Test NetworkPolicy plugin (if the kernel supports it)

Author: danwinship

test/extended/cni_vendor_test.sh

@@ -9,7 +9,7 @@ export NETWORKING_E2E_NETWORKPOLICY="${NETWORKING_E2E_NETWORKPOLICY:-true}"
 # redhat/openshift-ovs-multitenant
 export NETWORKING_E2E_ISOLATION="${NETWORKING_E2E_ISOLATION:-false}"
 
-export NETWORKING_E2E_FOCUS="${NETWORKING_E2E_FOCUS:-\[networking\]}"
+export NETWORKING_E2E_FOCUS="${NETWORKING_E2E_FOCUS:-\[networking\]|Feature:NetworkPolicy}"
 export NETWORKING_E2E_EXTERNAL=1
 
 # Checking for a given kubeconfig

test/extended/networking.sh

@@ -16,7 +16,7 @@ export SHELLOPTS
 #
 # The EmptyDir test is a canary; it will fail if mount propagation is
 # not properly configured on the host.
-NETWORKING_E2E_FOCUS="${NETWORKING_E2E_FOCUS:-etworking|Services should be able to create a functioning NodePort service|EmptyDir volumes should support \(root,0644,tmpfs\)}"
+NETWORKING_E2E_FOCUS="${NETWORKING_E2E_FOCUS:-etworking|Feature:NetworkPolicy|Services should be able to create a functioning NodePort service|EmptyDir volumes should support \(root,0644,tmpfs\)}"
 NETWORKING_E2E_SKIP="${NETWORKING_E2E_SKIP:-}"
 
 DEFAULT_SKIP_LIST=(
@@ -313,6 +313,25 @@ function disable-selinux() {
   fi
 }
 
+function kernel-supports-networkpolicy() {
+  # There's really no good way to test this "correctly" if OVS isn't installed.
+  # The mainline kernel got support for OVS NAT support in 4.6. RHEL kernels have
+  # it in 3.10.0-514 and later.
+  version="$(uname -r)"
+  case "${version}" in
+    3.10.0-*.el7.*)
+      build=$(sed -e 's/.*-\([0-9]*\)\..*/\1/' <<< "${version}")
+      if [[ "${build}" -lt 514 ]]; then
+        return 1
+      fi
+      ;;
+    [0-3].*|4.[0-5].*)
+      return 1
+      ;;
+  esac
+  return 0
+}
+
 os::log::info "Starting 'networking' extended tests"
 if [[ -n "${CONFIG_ROOT}" ]]; then
   KUBECONFIG="$(get-kubeconfig-from-root "${CONFIG_ROOT}")"
@@ -377,11 +396,16 @@ else
   # Docker-in-docker is not compatible with selinux
   disable-selinux
 
-  # Skip the subnet tests during a minimal test run
+  # Skip subnet and networkpolicy tests during a minimal test run
   if [[ -z "${NETWORKING_E2E_MINIMAL}" ]]; then
     # Ignore deployment errors for a given plugin to allow other plugins
     # to be tested.
     test-osdn-plugin "subnet" "redhat/openshift-ovs-subnet" "false" "false" || true
+    if kernel-supports-networkpolicy; then
+      test-osdn-plugin "networkpolicy" "redhat/openshift-ovs-networkpolicy" "false" "true" || true
+    else
+      os::log::warning "Skipping networkpolicy tests due to kernel version"
+    fi
   fi
 
   test-osdn-plugin "multitenant" "redhat/openshift-ovs-multitenant" "true" "false" || true