From dee24aec6541ab6fa266dcd102f69eaab4098111 Mon Sep 17 00:00:00 2001
From: Martynas Pumputis <martynasp@gmail.com>
Date: Thu, 7 Jun 2018 09:31:49 +0200
Subject: [PATCH] npc: Add integration test for egress

Also, install dig (bind-tools) in the network-tester image.
---
 test/840_weave_kube_3_test.sh         | 55 +++++++++++++++++++++++++++
 test/images/network-tester/Dockerfile |  2 +-
 2 files changed, 56 insertions(+), 1 deletion(-)

diff --git a/test/840_weave_kube_3_test.sh b/test/840_weave_kube_3_test.sh
index a2679203..a0001937 100755
--- a/test/840_weave_kube_3_test.sh
+++ b/test/840_weave_kube_3_test.sh
@@ -275,6 +275,61 @@ EOF
 assert_raises "$SSH $HOST1 curl -s -S -f -m 2 http://$VIRTUAL_IP/status >/dev/null"
 assert_raises "$SSH $HOST1 curl -s -S -f -m 2 http://$HOST2:31138/status >/dev/null"
 
+# allow nettest-deny to access only to 8.8.8.0/24
+run_on $HOST1 "$KUBECTL apply -f -" <<EOF
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: egress-nettest-deny-dns
+  namespace: default
+spec:
+  podSelector:
+    matchLabels:
+      run: nettest-deny
+  policyTypes:
+  - Egress
+  egress:
+  - to:
+    - ipBlock:
+        cidr: 8.8.8.0/24
+        except:
+        - 8.8.8.4/32
+EOF
+
+assert_raises "! $SSH $HOST1 $KUBECTL exec $denyPodName -- curl -s -S -f -m 2 http://$DOMAIN:8080/status >/dev/null"
+assert_raises "! $SSH $HOST1 $KUBECTL exec $denyPodName -- dig @8.8.8.4 google.com >/dev/null"
+assert_raises "$SSH $HOST1 $KUBECTL exec $denyPodName -- dig @8.8.8.8 google.com >/dev/null"
+
+# also, allow nettest-deny to access nettest and kube-system (for kube-dns)
+run_on $HOST1 "$KUBECTL label namespace kube-system name=kube-system"
+run_on $HOST1 "$KUBECTL replace -f -" <<EOF
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: egress-nettest-deny-dns
+  namespace: default
+spec:
+  podSelector:
+    matchLabels:
+      run: nettest-deny
+  policyTypes:
+  - Egress
+  egress:
+  - to:
+    - ipBlock:
+        cidr: 8.8.8.0/24
+        except:
+        - 8.8.8.4/32
+    - podSelector:
+        matchLabels:
+          run: nettest
+    - namespaceSelector:
+        matchLabels:
+          name: kube-system
+EOF
+
+assert_raises "$SSH $HOST1 $KUBECTL exec $denyPodName -- curl -s -S -f -m 2 http://$DOMAIN:8080/status >/dev/null"
+
 # Passing --no-masq-local and setting externalTrafficPolicy to Local must preserve
 # the client source IP addr
 
diff --git a/test/images/network-tester/Dockerfile b/test/images/network-tester/Dockerfile
index 149b92c3..a7be5948 100644
--- a/test/images/network-tester/Dockerfile
+++ b/test/images/network-tester/Dockerfile
@@ -13,7 +13,7 @@
 # limitations under the License.
 
 FROM bash
-RUN apk add --no-cache curl
+RUN apk add --no-cache curl bind-tools
 ADD webserver webserver
 EXPOSE 8080
 ENTRYPOINT ["/webserver"]