Add traffic permissions integration tests. #19008
Conversation
erichaberkorn
added
pr/no-changelog
erichaberkorn
force-pushed
the
tp-tests
branch
8 times, most recently
from
5f591b7 to
eb17a1e
Compare
| var ctx context.Context | ||
| rtestClient, ok := client.(*Client) | ||
| if ok { | ||
| ctx = rtestClient.Context(t) | ||
| } else { | ||
| ctx = testutil.TestContext(t) | ||
| rtestClient = NewClient(client) | ||
| } |
There was a problem hiding this comment.
I don't particularly like this, but it's hard to do much better without making a breaking change that impacts tons and tons of tests.
| client2EchoSuccess: true, | ||
| }, | ||
| // TODO I don't like this behavior. | ||
| "allow one protocol doesnt impact the other protocol": { |
There was a problem hiding this comment.
@ishustava It feels weird to me that configuring a traffic permission with default allow only swaps to default deny for a single port rather than all port. Should we change this behavior to swap all ports to default deny?
erichaberkorn
force-pushed
the
tp-tests
branch
from
eb17a1e to
f72aead
Compare
erichaberkorn
force-pushed
the
tp-tests
branch
from
f72aead to
5719346
Compare
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎ 2 Ignored Deployments
|
| // Copyright (c) HashiCorp, Inc. | ||
| // SPDX-License-Identifier: BUSL-1.1 | ||
|
|
||
| package tproxy |
There was a problem hiding this comment.
Should this be trafficpermissions?
erichaberkorn
force-pushed
the
tp-tests
branch
from
5719346 to
0a4366b
Compare
| USER root | ||
|
|
||
| RUN microdnf install -y iptables sudo nc \ |
There was a problem hiding this comment.
Can we add a note for something like:
On Mac M1s when TProxy is enabled, consul-dataplane that are spawned from this image (only used in consul-container integration tests) will terminate with the below error. It is related to tproxy-startup.sh calling iptables SDK which then calls the underly iptables. We are investigating how this works on M1s with consul-envoy images which do not have this problem. For the time being tproxy tests on Mac M1s will fail locally but pass in CI.
Error setting up traffic redirection rules: failed to run command: /sbin/iptables -t nat -N CONSUL_PROXY_INBOUND, err: exit status 1, output: iptables: Failed to initialize nft: Protocol not supported
erichaberkorn
force-pushed
the
tp-tests
branch
from
0a4366b to
033594f
Compare
erichaberkorn
force-pushed
the
tp-tests
branch
2 times, most recently
from
acaa084 to
53cf850
Compare
erichaberkorn
force-pushed
the
tp-tests
branch
from
53cf850 to
6af4fe2
Compare
Add traffic permissions integration tests.
Description
Add integration tests for TCP traffic permissions.
PR Checklist