Julian Sommer 7528c063cb feat: make TestMultinodeIPSec fail unless cross-node guest traffic leaves as ESP (#1307) ...

The test checked IPsec config and that AES-GCM SAs exist, and only warned when
a 5s idle capture saw no ESP, so a cluster sending plaintext Geneve passed.

It now launches an instance pair on distinct nodes, pings 200 x 1000 bytes
between them, and for each direction fails unless the outbound SA counters to
the peer's ovn-encap-ip rose by the payload, an outbound-only capture on the
interface routing to the peer saw ESP or UDP/4500 ESP, and saw no UDP/6081.

The distinct-node launch loop moves from the baseline cross-host test into a
shared helper. The test is no longer parallel since it now launches instances.

2026-10-28 10:00:47 +11:00

..

e2e-coverage.md

feat: make TestMultinodeIPSec fail unless cross-node guest traffic leaves as ESP (#1307)

2026-10-28 10:00:47 +11:00