Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Register mesh-gateways using the endpoints controller. #1464

Merged
merged 7 commits into from
Sep 21, 2022
Merged

Register mesh-gateways using the endpoints controller. #1464

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
cc083ff
Initial support for agentless (#1267)
ishustava Jun 24, 2022
b77cd7a
Enable connect-injector to talk to external servers. (#1323)
ishustava Jul 7, 2022
0a0053b
Enable CRD controller to talk to Consul servers (#1326)
ishustava Jul 7, 2022
b27925c
agentless: initial integration with consul-dataplane (#1470)
ishustava Sep 6, 2022
8784c23
Register mesh-gateways using the endpoints controller.
thisisnotashwin Aug 30, 2022
26f0877
Replace ioutil.ReadFile with os.ReadFile
thisisnotashwin Sep 20, 2022
c8e54f1
Review feedback from Iryna
thisisnotashwin Sep 20, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .circleci/config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,6 +110,7 @@ commands:
do
if ! gotestsum --no-summary=all --jsonfile=jsonfile-${pkg////-} -- $pkg -p 1 -timeout 2h -failfast \
<< parameters.additional-flags >> \
-enable-multi-cluster \
${ENABLE_ENTERPRISE:+-enable-enterprise} \
-debug-directory="$TEST_RESULTS/debug" \
-consul-image=hashicorppreview/consul-enterprise:1.14-dev \
Expand Down
21 changes: 7 additions & 14 deletions acceptance/tests/mesh-gateway/mesh_gateway_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ func TestMeshGatewayDefault(t *testing.T) {

primaryHelmValues := map[string]string{
"global.datacenter": "dc1",
"global.image": "thisisnotashwin/consul@sha256:477091fe84cde79a68a37cc9cc69fb7a5ab35e647a0f5f2632451ace5ecc5e7c",
thisisnotashwin marked this conversation as resolved.
Show resolved Hide resolved
"global.tls.enabled": "true",
"global.tls.httpsOnly": "false",
"global.federation.enabled": "true",
Expand Down Expand Up @@ -63,8 +64,8 @@ func TestMeshGatewayDefault(t *testing.T) {

// Create secondary cluster
secondaryHelmValues := map[string]string{
"global.datacenter": "dc2",

"global.datacenter": "dc2",
"global.image": "thisisnotashwin/consul@sha256:477091fe84cde79a68a37cc9cc69fb7a5ab35e647a0f5f2632451ace5ecc5e7c",
thisisnotashwin marked this conversation as resolved.
Show resolved Hide resolved
"global.tls.enabled": "true",
"global.tls.httpsOnly": "false",
"global.tls.caCert.secretName": federationSecretName,
Expand Down Expand Up @@ -135,16 +136,10 @@ func TestMeshGatewayDefault(t *testing.T) {
// with ACLs and TLS with and without auto-encrypt enabled.
func TestMeshGatewaySecure(t *testing.T) {
cases := []struct {
name string
enableAutoEncrypt string
name string
}{
{
"with ACLs and TLS without auto-encrypt",
"false",
},
{
"with ACLs and auto-encrypt",
"true",
"with ACLs and TLS",
thisisnotashwin marked this conversation as resolved.
Show resolved Hide resolved
},
}

Expand All @@ -157,9 +152,8 @@ func TestMeshGatewaySecure(t *testing.T) {
secondaryContext := env.Context(t, environment.SecondaryContextName)

primaryHelmValues := map[string]string{
"global.datacenter": "dc1",
"global.tls.enabled": "true",
"global.tls.enableAutoEncrypt": c.enableAutoEncrypt,
"global.datacenter": "dc1",
"global.tls.enabled": "true",

"global.acls.manageSystemACLs": "true",
"global.acls.createReplicationToken": "true",
Expand Down Expand Up @@ -214,7 +208,6 @@ func TestMeshGatewaySecure(t *testing.T) {

"global.tls.enabled": "true",
"global.tls.httpsOnly": "false",
"global.tls.enableAutoEncrypt": c.enableAutoEncrypt,
"global.tls.caCert.secretName": federationSecretName,
"global.tls.caCert.secretKey": "caCert",
"global.tls.caKey.secretName": federationSecretName,
Expand Down
41 changes: 22 additions & 19 deletions acceptance/tests/partitions/partitions_connect_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ const staticServerName = "static-server"
const staticServerNamespace = "ns1"
const StaticClientNamespace = "ns2"

// Test that Connect works in a default and ACLsAndAutoEncryptEnabled installations for X-Partition and in-partition networking.
// Test that Connect works in a default and ACLsEnabled installations for X-Partition and in-partition networking.
func TestPartitions_Connect(t *testing.T) {
env := suite.Environment()
cfg := suite.Config()
Expand All @@ -32,14 +32,18 @@ func TestPartitions_Connect(t *testing.T) {
t.Skipf("skipping this test because -enable-enterprise is not set")
}

if cfg.EnableTransparentProxy {
t.Skipf("skipping because no t-proxy support")
}

const defaultPartition = "default"
const secondaryPartition = "secondary"
const defaultNamespace = "default"
cases := []struct {
name string
destinationNamespace string
mirrorK8S bool
ACLsAndAutoEncryptEnabled bool
name string
destinationNamespace string
mirrorK8S bool
ACLsEnabled bool
}{
{
"default destination namespace",
Expand Down Expand Up @@ -88,14 +92,13 @@ func TestPartitions_Connect(t *testing.T) {

commonHelmValues := map[string]string{
"global.adminPartitions.enabled": "true",
"global.image": "thisisnotashwin/consul@sha256:477091fe84cde79a68a37cc9cc69fb7a5ab35e647a0f5f2632451ace5ecc5e7c",
"global.enableConsulNamespaces": "true",

"global.enableConsulNamespaces": "true",

"global.tls.enabled": "true",
"global.tls.httpsOnly": strconv.FormatBool(c.ACLsAndAutoEncryptEnabled),
"global.tls.enableAutoEncrypt": strconv.FormatBool(c.ACLsAndAutoEncryptEnabled),
"global.tls.enabled": "true",
"global.tls.httpsOnly": strconv.FormatBool(c.ACLsEnabled),

"global.acls.manageSystemACLs": strconv.FormatBool(c.ACLsAndAutoEncryptEnabled),
"global.acls.manageSystemACLs": strconv.FormatBool(c.ACLsEnabled),

"connectInject.enabled": "true",
// When mirroringK8S is set, this setting is ignored.
Expand Down Expand Up @@ -141,15 +144,15 @@ func TestPartitions_Connect(t *testing.T) {
logger.Logf(t, "retrieving ca cert secret %s from the server cluster and applying to the client cluster", caCertSecretName)
k8s.CopySecret(t, serverClusterContext, clientClusterContext, caCertSecretName)

if !c.ACLsAndAutoEncryptEnabled {
if !c.ACLsEnabled {
// When auto-encrypt is disabled, we need both
// the CA cert and CA key to be available in the clients cluster to generate client certificates and keys.
logger.Logf(t, "retrieving ca key secret %s from the server cluster and applying to the client cluster", caKeySecretName)
k8s.CopySecret(t, serverClusterContext, clientClusterContext, caKeySecretName)
}

partitionToken := fmt.Sprintf("%s-consul-partitions-acl-token", releaseName)
if c.ACLsAndAutoEncryptEnabled {
if c.ACLsEnabled {
logger.Logf(t, "retrieving partition token secret %s from the server cluster and applying to the client cluster", partitionToken)
k8s.CopySecret(t, serverClusterContext, clientClusterContext, partitionToken)
}
Expand Down Expand Up @@ -177,7 +180,7 @@ func TestPartitions_Connect(t *testing.T) {
"client.join[0]": partitionSvcAddress,
}

if c.ACLsAndAutoEncryptEnabled {
if c.ACLsEnabled {
// Setup partition token and auth method host if ACLs enabled.
clientHelmValues["global.acls.bootstrapToken.secretName"] = partitionToken
clientHelmValues["global.acls.bootstrapToken.secretKey"] = "token"
Expand Down Expand Up @@ -244,7 +247,7 @@ func TestPartitions_Connect(t *testing.T) {
k8s.RunKubectl(t, clientClusterContext.KubectlOptions(t), "delete", "ns", staticServerNamespace, StaticClientNamespace)
})

consulClient, _ := serverConsulCluster.SetupConsulClient(t, c.ACLsAndAutoEncryptEnabled)
consulClient, _ := serverConsulCluster.SetupConsulClient(t, c.ACLsEnabled)

serverQueryServerOpts := &api.QueryOptions{Namespace: staticServerNamespace, Partition: defaultPartition}
clientQueryServerOpts := &api.QueryOptions{Namespace: StaticClientNamespace, Partition: defaultPartition}
Expand All @@ -260,12 +263,12 @@ func TestPartitions_Connect(t *testing.T) {
}

// Check that the ACL token is deleted.
if c.ACLsAndAutoEncryptEnabled {
if c.ACLsEnabled {
// We need to register the cleanup function before we create the deployments
// because golang will execute them in reverse order i.e. the last registered
// cleanup function will be executed first.
t.Cleanup(func() {
if c.ACLsAndAutoEncryptEnabled {
if c.ACLsEnabled {
retry.Run(t, func(r *retry.R) {
tokens, _, err := consulClient.ACL().TokenList(serverQueryServerOpts)
require.NoError(r, err)
Expand Down Expand Up @@ -377,7 +380,7 @@ func TestPartitions_Connect(t *testing.T) {
require.NoError(t, err)
require.Len(t, services, 1)

if c.ACLsAndAutoEncryptEnabled {
if c.ACLsEnabled {
logger.Log(t, "checking that the connection is not successful because there's no intention")
if cfg.EnableTransparentProxy {
k8s.CheckStaticServerConnectionFailing(t, serverClusterStaticClientOpts, StaticClientName, fmt.Sprintf("http://static-server.%s", staticServerNamespace))
Expand Down Expand Up @@ -538,7 +541,7 @@ func TestPartitions_Connect(t *testing.T) {
})
}

if c.ACLsAndAutoEncryptEnabled {
if c.ACLsEnabled {
logger.Log(t, "checking that the connection is not successful because there's no intention")
if cfg.EnableTransparentProxy {
if !c.mirrorK8S {
Expand Down
33 changes: 16 additions & 17 deletions acceptance/tests/partitions/partitions_sync_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)

// Test that Sync Catalog works in a default and ACLsAndAutoEncryptEnabled installations for partitions.
// Test that Sync Catalog works in a default and ACLsEnabled installations for partitions.
func TestPartitions_Sync(t *testing.T) {
ishustava marked this conversation as resolved.
Show resolved Hide resolved
env := suite.Environment()
cfg := suite.Config()
Expand All @@ -35,10 +35,10 @@ func TestPartitions_Sync(t *testing.T) {
const secondaryPartition = "secondary"
const defaultNamespace = "default"
cases := []struct {
name string
destinationNamespace string
mirrorK8S bool
ACLsAndAutoEncryptEnabled bool
name string
destinationNamespace string
mirrorK8S bool
ACLsEnabled bool
}{
{
"default destination namespace",
Expand Down Expand Up @@ -87,14 +87,13 @@ func TestPartitions_Sync(t *testing.T) {

commonHelmValues := map[string]string{
"global.adminPartitions.enabled": "true",
"global.image": "thisisnotashwin/consul@sha256:477091fe84cde79a68a37cc9cc69fb7a5ab35e647a0f5f2632451ace5ecc5e7c",
"global.enableConsulNamespaces": "true",

"global.enableConsulNamespaces": "true",
"global.tls.enabled": "true",
"global.tls.httpsOnly": strconv.FormatBool(c.ACLsEnabled),

"global.tls.enabled": "true",
"global.tls.httpsOnly": strconv.FormatBool(c.ACLsAndAutoEncryptEnabled),
"global.tls.enableAutoEncrypt": strconv.FormatBool(c.ACLsAndAutoEncryptEnabled),

"global.acls.manageSystemACLs": strconv.FormatBool(c.ACLsAndAutoEncryptEnabled),
"global.acls.manageSystemACLs": strconv.FormatBool(c.ACLsEnabled),

"syncCatalog.enabled": "true",
// When mirroringK8S is set, this setting is ignored.
Expand Down Expand Up @@ -133,15 +132,15 @@ func TestPartitions_Sync(t *testing.T) {
logger.Logf(t, "retrieving ca cert secret %s from the server cluster and applying to the client cluster", caCertSecretName)
k8s.CopySecret(t, primaryClusterContext, secondaryClusterContext, caCertSecretName)

if !c.ACLsAndAutoEncryptEnabled {
if !c.ACLsEnabled {
// When auto-encrypt is disabled, we need both
// the CA cert and CA key to be available in the clients cluster to generate client certificates and keys.
logger.Logf(t, "retrieving ca key secret %s from the server cluster and applying to the client cluster", caKeySecretName)
k8s.CopySecret(t, primaryClusterContext, secondaryClusterContext, caKeySecretName)
}

partitionToken := fmt.Sprintf("%s-consul-partitions-acl-token", releaseName)
if c.ACLsAndAutoEncryptEnabled {
if c.ACLsEnabled {
logger.Logf(t, "retrieving partition token secret %s from the server cluster and applying to the client cluster", partitionToken)
k8s.CopySecret(t, primaryClusterContext, secondaryClusterContext, partitionToken)
}
Expand Down Expand Up @@ -169,7 +168,7 @@ func TestPartitions_Sync(t *testing.T) {
"client.join[0]": partitionSvcAddress,
}

if c.ACLsAndAutoEncryptEnabled {
if c.ACLsEnabled {
// Setup partition token and auth method host if ACLs enabled.
clientHelmValues["global.acls.bootstrapToken.secretName"] = partitionToken
clientHelmValues["global.acls.bootstrapToken.secretKey"] = "token"
Expand Down Expand Up @@ -222,7 +221,7 @@ func TestPartitions_Sync(t *testing.T) {
k8s.RunKubectl(t, secondaryClusterContext.KubectlOptions(t), "delete", "ns", staticServerNamespace)
})

consulClient, _ := primaryConsulCluster.SetupConsulClient(t, c.ACLsAndAutoEncryptEnabled)
consulClient, _ := primaryConsulCluster.SetupConsulClient(t, c.ACLsEnabled)

defaultPartitionQueryOpts := &api.QueryOptions{Namespace: staticServerNamespace, Partition: defaultPartition}
secondaryPartitionQueryOpts := &api.QueryOptions{Namespace: staticServerNamespace, Partition: secondaryPartition}
Expand All @@ -233,12 +232,12 @@ func TestPartitions_Sync(t *testing.T) {
}

// Check that the ACL token is deleted.
if c.ACLsAndAutoEncryptEnabled {
if c.ACLsEnabled {
// We need to register the cleanup function before we create the deployments
// because golang will execute them in reverse order i.e. the last registered
// cleanup function will be executed first.
t.Cleanup(func() {
if c.ACLsAndAutoEncryptEnabled {
if c.ACLsEnabled {
retry.Run(t, func(r *retry.R) {
tokens, _, err := consulClient.ACL().TokenList(defaultPartitionQueryOpts)
require.NoError(r, err)
Expand Down
27 changes: 15 additions & 12 deletions acceptance/tests/peering/peering_connect_namespaces_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,10 @@ func TestPeering_ConnectNamespaces(t *testing.T) {
t.Skipf("skipping this test because -enable-enterprise is not set")
}

if cfg.EnableTransparentProxy {
t.Skipf("skipping because no t-proxy support")
}

ver, err := version.NewVersion("1.13.0")
require.NoError(t, err)
if cfg.ConsulVersion != nil && cfg.ConsulVersion.LessThan(ver) {
Expand All @@ -44,10 +48,10 @@ func TestPeering_ConnectNamespaces(t *testing.T) {
const staticClientPeer = "client"
const defaultNamespace = "default"
cases := []struct {
name string
destinationNamespace string
mirrorK8S bool
ACLsAndAutoEncryptEnabled bool
name string
destinationNamespace string
mirrorK8S bool
ACLsEnabled bool
}{
{
"default destination namespace",
Expand Down Expand Up @@ -95,12 +99,11 @@ func TestPeering_ConnectNamespaces(t *testing.T) {
commonHelmValues := map[string]string{
"global.peering.enabled": "true",
"global.enableConsulNamespaces": "true",
"global.image": "thisisnotashwin/consul@sha256:477091fe84cde79a68a37cc9cc69fb7a5ab35e647a0f5f2632451ace5ecc5e7c",
"global.tls.enabled": "true",
"global.tls.httpsOnly": strconv.FormatBool(c.ACLsEnabled),

"global.tls.enabled": "true",
"global.tls.httpsOnly": strconv.FormatBool(c.ACLsAndAutoEncryptEnabled),
"global.tls.enableAutoEncrypt": strconv.FormatBool(c.ACLsAndAutoEncryptEnabled),

"global.acls.manageSystemACLs": strconv.FormatBool(c.ACLsAndAutoEncryptEnabled),
"global.acls.manageSystemACLs": strconv.FormatBool(c.ACLsEnabled),

"connectInject.enabled": "true",

Expand Down Expand Up @@ -213,8 +216,8 @@ func TestPeering_ConnectNamespaces(t *testing.T) {
k8s.RunKubectl(t, staticClientPeerClusterContext.KubectlOptions(t), "delete", "ns", staticClientNamespace)
})

staticServerPeerClient, _ := staticServerPeerCluster.SetupConsulClient(t, c.ACLsAndAutoEncryptEnabled)
staticClientPeerClient, _ := staticClientPeerCluster.SetupConsulClient(t, c.ACLsAndAutoEncryptEnabled)
staticServerPeerClient, _ := staticServerPeerCluster.SetupConsulClient(t, c.ACLsEnabled)
staticClientPeerClient, _ := staticClientPeerCluster.SetupConsulClient(t, c.ACLsEnabled)

serverQueryOpts := &api.QueryOptions{Namespace: staticServerNamespace}
clientQueryOpts := &api.QueryOptions{Namespace: staticClientNamespace}
Expand Down Expand Up @@ -296,7 +299,7 @@ func TestPeering_ConnectNamespaces(t *testing.T) {
})
}

if c.ACLsAndAutoEncryptEnabled {
if c.ACLsEnabled {
logger.Log(t, "checking that the connection is not successful because there's no allow intention")
if cfg.EnableTransparentProxy {
k8s.CheckStaticServerConnectionMultipleFailureMessages(t, staticClientOpts, staticClientName, false, []string{"curl: (56) Recv failure: Connection reset by peer", "curl: (52) Empty reply from server", fmt.Sprintf("curl: (7) Failed to connect to static-server.%s port 80: Connection refused", c.destinationNamespace)}, "", fmt.Sprintf("http://static-server.virtual.%s.%s.consul", c.destinationNamespace, staticServerPeer))
Expand Down
21 changes: 12 additions & 9 deletions acceptance/tests/peering/peering_connect_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,11 +31,15 @@ func TestPeering_Connect(t *testing.T) {
t.Skipf("skipping this test because peering is not supported in version %v", cfg.ConsulVersion.String())
}

if cfg.EnableTransparentProxy {
t.Skipf("skipping because no t-proxy support")
}

const staticServerPeer = "server"
const staticClientPeer = "client"
cases := []struct {
name string
ACLsAndAutoEncryptEnabled bool
name string
ACLsEnabled bool
}{
{
"default installation",
Expand All @@ -56,10 +60,9 @@ func TestPeering_Connect(t *testing.T) {
"global.peering.enabled": "true",

"global.tls.enabled": "true",
"global.tls.httpsOnly": strconv.FormatBool(c.ACLsAndAutoEncryptEnabled),
"global.tls.enableAutoEncrypt": strconv.FormatBool(c.ACLsAndAutoEncryptEnabled),

"global.acls.manageSystemACLs": strconv.FormatBool(c.ACLsAndAutoEncryptEnabled),
"global.tls.httpsOnly": strconv.FormatBool(c.ACLsEnabled),
"global.image": "thisisnotashwin/consul@sha256:477091fe84cde79a68a37cc9cc69fb7a5ab35e647a0f5f2632451ace5ecc5e7c",
"global.acls.manageSystemACLs": strconv.FormatBool(c.ACLsEnabled),

"connectInject.enabled": "true",

Expand Down Expand Up @@ -168,8 +171,8 @@ func TestPeering_Connect(t *testing.T) {
k8s.RunKubectl(t, staticClientPeerClusterContext.KubectlOptions(t), "delete", "ns", staticClientNamespace)
})

staticServerPeerClient, _ := staticServerPeerCluster.SetupConsulClient(t, c.ACLsAndAutoEncryptEnabled)
staticClientPeerClient, _ := staticClientPeerCluster.SetupConsulClient(t, c.ACLsAndAutoEncryptEnabled)
staticServerPeerClient, _ := staticServerPeerCluster.SetupConsulClient(t, c.ACLsEnabled)
staticClientPeerClient, _ := staticClientPeerCluster.SetupConsulClient(t, c.ACLsEnabled)

// Create a ProxyDefaults resource to configure services to use the mesh
// gateways.
Expand Down Expand Up @@ -227,7 +230,7 @@ func TestPeering_Connect(t *testing.T) {
k8s.KubectlDeleteK(t, staticServerPeerClusterContext.KubectlOptions(t), "../fixtures/cases/crd-peers/default")
})

if c.ACLsAndAutoEncryptEnabled {
if c.ACLsEnabled {
logger.Log(t, "checking that the connection is not successful because there's no allow intention")
if cfg.EnableTransparentProxy {
k8s.CheckStaticServerConnectionMultipleFailureMessages(t, staticClientOpts, staticClientName, false, []string{"curl: (56) Recv failure: Connection reset by peer", "curl: (52) Empty reply from server", "curl: (7) Failed to connect to static-server port 80: Connection refused"}, "", fmt.Sprintf("http://static-server.virtual.%s.consul", staticServerPeer))
Expand Down
Loading