Skip to content

e2e test: verify num autogenerated security groups for basic service … #4685

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bobert-2 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

e2e test: verify num autogenerated security groups for basic service … #4685

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 7 additions & 5 deletions test/e2e/service/nlb_instance_target_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,11 @@ package service
import (
"context"
"fmt"
"strings"

awssdk "github.com/aws/aws-sdk-go-v2/aws"
"k8s.io/apimachinery/pkg/util/intstr"
"sigs.k8s.io/aws-load-balancer-controller/test/framework/verifier"
"strings"

. "github.com/onsi/ginkgo/v2"
. "github.com/onsi/gomega"
Expand Down Expand Up @@ -81,10 +82,11 @@ var _ = Describe("test k8s service using instance target reconciled by the aws l
}

err = verifier.VerifyAWSLoadBalancerResources(ctx, tf, lbARN, verifier.LoadBalancerExpectation{
Type: "network",
Scheme: "internet-facing",
Listeners: stack.resourceStack.getListenersPortMap(),
TargetGroups: expectedTargetGroups,
Type: "network",
Copy link
Copy Markdown
Collaborator

@shuqz shuqz Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do we only need to verify SG number for those 2 test cases? or there is a plan to cover more

Scheme: "internet-facing",
NumSecurityGroups: 2, // One shared backend security group, one managed security group
Listeners: stack.resourceStack.getListenersPortMap(),
TargetGroups: expectedTargetGroups,
})
Expect(err).NotTo(HaveOccurred())
})
Expand Down
10 changes: 6 additions & 4 deletions test/e2e/service/nlb_ip_target_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,12 @@ package service
import (
"context"
"fmt"
elbv2types "github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2/types"
"sigs.k8s.io/aws-load-balancer-controller/test/framework/verifier"
"strings"
"time"

elbv2types "github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2/types"
"sigs.k8s.io/aws-load-balancer-controller/test/framework/verifier"

awssdk "github.com/aws/aws-sdk-go-v2/aws"
. "github.com/onsi/ginkgo/v2"
. "github.com/onsi/gomega"
Expand Down Expand Up @@ -143,8 +144,9 @@ var _ = Describe("k8s service using ip target reconciled by the aws load balance
}

err := verifier.VerifyAWSLoadBalancerResources(ctx, tf, lbARN, verifier.LoadBalancerExpectation{
Type: "network",
Scheme: "internet-facing",
Type: "network",
Scheme: "internet-facing",
NumSecurityGroups: 2,
Listeners: map[string]string{
"80": "TCP",
},
Expand Down
20 changes: 15 additions & 5 deletions test/framework/verifier/aws_resource_verifier.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,11 +38,12 @@ type ExpectedTargetGroup struct {
}

type LoadBalancerExpectation struct {
Name string
Type string
Scheme string
Listeners map[string]string // listener port, protocol
TargetGroups []ExpectedTargetGroup
Name string
Type string
Scheme string
NumSecurityGroups int
Listeners map[string]string // listener port, protocol
TargetGroups []ExpectedTargetGroup
}

// ListenerExpectation contains the expected configuration for an ALB/NLB listener
Expand Down Expand Up @@ -79,6 +80,8 @@ func VerifyAWSLoadBalancerResources(ctx context.Context, f *framework.Framework,
Expect(err).NotTo(HaveOccurred())
err = VerifyLoadBalancerType(ctx, f, lb, expected.Type, expected.Scheme)
Expect(err).NotTo(HaveOccurred())
err = VerifyLoadBalancerSecurityGroups(lb, expected.NumSecurityGroups)
Expect(err).NotTo(HaveOccurred())
err = VerifyLoadBalancerListeners(ctx, f, lbARN, expected.Listeners)
Expect(err).NotTo(HaveOccurred())
err = VerifyLoadBalancerTargetGroups(ctx, f, lbARN, expected)
Expand All @@ -99,6 +102,13 @@ func VerifyLoadBalancerType(_ context.Context, f *framework.Framework, lb *elbv2
return nil
}

func VerifyLoadBalancerSecurityGroups(lb *elbv2types.LoadBalancer, numExpectedSgs int) error {
Copy link
Copy Markdown
Collaborator

@shuqz shuqz Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

other than SG number, is there anything else worth verifying?

if numExpectedSgs > 0 {
Expect(lb.SecurityGroups).To(HaveLen(numExpectedSgs))
}
return nil
}

func VerifyLoadBalancerAttributes(ctx context.Context, f *framework.Framework, lbARN string, expectedAttrs map[string]string) error {
lbAttrs, err := f.LBManager.GetLoadBalancerAttributes(ctx, lbARN)
Expect(err).NotTo(HaveOccurred())
Expand Down