Linkerd Conformance project

[Pothulapati]

Linkerd2-conformance is aimed at users to check if Linkerd runs on their cluster correctly. This is important as currently there are 1000 different of ways you can configure a Kubernetes cluster, across many distributions i.e OpenShift, K3s, etc across many cloud providers. And there are chances that there could be a mismatch between what Linkerd expects, and what your cluster configuration might have.

Linkerd2-Conformance aims to be a suite of tests that include comprehensive tests of all the major features provided in Linkerd i.e Service Profiles, Automatic Injection, Multi-Cluster, etc. Each Feature test not only applies that feature onto your cluster but also validates it, if the feature is correctly working or not. It also cleans up your cluster once the test suites complete. After that it provides a report for the users to check on what test suites worked and what did not.

It uses Sonobuoy as the underlying tool, and builds(a plugin) on top of it.

Once a cluster is conformed through this tool, The expectation is that users would not face any problems running that feature-set on the cluster.

There is a first pass of the tool available at linkerd/linkerd2-conformance#1, which shows the planned UX for users to run these tests.

This discussion thread hopes to be the place for users to interact regarding the tests needed, UX, etc.

cc: @mayankshah1607 @grampelberg

[naseemkullah]

Is this a superset of linkerd check, if not how do check and conformance differ (where is the line drawn between the two)?

[olix0r]

linkerd check checks the state of a cluster to ensure it's healthy. It's my hope that the conformance testing tooling let's us actively seek out problems (i.e., by modifying the cluster state). This can be useful as we determine whether Linkerd works correctly with new Kubernetes versions, cloud providers, configurations, etc.

[ihcsim]

The conformance test allows you to uncover issues related to k8s configuration specific to your clusters. For example, pod security policy, network policy, service account token automount settings, missing APIExtension trust cert, nodes taint/tolerance, (anti-)affinity settings etc. Think of it as an extended integration test that you can run to ensure Linkerd works with your workloads on a specific cluster (dev, staging, prod etc.).

[naseemkullah]

check is unit testing and conformance is the integration testing is a nice analogy from @grampelberg

[christianhuening]

This sounds super useful! We already use sonobuoy for our clusters and just finished a labcluster setup to test infra changes in the future. Having this as part of sonobuoy would be very handy!

[mayankshah1607]

That's really nice to hear! By any chance are you using Sonobuoy's plugin feature? Do let us know if there's anything in particular that you'd like to see in this project! 😄