Add e2e test for EgressIP pod IP leakage on secondary host interface#31427
Add e2e test for EgressIP pod IP leakage on secondary host interface#31427arghosh93 wants to merge 1 commit into
Conversation
Tests that a new pod's real IP does not leak as source during EgressIP reconciliation when using a secondary (non-OVN) host interface. upstream PR: ovn-kubernetes/ovn-kubernetes#6591 Signed-off-by: Arnab Ghosh <arnabghosh89@gmail.com>
|
Pipeline controller notification For optional jobs, comment This repository is configured in: automatic mode |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: arghosh93 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
WalkthroughAdds a gated E2E scenario for secondary-host EgressIP behavior. It configures a secondary interface, captures trigger-pod traffic, stresses reconciliation, and verifies packets use the expected EgressIP without pod source-IP leakage. ChangesSecondary-host EgressIP validation
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant EgressIPTest
participant NMState
participant EgressIPController
participant TriggerPod
participant PacketSniffer
EgressIPTest->>NMState: Apply secondary interface policy
EgressIPTest->>EgressIPController: Create secondary-interface EgressIP
EgressIPTest->>TriggerPod: Create traffic trigger
TriggerPod->>PacketSniffer: Generate identifiable traffic
EgressIPTest->>PacketSniffer: Inspect matching packets
PacketSniffer-->>EgressIPTest: Return observed source IPs
Caution Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional.
❌ Failed checks (1 error, 2 warnings)
✅ Passed checks (12 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
test/extended/networking/egressip.go (1)
708-712: 🚀 Performance & Scalability | 🔵 Trivial | 💤 Low valueSequential stress-pod creation is slow.
CreateExecPodOrFailblocks until each pod is Running, so creating 50 pods serially adds substantial wall-clock time to the spec. Consider launching creations concurrently (e.g. a boundederrgroup/sync.WaitGroup) if reconciliation stress, not readiness ordering, is the goal.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/extended/networking/egressip.go` around lines 708 - 712, The stress pods in the creation loop are started serially through CreateExecPodOrFail, unnecessarily extending the test duration. Update the stress-pod setup around CreateExecPodOrFail to launch pod creations concurrently, using bounded concurrency or a synchronized wait group, while preserving unique pod names and waiting for all creations to complete before continuing.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@test/extended/networking/egressip.go`:
- Around line 708-712: The stress pods in the creation loop are started serially
through CreateExecPodOrFail, unnecessarily extending the test duration. Update
the stress-pod setup around CreateExecPodOrFail to launch pod creations
concurrently, using bounded concurrency or a synchronized wait group, while
preserving unique pod names and waiting for all creations to complete before
continuing.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: ec4a8ed5-551c-4484-8cdd-341d44c46c3e
📒 Files selected for processing (2)
test/extended/networking/egressip.gotest/extended/networking/egressip_helpers.go
|
Scheduling required tests: |
|
/retest |
|
@arghosh93: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Tests that a new pod's real IP does not leak as source during EgressIP reconciliation when using a secondary (non-OVN) host interface.
upstream PR: ovn-kubernetes/ovn-kubernetes#6591
Summary by CodeRabbit