Add tests covering local container networking. (openconfig#2445)

Co-authored-by: Ali Al-Shabibi <alshabibi.ali@gmail.com>

feature/container/containerz/README.md

@@ -0,0 +1,30 @@
+# CNTR-1: Basic container lifecycle via `gnoi.Containerz`.
+
+## CNTR-1.1: Deploy and Start a Container
+
+Using the
+[`gnoi.Containerz`](https://github.com/openconfig/gnoi/tree/main/containerz) API
+(reference implementation to be available
+[`openconfig/containerz`](https://github.com/openconfig/containerz), deploy a
+container to the DUT. Using `gnoi.Containerz` start the container.
+
+The container should expose a simple health API. The test succeeds if is
+possible to connect to the container via the gRPC API to determine its health.
+
+## CNTR-1.2: Retrieve a running container's logs.
+
+Using the container started as part of CNTR-1.1, retrieve the logs from the
+container and ensure non-zero contents are returned when using
+`gnoi.Containerz.Log`.
+
+## CNTR-1.3: List the running containers on a DUT
+
+Using the container started as part of CNTR-1.1, validate that the container is
+included in the listed set of containers when calling `gnoi.Containerz.List`.
+
+## CNTR-1.4: Stop a container running on a DUT.
+
+Using the container started as part of CNTR-1.2, validate that the container can
+be stopped, and is subsequently no longer listed in the `gnoi.Containerz.List`
+API.
+

feature/container/networking/tests/container_connectivity/README.md

@@ -0,0 +1,52 @@
+# CNTR-2: Container network connectivity tests
+
+Tests within this directory ensure that a container deployed on a network
+device is able to connect to external services via gRPC.
+
+## CNTR-2.1: Connect to container from external client.
+
+Deploy a container to a DUT that is listening on `[::]:60061`. Validate that the
+test can connect to tcp/60061 via gRPC and receive a response on a simple
+"dummy" service.
+
+## CNTR-2.2: Connect to locally running service.
+
+For a DUT configured with gNMI running on tcp/9339 (IANA standard), and gRIBI
+running on tcp/9340 (IANA standard), the test should:
+
+*   Instruct the container to make a gRPC `Dial` call to the running gNMI
+    instance, with a specified timeout. The test succeeds if the connection
+    succeeds within the timeout, otherwise it fails.
+*   Instruct the container to make a gRPC `Dial` call to the running gRIBI
+    instance with the same pass/fail logic.
+
+## CNTR-2.3: Connect to a remote node.
+
+Deploy two DUTs running in the following configuration:
+
+```
+  [  c1   ]                 [  c2   ]
+  ---------                 --------
+  [ DUT 1 ] ---- port1 ---- [ DUT 2 ]
+```
+
+where c1 is an instance of the "listener" container image, and c2 is an instance
+of the "dialer" image.
+
+The test should: * ensure that c1 is listening on `[::]:60071` running a gRPC
+service. * use gNMI to configure and/or discover the link local addresses
+configured on DUT1 port 1 and DUT2 port1. * instruct c2 to make a dial call and
+isue a simple RPC to the address configured by c1. If the dial call succeeds
+within a specified timeout, the test passes, otherwise it fails.
+
+## CNTR-2.4: Connect to another container on a local node
+
+Deploy a single DUT with two containers C1 and C2 running on them. C1 should
+listen on a gRPC service on `tcp/[::]:60061` and C2 should listen on a gRPC
+service on `tcp/[::]60062`.
+
+*   Instruct C1 to make a gRPC dial call to C2's listen port with a specified
+    timeout, ensure that an RPC response is received.
+*   Instruct C2 to make a gRPC dial call to C2's listen port with a specified
+    timeout, ensure that an RPC response is received.
+

feature/container/networking/tests/container_connectivity/cntr_test.go

@@ -0,0 +1,228 @@
+/*
+ Copyright 2022 Google LLC
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+      https://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
+
+// Package cntr_test implements an ONDATRA test for container functionalities
+// as described in the CNTR-[234] tests in README.md.
+package cntr_test
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kr/pretty"
+	"github.com/openconfig/featureprofiles/internal/fptest"
+	"github.com/openconfig/ondatra"
+	"github.com/openconfig/ondatra/binding"
+	"github.com/openconfig/ondatra/gnmi"
+	"github.com/openconfig/ondatra/gnmi/oc"
+	"github.com/openconfig/ygot/ygot"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/protobuf/encoding/prototext"
+
+	cpb "github.com/openconfig/featureprofiles/internal/cntrsrv/proto/cntr"
+)
+
+func TestMain(m *testing.M) {
+	fptest.RunTests(m)
+}
+
+func DialService(ctx context.Context, t *testing.T, name string, dut *ondatra.DUTDevice) (*grpc.ClientConn, func()) {
+	t.Helper()
+
+	var dialer interface {
+		DialGRPC(context.Context, string, ...grpc.DialOption) (*grpc.ClientConn, error)
+	}
+	if err := binding.DUTAs(dut.RawAPIs().BindingDUT(), &dialer); err != nil {
+		t.Fatalf("DUT does not support DialGRPC function: %v", err)
+	}
+
+	tlsc := credentials.NewTLS(&tls.Config{
+		InsecureSkipVerify: true, // NOLINT
+	})
+	conn, err := dialer.DialGRPC(ctx, name, grpc.WithTransportCredentials(tlsc), grpc.WithBlock())
+	if err != nil {
+		t.Fatalf("Failed to dial %s, %v", name, err)
+	}
+	return conn, func() { conn.Close() }
+}
+
+// TestDial implements CNTR-2, validating that it is possible for an external caller to dial into a service
+// running in a container on a DUT. The service used is the cntr service defined by cntr.proto.
+func TestDial(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	_, stop := DialService(ctx, t, "cntr", ondatra.DUT(t, "r0"))
+	stop()
+}
+
+// TestDialLocal implements CNTR-3, validating that it is possible for a
+// container running on the device to connect to local gRPC services that are
+// running on the DUT.
+func TestDialLocal(t *testing.T) {
+
+	tests := []struct {
+		desc     string
+		inMsg    *cpb.DialRequest
+		wantResp bool
+		wantErr  bool
+	}{{
+		desc: "dial gNMI",
+		inMsg: &cpb.DialRequest{
+			Addr: "localhost:9339",
+			Request: &cpb.DialRequest_Srv{
+				Srv: cpb.Service_ST_GNMI,
+			},
+		},
+		wantResp: true,
+	}, {
+		desc: "dial gRIBI",
+		inMsg: &cpb.DialRequest{
+			Addr: "localhost:9340",
+			Request: &cpb.DialRequest_Srv{
+				Srv: cpb.Service_ST_GRIBI,
+			},
+		},
+		wantResp: true,
+	}, {
+		desc: "dial something not listening",
+		inMsg: &cpb.DialRequest{
+			Addr: "localhost:4242",
+			Request: &cpb.DialRequest_Srv{
+				Srv: cpb.Service_ST_GRIBI,
+			},
+		},
+		wantErr: true,
+	}}
+
+	for _, tt := range tests {
+		t.Run(tt.desc, func(t *testing.T) {
+			ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+			defer cancel()
+
+			conn, stop := DialService(ctx, t, "cntr", ondatra.DUT(t, "r0"))
+			defer stop()
+
+			client := cpb.NewCntrClient(conn)
+			got, err := client.Dial(ctx, tt.inMsg)
+			if (err != nil) != tt.wantErr {
+				t.Fatalf("DialContext(): got unexpected error, err: %v, wantErr? %v", err, tt.wantErr)
+			}
+
+			t.Logf("got response: %s", prototext.Format(got))
+			if (got != nil) != tt.wantResp {
+				t.Fatalf("Dial: did not get correct response, got: %s, wantResponse? %v", prototext.Format(got), tt.wantResp)
+			}
+		})
+	}
+}
+
+// TestConnectRemote implements CNTR-4, validating that it is possible for a container to connect to a container
+// on an adjacent node via gRPC using IPv6 link local addresses. r0 and r1 in the topology are configured with
+// IPv6 link-local addresses via gNMI, and the CNTR service is used to trigger a connection between the two addresses.
+//
+// The test is repeated for r0 --> r1 and r1 --> r0.
+func TestConnectRemote(t *testing.T) {
+	configureIPv6Addr := func(dut *ondatra.DUTDevice, name, addr string) {
+		pn := dut.Port(t, "port1").Name()
+
+		d := &oc.Interface{
+			Name:    ygot.String(pn),
+			Type:    oc.IETFInterfaces_InterfaceType_ethernetCsmacd,
+			Enabled: ygot.Bool(true),
+		}
+		s := d.GetOrCreateSubinterface(0)
+		s.GetOrCreateIpv4().Enabled = ygot.Bool(true)
+		v6 := s.GetOrCreateIpv6()
+		// TODO(robjs): Clarify whether IPv4 enabled is required here for multiple
+		// targets, otherwise add a deviation.
+		v6.Enabled = ygot.Bool(true)
+		a := v6.GetOrCreateAddress(addr)
+		a.PrefixLength = ygot.Uint8(64)
+		a.Type = oc.IfIp_Ipv6AddressType_LINK_LOCAL_UNICAST
+		gnmi.Replace(t, dut, gnmi.OC().Interface(pn).Config(), d)
+
+		time.Sleep(1 * time.Second)
+	}
+
+	configureIPv6Addr(ondatra.DUT(t, "r0"), "port1", "fe80::cafe:1")
+	configureIPv6Addr(ondatra.DUT(t, "r1"), "port1", "fe80::cafe:2")
+
+	validateIPv6Present := func(dut *ondatra.DUTDevice, name string) {
+		// Check that there is a configured IPv6 address on the interface.
+		// TODO(robjs): Validate expectations as to whether autoconf link-local is returned
+		// here.
+		v6addr := gnmi.GetAll(t, dut, gnmi.OC().Interface(dut.Port(t, name).Name()).SubinterfaceAny().Ipv6().AddressAny().State())
+		if len(v6addr) < 1 {
+			t.Fatalf("%s: did not get a configured IPv6 address, got: %d (%s), want: 1", dut.Name(), len(v6addr), pretty.Sprint(v6addr))
+		}
+	}
+
+	validateIPv6Present(ondatra.DUT(t, "r0"), "port1")
+	validateIPv6Present(ondatra.DUT(t, "r1"), "port1")
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	conn, stop := DialService(ctx, t, "cntr", ondatra.DUT(t, "r1"))
+	defer stop()
+
+	containerInterfaceName := func(t *testing.T, d *ondatra.DUTDevice, port *ondatra.Port) string {
+		switch d.Vendor() {
+		case ondatra.ARISTA:
+			switch {
+			case strings.HasPrefix(port.Name(), "Ethernet"):
+				num, _ := strings.CutPrefix(port.Name(), "Ethernet")
+				return fmt.Sprintf("eth%s", num)
+			}
+		}
+		t.Fatalf("cannot resolve interface name into Linux interface name, %s -> %s", d.Vendor(), port.Name())
+		return ""
+	}
+
+	tests := []struct {
+		inDUT        *ondatra.DUTDevice
+		inRemoteAddr string
+	}{{
+		inDUT:        ondatra.DUT(t, "r1"),
+		inRemoteAddr: "fe80::cafe:1",
+	}, {
+		inDUT:        ondatra.DUT(t, "r0"),
+		inRemoteAddr: "fe80::cafe:2",
+	}}
+
+	for _, tt := range tests {
+		t.Run(fmt.Sprintf("dial from %s to %s", tt.inDUT, tt.inRemoteAddr), func(t *testing.T) {
+			dialAddr := fmt.Sprintf("[%s%%25%s]:60061", tt.inRemoteAddr, containerInterfaceName(t, tt.inDUT, tt.inDUT.Port(t, "port1")))
+			t.Logf("dialing remote address %s", dialAddr)
+			client := cpb.NewCntrClient(conn)
+			got, err := client.Dial(ctx, &cpb.DialRequest{
+				Addr: dialAddr,
+				Request: &cpb.DialRequest_Ping{
+					Ping: &cpb.PingRequest{},
+				},
+			})
+			if err != nil {
+				t.Fatalf("could not make request to remote device, got err: %v", err)
+			}
+			t.Logf("got response, %s", prototext.Format(got))
+		})
+	}
+}

feature/container/networking/tests/container_connectivity/metadata.textproto

@@ -0,0 +1,7 @@
+# proto-file: github.com/openconfig/featureprofiles/proto/metadata.proto
+# proto-message: Metadata
+
+uuid: "dc9a9682-8ec1-4ca0-8f54-635d690bb488"
+plan_id: "CNTR-2"
+description: "Container network connectivity tests"
+testbed: TESTBED_DUT_ATE_2LINKS

go.mod

@@ -14,6 +14,7 @@ require (
 	github.com/google/gopacket v1.1.19
 	github.com/google/uuid v1.5.0
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0
+	github.com/kr/pretty v0.3.1
 	github.com/open-traffic-generator/snappi/gosnappi v0.13.7
 	github.com/openconfig/entity-naming v0.0.0-20230912181021-7ac806551a31
 	github.com/openconfig/gnmi v0.10.0
@@ -41,6 +42,7 @@ require (
 	google.golang.org/grpc v1.60.1
 	google.golang.org/protobuf v1.32.0
 	gopkg.in/yaml.v2 v2.4.0
+	k8s.io/klog/v2 v2.100.1
 )
 
 require (
@@ -97,7 +99,6 @@ require (
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/jstemmer/go-junit-report/v2 v2.1.0 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
-	github.com/kr/pretty v0.3.1 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/magiconair/properties v1.8.7 // indirect
@@ -159,7 +160,6 @@ require (
 	k8s.io/api v0.26.3 // indirect
 	k8s.io/apimachinery v0.26.3 // indirect
 	k8s.io/client-go v0.26.3 // indirect
-	k8s.io/klog/v2 v2.100.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20230308215209-15aac26d736a // indirect
 	k8s.io/utils v0.0.0-20230313181309-38a27ef9d749 // indirect
 	lukechampine.com/uint128 v1.3.0 // indirect

internal/cntrsrv/README.md

@@ -0,0 +1,11 @@
+# `cntr` Container Image
+
+This directory contains the source code for a binary which can be run as a
+container on a network device to run the `feature/container` tests. It exposes
+a gRPC API that can be interacted with through ONDATRA in order to validate
+connectivity to specific gRPC services.
+
+The `build` directory contains a `Dockerfile` for building the container.
+
+The `proto/cntr` directory contains a protobuf that defines the gRPC API
+exposed by the container for test purposes.

internal/cntrsrv/build/Dockerfile.cntr

@@ -0,0 +1,6 @@
+FROM us-west1-docker.pkg.dev/gep-kne/arista/ceos:ga
+
+COPY cntrsrv /usr/bin
+COPY ./cntr.service /etc/systemd/system
+
+RUN systemctl enable cntr

internal/cntrsrv/build/cntr.service

@@ -0,0 +1,13 @@
+[Unit]
+Description="CNTR"
+
+[Service]
+Type=simple
+Restart=always
+RestartSec=10
+User=root
+ExecStart=/usr/bin/cntrsrv
+StandardOutput=append:/var/log/cntr.log
+
+[Install]
+WantedBy=multi-user.target