Update scripts to create an AKS cluster and scripts for Cilium tests

policies/cilium/egress-tutorial/00-install-cilium-hubble-cli.sh

@@ -2,18 +2,18 @@
 
 # For more information, see https://docs.cilium.io/en/latest/gettingstarted/k8s-install-default/#install-the-cilium-cli
 
-CILIUM_CLI_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/cilium-cli/master/stable.txt)
+CILIUM_CLI_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/cilium-cli/main/stable.txt)
 CLI_ARCH=amd64
 if [ "$(uname -m)" = "aarch64" ]; then CLI_ARCH=arm64; fi
 curl -L --fail --remote-name-all https://github.com/cilium/cilium-cli/releases/download/${CILIUM_CLI_VERSION}/cilium-linux-${CLI_ARCH}.tar.gz{,.sha256sum}
 sha256sum --check cilium-linux-${CLI_ARCH}.tar.gz.sha256sum
 sudo tar xzvfC cilium-linux-${CLI_ARCH}.tar.gz /usr/local/bin
-rm cilium-linux-${CLI_ARCH}.tar.gz{,.sha256sum}
+rm cilium-linux-${CLI_ARCH}.tar.gz cilium-linux-${CLI_ARCH}.tar.gz.sha256sum
 
-HUBBLE_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/hubble/master/stable.txt)
+HUBBLE_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/hubble/main/stable.txt)
 HUBBLE_ARCH=amd64
 if [ "$(uname -m)" = "aarch64" ]; then HUBBLE_ARCH=arm64; fi
 curl -L --fail --remote-name-all https://github.com/cilium/hubble/releases/download/$HUBBLE_VERSION/hubble-linux-${HUBBLE_ARCH}.tar.gz{,.sha256sum}
 sha256sum --check hubble-linux-${HUBBLE_ARCH}.tar.gz.sha256sum
 sudo tar xzvfC hubble-linux-${HUBBLE_ARCH}.tar.gz /usr/local/bin
-rm hubble-linux-${HUBBLE_ARCH}.tar.gz{,.sha256sum}
+rm hubble-linux-${HUBBLE_ARCH}.tar.gz hubble-linux-${HUBBLE_ARCH}.tar.gz.sha256sum

policies/cilium/egress-tutorial/01-deploy-demo.sh

@@ -25,5 +25,9 @@ fi
 # Deploy the demo
 kubectl apply -n $namespace -f $template
 
+# Wait for the pod to be ready before running the connectivity checks
+echo "Waiting for the mediabot pod to be ready..."
+kubectl wait --namespace $namespace --for=condition=Ready pod/mediabot --timeout=120s
+
 # Check the status of the pods and services
 kubectl get pods,svc -n $namespace

policies/cilium/egress-tutorial/02-call-services.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+# Variables
+namespace="starwars"
+
+# Connect to pods and try to land
+echo "Calling https://api.github.com from mediabot pod..."
+kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://api.github.com | head -1 # This call should succeed as no network policy is applied yet
+echo "Calling http://api.github.com from mediabot pod..."
+kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 http://api.github.com | head -1 # This call should succeed as no network policy is applied yet and HTTP is redirected to HTTPS
+echo "Calling https://status.github.com from mediabot pod..."
+kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://status.github.com | head -1 # This call should succeed as no network policy is applied yet
+echo "Calling https://github.com from mediabot pod..."
+kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://github.com | head -1 # This call should succeed as no network policy is applied yet

policies/cilium/egress-tutorial/04-call-services.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+# Variables
+namespace="starwars"
+
+# Connect to pods and try to land
+echo "Calling https://api.github.com from mediabot pod..."
+kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://api.github.com | head -1 # This call should succeed as api.github.com is allowed by the DNS whitelist
+echo "Calling http://api.github.com from mediabot pod..."
+kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 http://api.github.com | head -1 # This call should succeed as api.github.com is allowed by the DNS whitelist and HTTP is redirected to HTTPS
+echo "Calling https://status.github.com from mediabot pod..."
+kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://status.github.com | head -1 # This call should fails as status.github.com is not allowed by the DNS whitelist
+echo "Calling https://github.com from mediabot pod..."
+kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://github.com | head -1 # This call should fail as github.com is not allowed by the DNS whitelist

policies/cilium/egress-tutorial/06-call-services.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+# Variables
+namespace="starwars"
+
+# Connect to pods and try to land
+echo "Calling https://api.github.com from mediabot pod..."
+kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://api.github.com | head -1 # This call should succeed as api.github.com is allowed by the DNS whitelist
+echo "Calling http://api.github.com from mediabot pod..."
+kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 http://api.github.com | head -1 # This call should succeed as api.github.com is allowed by the DNS whitelist and HTTP is redirected to HTTPS
+echo "Calling https://status.github.com from mediabot pod..."
+kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://status.github.com | head -1 # This call should succeed as api.github.com is allowed by the DNS whitelist
+echo "Calling https://github.com from mediabot pod..."
+kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://github.com | head -1 # This call should fail as github.com is not allowed by the DNS whitelist

policies/cilium/egress-tutorial/08-call-services.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+# Variables
+namespace="starwars"
+
+# Connect to pods and try to land
+echo "Calling https://api.github.com from mediabot pod..."
+kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://api.github.com | head -1 # This call should succeed as api.github.com is allowed by the DNS whitelist
+echo "Calling http://api.github.com from mediabot pod..."
+kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 http://api.github.com | head -1 # This call should fail as the network policy allows only HTTPS traffic on port 443
+echo "Calling https://status.github.com from mediabot pod..."
+kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://status.github.com | head -1 # This call should succeed as api.github.com is allowed by the DNS whitelist
+echo "Calling https://github.com from mediabot pod..."
+kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://github.com | head -1 # This call should fail as github.com is not allowed by the DNS whitelist

policies/cilium/egress-tutorial/11-cleanup.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+
+# Variables
+namespace="starwars"
+
+# Controlla se il namespace esiste nel cluster
+if kubectl get namespace "$namespace" >/dev/null 2>&1; then
+    echo "Deleting [$namespace] namespace and all its resources..."
+    kubectl delete namespace "$namespace" --wait=false
+
+    # Aspetta il completamento, intercettando il timeout
+    if ! kubectl wait --for=delete namespace/$namespace --timeout=60s 2>/dev/null; then
+        echo "Namespace deletion is taking longer than expected. Forcing finalizer removal..."
+        kubectl patch namespace "$namespace" -p '{"spec":{"finalizers":[]}}' --type=merge 2>/dev/null
+
+        # Ultima verifica breve
+        kubectl wait --for=delete namespace/$namespace --timeout=10s 2>/dev/null
+    fi
+    echo "[$namespace] namespace and all its resources have been deleted"
+else
+    echo "[$namespace] namespace does not exist in the cluster, nothing to clean up"
+fi

policies/cilium/ingress-tutorial/00-install-cilium-hubble-cli.sh

@@ -2,18 +2,18 @@
 
 # For more information, see https://docs.cilium.io/en/latest/gettingstarted/k8s-install-default/#install-the-cilium-cli
 
-CILIUM_CLI_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/cilium-cli/master/stable.txt)
+CILIUM_CLI_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/cilium-cli/main/stable.txt)
 CLI_ARCH=amd64
 if [ "$(uname -m)" = "aarch64" ]; then CLI_ARCH=arm64; fi
 curl -L --fail --remote-name-all https://github.com/cilium/cilium-cli/releases/download/${CILIUM_CLI_VERSION}/cilium-linux-${CLI_ARCH}.tar.gz{,.sha256sum}
 sha256sum --check cilium-linux-${CLI_ARCH}.tar.gz.sha256sum
 sudo tar xzvfC cilium-linux-${CLI_ARCH}.tar.gz /usr/local/bin
-rm cilium-linux-${CLI_ARCH}.tar.gz{,.sha256sum}
+rm cilium-linux-${CLI_ARCH}.tar.gz cilium-linux-${CLI_ARCH}.tar.gz.sha256sum
 
-HUBBLE_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/hubble/master/stable.txt)
+HUBBLE_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/hubble/main/stable.txt)
 HUBBLE_ARCH=amd64
 if [ "$(uname -m)" = "aarch64" ]; then HUBBLE_ARCH=arm64; fi
 curl -L --fail --remote-name-all https://github.com/cilium/hubble/releases/download/$HUBBLE_VERSION/hubble-linux-${HUBBLE_ARCH}.tar.gz{,.sha256sum}
 sha256sum --check hubble-linux-${HUBBLE_ARCH}.tar.gz.sha256sum
 sudo tar xzvfC hubble-linux-${HUBBLE_ARCH}.tar.gz /usr/local/bin
-rm hubble-linux-${HUBBLE_ARCH}.tar.gz{,.sha256sum}
+rm hubble-linux-${HUBBLE_ARCH}.tar.gz hubble-linux-${HUBBLE_ARCH}.tar.gz.sha256sum

policies/cilium/ingress-tutorial/01-deploy-demo.sh

@@ -25,5 +25,11 @@ fi
 # Deploy the demo
 kubectl apply -n $namespace -f $template
 
+# Wait for the workloads to be ready before running the connectivity checks
+echo "Waiting for the workloads to be ready..."
+kubectl wait --namespace $namespace --for=condition=Available deployment/deathstar --timeout=120s
+kubectl wait --namespace $namespace --for=condition=Ready pod/tiefighter --timeout=120s
+kubectl wait --namespace $namespace --for=condition=Ready pod/xwing --timeout=120s
+
 # Check the status of the pods and services
 kubectl get pods,svc -n $namespace

policies/cilium/ingress-tutorial/05-call-request-landing-web-method.sh

@@ -4,5 +4,5 @@
 namespace="starwars"
 
 # Connect to pods and try to land
-kubectl exec tiefighter -n $namespace -- curl -s -XPOST --connect-timeout 5 deathstar.$namespace.svc.cluster.local/v1/request-landing
-kubectl exec xwing -n $namespace -- curl -s -XPOST --connect-timeout 5 deathstar.$namespace.svc.cluster.local/v1/request-landing
+kubectl exec tiefighter -n $namespace -- curl -s -XPOST --connect-timeout 3 --max-time 3 deathstar.$namespace.svc.cluster.local/v1/request-landing
+kubectl exec xwing -n $namespace -- curl -s -XPOST --connect-timeout 3 --max-time 3 deathstar.$namespace.svc.cluster.local/v1/request-landing

policies/cilium/ingress-tutorial/06-call-other-web-method.sh

@@ -4,5 +4,5 @@
 namespace="starwars"
 
 # Connect to pods and try to land
-kubectl exec tiefighter -n $namespace -- curl -s -XPUT --connect-timeout 3 deathstar.$namespace.svc.cluster.local/v1/exhaust-port
-kubectl exec xwing -n $namespace -- curl -s -XPUT --connect-timeout 3 deathstar.$namespace.svc.cluster.local/v1/exhaust-port
+kubectl exec tiefighter -n $namespace -- curl -s -XPUT --connect-timeout 3 --max-time 3 deathstar.$namespace.svc.cluster.local/v1/exhaust-port
+kubectl exec xwing -n $namespace -- curl -s -XPUT --connect-timeout 3 --max-time 3 deathstar.$namespace.svc.cluster.local/v1/exhaust-port

policies/cilium/ingress-tutorial/08-call-deathstar-methods.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+# Variables
+namespace="starwars"
+
+# Connect to pods and try to land. The first call should succeed, while the second one should be blocked by Cilium's L7 policy.
+echo "Calling /v1/request-landing and /v1/exhaust-port from the tiefighter pod..."
+kubectl exec tiefighter -n $namespace -- curl -s -XPOST --connect-timeout 3 --max-time 3 deathstar.$namespace.svc.cluster.local/v1/request-landing
+echo "Calling /v1/exhaust-port from the tiefighter pod..."
+kubectl exec tiefighter -n $namespace -- curl -s -XPUT --connect-timeout 3 --max-time 3 deathstar.$namespace.svc.cluster.local/v1/exhaust-port
+
+# The following calls should timeout, as the xwing pod is not allowed to access the deathstar service.
+echo "Calling /v1/request-landing and /v1/exhaust-port from the xwing pod..."
+kubectl exec xwing -n $namespace -- curl -s -XPOST --connect-timeout 3 --max-time 3 deathstar.$namespace.svc.cluster.local/v1/request-landing
+echo "Calling /v1/exhaust-port from the xwing pod..."
+kubectl exec xwing -n $namespace -- curl -s -XPUT --connect-timeout 3 --max-time 3 deathstar.$namespace.svc.cluster.local/v1/exhaust-port

policies/cilium/ingress-tutorial/10-call-deathstar-methods.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+# Variables
+namespace="starwars"
+
+# Connect to pods and try to land. The first call should succeed, while the second one should be blocked by Cilium's L7 policy.
+echo "Calling /v1/request-landing and /v1/exhaust-port from the tiefighter pod..."
+kubectl exec tiefighter -n $namespace -- curl -s -XPOST --connect-timeout 3 --max-time 3 deathstar.$namespace.svc.cluster.local/v1/request-landing
+echo "Calling /v1/exhaust-port from the tiefighter pod..."
+kubectl exec tiefighter -n $namespace -- curl -s -XPUT --connect-timeout 3 --max-time 3 deathstar.$namespace.svc.cluster.local/v1/exhaust-port
+
+# The following calls should timeout, as the xwing pod is not allowed to access the deathstar service.
+echo "Calling /v1/request-landing and /v1/exhaust-port from the xwing pod..."
+kubectl exec xwing -n $namespace -- curl -s -XPOST --connect-timeout 3 --max-time 3 deathstar.$namespace.svc.cluster.local/v1/request-landing
+echo "Calling /v1/exhaust-port from the xwing pod..."
+kubectl exec xwing -n $namespace -- curl -s -XPUT --connect-timeout 3 --max-time 3 deathstar.$namespace.svc.cluster.local/v1/exhaust-port

policies/cilium/ingress-tutorial/12-cleanup.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+
+# Variables
+namespace="starwars"
+
+# Controlla se il namespace esiste nel cluster
+if kubectl get namespace "$namespace" >/dev/null 2>&1; then
+    echo "Deleting [$namespace] namespace and all its resources..."
+    kubectl delete namespace "$namespace" --wait=false
+
+    # Aspetta il completamento, intercettando il timeout
+    if ! kubectl wait --for=delete namespace/$namespace --timeout=60s 2>/dev/null; then
+        echo "Namespace deletion is taking longer than expected. Forcing finalizer removal..."
+        kubectl patch namespace "$namespace" -p '{"spec":{"finalizers":[]}}' --type=merge 2>/dev/null
+
+        # Ultima verifica breve
+        kubectl wait --for=delete namespace/$namespace --timeout=10s 2>/dev/null
+    fi
+    echo "[$namespace] namespace and all its resources have been deleted"
+else
+    echo "[$namespace] namespace does not exist in the cluster, nothing to clean up"
+fi