|
| 1 | +#!/bin/bash |
| 2 | +# Copyright (c) 2024-present SIGHUP s.r.l All rights reserved. |
| 3 | +# Use of this source code is governed by a BSD-style |
| 4 | +# license that can be found in the LICENSE file. |
| 5 | + |
| 6 | +# shellcheck disable=SC2154 |
| 7 | + |
| 8 | +load ./../helper |
| 9 | + |
| 10 | +@test "Nodes in Not Ready state" { |
| 11 | + info |
| 12 | + nodes_not_ready() { |
| 13 | + kubectl get nodes --no-headers | awk '{print $2}' | uniq | grep -q NotReady |
| 14 | + } |
| 15 | + run nodes_not_ready |
| 16 | + [ "$status" -eq 0 ] |
| 17 | +} |
| 18 | + |
| 19 | +@test "Install Prerequisites" { |
| 20 | + info |
| 21 | + install() { |
| 22 | + kubectl apply -f 'https://raw.githubusercontent.com/sighupio/fury-kubernetes-monitoring/v3.1.0/katalog/prometheus-operator/crds/0servicemonitorCustomResourceDefinition.yaml' |
| 23 | + kubectl apply -f 'https://raw.githubusercontent.com/sighupio/fury-kubernetes-monitoring/v3.1.0/katalog/prometheus-operator/crds/0prometheusruleCustomResourceDefinition.yaml' |
| 24 | + } |
| 25 | + run install |
| 26 | + [ "$status" -eq 0 ] |
| 27 | +} |
| 28 | + |
| 29 | +# |
| 30 | +@test "Install Tigera operator and calico operated" { |
| 31 | + info |
| 32 | + test() { |
| 33 | + apply katalog/tigera/on-prem |
| 34 | + } |
| 35 | + loop_it test 60 5 |
| 36 | + status=${loop_it_result} |
| 37 | + [ "$status" -eq 0 ] |
| 38 | +} |
| 39 | + |
| 40 | +@test "Calico Kube Controller is Running" { |
| 41 | + info |
| 42 | + test() { |
| 43 | + kubectl get pods -l k8s-app=calico-kube-controllers -o json -n calico-system |jq '.items[].status.containerStatuses[].ready' | uniq | grep -q true |
| 44 | + } |
| 45 | + loop_it test 60 5 |
| 46 | + status=${loop_it_result} |
| 47 | + [ "$status" -eq 0 ] |
| 48 | +} |
| 49 | + |
| 50 | +@test "Calico Node is Running" { |
| 51 | + info |
| 52 | + test() { |
| 53 | + kubectl get pods -l k8s-app=calico-node -o json -n calico-system |jq '.items[].status.containerStatuses[].ready' | uniq | grep -q true |
| 54 | + } |
| 55 | + loop_it test 60 5 |
| 56 | + status=${loop_it_result} |
| 57 | + [ "$status" -eq 0 ] |
| 58 | +} |
| 59 | + |
| 60 | +@test "Nodes in ready State" { |
| 61 | + info |
| 62 | + test() { |
| 63 | + kubectl get nodes --no-headers | awk '{print $2}' | uniq | grep -q Ready |
| 64 | + } |
| 65 | + run test |
| 66 | + [ "$status" -eq 0 ] |
| 67 | +} |
| 68 | + |
| 69 | +@test "Apply whitelist-system-ns GlobalNetworkPolicy" { |
| 70 | + info |
| 71 | + install() { |
| 72 | + kubectl apply -f examples/globalnetworkpolicies/1.whitelist-system-namespace.yml |
| 73 | + } |
| 74 | + run install |
| 75 | + [ "$status" -eq 0 ] |
| 76 | +} |
| 77 | + |
| 78 | +@test "Create a non-whitelisted namespace with an app" { |
| 79 | + info |
| 80 | + install() { |
| 81 | + kubectl create ns test-1 |
| 82 | + kubectl apply -f katalog/tests/calico/resources/echo-server.yaml -n test-1 |
| 83 | + kubectl wait -n test-1 --for=condition=ready --timeout=120s pod -l app=echoserver |
| 84 | + } |
| 85 | + run install |
| 86 | + [ "$status" -eq 0 ] |
| 87 | +} |
| 88 | + |
| 89 | +@test "Test app within the same namespace" { |
| 90 | + info |
| 91 | + test() { |
| 92 | + kubectl create job -n test-1 isolated-test --image travelping/nettools -- curl http://echoserver.test-1.svc.cluster.local |
| 93 | + kubectl wait -n test-1 --for=condition=complete --timeout=30s job/isolated-test |
| 94 | + } |
| 95 | + run test |
| 96 | + [ "$status" -eq 0 ] |
| 97 | +} |
| 98 | + |
| 99 | +@test "Test app from a system namespace" { |
| 100 | + info |
| 101 | + test() { |
| 102 | + kubectl create job -n kube-system isolated-test --image travelping/nettools -- curl http://echoserver.test-1.svc.cluster.local |
| 103 | + kubectl wait -n kube-system --for=condition=complete --timeout=30s job/isolated-test |
| 104 | + } |
| 105 | + run test |
| 106 | + [ "$status" -eq 0 ] |
| 107 | +} |
| 108 | + |
| 109 | +@test "Test app from a different namespace" { |
| 110 | + info |
| 111 | + test() { |
| 112 | + kubectl create ns test-1-1 |
| 113 | + kubectl create job -n test-1-1 isolated-test --image travelping/nettools -- curl http://echoserver.test-1.svc.cluster.local |
| 114 | + kubectl wait -n test-1-1 --for=condition=complete --timeout=30s job/isolated-test |
| 115 | + } |
| 116 | + run test |
| 117 | + [ "$status" -eq 0 ] |
| 118 | +} |
| 119 | + |
| 120 | +@test "Apply deny-all GlobalNetworkPolicy" { |
| 121 | + info |
| 122 | + install() { |
| 123 | + kubectl apply -f examples/globalnetworkpolicies/2000.deny-all.yml |
| 124 | + } |
| 125 | + run install |
| 126 | + [ "$status" -eq 0 ] |
| 127 | +} |
| 128 | + |
| 129 | +@test "Test app from the same namespace (isolated namespace)" { |
| 130 | + info |
| 131 | + test() { |
| 132 | + kubectl create job -n test-1 isolated-test-1 --image travelping/nettools -- curl http://echoserver.test-1.svc.cluster.local |
| 133 | + kubectl wait -n test-1 --for=condition=complete --timeout=30s job/isolated-test-1 |
| 134 | + } |
| 135 | + run test |
| 136 | + [ "$status" -eq 1 ] |
| 137 | +} |
| 138 | + |
| 139 | +@test "Test app from a system namespace (isolated namespace)" { |
| 140 | + info |
| 141 | + test() { |
| 142 | + kubectl create job -n kube-system isolated-test-1 --image travelping/nettools -- curl http://echoserver.test-1.svc.cluster.local |
| 143 | + kubectl wait -n kube-system --for=condition=complete --timeout=30s job/isolated-test-1 |
| 144 | + } |
| 145 | + run test |
| 146 | + [ "$status" -eq 0 ] |
| 147 | +} |
| 148 | + |
| 149 | +@test "Test app from a different namespace (isolated namespace)" { |
| 150 | + info |
| 151 | + test() { |
| 152 | + kubectl create job -n test-1-1 isolated-test-1 --image travelping/nettools -- curl http://echoserver.test-1.svc.cluster.local |
| 153 | + kubectl wait -n test-1-1 --for=condition=complete --timeout=30s job/isolated-test-1 |
| 154 | + } |
| 155 | + run test |
| 156 | + [ "$status" -eq 1 ] |
| 157 | +} |
0 commit comments