Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Removing the gateway type suffix from the naming conventions for terminating and ingress gateways #1120

Merged
merged 17 commits into from
Mar 30, 2022
Merged

Removing the gateway type suffix from the naming conventions for terminating and ingress gateways #1120

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
0f8b079
Enable ACL Client Token (#1093)
jmurret Mar 15, 2022
255b174
Enable terminating gateway policy to be generated via Auth Method
jmurret Mar 17, 2022
1e1390d
Filtering out failing portion of test for terminating gateway work
jmurret Mar 17, 2022
83fd2a5
PR feedback.Fixing tests. Changing naming conventions for policy and…
jmurret Mar 17, 2022
b575c68
Correcting serviceAccount used on deployment
jmurret Mar 18, 2022
bf2aa53
Making all nameshavea-ingress-gateway
jmurret Mar 19, 2022
b5cad16
Enable ingress gateway policy to be generated via Auth Method
jmurret Mar 19, 2022
2cfbe01
Making all names have a -ingress-gateway suffix
jmurret Mar 19, 2022
f603539
Removing duplicate test
jmurret Mar 24, 2022
b5ae629
Update acceptance/tests/ingress-gateway/ingress_gateway_namespaces_te…
jmurret Mar 24, 2022
7d143fa
Removing the gateway type suffix from the naming conventions for term…
jmurret Mar 24, 2022
a3a2ca0
Adding check for duplicate terminating gateways and ingress gateway n…
jmurret Mar 25, 2022
e384982
Update charts/consul/templates/ingress-gateways-deployment.yaml
jmurret Mar 25, 2022
a7a26fe
PR Feedback - adding the duplicate name found to the check failures f…
jmurret Mar 28, 2022
d7887ea
Fixing rebase conflict
jmurret Mar 30, 2022
2afdec2
Merge Conflict- duplicate test
jmurret Mar 30, 2022
26c07ca
Adding a 10s sleep to flakey snapshot agent tests that were not findi…
jmurret Mar 30, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions acceptance/tests/ingress-gateway/ingress_gateway_namespaces_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,7 +121,7 @@ func TestIngressGatewaySingleNamespace(t *testing.T) {
require.NoError(t, err)
require.Equal(t, true, created, "config entry failed")

ingressGatewayService := fmt.Sprintf("http://%s-consul-%s-ingress-gateway.%s:8080/", releaseName, igName, ctx.KubectlOptions(t).Namespace)
ingressGatewayService := fmt.Sprintf("http://%s-consul-%s.%s:8080/", releaseName, igName, ctx.KubectlOptions(t).Namespace)

// If ACLs are enabled, test that intentions prevent connections.
if c.secure {
Expand Down Expand Up @@ -247,7 +247,7 @@ func TestIngressGatewayNamespaceMirroring(t *testing.T) {
require.NoError(t, err)
require.Equal(t, true, created, "config entry failed")

ingressGatewayService := fmt.Sprintf("http://%s-consul-%s-ingress-gateway.%s:8080/", releaseName, igName, ctx.KubectlOptions(t).Namespace)
ingressGatewayService := fmt.Sprintf("http://%s-consul-%s.%s:8080/", releaseName, igName, ctx.KubectlOptions(t).Namespace)

// If ACLs are enabled, test that intentions prevent connections.
if c.secure {
Expand Down
4 changes: 2 additions & 2 deletions acceptance/tests/ingress-gateway/ingress_gateway_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ func TestIngressGateway(t *testing.T) {
logger.Log(t, "testing intentions prevent ingress")
k8s.CheckStaticServerConnectionFailing(t, k8sOptions,
staticClientName, "-H", "Host: static-server.ingress.consul",
fmt.Sprintf("http://%s-consul-%s-ingress-gateway:8080/", releaseName, igName))
fmt.Sprintf("http://%s-consul-%s:8080/", releaseName, igName))

// Now we create the allow intention.
logger.Log(t, "creating ingress-gateway => static-server intention")
Expand All @@ -119,7 +119,7 @@ func TestIngressGateway(t *testing.T) {
logger.Log(t, "trying calls to ingress gateway")
k8s.CheckStaticServerConnectionSuccessful(t, k8sOptions,
staticClientName, "-H", "Host: static-server.ingress.consul",
fmt.Sprintf("http://%s-consul-%s-ingress-gateway:8080/", releaseName, igName))
fmt.Sprintf("http://%s-consul-%s:8080/", releaseName, igName))
})
}
}
4 changes: 4 additions & 0 deletions acceptance/tests/snapshot-agent/snapshot_agent_k8s_secret_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ import (
"fmt"
"strings"
"testing"
"time"

terratestLogger "github.com/gruntwork-io/terratest/modules/logger"
"github.com/hashicorp/consul-k8s/acceptance/framework/consul"
Expand Down Expand Up @@ -80,6 +81,9 @@ func TestSnapshotAgent_K8sSecret(t *testing.T) {
require.NoError(t, err)
require.True(t, len(podList.Items) > 0)

// Wait for 10seconds to allow snapsot to write.
time.Sleep(10 * time.Second)

// Loop through snapshot agents. Only one will be the leader and have the snapshot files.
hasSnapshots := false
for _, pod := range podList.Items {
Expand Down
4 changes: 4 additions & 0 deletions acceptance/tests/snapshot-agent/snapshot_agent_vault_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ import (
"fmt"
"strings"
"testing"
"time"

terratestLogger "github.com/gruntwork-io/terratest/modules/logger"
"github.com/hashicorp/consul-k8s/acceptance/framework/consul"
Expand Down Expand Up @@ -119,6 +120,9 @@ func TestSnapshotAgent_Vault(t *testing.T) {
require.NoError(t, err)
require.True(t, len(podList.Items) > 0)

// Wait for 10seconds to allow snapsot to write.
time.Sleep(10 * time.Second)

// Loop through snapshot agents. Only one will be the leader and have the snapshot files.
hasSnapshots := false
for _, pod := range podList.Items {
Expand Down
23 changes: 17 additions & 6 deletions charts/consul/templates/ingress-gateways-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,17 @@
{{- $defaults := .Values.ingressGateways.defaults }}
{{- $names := dict }}

{{- /* Check if gateway names are unique. */ -}}
{{- $gateways := .Values.ingressGateways.gateways }}
jmurret marked this conversation as resolved.
Show resolved Hide resolved
{{- range $outerIngressIndex, $outerIngressVal := $gateways }}

{{- range $innerIngressIndex, $innerIngressVal := $gateways }}
{{- if (and (ne $outerIngressIndex $innerIngressIndex) (eq $outerIngressVal.name $innerIngressVal.name)) }}
{{ fail (cat "ingress gateways must have unique names but found duplicate name" $innerIngressVal.name) }}
{{ end -}}
{{ end -}}
{{ end -}}

{{- range .Values.ingressGateways.gateways }}

{{- $service := .service }}
Expand All @@ -26,15 +37,15 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ template "consul.fullname" $root }}-{{ .name }}-ingress-gateway
name: {{ template "consul.fullname" $root }}-{{ .name }}
namespace: {{ $root.Release.Namespace }}
labels:
app: {{ template "consul.name" $root }}
chart: {{ template "consul.chart" $root }}
heritage: {{ $root.Release.Service }}
release: {{ $root.Release.Name }}
component: ingress-gateway
ingress-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}-ingress-gateway
ingress-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}
spec:
replicas: {{ default $defaults.replicas .replicas }}
selector:
Expand All @@ -44,7 +55,7 @@ spec:
heritage: {{ $root.Release.Service }}
release: {{ $root.Release.Name }}
component: ingress-gateway
ingress-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}-ingress-gateway
ingress-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}
template:
metadata:
labels:
Expand All @@ -53,7 +64,7 @@ spec:
heritage: {{ $root.Release.Service }}
release: {{ $root.Release.Name }}
component: ingress-gateway
ingress-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}-ingress-gateway
ingress-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}
annotations:
{{- if (and $root.Values.global.secretsBackend.vault.enabled $root.Values.global.tls.enabled) }}
"vault.hashicorp.com/agent-init-first": "true"
Expand Down Expand Up @@ -92,7 +103,7 @@ spec:
{{ tpl (default $defaults.tolerations .tolerations) $root | nindent 8 | trim }}
{{- end }}
terminationGracePeriodSeconds: {{ default $defaults.terminationGracePeriodSeconds .terminationGracePeriodSeconds }}
serviceAccountName: {{ template "consul.fullname" $root }}-{{ .name }}-ingress-gateway
serviceAccountName: {{ template "consul.fullname" $root }}-{{ .name }}
volumes:
- name: consul-bin
emptyDir: {}
Expand Down Expand Up @@ -189,7 +200,7 @@ spec:
-log-level={{ $root.Values.global.logLevel }} \
-log-json={{ $root.Values.global.logJSON }} \
-k8s-namespace={{ $root.Release.Namespace }} \
-name={{ template "consul.fullname" $root }}-{{ .name }}-ingress-gateway \
-name={{ template "consul.fullname" $root }}-{{ .name }} \
-output-file=/tmp/address.txt
WAN_ADDR="$(cat /tmp/address.txt)"
{{- else }}
Expand Down
4 changes: 2 additions & 2 deletions charts/consul/templates/ingress-gateways-podsecuritypolicy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,15 +4,15 @@
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: {{ template "consul.fullname" $root }}-{{ .name }}-ingress-gateway
name: {{ template "consul.fullname" $root }}-{{ .name }}
namespace: {{ $root.Release.Namespace }}
labels:
app: {{ template "consul.name" $root }}
chart: {{ template "consul.chart" $root }}
heritage: {{ $root.Release.Service }}
release: {{ $root.Release.Name }}
component: ingress-gateway
ingress-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}-ingress-gateway
ingress-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}
spec:
privileged: false
# Required to prevent escalations to root.
Expand Down
10 changes: 5 additions & 5 deletions charts/consul/templates/ingress-gateways-role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,28 +7,28 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ template "consul.fullname" $root }}-{{ .name }}-ingress-gateway
name: {{ template "consul.fullname" $root }}-{{ .name }}
namespace: {{ $root.Release.Namespace }}
labels:
app: {{ template "consul.name" $root }}
chart: {{ template "consul.chart" $root }}
heritage: {{ $root.Release.Service }}
release: {{ $root.Release.Name }}
component: ingress-gateway
ingress-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}-ingress-gateway
ingress-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}
rules:
- apiGroups: [""]
resources:
- services
resourceNames:
- {{ template "consul.fullname" $root }}-{{ .name }}-ingress-gateway
- {{ template "consul.fullname" $root }}-{{ .name }}
verbs:
- get
{{- if $root.Values.global.enablePodSecurityPolicies }}
- apiGroups: ["policy"]
resources: ["podsecuritypolicies"]
resourceNames:
- {{ template "consul.fullname" $root }}-{{ .name }}-ingress-gateway
- {{ template "consul.fullname" $root }}-{{ .name }}
verbs:
- use
{{- end }}
Expand All @@ -37,7 +37,7 @@ rules:
resources:
- secrets
resourceNames:
- {{ template "consul.fullname" $root }}-{{ .name }}-ingress-gateway-acl-token
- {{ template "consul.fullname" $root }}-{{ .name }}-acl-token
verbs:
- get
{{- end }}
Expand Down
8 changes: 4 additions & 4 deletions charts/consul/templates/ingress-gateways-rolebinding.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,22 +4,22 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: {{ template "consul.fullname" $root }}-{{ .name }}-ingress-gateway
name: {{ template "consul.fullname" $root }}-{{ .name }}
namespace: {{ $root.Release.Namespace }}
labels:
app: {{ template "consul.name" $root }}
chart: {{ template "consul.chart" $root }}
heritage: {{ $root.Release.Service }}
release: {{ $root.Release.Name }}
component: ingress-gateway
ingress-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}-ingress-gateway
ingress-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ template "consul.fullname" $root }}-{{ .name }}-ingress-gateway
name: {{ template "consul.fullname" $root }}-{{ .name }}
subjects:
- kind: ServiceAccount
name: {{ template "consul.fullname" $root }}-{{ .name }}-ingress-gateway
name: {{ template "consul.fullname" $root }}-{{ .name }}
---
{{- end }}
{{- end }}
6 changes: 3 additions & 3 deletions charts/consul/templates/ingress-gateways-service.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,15 +9,15 @@
apiVersion: v1
kind: Service
metadata:
name: {{ template "consul.fullname" $root }}-{{ .name }}-ingress-gateway
name: {{ template "consul.fullname" $root }}-{{ .name }}
namespace: {{ $root.Release.Namespace }}
labels:
app: {{ template "consul.name" $root }}
chart: {{ template "consul.chart" $root }}
heritage: {{ $root.Release.Service }}
release: {{ $root.Release.Name }}
component: ingress-gateway
ingress-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}-ingress-gateway
ingress-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}
{{- if (or $defaults.service.annotations $service.annotations) }}
# We allow both default annotations and gateway-specific annotations
annotations:
Expand All @@ -33,7 +33,7 @@ spec:
app: {{ template "consul.name" $root }}
release: "{{ $root.Release.Name }}"
component: ingress-gateway
ingress-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}-ingress-gateway
ingress-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}
ports:
{{- range $index, $ports := (default $defaults.service.ports $service.ports) }}
- name: gateway-{{ $index }}
Expand Down
4 changes: 2 additions & 2 deletions charts/consul/templates/ingress-gateways-serviceaccount.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,15 +6,15 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ template "consul.fullname" $root }}-{{ .name }}-ingress-gateway
name: {{ template "consul.fullname" $root }}-{{ .name }}
namespace: {{ $root.Release.Namespace }}
labels:
app: {{ template "consul.name" $root }}
chart: {{ template "consul.chart" $root }}
heritage: {{ $root.Release.Service }}
release: {{ $root.Release.Name }}
component: ingress-gateway
ingress-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}-ingress-gateway
ingress-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}
{{- if (or $defaults.serviceAccount.annotations $serviceAccount.annotations) }}
annotations:
{{- if $defaults.serviceAccount.annotations }}
Expand Down
26 changes: 21 additions & 5 deletions charts/consul/templates/terminating-gateways-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,22 @@
{{- $defaults := .Values.terminatingGateways.defaults }}
{{- $names := dict }}

{{- $gateways := .Values.terminatingGateways.gateways }}
{{- range $outerTerminatingIndex, $outerTerminatingVal := $gateways }}

{{- range $innerTerminatingIndex, $innerTerminatingVal := $gateways }}
{{- if (and (ne $outerTerminatingIndex $innerTerminatingIndex) (eq $outerTerminatingVal.name $innerTerminatingVal.name)) }}
{{ fail (cat "terminating gateways must have unique names but found duplicate name" $innerTerminatingVal.name) }}
{{ end -}}
{{ end -}}

{{- range $outerIngressIndex, $outerIngressVal := $root.Values.ingressGateways.gateways }}
{{- if (eq $outerTerminatingVal.name $outerIngressVal.name) }}
{{ fail (cat "terminating gateways cannot have duplicate names of any ingress gateways but found duplicate name" $outerTerminatingVal.name) }}
{{ end -}}
{{ end -}}
{{ end -}}

{{- range .Values.terminatingGateways.gateways }}

{{- if empty .name }}
Expand All @@ -24,15 +40,15 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ template "consul.fullname" $root }}-{{ .name }}-terminating-gateway
name: {{ template "consul.fullname" $root }}-{{ .name }}
namespace: {{ $root.Release.Namespace }}
labels:
app: {{ template "consul.name" $root }}
chart: {{ template "consul.chart" $root }}
heritage: {{ $root.Release.Service }}
release: {{ $root.Release.Name }}
component: terminating-gateway
terminating-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}-terminating-gateway
terminating-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}
spec:
replicas: {{ default $defaults.replicas .replicas }}
selector:
Expand All @@ -42,7 +58,7 @@ spec:
heritage: {{ $root.Release.Service }}
release: {{ $root.Release.Name }}
component: terminating-gateway
terminating-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}-terminating-gateway
terminating-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}
template:
metadata:
labels:
Expand All @@ -51,7 +67,7 @@ spec:
heritage: {{ $root.Release.Service }}
release: {{ $root.Release.Name }}
component: terminating-gateway
terminating-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}-terminating-gateway
terminating-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}
annotations:
{{- if (and $root.Values.global.secretsBackend.vault.enabled $root.Values.global.tls.enabled) }}
"vault.hashicorp.com/agent-init-first": "true"
Expand Down Expand Up @@ -90,7 +106,7 @@ spec:
{{ tpl (default $defaults.tolerations .tolerations) $root | nindent 8 | trim }}
{{- end }}
terminationGracePeriodSeconds: 10
serviceAccountName: {{ template "consul.fullname" $root }}-{{ .name }}-terminating-gateway
serviceAccountName: {{ template "consul.fullname" $root }}-{{ .name }}
volumes:
- name: consul-bin
emptyDir: {}
Expand Down
4 changes: 2 additions & 2 deletions charts/consul/templates/terminating-gateways-podsecuritypolicy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,15 +4,15 @@
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: {{ template "consul.fullname" $root }}-{{ .name }}-terminating-gateway
name: {{ template "consul.fullname" $root }}-{{ .name }}
namespace: {{ $root.Release.Namespace }}
labels:
app: {{ template "consul.name" $root }}
chart: {{ template "consul.chart" $root }}
heritage: {{ $root.Release.Service }}
release: {{ $root.Release.Name }}
component: terminating-gateway
terminating-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}-terminating-gateway
terminating-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}
spec:
privileged: false
# Required to prevent escalations to root.
Expand Down
8 changes: 4 additions & 4 deletions charts/consul/templates/terminating-gateways-role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,22 +7,22 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ template "consul.fullname" $root }}-{{ .name }}-terminating-gateway
name: {{ template "consul.fullname" $root }}-{{ .name }}
namespace: {{ $root.Release.Namespace }}
labels:
app: {{ template "consul.name" $root }}
chart: {{ template "consul.chart" $root }}
heritage: {{ $root.Release.Service }}
release: {{ $root.Release.Name }}
component: terminating-gateway
terminating-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}-terminating-gateway
terminating-gateway-name: {{ template "consul.fullname" $root }}-{{ .name }}
{{- if (or $root.Values.global.acls.manageSystemACLs $root.Values.global.enablePodSecurityPolicies) }}
rules:
{{- if $root.Values.global.enablePodSecurityPolicies }}
- apiGroups: ["policy"]
resources: ["podsecuritypolicies"]
resourceNames:
- {{ template "consul.fullname" $root }}-{{ .name }}-terminating-gateway
- {{ template "consul.fullname" $root }}-{{ .name }}
verbs:
- use
{{- end }}
Expand All @@ -31,7 +31,7 @@ rules:
resources:
- secrets
resourceNames:
- {{ template "consul.fullname" $root }}-{{ .name }}-terminating-gateway-acl-token
- {{ template "consul.fullname" $root }}-{{ .name }}-acl-token
verbs:
- get
{{- end }}
Expand Down
Loading