Skip to content

Commit

Permalink
Add support for tproxy for partitions test
Browse files Browse the repository at this point in the history
  • Loading branch information
Ashwin Venkatesh committed Dec 6, 2021
1 parent 436a570 commit d743c67
Show file tree
Hide file tree
Showing 2 changed files with 73 additions and 33 deletions.
2 changes: 1 addition & 1 deletion acceptance/tests/controller/controller_namespaces_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ func TestControllerNamespaces(t *testing.T) {
ctx := suite.Environment().DefaultContext(t)

helmValues := map[string]string{
"global.image": "hashicorp/consul-enterprise:1.11.0-ent-beta3",
"global.image": "ashwinvenkatesh/consul@sha256:c1299cdc9b22e1eb3288b7a00cea96f305415ca8b6c72ee073b8366aa7bdf6ff",

"global.enableConsulNamespaces": "true",
"global.adminPartitions.enabled": "true",
Expand Down
104 changes: 72 additions & 32 deletions acceptance/tests/partitions/partitions_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -36,10 +36,6 @@ func TestPartitions(t *testing.T) {
t.Skipf("skipping this test because Admin Partition tests are only supported in Kind for now")
}

if cfg.EnableTransparentProxy {
t.Skipf("skipping this test because -enable-transparent-proxy is true")
}

const defaultPartition = "default"
const secondaryPartition = "secondary"
const defaultNamespace = "default"
Expand Down Expand Up @@ -96,7 +92,7 @@ func TestPartitions(t *testing.T) {

serverHelmValues := map[string]string{
"global.datacenter": "dc1",
"global.image": "hashicorp/consul-enterprise:1.11.0-ent-beta3",
"global.image": "ashwinvenkatesh/consul@sha256:c1299cdc9b22e1eb3288b7a00cea96f305415ca8b6c72ee073b8366aa7bdf6ff",

"global.adminPartitions.enabled": "true",
"global.enableConsulNamespaces": "true",
Expand All @@ -110,7 +106,6 @@ func TestPartitions(t *testing.T) {
// When mirroringK8S is set, this setting is ignored.
"connectInject.consulNamespaces.consulDestinationNamespace": c.destinationNamespace,
"connectInject.consulNamespaces.mirroringK8S": strconv.FormatBool(c.mirrorK8S),
"connectInject.transparentProxy.defaultEnabled": "false",

"global.acls.manageSystemACLs": strconv.FormatBool(c.secure),

Expand Down Expand Up @@ -192,7 +187,7 @@ func TestPartitions(t *testing.T) {
// Create client cluster.
clientHelmValues := map[string]string{
"global.datacenter": "dc1",
"global.image": "hashicorp/consul-enterprise:1.11.0-ent-beta3",
"global.image": "ashwinvenkatesh/consul@sha256:c1299cdc9b22e1eb3288b7a00cea96f305415ca8b6c72ee073b8366aa7bdf6ff",
"global.enabled": "false",

"global.tls.enabled": "true",
Expand All @@ -205,7 +200,6 @@ func TestPartitions(t *testing.T) {
// When mirroringK8S is set, this setting is ignored.
"connectInject.consulNamespaces.consulDestinationNamespace": c.destinationNamespace,
"connectInject.consulNamespaces.mirroringK8S": strconv.FormatBool(c.mirrorK8S),
"connectInject.transparentProxy.defaultEnabled": "false",

"global.acls.manageSystemACLs": strconv.FormatBool(c.secure),

Expand Down Expand Up @@ -364,17 +358,25 @@ func TestPartitions(t *testing.T) {
logger.Log(t, "test in-partition networking")
logger.Log(t, "creating static-server and static-client deployments in server cluster")
k8s.DeployKustomize(t, serverClusterStaticServerOpts, cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-server-inject")
if c.destinationNamespace == defaultNamespace {
k8s.DeployKustomize(t, serverClusterStaticClientOpts, cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-client-inject")
if cfg.EnableTransparentProxy {
k8s.DeployKustomize(t, serverClusterStaticClientOpts, cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-client-tproxy")
} else {
k8s.DeployKustomize(t, serverClusterStaticClientOpts, cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-client-namespaces")
if c.destinationNamespace == defaultNamespace {
k8s.DeployKustomize(t, serverClusterStaticClientOpts, cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-client-inject")
} else {
k8s.DeployKustomize(t, serverClusterStaticClientOpts, cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-client-namespaces")
}
}
logger.Log(t, "creating static-server and static-client deployments in client cluster")
k8s.DeployKustomize(t, clientClusterStaticServerOpts, cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-server-inject")
if c.destinationNamespace == defaultNamespace {
k8s.DeployKustomize(t, clientClusterStaticClientOpts, cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-client-inject")
if cfg.EnableTransparentProxy {
k8s.DeployKustomize(t, clientClusterStaticClientOpts, cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-client-tproxy")
} else {
k8s.DeployKustomize(t, clientClusterStaticClientOpts, cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-client-namespaces")
if c.destinationNamespace == defaultNamespace {
k8s.DeployKustomize(t, clientClusterStaticClientOpts, cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-client-inject")
} else {
k8s.DeployKustomize(t, clientClusterStaticClientOpts, cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-client-namespaces")
}
}
// Check that both static-server and static-client have been injected and now have 2 containers in server cluster.
for _, labelSelector := range []string{"app=static-server", "app=static-client"} {
Expand Down Expand Up @@ -422,8 +424,13 @@ func TestPartitions(t *testing.T) {

if c.secure {
logger.Log(t, "checking that the connection is not successful because there's no intention")
k8s.CheckStaticServerConnectionFailing(t, serverClusterStaticClientOpts, "http://localhost:1234")
k8s.CheckStaticServerConnectionFailing(t, clientClusterStaticClientOpts, "http://localhost:1234")
if cfg.EnableTransparentProxy {
k8s.CheckStaticServerConnectionFailing(t, serverClusterStaticClientOpts, fmt.Sprintf("http://static-server.%s", staticServerNamespace))
k8s.CheckStaticServerConnectionFailing(t, clientClusterStaticClientOpts, fmt.Sprintf("http://static-server.%s", staticServerNamespace))
} else {
k8s.CheckStaticServerConnectionFailing(t, serverClusterStaticClientOpts, "http://localhost:1234")
k8s.CheckStaticServerConnectionFailing(t, clientClusterStaticClientOpts, "http://localhost:1234")
}

intention := &api.ServiceIntentionsConfigEntry{
Kind: api.ServiceIntentions,
Expand Down Expand Up @@ -453,8 +460,13 @@ func TestPartitions(t *testing.T) {
}

logger.Log(t, "checking that connection is successful")
k8s.CheckStaticServerConnectionSuccessful(t, serverClusterStaticClientOpts, "http://localhost:1234")
k8s.CheckStaticServerConnectionSuccessful(t, clientClusterStaticClientOpts, "http://localhost:1234")
if cfg.EnableTransparentProxy {
k8s.CheckStaticServerConnectionSuccessful(t, serverClusterStaticClientOpts, fmt.Sprintf("http://static-server.%s", staticServerNamespace))
k8s.CheckStaticServerConnectionSuccessful(t, clientClusterStaticClientOpts, fmt.Sprintf("http://static-server.%s", staticServerNamespace))
} else {
k8s.CheckStaticServerConnectionSuccessful(t, serverClusterStaticClientOpts, "http://localhost:1234")
k8s.CheckStaticServerConnectionSuccessful(t, clientClusterStaticClientOpts, "http://localhost:1234")
}

// Test that kubernetes readiness status is synced to Consul.
// Create the file so that the readiness probe of the static-server pod fails.
Expand All @@ -468,25 +480,38 @@ func TestPartitions(t *testing.T) {
// there will be no healthy proxy host to connect to. That's why we can't assert that we receive an empty reply
// from server, which is the case when a connection is unsuccessful due to intentions in other tests.
logger.Log(t, "checking that connection is unsuccessful")
k8s.CheckStaticServerConnectionMultipleFailureMessages(t, serverClusterStaticClientOpts, false, []string{"curl: (56) Recv failure: Connection reset by peer", "curl: (52) Empty reply from server"}, "http://localhost:1234")
k8s.CheckStaticServerConnectionMultipleFailureMessages(t, clientClusterStaticClientOpts, false, []string{"curl: (56) Recv failure: Connection reset by peer", "curl: (52) Empty reply from server"}, "http://localhost:1234")
if cfg.EnableTransparentProxy {
k8s.CheckStaticServerConnectionMultipleFailureMessages(t, serverClusterStaticClientOpts, false, []string{"curl: (56) Recv failure: Connection reset by peer", "curl: (52) Empty reply from server", "curl: (7) Failed to connect to static-server.ns1 port 80: Connection refused"}, fmt.Sprintf("http://static-server.%s", staticServerNamespace))
k8s.CheckStaticServerConnectionMultipleFailureMessages(t, clientClusterStaticClientOpts, false, []string{"curl: (56) Recv failure: Connection reset by peer", "curl: (52) Empty reply from server", "curl: (7) Failed to connect to static-server.ns1 port 80: Connection refused"}, fmt.Sprintf("http://static-server.%s", staticServerNamespace))
} else {
k8s.CheckStaticServerConnectionMultipleFailureMessages(t, serverClusterStaticClientOpts, false, []string{"curl: (56) Recv failure: Connection reset by peer", "curl: (52) Empty reply from server"}, "http://localhost:1234")
k8s.CheckStaticServerConnectionMultipleFailureMessages(t, clientClusterStaticClientOpts, false, []string{"curl: (56) Recv failure: Connection reset by peer", "curl: (52) Empty reply from server"}, "http://localhost:1234")
}
})
// This section of the tests run the cross-partition networking tests.
t.Run("cross-partition", func(t *testing.T) {
logger.Log(t, "test cross-partition networking")
logger.Log(t, "creating static-server and static-client deployments in server cluster")
k8s.DeployKustomize(t, serverClusterStaticServerOpts, cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-server-inject")
if c.destinationNamespace == defaultNamespace {
k8s.DeployKustomize(t, serverClusterStaticClientOpts, cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-client-partitions/default-ns-partition")
if cfg.EnableTransparentProxy {
k8s.DeployKustomize(t, serverClusterStaticClientOpts, cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-client-tproxy")
} else {
k8s.DeployKustomize(t, serverClusterStaticClientOpts, cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-client-partitions/ns-partition")
if c.destinationNamespace == defaultNamespace {
k8s.DeployKustomize(t, serverClusterStaticClientOpts, cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-client-partitions/default-ns-partition")
} else {
k8s.DeployKustomize(t, serverClusterStaticClientOpts, cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-client-partitions/ns-partition")
}
}
logger.Log(t, "creating static-server and static-client deployments in client cluster")
k8s.DeployKustomize(t, clientClusterStaticServerOpts, cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-server-inject")
if c.destinationNamespace == defaultNamespace {
k8s.DeployKustomize(t, clientClusterStaticClientOpts, cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-client-partitions/default-ns-default-partition")
if cfg.EnableTransparentProxy {
k8s.DeployKustomize(t, clientClusterStaticClientOpts, cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-client-tproxy")
} else {
k8s.DeployKustomize(t, clientClusterStaticClientOpts, cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-client-partitions/ns-default-partition")
if c.destinationNamespace == defaultNamespace {
k8s.DeployKustomize(t, clientClusterStaticClientOpts, cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-client-partitions/default-ns-default-partition")
} else {
k8s.DeployKustomize(t, clientClusterStaticClientOpts, cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-client-partitions/ns-default-partition")
}
}
// Check that both static-server and static-client have been injected and now have 2 containers in server cluster.
for _, labelSelector := range []string{"app=static-server", "app=static-client"} {
Expand Down Expand Up @@ -554,8 +579,13 @@ func TestPartitions(t *testing.T) {

if c.secure {
logger.Log(t, "checking that the connection is not successful because there's no intention")
k8s.CheckStaticServerConnectionFailing(t, serverClusterStaticClientOpts, "http://localhost:1234")
k8s.CheckStaticServerConnectionFailing(t, clientClusterStaticClientOpts, "http://localhost:1234")
if cfg.EnableTransparentProxy {
k8s.CheckStaticServerConnectionFailing(t, serverClusterStaticClientOpts, fmt.Sprintf("http://static-server.virtual.%s.ns.%s.ap.dc1.dc.consul", staticServerNamespace, secondaryPartition))
k8s.CheckStaticServerConnectionFailing(t, clientClusterStaticClientOpts, fmt.Sprintf("http://static-server.virtual.%s.ns.%s.ap.dc1.dc.consul", staticServerNamespace, defaultPartition))
} else {
k8s.CheckStaticServerConnectionFailing(t, serverClusterStaticClientOpts, "http://localhost:1234")
k8s.CheckStaticServerConnectionFailing(t, clientClusterStaticClientOpts, "http://localhost:1234")
}

intention := &api.ServiceIntentionsConfigEntry{
Name: staticServerName,
Expand Down Expand Up @@ -587,8 +617,13 @@ func TestPartitions(t *testing.T) {
}

logger.Log(t, "checking that connection is successful")
k8s.CheckStaticServerConnectionSuccessful(t, serverClusterStaticClientOpts, "http://localhost:1234")
k8s.CheckStaticServerConnectionSuccessful(t, clientClusterStaticClientOpts, "http://localhost:1234")
if cfg.EnableTransparentProxy {
k8s.CheckStaticServerConnectionSuccessful(t, serverClusterStaticClientOpts, fmt.Sprintf("http://static-server.virtual.%s.ns.%s.ap.dc1.dc.consul", staticServerNamespace, secondaryPartition))
k8s.CheckStaticServerConnectionSuccessful(t, clientClusterStaticClientOpts, fmt.Sprintf("http://static-server.virtual.%s.ns.%s.ap.dc1.dc.consul", staticServerNamespace, defaultPartition))
} else {
k8s.CheckStaticServerConnectionSuccessful(t, serverClusterStaticClientOpts, "http://localhost:1234")
k8s.CheckStaticServerConnectionSuccessful(t, clientClusterStaticClientOpts, "http://localhost:1234")
}

// Test that kubernetes readiness status is synced to Consul.
// Create the file so that the readiness probe of the static-server pod fails.
Expand All @@ -602,8 +637,13 @@ func TestPartitions(t *testing.T) {
// there will be no healthy proxy host to connect to. That's why we can't assert that we receive an empty reply
// from server, which is the case when a connection is unsuccessful due to intentions in other tests.
logger.Log(t, "checking that connection is unsuccessful")
k8s.CheckStaticServerConnectionMultipleFailureMessages(t, serverClusterStaticClientOpts, false, []string{"curl: (56) Recv failure: Connection reset by peer", "curl: (52) Empty reply from server"}, "http://localhost:1234")
k8s.CheckStaticServerConnectionMultipleFailureMessages(t, clientClusterStaticClientOpts, false, []string{"curl: (56) Recv failure: Connection reset by peer", "curl: (52) Empty reply from server"}, "http://localhost:1234")
if cfg.EnableTransparentProxy {
k8s.CheckStaticServerConnectionMultipleFailureMessages(t, serverClusterStaticClientOpts, false, []string{"curl: (56) Recv failure: Connection reset by peer", "curl: (52) Empty reply from server", "curl: (7) Failed to connect to static-server.ns1 port 80: Connection refused"}, fmt.Sprintf("http://static-server.vitual.%s.ns.%s.ap.dc1.dc.consul", staticServerNamespace, secondaryPartition))
k8s.CheckStaticServerConnectionMultipleFailureMessages(t, clientClusterStaticClientOpts, false, []string{"curl: (56) Recv failure: Connection reset by peer", "curl: (52) Empty reply from server", "curl: (7) Failed to connect to static-server.ns1 port 80: Connection refused"}, fmt.Sprintf("http://static-server.vitual.%s.ns.%s.ap.dc1.dc.consul", staticServerNamespace, defaultPartition))
} else {
k8s.CheckStaticServerConnectionMultipleFailureMessages(t, serverClusterStaticClientOpts, false, []string{"curl: (56) Recv failure: Connection reset by peer", "curl: (52) Empty reply from server"}, "http://localhost:1234")
k8s.CheckStaticServerConnectionMultipleFailureMessages(t, clientClusterStaticClientOpts, false, []string{"curl: (56) Recv failure: Connection reset by peer", "curl: (52) Empty reply from server"}, "http://localhost:1234")
}
})
})
}
Expand Down

0 comments on commit d743c67

Please sign in to comment.