Skip to content

test/runtime: remove already covered FQDN tests #38866

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 3 commits into from
Apr 14, 2025
Merged

test/runtime: remove already covered FQDN tests #38866

merged 3 commits into from
Apr 14, 2025

Conversation

tklauser
Copy link
Member

@tklauser tklauser commented Apr 10, 2025 •
edited
Loading

Remove three more tests from the runtime FQDN test suite that are either already covered by existing tests or are of limited use.

test/runtime: remove RuntimeAgentFQDNPolicies default-deny test

The policy used in the test doesn't have a toPorts.rules.dns rule, so
the DNS proxy isn't covered at all in the test.

This test is thus testing the default-deny behavior which is already
covered elsewhere, e.g. various Cilium CLI connectivity tests.

test/runtime: remove RuntimeAgentFQDNPolicies Implement matchPattern * test

matchPattern * is already covered in existing Cilium CLI connectivity
tests, though not for subdomains currently.  However, the correct
application of the provided pattern to FQDNs is already covered in
various unit tests in pkg/fqdn. Thus the corresponding runtime FQDN test
case is redundant and can be removed.

test/runtime: remove RuntimeAgentFQDNPolicies DNSSEC test

The existing FQDN runtime test only checks for the existence of an
RRSIG record in the DNS response[^1]. The Cilium DNS proxy doesn't touch
RRSIG records at all. So it looks like the existing test is
already of limited use and can be removed without replacement.

[^1]: https://github.com/cilium/dnssec-client/blob/master/client.py#L30-L32

For #37838

@tklauser tklauser added the release-note/ci This PR makes changes to the CI. label Apr 10, 2025
@tklauser tklauser requested review from a team as code owners April 10, 2025 09:12
@tklauser
Copy link
Member Author

/test

@github-actions github-actions bot added the cilium-cli This PR contains changes related with cilium-cli label Apr 10, 2025
@tklauser tklauser requested a review from squeed April 10, 2025 09:12
@tklauser tklauser enabled auto-merge April 10, 2025 09:12
@tklauser tklauser force-pushed the pr/tklauser/test-runtime-migrate-dnssec branch from aa5b08f to 4c446e4 Compare April 10, 2025 09:15
@tklauser tklauser requested review from a team as code owners April 10, 2025 09:15
@tklauser
Copy link
Member Author

/test

@tklauser tklauser force-pushed the pr/tklauser/test-runtime-migrate-dnssec branch from 4c446e4 to f69a125 Compare April 10, 2025 10:04
@tklauser tklauser requested a review from a team as a code owner April 10, 2025 10:04
@tklauser tklauser requested a review from marseel April 10, 2025 10:04
@tklauser
Copy link
Member Author

/test

@tklauser tklauser force-pushed the pr/tklauser/test-runtime-migrate-dnssec branch from f69a125 to aa666e3 Compare April 10, 2025 11:06
@tklauser
Copy link
Member Author

/test

bimmlerd
bimmlerd reviewed Apr 10, 2025
View reviewed changes
Copy link
Member

@bimmlerd bimmlerd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure I fully get what we're trying to assert re DNSSEC and whether www.cilium.io actually has DNSSEC enabled

@tklauser
Copy link
Member Author

tklauser commented Apr 10, 2025 •
edited
Loading

The existing FQDN runtime test only checks for the existence of an RRSIG record in the DNS response. The Cilium DNS proxy doesn't seem to touch RRSIG records at all. So it really looks like the existing test is already of limited use and can IMO be removed without replacement.

Changing the PR to just remove the respective test without replacement.

@tklauser tklauser marked this pull request as draft April 10, 2025 13:02
auto-merge was automatically disabled April 10, 2025 13:02

Pull request was converted to draft

@tklauser tklauser changed the title Migrate runtime FQDN DNSSEC test Remove runtime FQDN DNSSEC and matchPattern * tests Apr 10, 2025
@tklauser tklauser force-pushed the pr/tklauser/test-runtime-migrate-dnssec branch 2 times, most recently from d2a1f76 to 32414ca Compare April 10, 2025 13:08
@tklauser tklauser removed request for a team April 10, 2025 13:09
@tklauser tklauser marked this pull request as ready for review April 10, 2025 13:10
@tklauser
Copy link
Member Author

/ci-runtime

@tklauser tklauser requested review from bimmlerd and brlbil April 10, 2025 13:10
@tklauser tklauser enabled auto-merge April 10, 2025 13:14
@tklauser
Copy link
Member Author

/test

1 similar comment
@tklauser
Copy link
Member Author

/test

bimmlerd
bimmlerd approved these changes Apr 11, 2025
View reviewed changes
Copy link
Member

@bimmlerd bimmlerd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Cilium DNS proxy doesn't seem to touch RRSIG records at all.

Could it be that the intent of the test is verifying that the DNS proxy doesn't drop DNSSEC records? I think the upstream DNS servers of www.cilium.io serve RRSIGs (i.e. root and authoritative NS) so if we drop those that could be a problem. But I think this is easily testable at the unit/component level (and may already be covered).

@tklauser
Copy link
Member Author

The Cilium DNS proxy doesn't seem to touch RRSIG records at all.

Could it be that the intent of the test is verifying that the DNS proxy doesn't drop DNSSEC records? I think the upstream DNS servers of www.cilium.io serve RRSIGs (i.e. root and authoritative NS) so if we drop those that could be a problem. But I think this is easily testable at the unit/component level (and may already be covered).

Yeah, might be that that was the original intent, though neither the commit message nor the PR description mention anything specific. But as you say, this is in any case better off in a unit test. I'm planning to add one for CNAME records (which are touched by the DNS proxy) so it'll be easy to extend that one to cover RRSIG as well.

tklauser added 2 commits April 11, 2025 15:32
@tklauser
test/runtime: remove RuntimeAgentFQDNPolicies DNSSEC test
5362353 
The existing FQDN runtime test only checks for the existence of an
RRSIG record in the DNS response[^1]. The Cilium DNS proxy doesn't touch
RRSIG records at all. So it looks like the existing test is
already of limited use and can be removed without replacement.

[^1]: https://github.com/cilium/dnssec-client/blob/master/client.py#L30-L32

Signed-off-by: Tobias Klauser <tobias@cilium.io>
@tklauser
test/runtime: remove RuntimeAgentFQDNPolicies Implement matchPattern …
676b941 
…* test

matchPattern * is already covered in existing Cilium CLI connectivity
tests, though not for subdomains currently.  However, the correct
application of the provided pattern to FQDNs is already covered in
various unit tests in pkg/fqdn. Thus the corresponding runtime FQDN test
case is redundant and can be removed.

Signed-off-by: Tobias Klauser <tobias@cilium.io>
@tklauser tklauser changed the title Remove runtime FQDN DNSSEC and matchPattern * tests test/runtime: remove already covered FQDN tests Apr 11, 2025
@tklauser tklauser force-pushed the pr/tklauser/test-runtime-migrate-dnssec branch from 32414ca to 9035722 Compare April 11, 2025 13:35
@tklauser
Copy link
Member Author

/test

@tklauser
test/runtime: remove RuntimeAgentFQDNPolicies default-deny test
c415376 
The policy used in the test doesn't have a toPorts.rules.dns rule, so
the DNS proxy isn't covered at all in the test.

This test is thus testing the default-deny behavior which is already
covered elsewhere, e.g. various Cilium CLI connectivity tests.

Signed-off-by: Tobias Klauser <tobias@cilium.io>
@tklauser tklauser force-pushed the pr/tklauser/test-runtime-migrate-dnssec branch from 9035722 to c415376 Compare April 11, 2025 13:37
@tklauser
Copy link
Member Author

FYI, I've pushed an additional commit removing one more test that wasn't even exercising the DNS proxy and was thus only testing default-deny behavior.

@tklauser
Copy link
Member Author

/test

@tklauser tklauser added this pull request to the merge queue Apr 14, 2025
@maintainer-s-little-helper maintainer-s-little-helper bot added the ready-to-merge This PR has passed all tests and received consensus from code owners to merge. label Apr 14, 2025
Merged via the queue into main with commit 4cd5104 Apr 14, 2025
143 checks passed
@tklauser tklauser deleted the pr/tklauser/test-runtime-migrate-dnssec branch April 14, 2025 06:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@squeed squeed squeed approved these changes

@brlbil brlbil brlbil approved these changes

@bimmlerd bimmlerd bimmlerd approved these changes

Assignees
No one assigned
Labels
cilium-cli This PR contains changes related with cilium-cli ready-to-merge This PR has passed all tests and received consensus from code owners to merge. release-note/ci This PR makes changes to the CI.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@tklauser @squeed @brlbil @bimmlerd