Adolfo Delorenzo
e372df578b
Complete Phase 1 implementation of KubeSolo OS — an immutable, bootable Linux distribution built on Tiny Core Linux for running KubeSolo single-node Kubernetes. Build system: - Makefile with fetch, rootfs, initramfs, iso, disk-image targets - Dockerfile.builder for reproducible builds - Scripts to download Tiny Core, extract rootfs, inject KubeSolo, pack initramfs, and create bootable ISO/disk images Init system (10 POSIX sh stages): - Early mount (proc/sys/dev/cgroup2), cmdline parsing, persistent mount with bind-mounts, kernel module loading, sysctl, DHCP networking, hostname, clock sync, containerd prep, KubeSolo exec Shared libraries: - functions.sh (device wait, IP lookup, config helpers) - network.sh (static IP, config persistence, interface detection) - health.sh (containerd, API server, node readiness checks) - Emergency shell for boot failure debugging Testing: - QEMU boot test with serial log marker detection - K8s readiness test with kubectl verification - Persistence test (reboot + verify state survives) - Workload deployment test (nginx pod) - Local storage test (PVC + local-path provisioner) - Network policy test - Reusable run-vm.sh launcher Developer tools: - dev-vm.sh (interactive QEMU with port forwarding) - rebuild-initramfs.sh (fast iteration) - inject-ssh.sh (dropbear SSH for debugging) - extract-kernel-config.sh + kernel-audit.sh Documentation: - Full design document with architecture research - Boot flow documentation covering all 10 init stages - Cloud-init examples (DHCP, static IP, Portainer Edge, air-gapped) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
120 lines
3.0 KiB
Bash
Executable File
120 lines
3.0 KiB
Bash
Executable File
#!/bin/bash
|
|
# test-network-policy.sh — Basic network policy enforcement test
|
|
# Usage: ./test/integration/test-network-policy.sh <iso-path>
|
|
# Verifies that NetworkPolicy resources can be created and traffic is filtered.
|
|
# Requires: kubectl on host, QEMU
|
|
set -euo pipefail
|
|
|
|
ISO="${1:?Usage: $0 <path-to-iso>}"
|
|
TIMEOUT_K8S=300
|
|
TIMEOUT_POD=120
|
|
API_PORT=6443
|
|
|
|
DATA_DISK=$(mktemp /tmp/kubesolo-data-XXXXXX.img)
|
|
dd if=/dev/zero of="$DATA_DISK" bs=1M count=1024 2>/dev/null
|
|
mkfs.ext4 -q -L KSOLODATA "$DATA_DISK" 2>/dev/null
|
|
|
|
SERIAL_LOG=$(mktemp /tmp/kubesolo-netpol-XXXXXX.log)
|
|
|
|
cleanup() {
|
|
$KUBECTL delete namespace netpol-test 2>/dev/null || true
|
|
kill "$QEMU_PID" 2>/dev/null || true
|
|
rm -f "$DATA_DISK" "$SERIAL_LOG"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
KUBECTL="kubectl --server=https://localhost:${API_PORT} --insecure-skip-tls-verify"
|
|
|
|
echo "==> Network policy test: $ISO"
|
|
|
|
# Launch QEMU
|
|
qemu-system-x86_64 \
|
|
-m 2048 -smp 2 \
|
|
-nographic \
|
|
-cdrom "$ISO" \
|
|
-boot d \
|
|
-drive "file=$DATA_DISK,format=raw,if=virtio" \
|
|
-net nic,model=virtio \
|
|
-net "user,hostfwd=tcp::${API_PORT}-:6443" \
|
|
-serial "file:$SERIAL_LOG" \
|
|
-append "console=ttyS0,115200n8 kubesolo.data=/dev/vda" \
|
|
&
|
|
QEMU_PID=$!
|
|
|
|
# Wait for K8s
|
|
echo " Waiting for K8s API..."
|
|
ELAPSED=0
|
|
while [ "$ELAPSED" -lt "$TIMEOUT_K8S" ]; do
|
|
if $KUBECTL get nodes 2>/dev/null | grep -q "Ready"; then
|
|
break
|
|
fi
|
|
sleep 5
|
|
ELAPSED=$((ELAPSED + 5))
|
|
done
|
|
|
|
if [ "$ELAPSED" -ge "$TIMEOUT_K8S" ]; then
|
|
echo "==> FAIL: K8s not ready within ${TIMEOUT_K8S}s"
|
|
exit 1
|
|
fi
|
|
echo " K8s ready (${ELAPSED}s)"
|
|
|
|
# Create test namespace
|
|
$KUBECTL create namespace netpol-test 2>/dev/null || true
|
|
|
|
# Create a web server pod
|
|
echo "==> Creating web server pod..."
|
|
$KUBECTL apply -n netpol-test -f - << 'YAML'
|
|
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
name: web
|
|
labels:
|
|
app: web
|
|
spec:
|
|
containers:
|
|
- name: web
|
|
image: busybox:latest
|
|
command: ["sh", "-c", "echo 'hello' | nc -l -p 80; sleep 3600"]
|
|
ports:
|
|
- containerPort: 80
|
|
YAML
|
|
|
|
# Wait for pod
|
|
ELAPSED=0
|
|
while [ "$ELAPSED" -lt "$TIMEOUT_POD" ]; do
|
|
STATUS=$($KUBECTL get pod -n netpol-test web -o jsonpath='{.status.phase}' 2>/dev/null || echo "")
|
|
[ "$STATUS" = "Running" ] && break
|
|
sleep 5
|
|
ELAPSED=$((ELAPSED + 5))
|
|
done
|
|
|
|
if [ "$STATUS" != "Running" ]; then
|
|
echo "==> FAIL: Web pod not running (status: $STATUS)"
|
|
exit 1
|
|
fi
|
|
echo " Web pod running"
|
|
|
|
# Create a deny-all NetworkPolicy
|
|
echo "==> Applying deny-all NetworkPolicy..."
|
|
$KUBECTL apply -n netpol-test -f - << 'YAML'
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: deny-all
|
|
spec:
|
|
podSelector: {}
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
YAML
|
|
|
|
# Verify the NetworkPolicy was created
|
|
if $KUBECTL get networkpolicy -n netpol-test deny-all >/dev/null 2>&1; then
|
|
echo "==> PASS: NetworkPolicy created successfully"
|
|
echo " NetworkPolicy resources are supported by the cluster"
|
|
exit 0
|
|
else
|
|
echo "==> FAIL: NetworkPolicy creation failed"
|
|
exit 1
|
|
fi
|