Skip to content

Commit 82e7c86

Browse files
tremestremes
authored
OCPBUGS-32702: anonymization - externalIP can be nil (#929)
1 parent 898015a commit 82e7c86

File tree

2 files changed

+185
-83
lines changed

2 files changed

+185
-83
lines changed

‎pkg/anonymization/anonymizer.go

+5
Original file line numberDiff line numberDiff line change
@@ -289,6 +289,11 @@ func getNetworksFromClusterNetworksConfig(networksConfig *configv1.Network) []st
289289
networks = append(networks, network.CIDR)
290290
}
291291
networks = append(networks, networksConfig.Spec.ServiceNetwork...)
292+
293+
if networksConfig.Spec.ExternalIP == nil {
294+
return networks
295+
}
296+
292297
networks = append(networks, networksConfig.Spec.ExternalIP.AutoAssignCIDRs...)
293298
networks = append(networks, networksConfig.Spec.ExternalIP.Policy.AllowedCIDRs...)
294299
networks = append(networks, networksConfig.Spec.ExternalIP.Policy.RejectedCIDRs...)

‎pkg/anonymization/anonymizer_test.go

+180-83
Original file line numberDiff line numberDiff line change
@@ -257,106 +257,203 @@ func Test_Anonymizer_StoreTranslationTable(t *testing.T) {
257257
}
258258
}
259259

260-
func TestAnonymizer_NewAnonymizerFromConfigClient(t *testing.T) {
260+
func TestNewAnonymizerFromConfigClient(t *testing.T) {
261261
const testClusterBaseDomain = "example.com"
262262
localhostCIDR := "127.0.0.0/8"
263263
_, localhostNet, err := net.ParseCIDR(localhostCIDR)
264264
assert.NoError(t, err)
265-
cidr1 := "55.44.0.0/16"
266-
_, net1, err := net.ParseCIDR(cidr1)
265+
clusterNetworkCIDR := "55.44.0.0/16"
266+
_, net1, err := net.ParseCIDR(clusterNetworkCIDR)
267267
assert.NoError(t, err)
268-
cidr2 := "192.168.0.0/16"
269-
_, net2, err := net.ParseCIDR(cidr2)
268+
serviceNetworkCIDR := "192.168.0.0/16"
269+
_, net2, err := net.ParseCIDR(serviceNetworkCIDR)
270270
assert.NoError(t, err)
271271
egressCIDR := "10.0.0.0/8"
272272
_, egressNet, err := net.ParseCIDR(egressCIDR)
273273
assert.NoError(t, err)
274-
testNetworks := []subnetInformation{
275-
{
276-
network: *localhostNet,
277-
lastIP: net.IPv4(127, 0, 0, 0),
278-
},
274+
275+
tests := []struct {
276+
name string
277+
dns *configv1.DNS
278+
network *configv1.Network
279+
hostsubnet *networkv1.HostSubnet
280+
clusterConfigMap *corev1.ConfigMap
281+
expectedSubnetInfo []subnetInformation
282+
}{
279283
{
280-
network: *egressNet,
281-
lastIP: net.IPv4(10, 0, 0, 0),
284+
name: "Network config includes DNS, ExternalIP and HostSubnet exists",
285+
dns: &configv1.DNS{
286+
ObjectMeta: metav1.ObjectMeta{Name: "cluster"},
287+
Spec: configv1.DNSSpec{BaseDomain: testClusterBaseDomain},
288+
},
289+
network: &configv1.Network{
290+
ObjectMeta: metav1.ObjectMeta{Name: "cluster"},
291+
Spec: configv1.NetworkSpec{
292+
ClusterNetwork: []configv1.ClusterNetworkEntry{{CIDR: clusterNetworkCIDR}},
293+
ServiceNetwork: []string{serviceNetworkCIDR},
294+
ExternalIP: &configv1.ExternalIPConfig{Policy: &configv1.ExternalIPPolicy{}},
295+
},
296+
},
297+
hostsubnet: &networkv1.HostSubnet{
298+
EgressCIDRs: []networkv1.HostSubnetEgressCIDR{networkv1.HostSubnetEgressCIDR(egressCIDR)},
299+
},
300+
clusterConfigMap: &corev1.ConfigMap{
301+
ObjectMeta: metav1.ObjectMeta{Name: "cluster-config-v1"},
302+
},
303+
expectedSubnetInfo: []subnetInformation{
304+
{
305+
network: *localhostNet,
306+
lastIP: net.IPv4(127, 0, 0, 0),
307+
},
308+
{
309+
network: *egressNet,
310+
lastIP: net.IPv4(10, 0, 0, 0),
311+
},
312+
{
313+
network: *net1,
314+
lastIP: net.IPv4(55, 44, 0, 0),
315+
},
316+
{
317+
network: *net2,
318+
lastIP: net.IPv4(192, 168, 0, 0),
319+
},
320+
},
282321
},
283322
{
284-
network: *net1,
285-
lastIP: net.IPv4(55, 44, 0, 0),
323+
name: "Network config includes DNS, ExternalIP and HostSubnet is nil",
324+
dns: &configv1.DNS{
325+
ObjectMeta: metav1.ObjectMeta{Name: "cluster"},
326+
Spec: configv1.DNSSpec{BaseDomain: testClusterBaseDomain},
327+
},
328+
network: &configv1.Network{
329+
ObjectMeta: metav1.ObjectMeta{Name: "cluster"},
330+
Spec: configv1.NetworkSpec{
331+
ClusterNetwork: []configv1.ClusterNetworkEntry{{CIDR: clusterNetworkCIDR}},
332+
ServiceNetwork: []string{serviceNetworkCIDR},
333+
ExternalIP: &configv1.ExternalIPConfig{Policy: &configv1.ExternalIPPolicy{}},
334+
},
335+
},
336+
hostsubnet: nil,
337+
clusterConfigMap: &corev1.ConfigMap{
338+
ObjectMeta: metav1.ObjectMeta{Name: "cluster-config-v1"},
339+
},
340+
expectedSubnetInfo: []subnetInformation{
341+
{
342+
network: *localhostNet,
343+
lastIP: net.IPv4(127, 0, 0, 0),
344+
},
345+
{
346+
network: *egressNet,
347+
// when hostsubnet doesn't exist then OVN egress CIDR 192.168.126.0/18
348+
// is added
349+
lastIP: net.IPv4(192, 168, 64, 0),
350+
},
351+
{
352+
network: *net1,
353+
lastIP: net.IPv4(55, 44, 0, 0),
354+
},
355+
{
356+
network: *net2,
357+
lastIP: net.IPv4(192, 168, 0, 0),
358+
},
359+
},
286360
},
287361
{
288-
network: *net2,
289-
lastIP: net.IPv4(192, 168, 0, 0),
290-
},
291-
}
292-
293-
kubeClient := kubefake.NewSimpleClientset()
294-
coreClient := kubeClient.CoreV1()
295-
networkClient := networkfake.NewSimpleClientset().NetworkV1()
296-
configClient := configfake.NewSimpleClientset().ConfigV1()
297-
ctx := context.TODO()
298-
299-
// create fake resources
300-
_, err = configClient.DNSes().Create(ctx, &configv1.DNS{
301-
ObjectMeta: metav1.ObjectMeta{Name: "cluster"},
302-
Spec: configv1.DNSSpec{BaseDomain: testClusterBaseDomain},
303-
}, metav1.CreateOptions{})
304-
assert.NoError(t, err)
305-
306-
_, err = configClient.Networks().Create(context.TODO(), &configv1.Network{
307-
ObjectMeta: metav1.ObjectMeta{Name: "cluster"},
308-
Spec: configv1.NetworkSpec{
309-
ClusterNetwork: []configv1.ClusterNetworkEntry{{CIDR: cidr1}},
310-
ServiceNetwork: []string{cidr2},
311-
ExternalIP: &configv1.ExternalIPConfig{Policy: &configv1.ExternalIPPolicy{}},
312-
},
313-
}, metav1.CreateOptions{})
314-
assert.NoError(t, err)
315-
316-
_, err = coreClient.ConfigMaps("kube-system").Create(ctx, &corev1.ConfigMap{
317-
ObjectMeta: metav1.ObjectMeta{Name: "cluster-config-v1"},
318-
}, metav1.CreateOptions{})
319-
assert.NoError(t, err)
320-
321-
_, err = networkClient.HostSubnets().Create(ctx, &networkv1.HostSubnet{
322-
EgressCIDRs: []networkv1.HostSubnetEgressCIDR{networkv1.HostSubnetEgressCIDR(egressCIDR)},
323-
}, metav1.CreateOptions{})
324-
assert.NoError(t, err)
325-
326-
// test that everything was initialized correctly
327-
328-
mockConfigMapConfigurator := config.NewMockConfigMapConfigurator(&config.InsightsConfiguration{
329-
DataReporting: config.DataReporting{
330-
Obfuscation: config.Obfuscation{
331-
config.Networking,
362+
name: "Network config includes DNS, HostSubnet but ExternalIP is nil",
363+
dns: &configv1.DNS{
364+
ObjectMeta: metav1.ObjectMeta{Name: "cluster"},
365+
Spec: configv1.DNSSpec{BaseDomain: testClusterBaseDomain},
366+
},
367+
network: &configv1.Network{
368+
ObjectMeta: metav1.ObjectMeta{Name: "cluster"},
369+
Spec: configv1.NetworkSpec{
370+
ClusterNetwork: []configv1.ClusterNetworkEntry{{CIDR: clusterNetworkCIDR}},
371+
ServiceNetwork: []string{serviceNetworkCIDR},
372+
ExternalIP: nil,
373+
},
374+
},
375+
hostsubnet: &networkv1.HostSubnet{
376+
EgressCIDRs: []networkv1.HostSubnetEgressCIDR{networkv1.HostSubnetEgressCIDR(egressCIDR)},
377+
},
378+
clusterConfigMap: &corev1.ConfigMap{
379+
ObjectMeta: metav1.ObjectMeta{Name: "cluster-config-v1"},
380+
},
381+
expectedSubnetInfo: []subnetInformation{
382+
{
383+
network: *localhostNet,
384+
lastIP: net.IPv4(127, 0, 0, 0),
385+
},
386+
{
387+
network: *egressNet,
388+
lastIP: net.IPv4(10, 0, 0, 0),
389+
},
390+
{
391+
network: *net1,
392+
lastIP: net.IPv4(55, 44, 0, 0),
393+
},
394+
{
395+
network: *net2,
396+
lastIP: net.IPv4(192, 168, 0, 0),
397+
},
332398
},
333399
},
334-
})
335-
336-
anonymizer, err := NewAnonymizerFromConfigClient(
337-
context.Background(),
338-
kubeClient,
339-
kubeClient,
340-
configClient,
341-
networkClient,
342-
mockConfigMapConfigurator,
343-
v1alpha1.ObfuscateNetworking,
344-
)
345-
assert.NoError(t, err)
346-
assert.NotNil(t, anonymizer)
400+
}
347401

348-
assert.Equal(t, testClusterBaseDomain, anonymizer.clusterBaseDomain)
349-
assert.Empty(t, anonymizer.translationTable)
350-
assert.NotNil(t, anonymizer.ipNetworkRegex)
351-
assert.NotNil(t, anonymizer.secretsClient)
402+
for _, tt := range tests {
403+
t.Run(tt.name, func(t *testing.T) {
404+
kubeClient := kubefake.NewSimpleClientset()
405+
coreClient := kubeClient.CoreV1()
406+
networkClient := networkfake.NewSimpleClientset().NetworkV1()
407+
configClient := configfake.NewSimpleClientset().ConfigV1()
408+
409+
mockConfigMapConfigurator := config.NewMockConfigMapConfigurator(&config.InsightsConfiguration{
410+
DataReporting: config.DataReporting{
411+
Obfuscation: config.Obfuscation{
412+
config.Networking,
413+
},
414+
},
415+
})
416+
ctx := context.Background()
417+
_, err := configClient.DNSes().Create(ctx, tt.dns, metav1.CreateOptions{})
418+
assert.NoError(t, err)
419+
420+
_, err = configClient.Networks().Create(ctx, tt.network, metav1.CreateOptions{})
421+
assert.NoError(t, err)
422+
423+
_, err = coreClient.ConfigMaps("kube-system").Create(ctx, tt.clusterConfigMap, metav1.CreateOptions{})
424+
assert.NoError(t, err)
425+
426+
if tt.hostsubnet != nil {
427+
_, err = networkClient.HostSubnets().Create(ctx, tt.hostsubnet, metav1.CreateOptions{})
428+
assert.NoError(t, err)
429+
}
352430

353-
err = anonymizer.readNetworkConfigs()
354-
assert.NoError(t, err)
355-
assert.Equal(t, len(testNetworks), len(anonymizer.networks))
356-
// the networks are already sorted in anonymizer
357-
for i, subnetInfo := range anonymizer.networks {
358-
expectedSubnetInfo := testNetworks[i]
359-
assert.Equal(t, expectedSubnetInfo.network.Network(), subnetInfo.network.Network())
360-
assert.Equal(t, expectedSubnetInfo.lastIP.String(), subnetInfo.lastIP.String())
431+
anonymizer, err := NewAnonymizerFromConfigClient(
432+
context.Background(),
433+
kubeClient,
434+
kubeClient,
435+
configClient,
436+
networkClient,
437+
mockConfigMapConfigurator,
438+
v1alpha1.ObfuscateNetworking,
439+
)
440+
assert.NoError(t, err)
441+
assert.NotNil(t, anonymizer)
442+
443+
assert.Equal(t, testClusterBaseDomain, anonymizer.clusterBaseDomain)
444+
assert.Empty(t, anonymizer.translationTable)
445+
assert.NotNil(t, anonymizer.ipNetworkRegex)
446+
assert.NotNil(t, anonymizer.secretsClient)
447+
448+
err = anonymizer.readNetworkConfigs()
449+
assert.NoError(t, err)
450+
assert.Equal(t, len(tt.expectedSubnetInfo), len(anonymizer.networks))
451+
// the networks are already sorted in anonymizer
452+
for i, subnetInfo := range anonymizer.networks {
453+
expectedSubnetInfo := tt.expectedSubnetInfo[i]
454+
assert.Equal(t, expectedSubnetInfo.network.Network(), subnetInfo.network.Network())
455+
assert.Equal(t, expectedSubnetInfo.lastIP.String(), subnetInfo.lastIP.String())
456+
}
457+
})
361458
}
362459
}

0 commit comments

Comments
 (0)