@@ -751,141 +751,6 @@ func TestMixNsAndServiceWaypoint(t *testing.T) {
751751 })
752752}
753753
754- func TestAuthorizationL4 (t * testing.T ) {
755- framework .NewTest (t ).Run (func (t framework.TestContext ) {
756- t .NewSubTest ("L4 Authorization" ).Run (func (t framework.TestContext ) {
757- // Enable authorizaiton offload to xdp.
758-
759- if len (apps .ServiceWithWaypointAtServiceGranularity ) == 0 {
760- t .Fatal (fmt .Errorf ("need at least 1 instance of apps.ServiceWithWaypointAtServiceGranularity" ))
761- }
762- src := apps .ServiceWithWaypointAtServiceGranularity [0 ]
763-
764- clients := src .WorkloadsOrFail (t )
765- dst := apps .EnrolledToKmesh
766-
767- addresses := clients .Addresses ()
768- if len (addresses ) < 2 {
769- t .Fatal (fmt .Errorf ("need at least 2 clients" ))
770- }
771- selectedAddress := addresses [0 ]
772-
773- authzCases := []struct {
774- name string
775- spec string
776- }{
777- {
778- name : "allow" ,
779- spec : `
780- action: ALLOW
781- ` ,
782- },
783- {
784- name : "deny" ,
785- spec : `
786- action: DENY
787- ` ,
788- },
789- }
790-
791- chooseChecker := func (action string , ip string ) echo.Checker {
792- switch action {
793- case "allow" :
794- if ip != selectedAddress {
795- return check .NotOK ()
796- } else {
797- return check .OK ()
798- }
799- case "deny" :
800- if ip != selectedAddress {
801- return check .OK ()
802- } else {
803- return check .NotOK ()
804- }
805- default :
806- t .Fatal ("invalid action" )
807- }
808-
809- return check .OK ()
810- }
811-
812- count := 0
813- workloads := dst .WorkloadsOrFail (t )
814- for _ , client := range workloads {
815- if count == len (workloads ) {
816- break
817- }
818- podName := client .PodName ()
819- namespace := apps .Namespace .Name ()
820- timeout := time .After (5 * time .Second )
821- ticker := time .NewTicker (500 * time .Millisecond )
822- defer ticker .Stop ()
823- InnerLoop:
824- for {
825- select {
826- case <- timeout :
827- t .Fatalf ("Timeout: XDP eBPF program not found on pod %s" , podName )
828- case <- ticker .C :
829- cmd := exec .Command ("kubectl" , "exec" , "-n" , namespace , podName , "--" , "sh" , "-c" , "ip a | grep xdp" )
830- output , err := cmd .CombinedOutput ()
831- if err == nil && len (output ) > 0 {
832- t .Logf ("XDP program is loaded on pod %s" , podName )
833- count ++
834- break InnerLoop
835- }
836- t .Logf ("Waiting for XDP program to load on pod %s: %v" , podName , err )
837- }
838- }
839- }
840-
841- for _ , tc := range authzCases {
842- t .ConfigIstio ().Eval (apps .Namespace .Name (), map [string ]string {
843- "Destination" : dst .Config ().Service ,
844- "Ip" : selectedAddress ,
845- }, `apiVersion: security.istio.io/v1beta1
846- kind: AuthorizationPolicy
847- metadata:
848- name: policy
849- spec:
850- selector:
851- matchLabels:
852- app: "{{.Destination}}"
853- ` + tc .spec + `
854- rules:
855- - from:
856- - source:
857- ipBlocks:
858- - "{{.Ip}}"
859- ` ).ApplyOrFail (t )
860-
861- for _ , client := range clients {
862- opt := echo.CallOptions {
863- To : dst ,
864- Port : echo.Port {Name : "tcp" },
865- Scheme : scheme .TCP ,
866- NewConnectionPerRequest : true ,
867- // Due to the mechanism of Kmesh L4 authorization, we need to set the timeout slightly longer.
868- Timeout : time .Minute * 2 ,
869- }
870-
871- var name string
872- if client .Address () != selectedAddress {
873- name = tc .name + ", not selected address"
874- } else {
875- name = tc .name + ", selected address"
876- }
877-
878- opt .Check = chooseChecker (tc .name , client .Address ())
879-
880- t .NewSubTestf ("%v" , name ).Run (func (t framework.TestContext ) {
881- src .WithWorkloads (client ).CallOrFail (t , opt )
882- })
883- }
884- }
885- })
886- })
887- }
888-
889754func TestBookinfo (t * testing.T ) {
890755 framework .NewTest (t ).Run (func (t framework.TestContext ) {
891756 namespace := apps .Namespace .Name ()
0 commit comments