Always enable identity in integration tests (#1298)

In preparation of making identity mandatory, this change adds
a default identity that is used in all integration tests (unless
overridden by the test itself).

This change also regenerates existing TLS credentials used in tests.

linkerd/app/integration/src/data/bar-ns1/ca1-cert.csr

@@ -1,8 +1,8 @@
 -----BEGIN CERTIFICATE REQUEST-----
-MIIBDzCBtQIBADAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEkXEy7KACN5+D
-+RcZ+GWGNDrvRvh0K0LHMND5z7heYd58/El915yGXxqXLUVgNW7AZoVnvO9yfxUl
-URZohMPY3aBTMFEGCSqGSIb3DQEJDjFEMEIwQAYDVR0RBDkwN4I1YmFyLm5zMS5z
+MIIBDjCBtQIBADAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEErHk5ZDW/YZQ
+bjeUzw5Q9rAAGFLFqxwD4kobkbHZ9t368GaY+b/FM3D+RwvY6GG03fp/mhguwORL
+yHZLGdmZpKBTMFEGCSqGSIb3DQEJDjFEMEIwQAYDVR0RBDkwN4I1YmFyLm5zMS5z
 ZXJ2aWNlYWNjb3VudC5pZGVudGl0eS5saW5rZXJkLmNsdXN0ZXIubG9jYWwwCgYI
-KoZIzj0EAwIDSQAwRgIhAPfC0SdBTKDNJHOs4DtuW3haDrgl4hb3boUBk6BY/WQP
-AiEAw7KsTKEDaLTgXjhaHEUBW6YSwUn2vSjzroOb5m+gLso=
+KoZIzj0EAwIDSAAwRQIgR4LzRpXO/InORp5YqjI2bcvc8IFCma9pS6q94sx8ar8C
+IQC7OtZ3LjSWSAJErkn/+hLcuBszhQCpJ+FJ08ZbUw/0Jg==
 -----END CERTIFICATE REQUEST-----

linkerd/app/integration/src/data/bar-ns1/ca1-cert.pem

@@ -1,12 +1,12 @@
 -----BEGIN CERTIFICATE-----
-MIIB1zCCAX2gAwIBAgIUKfEU+9uHyEXmpelpftqngl4bU9UwCgYIKoZIzj0EAwIw
-DzENMAsGA1UECxMETm9uZTAeFw0yMDAzMzAyMTIyMDBaFw0zMDAzMjgyMTIyMDBa
-MAAwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASRcTLsoAI3n4P5Fxn4ZYY0Ou9G
-+HQrQscw0PnPuF5h3nz8SX3XnIZfGpctRWA1bsBmhWe873J/FSVRFmiEw9jdo4HF
+MIIB2DCCAX2gAwIBAgIUGHfgCvdc/2zfvRGdB2l4z1eyUhswCgYIKoZIzj0EAwIw
+DzENMAsGA1UECxMETm9uZTAeFw0yMTEwMDQxOTA4MDBaFw0zMTEwMDIxOTA4MDBa
+MAAwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQSseTlkNb9hlBuN5TPDlD2sAAY
+UsWrHAPiShuRsdn23frwZpj5v8UzcP5HC9joYbTd+n+aGC7A5EvIdksZ2Zmko4HF
 MIHCMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUH
-AwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUy2pOKPncENMzyfHO1XhCpcLopecw
-HwYDVR0jBBgwFoAUXxNY6eh0PImAO2PyOa/UPNicDxswQwYDVR0RAQH/BDkwN4I1
+AwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUsEGbiw6sTfFQfJ04CEXhWEC13jsw
+HwYDVR0jBBgwFoAU51lin1XU1qY44LyfZlYKEo7n5SIwQwYDVR0RAQH/BDkwN4I1
 YmFyLm5zMS5zZXJ2aWNlYWNjb3VudC5pZGVudGl0eS5saW5rZXJkLmNsdXN0ZXIu
-bG9jYWwwCgYIKoZIzj0EAwIDSAAwRQIgKXM5QBnDoDnVeHFTm32kQWKh+Z3TXGI1
-sKRCJn0gc5YCIQCiacfvxTjiGeOHNwmyszllI/gYJRbdQnuIPwbSxRgLJw==
+bG9jYWwwCgYIKoZIzj0EAwIDSQAwRgIhAKawheqY1d4C1+FjpZdbXllz/T0a4YFS
+DwiFeGZwcWvWAiEA90nCluxhDrMLBrAKKFjwSDawOU944MmzH0BReVr5v/U=
 -----END CERTIFICATE-----

linkerd/app/integration/src/data/ca1-key.pem

@@ -1,5 +1,5 @@
 -----BEGIN EC PRIVATE KEY-----
-MHcCAQEEINaDtP23xzMaFWmqcYEQYOiVrsME00HXhlmiZ//RLY1eoAoGCCqGSM49
-AwEHoUQDQgAEmYmKPgUqT6jK5J6bpV6ZgDSEDo9Gfd5Z+7AVVsiZAPI8QR4KRDvB
-j3oyIweEJw46z3cOtlyMciDbZcs1vlifAw==
+MHcCAQEEIOWWOQpNycGNQuAJfNOyG4W6Kv+k/KJCcBiNKBLP/PQOoAoGCCqGSM49
+AwEHoUQDQgAEyCkIHTYP4oCx94Y+kdFfPmk6kC9WOmvJSSIRp9QZGw1dQ2h7vQ83
+7wZfu0Pz2z9xTnXZlqK7Y0TUcfxJ5u6rHg==
 -----END EC PRIVATE KEY-----

linkerd/app/integration/src/data/ca1.pem

@@ -1,10 +1,10 @@
 -----BEGIN CERTIFICATE-----
-MIIBYjCCAQigAwIBAgIUFQvMSl8jWuyUX/rOWggoSx5yXb8wCgYIKoZIzj0EAwIw
-DzENMAsGA1UECxMETm9uZTAeFw0yMDAzMzAyMTIyMDBaFw0zMDAzMjgyMTIyMDBa
-MA8xDTALBgNVBAsTBE5vbmUwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASZiYo+
-BSpPqMrknpulXpmANIQOj0Z93ln7sBVWyJkA8jxBHgpEO8GPejIjB4QnDjrPdw62
-XIxyINtlyzW+WJ8Do0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB
-/zAdBgNVHQ4EFgQUXxNY6eh0PImAO2PyOa/UPNicDxswCgYIKoZIzj0EAwIDSAAw
-RQIgXCuR7PQIVSPThUDirPwnkeAvNQE8+irO3op2OrEy44ICIQDzQaGahalfPrmo
-Zb4veDhUgnxMNIQDA6Iu9exlQJnj0w==
+MIIBYjCCAQigAwIBAgIUd+yT3FGl+a2u9lbYzkRPagjEL6IwCgYIKoZIzj0EAwIw
+DzENMAsGA1UECxMETm9uZTAeFw0yMTEwMDQxOTA4MDBaFw0zMTEwMDIxOTA4MDBa
+MA8xDTALBgNVBAsTBE5vbmUwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATIKQgd
+Ng/igLH3hj6R0V8+aTqQL1Y6a8lJIhGn1BkbDV1DaHu9DzfvBl+7Q/PbP3FOddmW
+ortjRNRx/Enm7qseo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB
+/zAdBgNVHQ4EFgQU51lin1XU1qY44LyfZlYKEo7n5SIwCgYIKoZIzj0EAwIDSAAw
+RQIhAKnMzC4ixuH2pb1i1dDE3GB+P/rSXt5/Eg09w/lT3NLOAiADaDH+NeDed22d
+vyhpWtTJn9TCMXZgz7ZVdBxx/6acyg==
 -----END CERTIFICATE-----

linkerd/app/integration/src/data/default-default/ca1-cert.csr

@@ -0,0 +1,8 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIBFjCBvQIBADAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE/ScRpeostCcA
+HBOnVcw9JEWykiHDJW9/QqgatuUNiZtRIZlktT1PSpOwDw1iMSZlDW/AqEQ5iTTI
+ZcNgq7jho6BbMFkGCSqGSIb3DQEJDjFMMEowSAYDVR0RBEEwP4I9ZGVmYXVsdC5k
+ZWZhdWx0LnNlcnZpY2VhY2NvdW50LmlkZW50aXR5LmxpbmtlcmQuY2x1c3Rlci5s
+b2NhbDAKBggqhkjOPQQDAgNIADBFAiBuIt4ix0Y4RYZ4sMlcR4YzgGDTBUu6n1YS
+/ElxctRqmAIhANw4QM4PvpNlpjpLHXHsYNYf7a7qMaRQJiyt/5DEakv1
+-----END CERTIFICATE REQUEST-----

linkerd/app/integration/src/data/default-default/ca1-cert.pem

@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIIB3zCCAYWgAwIBAgIUUu1CjvTzv9KxfVWjy9AZBLWu+mkwCgYIKoZIzj0EAwIw
+DzENMAsGA1UECxMETm9uZTAeFw0yMTEwMDQxOTA4MDBaFw0zMTEwMDIxOTA4MDBa
+MAAwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAT9JxGl6iy0JwAcE6dVzD0kRbKS
+IcMlb39CqBq25Q2Jm1EhmWS1PU9Kk7APDWIxJmUNb8CoRDmJNMhlw2CruOGjo4HN
+MIHKMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUH
+AwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQU4Qu2AjEp4tiyznaHRHlC/Zcnrnww
+HwYDVR0jBBgwFoAU51lin1XU1qY44LyfZlYKEo7n5SIwSwYDVR0RAQH/BEEwP4I9
+ZGVmYXVsdC5kZWZhdWx0LnNlcnZpY2VhY2NvdW50LmlkZW50aXR5LmxpbmtlcmQu
+Y2x1c3Rlci5sb2NhbDAKBggqhkjOPQQDAgNIADBFAiAIclYjUH550blsjfnLpFE3
+kbxBWggH1iifGHKOTwu+kQIhAMy0NN4dXQxWc48/jSioz04l5AVohuAgKYo2cAYy
+fGUQ
+-----END CERTIFICATE-----

linkerd/app/integration/src/data/default-default/token.txt

@@ -0,0 +1 @@
+Some default secret token of some kind

linkerd/app/integration/src/data/foo-ns1/ca1-cert.csr

@@ -1,8 +1,8 @@
 -----BEGIN CERTIFICATE REQUEST-----
-MIIBDjCBtQIBADAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAET5rq6n/h5hKQ
-JQngufzaHRcaiPVMdw+9624jItgBKV1EJOwGJ+RXgrZ4Jjsmd2PUY3MrO282lOIK
-VssCS8SLeKBTMFEGCSqGSIb3DQEJDjFEMEIwQAYDVR0RBDkwN4I1Zm9vLm5zMS5z
+MIIBDzCBtQIBADAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE9hqzrZfMvvXq
+6y42v4dDNY6tYKI5oHSBZAKHaUi1tESpD6XmD0q2OjMa830+Pdyw/zzw5mWLgOPK
+B57qh1U+36BTMFEGCSqGSIb3DQEJDjFEMEIwQAYDVR0RBDkwN4I1Zm9vLm5zMS5z
 ZXJ2aWNlYWNjb3VudC5pZGVudGl0eS5saW5rZXJkLmNsdXN0ZXIubG9jYWwwCgYI
-KoZIzj0EAwIDSAAwRQIgCVmQE8M82RjF/Hkw6JDveWQnD/gqHXtMcOVRVCZMLFkC
-IQDNWjwOXO2bTf8zCXwj7NnCQznV5y1FhNh5opDC5QpH8g==
+KoZIzj0EAwIDSQAwRgIhAPUh+A/QYirXAAy1R7fb8gwIZpNly5bHjcszCmeh5qNd
+AiEAxvjqkdc52G+8K/tbjwnFBbJ64wDmYnbhc3yKp6pWnz8=
 -----END CERTIFICATE REQUEST-----

linkerd/app/integration/src/data/foo-ns1/ca1-cert.pem

@@ -1,12 +1,12 @@
 -----BEGIN CERTIFICATE-----
-MIIB2DCCAX2gAwIBAgIUDH0DD74PMajWzVODePjJRKlLPiUwCgYIKoZIzj0EAwIw
-DzENMAsGA1UECxMETm9uZTAeFw0yMDAzMzAyMTIyMDBaFw0zMDAzMjgyMTIyMDBa
-MAAwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARPmurqf+HmEpAlCeC5/NodFxqI
-9Ux3D73rbiMi2AEpXUQk7AYn5FeCtngmOyZ3Y9Rjcys7bzaU4gpWywJLxIt4o4HF
+MIIB1jCCAX2gAwIBAgIUXyG3/iKKxIjdkZVF4RuYuperEUEwCgYIKoZIzj0EAwIw
+DzENMAsGA1UECxMETm9uZTAeFw0yMTEwMDQxOTA4MDBaFw0zMTEwMDIxOTA4MDBa
+MAAwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAT2GrOtl8y+9errLja/h0M1jq1g
+ojmgdIFkAodpSLW0RKkPpeYPSrY6MxrzfT493LD/PPDmZYuA48oHnuqHVT7fo4HF
 MIHCMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUH
-AwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUIkD7sONKzvUDn4z3YL5JIvl1ytww
-HwYDVR0jBBgwFoAUXxNY6eh0PImAO2PyOa/UPNicDxswQwYDVR0RAQH/BDkwN4I1
+AwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUsSmxE9h8rw8mdL9ptw+rwBUYl3Qw
+HwYDVR0jBBgwFoAU51lin1XU1qY44LyfZlYKEo7n5SIwQwYDVR0RAQH/BDkwN4I1
 Zm9vLm5zMS5zZXJ2aWNlYWNjb3VudC5pZGVudGl0eS5saW5rZXJkLmNsdXN0ZXIu
-bG9jYWwwCgYIKoZIzj0EAwIDSQAwRgIhAIOAhzlLFB6GDgkeu6qKTbgKdmvi8qVq
-93nLZ+Jtu40KAiEApFaw1+AZuQfjEQNMP+kdH40qF9ErJsqVswBnAzjx6E0=
+bG9jYWwwCgYIKoZIzj0EAwIDRwAwRAIgZMLTV287+10RVIzgUblvi/JtYsyHqp2a
+xbZqRgb4U4sCIHtVQjE/ZRc5EBFRMvp+M82ZOC/FI9R6R/3xJDyIasDa
 -----END CERTIFICATE-----

linkerd/app/integration/src/data/gen-certs.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/sh
 #
 # Requires:
 # go get -u github.com/cloudflare/cfssl/cmd/cfssl
@@ -52,6 +52,7 @@ ca "Cluster-local CA 1" ca1
 # The controller itself.
 # ee ca1 controller linkerd linkerd
 
+ee ca1 default default linkerd
 ee ca1 foo ns1 linkerd
 # ee ca2 foo ns1 linkerd # Same, but different CA
 ee ca1 bar ns1 linkerd # Different service.

linkerd/app/integration/src/proxy.rs

@@ -42,7 +42,7 @@ pub struct Listening {
     pub inbound_server: Option<server::Listening>,
 
     controller: controller::Listening,
-    identity: Option<controller::Listening>,
+    identity: controller::Listening,
 
     shutdown: Shutdown,
     terminated: oneshot::Receiver<()>,
@@ -228,16 +228,10 @@ impl Listening {
         }
         .instrument(tracing::info_span!("inbound"));
 
-        let identity = async move {
-            if let Some(srv) = identity {
-                srv.join().await;
-            }
-        };
-
         tokio::join! {
             inbound,
             outbound,
-            identity,
+            identity.join(),
             controller.join(),
         };
     }
@@ -249,12 +243,32 @@ async fn run(proxy: Proxy, mut env: TestEnv, random_ports: bool) -> Listening {
     let controller = if let Some(controller) = proxy.controller {
         controller
     } else {
-        // bummer that the whole function needs to be async just for this...
         controller::new().run().await
     };
+
+    let identity = if let Some(identity) = proxy.identity {
+        identity
+    } else {
+        let identity::Identity {
+            env: id_env,
+            mut certify_rsp,
+            ..
+        } = identity::Identity::new(
+            "default-default",
+            "default.default.serviceaccount.identity.linkerd.cluster.local".to_string(),
+        );
+        env.extend(id_env);
+        certify_rsp.valid_until =
+            Some((std::time::SystemTime::now() + Duration::from_secs(666)).into());
+
+        controller::identity()
+            .certify(move |_| certify_rsp)
+            .run()
+            .await
+    };
+
     let inbound = proxy.inbound;
     let outbound = proxy.outbound;
-    let identity = proxy.identity;
 
     env.put(
         "LINKERD2_PROXY_DESTINATION_SVC_ADDR",
@@ -284,14 +298,8 @@ async fn run(proxy: Proxy, mut env: TestEnv, random_ports: bool) -> Listening {
     static IDENTITY_SVC_NAME: &str = "LINKERD2_PROXY_IDENTITY_SVC_NAME";
     static IDENTITY_SVC_ADDR: &str = "LINKERD2_PROXY_IDENTITY_SVC_ADDR";
 
-    let identity_addr = if let Some(ref identity) = identity {
-        env.put(IDENTITY_SVC_NAME, "test-identity".to_owned());
-        env.put(IDENTITY_SVC_ADDR, format!("{}", identity.addr));
-        Some(identity.addr)
-    } else {
-        env.put(app::env::ENV_IDENTITY_DISABLED, "test".to_owned());
-        None
-    };
+    env.put(IDENTITY_SVC_NAME, "test-identity".to_owned());
+    env.put(IDENTITY_SVC_ADDR, identity.addr.to_string());
 
     if let Some(ports) = proxy.inbound_disable_ports_protocol_detection {
         let ports = ports
@@ -344,6 +352,7 @@ async fn run(proxy: Proxy, mut env: TestEnv, random_ports: bool) -> Listening {
         });
     }
 
+    let identity_addr = identity.addr;
     let thread = thread::Builder::new()
         .name(format!("{}:proxy", thread_name()))
         .spawn(move || {

linkerd/app/integration/src/test_env.rs

@@ -20,6 +20,10 @@ impl TestEnv {
     pub fn remove(&mut self, key: &'static str) {
         self.values.remove(key);
     }
+
+    pub fn extend(&mut self, other: TestEnv) {
+        self.values.extend(other.values);
+    }
 }
 
 impl Strings for TestEnv {

linkerd/app/integration/src/tests/discovery.rs

@@ -386,7 +386,6 @@ mod http2 {
         metrics::metric("tcp_close_total")
             .label("peer", "dst")
             .label("direction", "outbound")
-            .label("tls", "disabled")
             .label(
                 "authority",
                 format_args!("disco.test.svc.cluster.local:{}", port),

linkerd/app/integration/src/tests/telemetry/mod.rs

@@ -142,7 +142,6 @@ impl TcpFixture {
         let src_labels = metrics::labels()
             .label("direction", "inbound")
             .label("peer", "src")
-            .label("tls", "disabled")
             .label("target_addr", orig_dst)
             .label("srv_name", "default:all-unauthenticated");
 
@@ -207,7 +206,6 @@ async fn admin_request_count() {
     let metrics = fixture.metrics;
     let metric = metrics::metric("request_total")
         .label("direction", "inbound")
-        .label("tls", "disabled")
         .label("target_addr", metrics.target_addr())
         .value(1usize);
 
@@ -223,7 +221,6 @@ async fn admin_transport_metrics() {
     let metrics = fixture.metrics;
     let labels = metrics::labels()
         .label("direction", "inbound")
-        .label("tls", "disabled")
         .label("target_addr", metrics.target_addr())
         .label("peer", "src");
 
@@ -1223,7 +1220,6 @@ mod transport {
         metrics::metric("tcp_close_total")
             .label("peer", "dst")
             .label("direction", "inbound")
-            .label("tls", "disabled")
             .label("errno", "EXFULL")
             .value(1u64)
             .assert_in(&metrics)
@@ -1233,7 +1229,6 @@ mod transport {
         metrics::metric("tcp_close_total")
             .label("peer", "src")
             .label("direction", "inbound")
-            .label("tls", "disabled")
             .label("errno", "")
             .value(1u64)
             .assert_in(&metrics)
@@ -1264,7 +1259,6 @@ mod transport {
         metrics::metric("tcp_close_total")
             .label("peer", "dst")
             .label("direction", "outbound")
-            .label("tls", "disabled")
             .label("errno", "EXFULL")
             .value(1u64)
             .assert_in(&metrics)
@@ -1274,7 +1268,6 @@ mod transport {
         metrics::metric("tcp_close_total")
             .label("peer", "src")
             .label("direction", "outbound")
-            .label("tls", "disabled")
             .label("errno", "")
             .value(1u64)
             .assert_in(&metrics)
@@ -1327,9 +1320,7 @@ mod transport {
     async fn inbound_http_tcp_open_connections() {
         test_http_open_conns(
             Fixture::inbound(),
-            metrics::labels()
-                .label("direction", "inbound")
-                .label("tls", "disabled"),
+            metrics::labels().label("direction", "inbound"),
         )
         .await
     }

linkerd/app/integration/src/tests/transparency.rs

@@ -1347,7 +1347,6 @@ async fn retry_reconnect_errors() {
     metrics::metric("tcp_open_total")
         .label("peer", "src")
         .label("direction", "inbound")
-        .label("tls", "disabled")
         .label("srv_name", "default:all-unauthenticated")
         .value(1u64)
         .assert_in(&metrics)