K8sbykeshed / k8s-service-validator

Kubernetes Network Service Validator
22 stars 10 forks source link

added tests for service sessionAffinity #79

Closed yzaccc closed 2 years ago

yzaccc commented 2 years ago

Commits:

Goal:

Executed test plan: (setup)

  1. add label app=test-session-affinity to pod-3 and pod-4
  2. create service with same label, and sessionAffinity=ClientIP (memorize affinity)
  3. create from/to peer map to store from/to pods
  4. let all four pods to reach session affinity service via port 80
  5. save the destination pod for each into the from/to peer map (verify via port 80)
  6. create expected matrix based on from/to peer map
  7. 4x4 matrix validation via clusterIP (verify via port81)
  8. do step 6 and 7
  9. remove session affinity label from pod-3 and pod-4

result: Session affinity service, from/to peers: map[pod-1:pod-3 pod-2:pod-4 pod-3:pod-3 pod-4:pod-3] image

yzaccc commented 2 years ago

Well as discussed in issue https://github.com/kubernetes/kubernetes/issues/103000, this test encountered same problem for iptable mode kube-proxy.

Expected to use same client reach to the session affinity service via different port, the expected from/to pods peer should be same for port 80 and 81. But the reality is the destination pods are different, as below: Testing connections to different ports of sesson affinity service, should use same from/to peers: map[pod-1:pod-4 pod-2:pod-4 pod-3:pod-4 pod-4:pod-4] For port 80: image

for port 81: image

yzaccc commented 2 years ago

red pipelines are expected as iptables behavior in issue kubernetes/kubernetes#103000. Merging this PR.