
300+
missingLabels := []string{}
301+
for key, val := range dep.RequiredLabels {
302+
if deployment.Spec.Template.Labels[key] != val {
303+
missingLabels = append(missingLabels, fmt.Sprintf("%s=%s", key, val))
304+
}
305+
}
306+
307+
if len(missingLabels) > 0 {
308+
results = append(results, fmt.Sprintf("[FAIL] %s/%s missing labels: %s", dep.Namespace, dep.Name, strings.Join(missingLabels, ", ")))
309+
hasFail = true
310+
} else {
311+
results = append(results, fmt.Sprintf("[PASS] %s/%s", dep.Namespace, dep.Name))
312+
}
313+
}
314+
315+
if hasFail {
316+
summary := strings.Join(results, "\n")
317+
g.Fail(fmt.Sprintf("Some deployments are missing required labels:\n\n%s\n", summary))
318+
}
319+
}

0 commit comments

Comments
 (0)