mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-21 11:46:37 +00:00
joshsiv-mulga
7003168bc5
Move spinifex/network/* to spinifex/domains/network/* as one enclosing move so the L0-L5 layer invariants keep classifying every package from a single root. Package names and dependency direction are unchanged; invariant scan roots, the RG-10 sudo allow-list path, CODEOWNERS and the repo-root walk in the IMDS netns unit test follow the new path.
67 lines
2.5 KiB
Go
67 lines
2.5 KiB
Go
//go:build integration
|
|
|
|
package integration
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/aws/aws-sdk-go/aws"
|
|
"github.com/aws/aws-sdk-go/service/ec2"
|
|
"github.com/mulgadc/spinifex/spinifex/domains/network/topology"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// TestVPCD_SecurityGroupReachesOVN asserts the synchronous half of the
|
|
// handler-to-vpcd contract against a real responder. The SG topics use
|
|
// utils.RequestEvent, so unlike the topology events these need no polling: by
|
|
// the time the SDK call returns, vpcd has already committed to OVN.
|
|
//
|
|
// This is the case the tier previously faked outright with a canned
|
|
// {"success":true} — the API call succeeded whether or not any OVN work was
|
|
// possible, let alone correct.
|
|
func TestVPCD_SecurityGroupReachesOVN(t *testing.T) {
|
|
vpcd, c := startVPCDStack(t)
|
|
ctx := context.Background()
|
|
|
|
vpcID := createScratchVPC(t, c, "10.44.0.0/16")
|
|
sgOut, err := c.CreateSecurityGroup(&ec2.CreateSecurityGroupInput{
|
|
VpcId: aws.String(vpcID),
|
|
GroupName: aws.String("integration-sg"),
|
|
Description: aws.String("vpcd integration tier"),
|
|
})
|
|
require.NoError(t, err, "create-security-group in %s", vpcID)
|
|
sgID := aws.StringValue(sgOut.GroupId)
|
|
require.NotEmpty(t, sgID, "GroupId empty")
|
|
|
|
pgName := topology.SecurityGroupPortGroup(sgID)
|
|
pg, err := vpcd.OVN.GetPortGroup(ctx, pgName)
|
|
require.NoError(t, err, "SG port group %s absent after create-security-group", pgName)
|
|
baseACLs := len(pg.ACLs)
|
|
|
|
_, err = c.AuthorizeSecurityGroupIngress(&ec2.AuthorizeSecurityGroupIngressInput{
|
|
GroupId: aws.String(sgID),
|
|
IpPermissions: []*ec2.IpPermission{{
|
|
IpProtocol: aws.String("tcp"),
|
|
FromPort: aws.Int64(22),
|
|
ToPort: aws.Int64(22),
|
|
IpRanges: []*ec2.IpRange{{CidrIp: aws.String("10.44.0.0/16")}},
|
|
}},
|
|
})
|
|
require.NoError(t, err, "authorize-security-group-ingress on %s", sgID)
|
|
|
|
// The rule count is the assertion, not the ACL match text: that the rule
|
|
// crossed the wire at all is this tier's claim, while the match expression
|
|
// it compiles to belongs to policy's own tests.
|
|
pg, err = vpcd.OVN.GetPortGroup(ctx, pgName)
|
|
require.NoError(t, err, "SG port group %s after authorize", pgName)
|
|
require.Greater(t, len(pg.ACLs), baseACLs,
|
|
"authorize-security-group-ingress added no ACL to port group %s", pgName)
|
|
|
|
_, err = c.DeleteSecurityGroup(&ec2.DeleteSecurityGroupInput{GroupId: aws.String(sgID)})
|
|
require.NoError(t, err, "delete-security-group %s", sgID)
|
|
|
|
_, err = vpcd.OVN.GetPortGroup(ctx, pgName)
|
|
require.Error(t, err, "SG port group %s still present after delete-security-group", pgName)
|
|
}
|