cli/connectivity: Test strict mode encryption #35231
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
fa92920 to
067d687
Compare
|
/ci-e2e-upgrade |
067d687 to
9c5fdbf
Compare
|
/ci-e2e-upgrade |
9c5fdbf to
4a16751
Compare
|
/ci-e2e-upgrade |
4a16751 to
f6ba790
Compare
|
/ci-e2e-upgrade |
767fe87 to
77c91a1
Compare
|
/test |
77c91a1 to
9b8377e
Compare
|
/test |
a5584e8 to
afcd9e7
Compare
If ExecInPod() returns non-nil error, cli should wrap it with stderr which could provide valuable information. Signed-off-by: gray <gray.liang@isovalent.com>
afcd9e7 to
ef6f7b6
Compare
|
/test |
Strict mode wireguard drops plain-text egress packets as long as their dest addresses fall into strict mode cidr. This commit adds encryption-strict-mode test to cover this scenario by extending pod-to-pod test suite. To trigger the strict-mode-drop, connectivity executes cilium-dbg cilium-agent pods to delete all "echo" pods' entries from ipcache map, executes curl from "client" pods to remote "echo" pods, expects packet drops due to "Traffic is unencrypted". As suggested by Sebastian Wicki, encryption-strict-mode test is marked as unsafe because poking around in IPCache might not be something we want users to run in real clusters. Signed-off-by: gray <gray.liang@isovalent.com>
This commit enables encryption-strict-mode when wireguard is used with native routing. Signed-off-by: gray <gray.liang@isovalent.com>
ef6f7b6 to
739fbb6
Compare
|
/test |
nathanjsweet
approved these changes
Oct 25, 2024
|
As future item, would be nice to check if this allows us to remove the ginkgo test. |
gandro
approved these changes
Oct 28, 2024
|
/ci-gateway-api |
pippolo84
added a commit
to pippolo84/cilium
that referenced
this pull request
Mar 26, 2025
A cilium-cli test already exists to verify that there are no unencrypted leaks in WireGuard strict mode, thus it is safe to remove the now redundant Ginkgo test. Related: cilium#35231 Signed-off-by: Fabio Falzoi <fabio.falzoi@isovalent.com>
pippolo84
added a commit
to pippolo84/cilium
that referenced
this pull request
Mar 27, 2025
A cilium-cli test already exists to verify that there are no unencrypted leaks in WireGuard strict mode, thus it is safe to remove the now redundant Ginkgo one. Related: cilium#35231 Signed-off-by: Fabio Falzoi <fabio.falzoi@isovalent.com>
github-merge-queue bot
pushed a commit
that referenced
this pull request
Mar 28, 2025
A cilium-cli test already exists to verify that there are no unencrypted leaks in WireGuard strict mode, thus it is safe to remove the now redundant Ginkgo one. Related: #35231 Signed-off-by: Fabio Falzoi <fabio.falzoi@isovalent.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add
strict-mode-encryptionin connectivity test for ci-e2e-upgrade.