ci(*) run Enterprise integration tests (#1900)

* ci(*) add Enterprise test target and job

* fix(kongclient) use ExistsByName workspace API

Use go-kong ExistsByName() API for retrieving workspaces. This allows
KIC to confirm a workspace's presence with a user that has access to
that workspace only. Previously, KIC could only retrieve workspaces
with an RBAC user that had access to the default workspace.

Co-authored-by: Jimin <jimin.hu@konghq.com>

.github/workflows/test.yaml

@@ -106,6 +106,40 @@ jobs:
         name: coverage.unit.out
         path: coverage.unit.out
 
+  integration-tests-enterprise-postgres:
+    environment: "Configure ci"
+    runs-on: ubuntu-latest
+    steps:
+
+    - name: setup golang
+      uses: actions/setup-go@v2
+      with:
+        go-version: '^1.17'
+
+    - name: cache go modules
+      uses: actions/cache@v2.1.6
+      with:
+        path: ~/go/pkg/mod
+        key: ${{ runner.os }}-build-codegen-${{ hashFiles('**/go.sum') }}
+        restore-keys: |
+          ${{ runner.os }}-build-codegen-
+
+    - name: checkout repository
+      uses: actions/checkout@v2
+      with:
+        fetch-depth: 0
+
+    - name: run integration tests
+      run: make test.integration.enterprise.postgres
+      env:
+        KONG_LICENSE_DATA: ${{ secrets.KONG_ENTERPRISE_LICENSE }}
+
+    - name: collect test coverage
+      uses: actions/upload-artifact@v2.2.4
+      with:
+        name: coverage.enterprisepostgres.out
+        path: coverage.enterprisepostgres.out
+
   integration-tests-dbless:
     runs-on: ubuntu-latest
     steps:
@@ -204,6 +238,7 @@ jobs:
       - "unit-tests"
       - "integration-tests-dbless"
       - "integration-tests-postgres"
+      - "integration-tests-enterprise-postgres"
     runs-on: ubuntu-latest
     steps:
       # TODO: deduplicate the download-artifact steps by implementing a `matrix` workflow step instead
@@ -228,11 +263,19 @@ jobs:
         name: coverage.postgres.out
         path: coverage.postgres.out
 
+    - name: collect enterprisepostgres test coverage artifacts
+      id: download-enterprisepostgres
+      uses: actions/download-artifact@v2.0.10
+      with:
+        name: coverage.enterprisepostgres.out
+        path: coverage.enterprisepostgres.out
+
     - name: Upload coverage to Codecov
       uses: codecov/codecov-action@v2.1.0
       with:
         name: combined-coverage
         token: ${{ secrets.CODECOV_TOKEN }}
-        files: ${{steps.download-unit.outputs.download-path}}/coverage.unit.out,${{steps.download-dbless.outputs.download-path}}/coverage.dbless.out,${{steps.download-postgres.outputs.download-path}}/coverage.postgres.out
+        files: ${{steps.download-unit.outputs.download-path}}/coverage.unit.out,${{steps.download-dbless.outputs.download-path}}/coverage.dbless.out,${{steps.download-postgres.outputs.download-path}}/coverage.postgres.out,
+               ${{steps.download-enterprisepostgres.outputs.download-path}}/coverage.enterprisepostgres.out
         fail_ci_if_error: true
         verbose: true

Makefile

@@ -177,7 +177,7 @@ KIND_CLUSTER_NAME ?= "integration-tests"
 test.all: test test.integration
 
 .PHONY: test.integration
-test.integration: test.integration.dbless test.integration.postgres
+test.integration: test.integration.enterprise.postgres  test.integration.dbless test.integration.postgres
 
 .PHONY: test
 test:
@@ -211,6 +211,18 @@ test.integration.postgres:
 		-coverprofile=coverage.postgres.out \
 		./test/integration
 
+# TODO: ditto above https://github.com/Kong/kubernetes-ingress-controller/issues/1324
+.PHONY: test.integration.enterprise.postgres
+test.integration.enterprise.postgres:
+	@./scripts/check-container-environment.sh
+	@TEST_DATABASE_MODE="postgres" TEST_KONG_ENTERPRISE="true" GOFLAGS="-tags=integration_tests" go test -v \
+		-timeout 15m \
+		-parallel $(NCPU) \
+		-covermode=atomic \
+		-coverpkg=$(PKG_LIST) \
+		-coverprofile=coverage.enterprisepostgres.out \
+		./test/integration
+
 .PHONY: test.integration.legacy
 test.integration.legacy: container
 	KIC_IMAGE="${IMAGE}:${TAG}" KUBE_VERSION=${KUBE_VERSION} ./hack/legacy/test/test.sh

internal/adminapi/client.go

@@ -89,7 +89,7 @@ func GetKongClientForWorkspace(ctx context.Context, adminURL string, wsName stri
 	}
 
 	// if a workspace was provided, verify whether or not it exists.
-	exists, err := client.Workspaces.Exists(ctx, kong.String(wsName))
+	exists, err := client.Workspaces.ExistsByName(ctx, kong.String(wsName))
 	if err != nil {
 		return nil, fmt.Errorf("looking up workspace: %w", err)
 	}

test/integration/suite_test.go

@@ -36,9 +36,23 @@ func TestMain(m *testing.M) {
 
 	fmt.Println("INFO: setting up test environment")
 	kongbuilder := kong.NewBuilder()
+	extraControllerArgs := []string{}
+	if kongEnterpriseEnabled == "true" {
+		licenseJSON := os.Getenv("KONG_LICENSE_DATA")
+		if licenseJSON == "" {
+			exitOnErr(fmt.Errorf(("KONG_LICENSE_DATA must be set for Enterprise tests")))
+		}
+		extraControllerArgs = append(extraControllerArgs, fmt.Sprintf("--kong-admin-token=%s", kongTestPassword))
+		extraControllerArgs = append(extraControllerArgs, "--kong-workspace=notdefault")
+		kongbuilder = kongbuilder.WithProxyEnterpriseEnabled(licenseJSON).
+			WithProxyEnterpriseSuperAdminPassword(kongTestPassword).
+			WithProxyAdminServiceTypeLoadBalancer()
+	}
+
 	if dbmode == "postgres" {
 		kongbuilder = kongbuilder.WithPostgreSQL()
 	}
+
 	kongbuilder.WithControllerDisabled()
 	kongAddon := kongbuilder.Build()
 	builder := environments.NewBuilder().WithAddons(kongAddon, knative.New())
@@ -124,7 +138,7 @@ func TestMain(m *testing.M) {
 			}
 		}
 		fmt.Println("INFO: starting the controller manager")
-		exitOnErr(testutils.DeployControllerManagerForCluster(ctx, env.Cluster(),
+		standardControllerArgs := []string{
 			fmt.Sprintf("--ingress-class=%s", ingressClass),
 			fmt.Sprintf("--admission-webhook-cert=%s", admissionWebhookCert),
 			fmt.Sprintf("--admission-webhook-key=%s", admissionWebhookKey),
@@ -134,7 +148,9 @@ func TestMain(m *testing.M) {
 			"--dump-config",
 			"--log-level=trace",
 			"--debug-log-reduce-redundancy",
-		))
+		}
+		allControllerArgs := append(standardControllerArgs, extraControllerArgs...)
+		exitOnErr(testutils.DeployControllerManagerForCluster(ctx, env.Cluster(), allControllerArgs...))
 	}
 
 	fmt.Println("INFO: running final testing environment checks")

test/integration/utils_test.go

@@ -114,6 +114,9 @@ var (
 	// to persist after the test for inspection. This has a nil effect when an existing cluster
 	// is provided, as cleanup is not performed for existing clusters.
 	keepTestCluster = os.Getenv("KONG_TEST_CLUSTER_PERSIST")
+
+	// kongEnterpriseEnabled enables Enterprise-specific tests when set to "true"
+	kongEnterpriseEnabled = os.Getenv("TEST_KONG_ENTERPRISE")
 )
 
 // -----------------------------------------------------------------------------
@@ -144,6 +147,10 @@ const (
 	// ExitCodeEnvSetupFailed is a generic exit code that can be used as a fallback for general
 	// problems setting up the testing environment and/or cluster.
 	ExitCodeEnvSetupFailed = 104
+
+	// kongTestPassword is used as a password only within the context of transient integration test runs
+	// and is left static to help developers debug failures in those testing environments.
+	kongTestPassword = "password"
 )
 
 // -----------------------------------------------------------------------------