2018-10-03 12:36:38 +00:00
|
|
|
package proxycfg
|
|
|
|
|
|
|
|
import (
|
2019-07-12 21:19:37 +00:00
|
|
|
"context"
|
|
|
|
"fmt"
|
|
|
|
"sync"
|
2018-10-03 12:36:38 +00:00
|
|
|
"testing"
|
2021-04-06 20:48:54 +00:00
|
|
|
"time"
|
2018-10-03 12:36:38 +00:00
|
|
|
|
2020-12-23 23:03:30 +00:00
|
|
|
"github.com/hashicorp/go-hclog"
|
2020-11-10 23:57:35 +00:00
|
|
|
"github.com/stretchr/testify/require"
|
2022-10-14 14:52:00 +00:00
|
|
|
"golang.org/x/time/rate"
|
2020-11-10 23:57:35 +00:00
|
|
|
|
2022-04-05 21:10:06 +00:00
|
|
|
"github.com/hashicorp/consul/acl"
|
2019-07-12 21:19:37 +00:00
|
|
|
cachetype "github.com/hashicorp/consul/agent/cache-types"
|
2019-07-15 15:09:52 +00:00
|
|
|
"github.com/hashicorp/consul/agent/consul/discoverychain"
|
2018-10-03 12:36:38 +00:00
|
|
|
"github.com/hashicorp/consul/agent/structs"
|
2022-06-01 20:31:37 +00:00
|
|
|
"github.com/hashicorp/consul/proto/pbpeering"
|
|
|
|
"github.com/hashicorp/consul/proto/prototest"
|
2019-07-12 21:19:37 +00:00
|
|
|
"github.com/hashicorp/consul/sdk/testutil"
|
2018-10-03 12:36:38 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
func TestStateChanged(t *testing.T) {
|
|
|
|
tests := []struct {
|
|
|
|
name string
|
|
|
|
ns *structs.NodeService
|
|
|
|
token string
|
|
|
|
mutate func(ns structs.NodeService, token string) (*structs.NodeService, string)
|
|
|
|
want bool
|
|
|
|
}{
|
|
|
|
{
|
|
|
|
name: "nil node service",
|
|
|
|
ns: structs.TestNodeServiceProxy(t),
|
|
|
|
mutate: func(ns structs.NodeService, token string) (*structs.NodeService, string) {
|
|
|
|
return nil, token
|
|
|
|
},
|
|
|
|
want: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "same service",
|
|
|
|
ns: structs.TestNodeServiceProxy(t),
|
|
|
|
mutate: func(ns structs.NodeService, token string) (*structs.NodeService, string) {
|
|
|
|
return &ns, token
|
|
|
|
}, want: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "same service, different token",
|
|
|
|
ns: structs.TestNodeServiceProxy(t),
|
|
|
|
token: "foo",
|
|
|
|
mutate: func(ns structs.NodeService, token string) (*structs.NodeService, string) {
|
|
|
|
return &ns, "bar"
|
|
|
|
},
|
|
|
|
want: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "different address",
|
|
|
|
ns: structs.TestNodeServiceProxy(t),
|
|
|
|
token: "foo",
|
|
|
|
mutate: func(ns structs.NodeService, token string) (*structs.NodeService, string) {
|
|
|
|
ns.Address = "10.10.10.10"
|
|
|
|
return &ns, token
|
|
|
|
},
|
|
|
|
want: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "different port",
|
|
|
|
ns: structs.TestNodeServiceProxy(t),
|
|
|
|
token: "foo",
|
|
|
|
mutate: func(ns structs.NodeService, token string) (*structs.NodeService, string) {
|
|
|
|
ns.Port = 12345
|
|
|
|
return &ns, token
|
|
|
|
},
|
|
|
|
want: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "different service kind",
|
|
|
|
ns: structs.TestNodeServiceProxy(t),
|
|
|
|
token: "foo",
|
|
|
|
mutate: func(ns structs.NodeService, token string) (*structs.NodeService, string) {
|
|
|
|
ns.Kind = ""
|
|
|
|
return &ns, token
|
|
|
|
},
|
|
|
|
want: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "different proxy target",
|
|
|
|
ns: structs.TestNodeServiceProxy(t),
|
|
|
|
token: "foo",
|
|
|
|
mutate: func(ns structs.NodeService, token string) (*structs.NodeService, string) {
|
|
|
|
ns.Proxy.DestinationServiceName = "badger"
|
|
|
|
return &ns, token
|
|
|
|
},
|
|
|
|
want: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "different proxy upstreams",
|
|
|
|
ns: structs.TestNodeServiceProxy(t),
|
|
|
|
token: "foo",
|
|
|
|
mutate: func(ns structs.NodeService, token string) (*structs.NodeService, string) {
|
|
|
|
ns.Proxy.Upstreams = nil
|
|
|
|
return &ns, token
|
|
|
|
},
|
|
|
|
want: true,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, tt := range tests {
|
|
|
|
t.Run(tt.name, func(t *testing.T) {
|
2022-05-27 11:38:52 +00:00
|
|
|
proxyID := ProxyID{ServiceID: tt.ns.CompoundServiceID()}
|
2022-10-14 14:52:00 +00:00
|
|
|
state, err := newState(proxyID, tt.ns, testSource, tt.token, stateConfig{logger: hclog.New(nil)}, rate.NewLimiter(rate.Inf, 1))
|
bulk rewrite using this script
set -euo pipefail
unset CDPATH
cd "$(dirname "$0")"
for f in $(git grep '\brequire := require\.New(' | cut -d':' -f1 | sort -u); do
echo "=== require: $f ==="
sed -i '/require := require.New(t)/d' $f
# require.XXX(blah) but not require.XXX(tblah) or require.XXX(rblah)
sed -i 's/\brequire\.\([a-zA-Z0-9_]*\)(\([^tr]\)/require.\1(t,\2/g' $f
# require.XXX(tblah) but not require.XXX(t, blah)
sed -i 's/\brequire\.\([a-zA-Z0-9_]*\)(\(t[^,]\)/require.\1(t,\2/g' $f
# require.XXX(rblah) but not require.XXX(r, blah)
sed -i 's/\brequire\.\([a-zA-Z0-9_]*\)(\(r[^,]\)/require.\1(t,\2/g' $f
gofmt -s -w $f
done
for f in $(git grep '\bassert := assert\.New(' | cut -d':' -f1 | sort -u); do
echo "=== assert: $f ==="
sed -i '/assert := assert.New(t)/d' $f
# assert.XXX(blah) but not assert.XXX(tblah) or assert.XXX(rblah)
sed -i 's/\bassert\.\([a-zA-Z0-9_]*\)(\([^tr]\)/assert.\1(t,\2/g' $f
# assert.XXX(tblah) but not assert.XXX(t, blah)
sed -i 's/\bassert\.\([a-zA-Z0-9_]*\)(\(t[^,]\)/assert.\1(t,\2/g' $f
# assert.XXX(rblah) but not assert.XXX(r, blah)
sed -i 's/\bassert\.\([a-zA-Z0-9_]*\)(\(r[^,]\)/assert.\1(t,\2/g' $f
gofmt -s -w $f
done
2022-01-20 16:46:23 +00:00
|
|
|
require.NoError(t, err)
|
2018-10-03 12:36:38 +00:00
|
|
|
otherNS, otherToken := tt.mutate(*tt.ns, tt.token)
|
bulk rewrite using this script
set -euo pipefail
unset CDPATH
cd "$(dirname "$0")"
for f in $(git grep '\brequire := require\.New(' | cut -d':' -f1 | sort -u); do
echo "=== require: $f ==="
sed -i '/require := require.New(t)/d' $f
# require.XXX(blah) but not require.XXX(tblah) or require.XXX(rblah)
sed -i 's/\brequire\.\([a-zA-Z0-9_]*\)(\([^tr]\)/require.\1(t,\2/g' $f
# require.XXX(tblah) but not require.XXX(t, blah)
sed -i 's/\brequire\.\([a-zA-Z0-9_]*\)(\(t[^,]\)/require.\1(t,\2/g' $f
# require.XXX(rblah) but not require.XXX(r, blah)
sed -i 's/\brequire\.\([a-zA-Z0-9_]*\)(\(r[^,]\)/require.\1(t,\2/g' $f
gofmt -s -w $f
done
for f in $(git grep '\bassert := assert\.New(' | cut -d':' -f1 | sort -u); do
echo "=== assert: $f ==="
sed -i '/assert := assert.New(t)/d' $f
# assert.XXX(blah) but not assert.XXX(tblah) or assert.XXX(rblah)
sed -i 's/\bassert\.\([a-zA-Z0-9_]*\)(\([^tr]\)/assert.\1(t,\2/g' $f
# assert.XXX(tblah) but not assert.XXX(t, blah)
sed -i 's/\bassert\.\([a-zA-Z0-9_]*\)(\(t[^,]\)/assert.\1(t,\2/g' $f
# assert.XXX(rblah) but not assert.XXX(r, blah)
sed -i 's/\bassert\.\([a-zA-Z0-9_]*\)(\(r[^,]\)/assert.\1(t,\2/g' $f
gofmt -s -w $f
done
2022-01-20 16:46:23 +00:00
|
|
|
require.Equal(t, tt.want, state.Changed(otherNS, otherToken))
|
2018-10-03 12:36:38 +00:00
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
2019-07-12 21:19:37 +00:00
|
|
|
|
2022-06-01 15:18:06 +00:00
|
|
|
func recordWatches(sc *stateConfig) *watchRecorder {
|
|
|
|
wr := newWatchRecorder()
|
|
|
|
|
|
|
|
sc.dataSources = DataSources{
|
|
|
|
CARoots: typedWatchRecorder[*structs.DCSpecificRequest]{wr},
|
|
|
|
CompiledDiscoveryChain: typedWatchRecorder[*structs.DiscoveryChainRequest]{wr},
|
|
|
|
ConfigEntry: typedWatchRecorder[*structs.ConfigEntryQuery]{wr},
|
|
|
|
ConfigEntryList: typedWatchRecorder[*structs.ConfigEntryQuery]{wr},
|
|
|
|
Datacenters: typedWatchRecorder[*structs.DatacentersRequest]{wr},
|
|
|
|
FederationStateListMeshGateways: typedWatchRecorder[*structs.DCSpecificRequest]{wr},
|
|
|
|
GatewayServices: typedWatchRecorder[*structs.ServiceSpecificRequest]{wr},
|
2022-07-14 18:45:51 +00:00
|
|
|
ServiceGateways: typedWatchRecorder[*structs.ServiceSpecificRequest]{wr},
|
2022-06-01 15:18:06 +00:00
|
|
|
Health: typedWatchRecorder[*structs.ServiceSpecificRequest]{wr},
|
|
|
|
HTTPChecks: typedWatchRecorder[*cachetype.ServiceHTTPChecksRequest]{wr},
|
2022-07-01 15:15:49 +00:00
|
|
|
Intentions: typedWatchRecorder[*structs.ServiceSpecificRequest]{wr},
|
2022-06-01 15:18:06 +00:00
|
|
|
IntentionUpstreams: typedWatchRecorder[*structs.ServiceSpecificRequest]{wr},
|
2022-07-14 18:45:51 +00:00
|
|
|
IntentionUpstreamsDestination: typedWatchRecorder[*structs.ServiceSpecificRequest]{wr},
|
2022-06-01 15:18:06 +00:00
|
|
|
InternalServiceDump: typedWatchRecorder[*structs.ServiceDumpRequest]{wr},
|
|
|
|
LeafCertificate: typedWatchRecorder[*cachetype.ConnectCALeafRequest]{wr},
|
2022-09-26 16:50:17 +00:00
|
|
|
PeeringList: typedWatchRecorder[*cachetype.PeeringListRequest]{wr},
|
2022-07-13 16:14:57 +00:00
|
|
|
PeeredUpstreams: typedWatchRecorder[*structs.PartitionSpecificRequest]{wr},
|
2022-06-01 15:18:06 +00:00
|
|
|
PreparedQuery: typedWatchRecorder[*structs.PreparedQueryExecuteRequest]{wr},
|
|
|
|
ResolvedServiceConfig: typedWatchRecorder[*structs.ServiceConfigRequest]{wr},
|
|
|
|
ServiceList: typedWatchRecorder[*structs.DCSpecificRequest]{wr},
|
2022-07-12 23:18:05 +00:00
|
|
|
TrustBundle: typedWatchRecorder[*cachetype.TrustBundleReadRequest]{wr},
|
|
|
|
TrustBundleList: typedWatchRecorder[*cachetype.TrustBundleListRequest]{wr},
|
2022-06-06 19:20:41 +00:00
|
|
|
ExportedPeeredServices: typedWatchRecorder[*structs.DCSpecificRequest]{wr},
|
2022-06-01 15:18:06 +00:00
|
|
|
}
|
|
|
|
recordWatchesEnterprise(sc, wr)
|
2019-07-12 21:19:37 +00:00
|
|
|
|
2022-06-01 15:18:06 +00:00
|
|
|
return wr
|
2019-07-12 21:19:37 +00:00
|
|
|
}
|
|
|
|
|
2022-06-01 15:18:06 +00:00
|
|
|
func newWatchRecorder() *watchRecorder {
|
|
|
|
return &watchRecorder{
|
|
|
|
watches: make(map[string]any),
|
2019-07-12 21:19:37 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-06-01 15:18:06 +00:00
|
|
|
type watchRecorder struct {
|
|
|
|
mu sync.Mutex
|
|
|
|
watches map[string]any
|
2022-05-20 14:47:40 +00:00
|
|
|
}
|
|
|
|
|
2022-06-01 15:18:06 +00:00
|
|
|
func (r *watchRecorder) record(correlationID string, req any) {
|
|
|
|
r.mu.Lock()
|
|
|
|
r.watches[correlationID] = req
|
|
|
|
r.mu.Unlock()
|
2019-07-12 21:19:37 +00:00
|
|
|
}
|
|
|
|
|
2022-06-01 15:18:06 +00:00
|
|
|
func (r *watchRecorder) verify(t *testing.T, correlationID string, verifyFn verifyWatchRequest) {
|
|
|
|
t.Helper()
|
2021-02-23 17:52:54 +00:00
|
|
|
|
2022-06-01 15:18:06 +00:00
|
|
|
r.mu.Lock()
|
|
|
|
req, ok := r.watches[correlationID]
|
|
|
|
r.mu.Unlock()
|
|
|
|
|
|
|
|
require.True(t, ok, "No such watch for Correlation ID: %q", correlationID)
|
2019-07-12 21:19:37 +00:00
|
|
|
|
2022-06-01 15:18:06 +00:00
|
|
|
if verifyFn != nil {
|
|
|
|
verifyFn(t, req)
|
|
|
|
}
|
2019-07-12 21:19:37 +00:00
|
|
|
}
|
|
|
|
|
2022-06-01 15:18:06 +00:00
|
|
|
type typedWatchRecorder[ReqType any] struct {
|
|
|
|
recorder *watchRecorder
|
2019-07-12 21:19:37 +00:00
|
|
|
}
|
|
|
|
|
2022-06-01 15:18:06 +00:00
|
|
|
func (r typedWatchRecorder[ReqType]) Notify(_ context.Context, req ReqType, correlationID string, _ chan<- UpdateEvent) error {
|
|
|
|
r.recorder.record(correlationID, req)
|
|
|
|
return nil
|
|
|
|
}
|
2019-07-12 21:19:37 +00:00
|
|
|
|
2022-06-01 15:18:06 +00:00
|
|
|
type verifyWatchRequest func(t testing.TB, request any)
|
2019-07-12 21:19:37 +00:00
|
|
|
|
2022-06-01 15:18:06 +00:00
|
|
|
func genVerifyDCSpecificWatch(expectedDatacenter string) verifyWatchRequest {
|
|
|
|
return func(t testing.TB, request any) {
|
2019-07-12 21:19:37 +00:00
|
|
|
reqReal, ok := request.(*structs.DCSpecificRequest)
|
2022-11-07 18:17:46 +00:00
|
|
|
reqReal.QueryOptions = structs.QueryOptions{
|
|
|
|
Token: aclToken,
|
|
|
|
}
|
2019-07-12 21:19:37 +00:00
|
|
|
require.True(t, ok)
|
2022-11-07 15:00:11 +00:00
|
|
|
require.Equal(t, aclToken, reqReal.Token)
|
2019-07-12 21:19:37 +00:00
|
|
|
require.Equal(t, expectedDatacenter, reqReal.Datacenter)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-06-01 15:18:06 +00:00
|
|
|
func verifyDatacentersWatch(t testing.TB, request any) {
|
2019-07-12 21:19:37 +00:00
|
|
|
_, ok := request.(*structs.DatacentersRequest)
|
|
|
|
require.True(t, ok)
|
|
|
|
}
|
|
|
|
|
2022-06-01 21:53:52 +00:00
|
|
|
func genVerifyTrustBundleReadWatch(peer string) verifyWatchRequest {
|
|
|
|
return func(t testing.TB, request any) {
|
2022-07-12 23:18:05 +00:00
|
|
|
reqReal, ok := request.(*cachetype.TrustBundleReadRequest)
|
2022-06-01 21:53:52 +00:00
|
|
|
require.True(t, ok)
|
2022-11-07 15:00:11 +00:00
|
|
|
require.Equal(t, aclToken, reqReal.Token)
|
2022-07-12 23:18:05 +00:00
|
|
|
require.Equal(t, peer, reqReal.Request.Name)
|
2022-06-01 21:53:52 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-04-27 23:36:20 +00:00
|
|
|
func genVerifyLeafWatchWithDNSSANs(expectedService string, expectedDatacenter string, expectedDNSSANs []string) verifyWatchRequest {
|
2022-06-01 15:18:06 +00:00
|
|
|
return func(t testing.TB, request any) {
|
2019-07-12 21:19:37 +00:00
|
|
|
reqReal, ok := request.(*cachetype.ConnectCALeafRequest)
|
2022-11-07 18:17:46 +00:00
|
|
|
reqReal.Token = aclToken
|
2019-07-12 21:19:37 +00:00
|
|
|
require.True(t, ok)
|
2022-11-07 15:00:11 +00:00
|
|
|
require.Equal(t, aclToken, reqReal.Token)
|
2019-07-12 21:19:37 +00:00
|
|
|
require.Equal(t, expectedDatacenter, reqReal.Datacenter)
|
|
|
|
require.Equal(t, expectedService, reqReal.Service)
|
2020-04-27 23:36:20 +00:00
|
|
|
require.ElementsMatch(t, expectedDNSSANs, reqReal.DNSSAN)
|
2019-07-12 21:19:37 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-04-27 23:36:20 +00:00
|
|
|
func genVerifyLeafWatch(expectedService string, expectedDatacenter string) verifyWatchRequest {
|
|
|
|
return genVerifyLeafWatchWithDNSSANs(expectedService, expectedDatacenter, nil)
|
|
|
|
}
|
|
|
|
|
2022-06-01 20:31:37 +00:00
|
|
|
func genVerifyTrustBundleListWatch(service string) verifyWatchRequest {
|
|
|
|
return func(t testing.TB, request any) {
|
2022-07-12 23:18:05 +00:00
|
|
|
reqReal, ok := request.(*cachetype.TrustBundleListRequest)
|
2022-06-01 20:31:37 +00:00
|
|
|
require.True(t, ok)
|
2022-11-07 15:00:11 +00:00
|
|
|
require.Equal(t, aclToken, reqReal.Token)
|
2022-07-12 23:18:05 +00:00
|
|
|
require.Equal(t, service, reqReal.Request.ServiceName)
|
2022-06-01 20:31:37 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-06-15 19:36:18 +00:00
|
|
|
func genVerifyTrustBundleListWatchForMeshGateway(partition string) verifyWatchRequest {
|
|
|
|
return func(t testing.TB, request any) {
|
2022-07-12 23:18:05 +00:00
|
|
|
reqReal, ok := request.(*cachetype.TrustBundleListRequest)
|
2022-11-07 18:17:46 +00:00
|
|
|
reqReal.QueryOptions = structs.QueryOptions{
|
|
|
|
Token: aclToken,
|
|
|
|
}
|
2022-06-15 19:36:18 +00:00
|
|
|
require.True(t, ok)
|
2022-07-12 23:18:05 +00:00
|
|
|
require.Equal(t, string(structs.ServiceKindMeshGateway), reqReal.Request.Kind)
|
|
|
|
require.True(t, acl.EqualPartitions(partition, reqReal.Request.Partition), "%q != %q", partition, reqReal.Request.Partition)
|
2022-11-07 15:00:11 +00:00
|
|
|
require.Equal(t, aclToken, reqReal.Token)
|
2022-07-12 23:18:05 +00:00
|
|
|
require.NotEmpty(t, reqReal.Request.ServiceName)
|
2022-06-15 19:36:18 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-09-26 16:50:17 +00:00
|
|
|
func genVerifyPeeringListWatchForMeshGateway() verifyWatchRequest {
|
|
|
|
return func(t testing.TB, request any) {
|
|
|
|
reqReal, ok := request.(*cachetype.PeeringListRequest)
|
|
|
|
require.True(t, ok)
|
2022-11-07 15:00:11 +00:00
|
|
|
require.Equal(t, aclToken, reqReal.Token)
|
2022-10-13 23:12:05 +00:00
|
|
|
require.Equal(t, acl.WildcardPartitionName, reqReal.Request.Partition)
|
2022-09-26 16:50:17 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-04-14 14:59:23 +00:00
|
|
|
func genVerifyResolverWatch(expectedService, expectedDatacenter, expectedKind string) verifyWatchRequest {
|
2022-06-01 15:18:06 +00:00
|
|
|
return func(t testing.TB, request any) {
|
2020-04-14 14:59:23 +00:00
|
|
|
reqReal, ok := request.(*structs.ConfigEntryQuery)
|
|
|
|
require.True(t, ok)
|
2022-11-07 15:00:11 +00:00
|
|
|
require.Equal(t, aclToken, reqReal.Token)
|
2020-04-14 14:59:23 +00:00
|
|
|
require.Equal(t, expectedDatacenter, reqReal.Datacenter)
|
|
|
|
require.Equal(t, expectedService, reqReal.Name)
|
|
|
|
require.Equal(t, expectedKind, reqReal.Kind)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-08-27 17:20:58 +00:00
|
|
|
func genVerifyResolvedConfigWatch(expectedService string, expectedDatacenter string) verifyWatchRequest {
|
2022-06-01 15:18:06 +00:00
|
|
|
return func(t testing.TB, request any) {
|
2020-08-27 17:20:58 +00:00
|
|
|
reqReal, ok := request.(*structs.ServiceConfigRequest)
|
|
|
|
require.True(t, ok)
|
2022-11-07 15:00:11 +00:00
|
|
|
require.Equal(t, aclToken, reqReal.Token)
|
2020-08-27 17:20:58 +00:00
|
|
|
require.Equal(t, expectedDatacenter, reqReal.Datacenter)
|
|
|
|
require.Equal(t, expectedService, reqReal.Name)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-07-12 21:19:37 +00:00
|
|
|
func genVerifyIntentionWatch(expectedService string, expectedDatacenter string) verifyWatchRequest {
|
2022-06-01 15:18:06 +00:00
|
|
|
return func(t testing.TB, request any) {
|
2022-07-01 15:15:49 +00:00
|
|
|
reqReal, ok := request.(*structs.ServiceSpecificRequest)
|
2022-11-07 18:17:46 +00:00
|
|
|
reqReal.QueryOptions = structs.QueryOptions{
|
|
|
|
Token: aclToken,
|
|
|
|
}
|
2019-07-12 21:19:37 +00:00
|
|
|
require.True(t, ok)
|
2022-11-07 15:00:11 +00:00
|
|
|
require.Equal(t, aclToken, reqReal.Token)
|
2019-07-12 21:19:37 +00:00
|
|
|
require.Equal(t, expectedDatacenter, reqReal.Datacenter)
|
2022-07-01 15:15:49 +00:00
|
|
|
require.Equal(t, expectedService, reqReal.ServiceName)
|
2019-07-12 21:19:37 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func genVerifyPreparedQueryWatch(expectedName string, expectedDatacenter string) verifyWatchRequest {
|
2022-06-01 15:18:06 +00:00
|
|
|
return func(t testing.TB, request any) {
|
2019-07-12 21:19:37 +00:00
|
|
|
reqReal, ok := request.(*structs.PreparedQueryExecuteRequest)
|
2022-11-07 18:17:46 +00:00
|
|
|
reqReal.QueryOptions = structs.QueryOptions{
|
|
|
|
Token: aclToken,
|
|
|
|
}
|
2019-07-12 21:19:37 +00:00
|
|
|
require.True(t, ok)
|
2022-11-07 15:00:11 +00:00
|
|
|
require.Equal(t, aclToken, reqReal.Token)
|
2019-07-12 21:19:37 +00:00
|
|
|
require.Equal(t, expectedDatacenter, reqReal.Datacenter)
|
|
|
|
require.Equal(t, expectedName, reqReal.QueryIDOrName)
|
|
|
|
require.Equal(t, true, reqReal.Connect)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-08-02 03:03:34 +00:00
|
|
|
func genVerifyDiscoveryChainWatch(expected *structs.DiscoveryChainRequest) verifyWatchRequest {
|
2022-06-01 15:18:06 +00:00
|
|
|
return func(t testing.TB, request any) {
|
2019-07-12 21:19:37 +00:00
|
|
|
reqReal, ok := request.(*structs.DiscoveryChainRequest)
|
2022-11-07 18:17:46 +00:00
|
|
|
reqReal.QueryOptions = structs.QueryOptions{
|
|
|
|
Token: aclToken,
|
|
|
|
}
|
2019-07-12 21:19:37 +00:00
|
|
|
require.True(t, ok)
|
2022-11-07 15:00:11 +00:00
|
|
|
require.Equal(t, aclToken, reqReal.Token)
|
2019-08-02 03:03:34 +00:00
|
|
|
require.Equal(t, expected, reqReal)
|
2019-07-12 21:19:37 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-04-28 22:13:29 +00:00
|
|
|
func genVerifyMeshConfigWatch(expectedDatacenter string) verifyWatchRequest {
|
2022-06-01 15:18:06 +00:00
|
|
|
return func(t testing.TB, request any) {
|
2021-04-06 18:19:59 +00:00
|
|
|
reqReal, ok := request.(*structs.ConfigEntryQuery)
|
2022-11-07 18:17:46 +00:00
|
|
|
reqReal.QueryOptions = structs.QueryOptions{
|
|
|
|
Token: aclToken,
|
|
|
|
}
|
2021-04-06 18:19:59 +00:00
|
|
|
require.True(t, ok)
|
2022-11-07 15:00:11 +00:00
|
|
|
require.Equal(t, aclToken, reqReal.Token)
|
2021-04-06 18:19:59 +00:00
|
|
|
require.Equal(t, expectedDatacenter, reqReal.Datacenter)
|
2021-04-28 22:13:29 +00:00
|
|
|
require.Equal(t, structs.MeshConfigMesh, reqReal.Name)
|
|
|
|
require.Equal(t, structs.MeshConfig, reqReal.Kind)
|
2021-04-06 18:19:59 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-07-12 21:19:37 +00:00
|
|
|
func genVerifyGatewayWatch(expectedDatacenter string) verifyWatchRequest {
|
2022-06-01 15:18:06 +00:00
|
|
|
return func(t testing.TB, request any) {
|
2019-07-12 21:19:37 +00:00
|
|
|
reqReal, ok := request.(*structs.ServiceDumpRequest)
|
|
|
|
require.True(t, ok)
|
2022-11-07 15:00:11 +00:00
|
|
|
require.Equal(t, aclToken, reqReal.Token)
|
2019-07-12 21:19:37 +00:00
|
|
|
require.Equal(t, expectedDatacenter, reqReal.Datacenter)
|
|
|
|
require.True(t, reqReal.UseServiceKind)
|
|
|
|
require.Equal(t, structs.ServiceKindMeshGateway, reqReal.ServiceKind)
|
2021-07-22 18:20:45 +00:00
|
|
|
require.Equal(t, structs.DefaultEnterpriseMetaInDefaultPartition(), &reqReal.EnterpriseMeta)
|
2019-07-12 21:19:37 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-06-01 15:18:06 +00:00
|
|
|
func genVerifyServiceSpecificRequest(expectedService, expectedFilter, expectedDatacenter string, connect bool) verifyWatchRequest {
|
2022-06-03 21:42:50 +00:00
|
|
|
return genVerifyServiceSpecificPeeredRequest(expectedService, expectedFilter, expectedDatacenter, "", connect)
|
|
|
|
}
|
|
|
|
|
|
|
|
func genVerifyServiceSpecificPeeredRequest(expectedService, expectedFilter, expectedDatacenter, expectedPeer string, connect bool) verifyWatchRequest {
|
2022-06-01 15:18:06 +00:00
|
|
|
return func(t testing.TB, request any) {
|
2019-07-12 21:19:37 +00:00
|
|
|
reqReal, ok := request.(*structs.ServiceSpecificRequest)
|
2022-11-07 18:17:46 +00:00
|
|
|
reqReal.QueryOptions = structs.QueryOptions{
|
|
|
|
Token: aclToken,
|
|
|
|
}
|
2019-07-12 21:19:37 +00:00
|
|
|
require.True(t, ok)
|
2022-11-07 15:00:11 +00:00
|
|
|
require.Equal(t, aclToken, reqReal.Token)
|
2019-07-12 21:19:37 +00:00
|
|
|
require.Equal(t, expectedDatacenter, reqReal.Datacenter)
|
2022-06-03 21:42:50 +00:00
|
|
|
require.Equal(t, expectedPeer, reqReal.PeerName)
|
2019-07-12 21:19:37 +00:00
|
|
|
require.Equal(t, expectedService, reqReal.ServiceName)
|
|
|
|
require.Equal(t, expectedFilter, reqReal.QueryOptions.Filter)
|
|
|
|
require.Equal(t, connect, reqReal.Connect)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-07-13 16:14:57 +00:00
|
|
|
func genVerifyPartitionSpecificRequest(expectedPartition, expectedDatacenter string) verifyWatchRequest {
|
|
|
|
return func(t testing.TB, request any) {
|
|
|
|
reqReal, ok := request.(*structs.PartitionSpecificRequest)
|
|
|
|
require.True(t, ok)
|
2022-11-07 15:00:11 +00:00
|
|
|
require.Equal(t, aclToken, reqReal.Token)
|
2022-07-13 16:14:57 +00:00
|
|
|
require.Equal(t, expectedDatacenter, reqReal.Datacenter)
|
|
|
|
require.Equal(t, expectedPartition, reqReal.PartitionOrDefault())
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-04-27 23:36:20 +00:00
|
|
|
func genVerifyGatewayServiceWatch(expectedService, expectedDatacenter string) verifyWatchRequest {
|
2022-06-01 15:18:06 +00:00
|
|
|
return genVerifyServiceSpecificRequest(expectedService, "", expectedDatacenter, false)
|
2020-04-27 23:36:20 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func genVerifyConfigEntryWatch(expectedKind, expectedName, expectedDatacenter string) verifyWatchRequest {
|
2022-06-01 15:18:06 +00:00
|
|
|
return func(t testing.TB, request any) {
|
2020-04-27 23:36:20 +00:00
|
|
|
reqReal, ok := request.(*structs.ConfigEntryQuery)
|
|
|
|
require.True(t, ok)
|
2022-11-07 15:00:11 +00:00
|
|
|
require.Equal(t, aclToken, reqReal.Token)
|
2020-04-27 23:36:20 +00:00
|
|
|
require.Equal(t, expectedKind, reqReal.Kind)
|
|
|
|
require.Equal(t, expectedName, reqReal.Name)
|
|
|
|
require.Equal(t, expectedDatacenter, reqReal.Datacenter)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-05-20 14:47:40 +00:00
|
|
|
func ingressConfigWatchEvent(gwTLS bool, mixedTLS bool) UpdateEvent {
|
2021-09-28 11:25:48 +00:00
|
|
|
e := &structs.IngressGatewayConfigEntry{
|
|
|
|
TLS: structs.GatewayTLSConfig{
|
|
|
|
Enabled: gwTLS,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
if mixedTLS {
|
|
|
|
// Add two listeners one with and one without connect TLS enabled
|
|
|
|
e.Listeners = []structs.IngressListener{
|
|
|
|
{
|
|
|
|
Port: 8080,
|
|
|
|
Protocol: "tcp",
|
|
|
|
TLS: &structs.GatewayTLSConfig{Enabled: true},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Port: 9090,
|
|
|
|
Protocol: "tcp",
|
|
|
|
TLS: nil,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-05-20 14:47:40 +00:00
|
|
|
return UpdateEvent{
|
2020-04-27 23:36:20 +00:00
|
|
|
CorrelationID: gatewayConfigWatchID,
|
|
|
|
Result: &structs.ConfigEntryResponse{
|
2021-09-28 11:25:48 +00:00
|
|
|
Entry: e,
|
2020-04-27 23:36:20 +00:00
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-01-20 16:12:04 +00:00
|
|
|
func upstreamIDForDC2(uid UpstreamID) UpstreamID {
|
|
|
|
uid.Datacenter = "dc2"
|
|
|
|
return uid
|
2021-06-15 18:00:26 +00:00
|
|
|
}
|
|
|
|
|
2019-07-12 21:19:37 +00:00
|
|
|
// This test is meant to exercise the various parts of the cache watching done by the state as
|
|
|
|
// well as its management of the ConfigSnapshot
|
|
|
|
//
|
|
|
|
// This test is expressly not calling Watch which in turn would execute the run function in a go
|
|
|
|
// routine. This allows the test to be fully synchronous and deterministic while still being able
|
|
|
|
// to validate the logic of most of the watching and state updating.
|
|
|
|
//
|
2022-10-21 19:58:06 +00:00
|
|
|
// The general strategy here is to:
|
2019-07-12 21:19:37 +00:00
|
|
|
//
|
2022-10-21 19:58:06 +00:00
|
|
|
// 1. Initialize a state with a call to newState + setting some of the extra stuff like the CacheNotifier
|
|
|
|
// We will not be using the CacheNotifier to send notifications but calling handleUpdate ourselves
|
|
|
|
// 2. Iterate through a list of verification stages performing validation and updates for each.
|
|
|
|
// a. Ensure that the required watches are in place and validate they are correct
|
|
|
|
// b. Process a bunch of UpdateEvents by calling handleUpdate
|
|
|
|
// c. Validate that the ConfigSnapshot has been updated appropriately
|
2019-07-12 21:19:37 +00:00
|
|
|
func TestState_WatchesAndUpdates(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
2019-10-17 21:46:49 +00:00
|
|
|
indexedRoots, issuedCert := TestCerts(t)
|
2022-06-01 21:53:52 +00:00
|
|
|
peerTrustBundles := TestPeerTrustBundles(t)
|
2019-10-17 21:46:49 +00:00
|
|
|
|
2021-04-15 19:54:40 +00:00
|
|
|
// Used to account for differences in OSS/ent implementations of ServiceID.String()
|
|
|
|
var (
|
|
|
|
db = structs.NewServiceName("db", nil)
|
|
|
|
billing = structs.NewServiceName("billing", nil)
|
|
|
|
api = structs.NewServiceName("api", nil)
|
2022-05-04 20:25:25 +00:00
|
|
|
apiA = structs.NewServiceName("api-a", nil)
|
2022-01-20 16:12:04 +00:00
|
|
|
|
2022-05-04 20:25:25 +00:00
|
|
|
apiUID = NewUpstreamIDFromServiceName(api)
|
|
|
|
dbUID = NewUpstreamIDFromServiceName(db)
|
|
|
|
pqUID = UpstreamIDFromString("prepared_query:query")
|
|
|
|
extApiUID = NewUpstreamIDFromServiceName(apiA)
|
2022-07-13 16:14:57 +00:00
|
|
|
extDBUID = NewUpstreamIDFromServiceName(db)
|
2021-04-15 19:54:40 +00:00
|
|
|
)
|
2022-05-04 20:25:25 +00:00
|
|
|
// TODO(peering): NewUpstreamIDFromServiceName should take a PeerName
|
|
|
|
extApiUID.Peer = "peer-a"
|
2022-07-13 16:14:57 +00:00
|
|
|
extDBUID.Peer = "peer-a"
|
2021-04-15 19:54:40 +00:00
|
|
|
|
2022-06-03 21:42:50 +00:00
|
|
|
const peerTrustDomain = "1c053652-8512-4373-90cf-5a7f6263a994.consul"
|
|
|
|
|
2022-05-20 14:47:40 +00:00
|
|
|
rootWatchEvent := func() UpdateEvent {
|
|
|
|
return UpdateEvent{
|
2019-10-17 21:46:49 +00:00
|
|
|
CorrelationID: rootsWatchID,
|
|
|
|
Result: indexedRoots,
|
|
|
|
Err: nil,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-07-12 21:19:37 +00:00
|
|
|
type verificationStage struct {
|
|
|
|
requiredWatches map[string]verifyWatchRequest
|
2022-05-20 14:47:40 +00:00
|
|
|
events []UpdateEvent
|
2019-07-12 21:19:37 +00:00
|
|
|
verifySnapshot func(t testing.TB, snap *ConfigSnapshot)
|
|
|
|
}
|
|
|
|
|
|
|
|
type testCase struct {
|
|
|
|
// the state to operate on. the logger, source, cache,
|
|
|
|
// ctx and cancel fields will be filled in by the test
|
|
|
|
ns structs.NodeService
|
|
|
|
sourceDC string
|
|
|
|
stages []verificationStage
|
|
|
|
}
|
|
|
|
|
2019-08-02 03:03:34 +00:00
|
|
|
newConnectProxyCase := func(meshGatewayProxyConfigValue structs.MeshGatewayMode) testCase {
|
|
|
|
ns := structs.NodeService{
|
|
|
|
Kind: structs.ServiceKindConnectProxy,
|
|
|
|
ID: "web-sidecar-proxy",
|
|
|
|
Service: "web-sidecar-proxy",
|
|
|
|
Address: "10.0.1.1",
|
|
|
|
Port: 443,
|
|
|
|
Proxy: structs.ConnectProxyConfig{
|
|
|
|
DestinationServiceName: "web",
|
|
|
|
Upstreams: structs.Upstreams{
|
|
|
|
structs.Upstream{
|
|
|
|
DestinationType: structs.UpstreamDestTypePreparedQuery,
|
|
|
|
DestinationName: "query",
|
|
|
|
LocalBindPort: 10001,
|
|
|
|
},
|
|
|
|
structs.Upstream{
|
|
|
|
DestinationType: structs.UpstreamDestTypeService,
|
|
|
|
DestinationName: "api",
|
|
|
|
LocalBindPort: 10002,
|
|
|
|
},
|
|
|
|
structs.Upstream{
|
|
|
|
DestinationType: structs.UpstreamDestTypeService,
|
|
|
|
DestinationName: "api-failover-remote",
|
|
|
|
Datacenter: "dc2",
|
|
|
|
LocalBindPort: 10003,
|
|
|
|
MeshGateway: structs.MeshGatewayConfig{
|
|
|
|
Mode: structs.MeshGatewayModeRemote,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
structs.Upstream{
|
|
|
|
DestinationType: structs.UpstreamDestTypeService,
|
|
|
|
DestinationName: "api-failover-local",
|
|
|
|
Datacenter: "dc2",
|
|
|
|
LocalBindPort: 10004,
|
|
|
|
MeshGateway: structs.MeshGatewayConfig{
|
|
|
|
Mode: structs.MeshGatewayModeLocal,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
structs.Upstream{
|
|
|
|
DestinationType: structs.UpstreamDestTypeService,
|
|
|
|
DestinationName: "api-failover-direct",
|
|
|
|
Datacenter: "dc2",
|
|
|
|
LocalBindPort: 10005,
|
|
|
|
MeshGateway: structs.MeshGatewayConfig{
|
|
|
|
Mode: structs.MeshGatewayModeNone,
|
|
|
|
},
|
|
|
|
},
|
2022-08-30 15:46:34 +00:00
|
|
|
structs.Upstream{
|
|
|
|
DestinationType: structs.UpstreamDestTypeService,
|
|
|
|
DestinationName: "api-failover-to-peer",
|
|
|
|
LocalBindPort: 10007,
|
|
|
|
},
|
2019-08-02 03:03:34 +00:00
|
|
|
structs.Upstream{
|
|
|
|
DestinationType: structs.UpstreamDestTypeService,
|
|
|
|
DestinationName: "api-dc2",
|
|
|
|
LocalBindPort: 10006,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
if meshGatewayProxyConfigValue != structs.MeshGatewayModeDefault {
|
Fix mesh gateway configuration with proxy-defaults (#15186)
* Fix mesh gateway proxy-defaults not affecting upstreams.
* Clarify distinction with upstream settings
Top-level mesh gateway mode in proxy-defaults and service-defaults gets
merged into NodeService.Proxy.MeshGateway, and only gets merged with
the mode attached to an an upstream in proxycfg/xds.
* Fix mgw mode usage for peered upstreams
There were a couple issues with how mgw mode was being handled for
peered upstreams.
For starters, mesh gateway mode from proxy-defaults
and the top-level of service-defaults gets stored in
NodeService.Proxy.MeshGateway, but the upstream watch for peered data
was only considering the mesh gateway config attached in
NodeService.Proxy.Upstreams[i]. This means that applying a mesh gateway
mode via global proxy-defaults or service-defaults on the downstream
would not have an effect.
Separately, transparent proxy watches for peered upstreams didn't
consider mesh gateway mode at all.
This commit addresses the first issue by ensuring that we overlay the
upstream config for peered upstreams as we do for non-peered. The second
issue is addressed by re-using setupWatchesForPeeredUpstream when
handling transparent proxy updates.
Note that for transparent proxies we do not yet support mesh gateway
mode per upstream, so the NodeService.Proxy.MeshGateway mode is used.
* Fix upstream mesh gateway mode handling in xds
This commit ensures that when determining the mesh gateway mode for
peered upstreams we consider the NodeService.Proxy.MeshGateway config as
a baseline.
In absense of this change, setting a mesh gateway mode via
proxy-defaults or the top-level of service-defaults will not have an
effect for peered upstreams.
* Merge service/proxy defaults in cfg resolver
Previously the mesh gateway mode for connect proxies would be
merged at three points:
1. On servers, in ComputeResolvedServiceConfig.
2. On clients, in MergeServiceConfig.
3. On clients, in proxycfg/xds.
The first merge returns a ServiceConfigResponse where there is a
top-level MeshGateway config from proxy/service-defaults, along with
per-upstream config.
The second merge combines per-upstream config specified at the service
instance with per-upstream config specified centrally.
The third merge combines the NodeService.Proxy.MeshGateway
config containing proxy/service-defaults data with the per-upstream
mode. This third merge is easy to miss, which led to peered upstreams
not considering the mesh gateway mode from proxy-defaults.
This commit removes the third merge, and ensures that all mesh gateway
config is available at the upstream. This way proxycfg/xds do not need
to do additional overlays.
* Ensure that proxy-defaults is considered in wc
Upstream defaults become a synthetic Upstream definition under a
wildcard key "*". Now that proxycfg/xds expect Upstream definitions to
have the final MeshGateway values, this commit ensures that values from
proxy-defaults/service-defaults are the default for this synthetic
upstream.
* Add changelog.
Co-authored-by: freddygv <freddy@hashicorp.com>
2022-11-09 16:14:29 +00:00
|
|
|
for i := range ns.Proxy.Upstreams {
|
|
|
|
if u := &ns.Proxy.Upstreams[i]; u.MeshGateway.Mode == structs.MeshGatewayModeDefault {
|
|
|
|
u.MeshGateway.Mode = meshGatewayProxyConfigValue
|
|
|
|
}
|
|
|
|
}
|
2019-08-02 03:03:34 +00:00
|
|
|
}
|
|
|
|
|
2020-08-27 17:20:58 +00:00
|
|
|
ixnMatch := TestIntentions()
|
|
|
|
|
2019-08-02 03:03:34 +00:00
|
|
|
stage0 := verificationStage{
|
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2022-06-01 15:18:06 +00:00
|
|
|
intentionsWatchID: genVerifyIntentionWatch("web", "dc1"),
|
|
|
|
meshConfigEntryID: genVerifyMeshConfigWatch("dc1"),
|
2022-01-20 16:12:04 +00:00
|
|
|
fmt.Sprintf("discovery-chain:%s", apiUID.String()): genVerifyDiscoveryChainWatch(&structs.DiscoveryChainRequest{
|
2019-08-02 03:03:34 +00:00
|
|
|
Name: "api",
|
|
|
|
EvaluateInDatacenter: "dc1",
|
2020-02-06 15:52:25 +00:00
|
|
|
EvaluateInNamespace: "default",
|
2021-09-07 20:29:32 +00:00
|
|
|
EvaluateInPartition: "default",
|
2019-08-02 03:03:34 +00:00
|
|
|
Datacenter: "dc1",
|
|
|
|
OverrideMeshGateway: structs.MeshGatewayConfig{
|
|
|
|
Mode: meshGatewayProxyConfigValue,
|
|
|
|
},
|
2022-11-07 15:00:11 +00:00
|
|
|
QueryOptions: structs.QueryOptions{
|
|
|
|
Token: aclToken,
|
|
|
|
},
|
2019-08-02 03:03:34 +00:00
|
|
|
}),
|
2022-01-20 16:12:04 +00:00
|
|
|
fmt.Sprintf("discovery-chain:%s-failover-remote?dc=dc2", apiUID.String()): genVerifyDiscoveryChainWatch(&structs.DiscoveryChainRequest{
|
2019-08-02 03:03:34 +00:00
|
|
|
Name: "api-failover-remote",
|
|
|
|
EvaluateInDatacenter: "dc2",
|
2020-02-06 15:52:25 +00:00
|
|
|
EvaluateInNamespace: "default",
|
2021-09-07 20:29:32 +00:00
|
|
|
EvaluateInPartition: "default",
|
2019-08-02 03:03:34 +00:00
|
|
|
Datacenter: "dc1",
|
|
|
|
OverrideMeshGateway: structs.MeshGatewayConfig{
|
|
|
|
Mode: structs.MeshGatewayModeRemote,
|
|
|
|
},
|
2022-11-07 15:00:11 +00:00
|
|
|
QueryOptions: structs.QueryOptions{
|
|
|
|
Token: aclToken,
|
|
|
|
},
|
2019-08-02 03:03:34 +00:00
|
|
|
}),
|
2022-01-20 16:12:04 +00:00
|
|
|
fmt.Sprintf("discovery-chain:%s-failover-local?dc=dc2", apiUID.String()): genVerifyDiscoveryChainWatch(&structs.DiscoveryChainRequest{
|
2019-08-02 03:03:34 +00:00
|
|
|
Name: "api-failover-local",
|
|
|
|
EvaluateInDatacenter: "dc2",
|
2020-02-06 15:52:25 +00:00
|
|
|
EvaluateInNamespace: "default",
|
2021-09-07 20:29:32 +00:00
|
|
|
EvaluateInPartition: "default",
|
2019-08-02 03:03:34 +00:00
|
|
|
Datacenter: "dc1",
|
|
|
|
OverrideMeshGateway: structs.MeshGatewayConfig{
|
|
|
|
Mode: structs.MeshGatewayModeLocal,
|
|
|
|
},
|
2022-11-07 15:00:11 +00:00
|
|
|
QueryOptions: structs.QueryOptions{
|
|
|
|
Token: aclToken,
|
|
|
|
},
|
2019-08-02 03:03:34 +00:00
|
|
|
}),
|
2022-01-20 16:12:04 +00:00
|
|
|
fmt.Sprintf("discovery-chain:%s-failover-direct?dc=dc2", apiUID.String()): genVerifyDiscoveryChainWatch(&structs.DiscoveryChainRequest{
|
2019-08-02 03:03:34 +00:00
|
|
|
Name: "api-failover-direct",
|
|
|
|
EvaluateInDatacenter: "dc2",
|
2020-02-06 15:52:25 +00:00
|
|
|
EvaluateInNamespace: "default",
|
2021-09-07 20:29:32 +00:00
|
|
|
EvaluateInPartition: "default",
|
2019-08-02 03:03:34 +00:00
|
|
|
Datacenter: "dc1",
|
|
|
|
OverrideMeshGateway: structs.MeshGatewayConfig{
|
|
|
|
Mode: structs.MeshGatewayModeNone,
|
|
|
|
},
|
2022-11-07 15:00:11 +00:00
|
|
|
QueryOptions: structs.QueryOptions{
|
|
|
|
Token: aclToken,
|
|
|
|
},
|
2019-08-02 03:03:34 +00:00
|
|
|
}),
|
2022-08-30 15:46:34 +00:00
|
|
|
fmt.Sprintf("discovery-chain:%s-failover-to-peer", apiUID.String()): genVerifyDiscoveryChainWatch(&structs.DiscoveryChainRequest{
|
|
|
|
Name: "api-failover-to-peer",
|
|
|
|
EvaluateInDatacenter: "dc1",
|
|
|
|
EvaluateInNamespace: "default",
|
|
|
|
EvaluateInPartition: "default",
|
|
|
|
Datacenter: "dc1",
|
|
|
|
OverrideMeshGateway: structs.MeshGatewayConfig{
|
|
|
|
Mode: meshGatewayProxyConfigValue,
|
|
|
|
},
|
2022-11-07 15:00:11 +00:00
|
|
|
QueryOptions: structs.QueryOptions{
|
|
|
|
Token: aclToken,
|
|
|
|
},
|
2022-08-30 15:46:34 +00:00
|
|
|
}),
|
2022-01-20 16:12:04 +00:00
|
|
|
fmt.Sprintf("discovery-chain:%s-dc2", apiUID.String()): genVerifyDiscoveryChainWatch(&structs.DiscoveryChainRequest{
|
2019-08-02 03:03:34 +00:00
|
|
|
Name: "api-dc2",
|
|
|
|
EvaluateInDatacenter: "dc1",
|
2020-02-06 15:52:25 +00:00
|
|
|
EvaluateInNamespace: "default",
|
2021-09-07 20:29:32 +00:00
|
|
|
EvaluateInPartition: "default",
|
2019-08-02 03:03:34 +00:00
|
|
|
Datacenter: "dc1",
|
|
|
|
OverrideMeshGateway: structs.MeshGatewayConfig{
|
|
|
|
Mode: meshGatewayProxyConfigValue,
|
|
|
|
},
|
2022-11-07 15:00:11 +00:00
|
|
|
QueryOptions: structs.QueryOptions{
|
|
|
|
Token: aclToken,
|
|
|
|
},
|
2019-08-02 03:03:34 +00:00
|
|
|
}),
|
2022-06-01 15:18:06 +00:00
|
|
|
"upstream:" + pqUID.String(): genVerifyPreparedQueryWatch("query", "dc1"),
|
|
|
|
rootsWatchID: genVerifyDCSpecificWatch("dc1"),
|
|
|
|
leafWatchID: genVerifyLeafWatch("web", "dc1"),
|
2019-08-02 03:03:34 +00:00
|
|
|
},
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2019-10-17 21:46:49 +00:00
|
|
|
rootWatchEvent(),
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2019-10-17 21:46:49 +00:00
|
|
|
CorrelationID: leafWatchID,
|
|
|
|
Result: issuedCert,
|
|
|
|
Err: nil,
|
|
|
|
},
|
2020-08-27 17:20:58 +00:00
|
|
|
{
|
|
|
|
CorrelationID: intentionsWatchID,
|
|
|
|
Result: ixnMatch,
|
|
|
|
Err: nil,
|
|
|
|
},
|
2022-03-30 18:43:59 +00:00
|
|
|
{
|
|
|
|
CorrelationID: meshConfigEntryID,
|
|
|
|
Result: &structs.ConfigEntryResponse{},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2022-01-20 16:12:04 +00:00
|
|
|
CorrelationID: fmt.Sprintf("discovery-chain:%s", apiUID.String()),
|
2019-08-02 03:03:34 +00:00
|
|
|
Result: &structs.DiscoveryChainResponse{
|
2021-10-22 23:15:05 +00:00
|
|
|
Chain: discoverychain.TestCompileConfigEntries(t, "api", "default", "default", "dc1", "trustdomain.consul",
|
2019-08-02 03:03:34 +00:00
|
|
|
func(req *discoverychain.CompileRequest) {
|
|
|
|
req.OverrideMeshGateway.Mode = meshGatewayProxyConfigValue
|
|
|
|
}),
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2022-01-20 16:12:04 +00:00
|
|
|
CorrelationID: fmt.Sprintf("discovery-chain:%s-failover-remote?dc=dc2", apiUID.String()),
|
2019-08-02 03:03:34 +00:00
|
|
|
Result: &structs.DiscoveryChainResponse{
|
2021-10-22 23:15:05 +00:00
|
|
|
Chain: discoverychain.TestCompileConfigEntries(t, "api-failover-remote", "default", "default", "dc2", "trustdomain.consul",
|
2019-08-02 03:03:34 +00:00
|
|
|
func(req *discoverychain.CompileRequest) {
|
|
|
|
req.OverrideMeshGateway.Mode = structs.MeshGatewayModeRemote
|
|
|
|
}),
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2022-01-20 16:12:04 +00:00
|
|
|
CorrelationID: fmt.Sprintf("discovery-chain:%s-failover-local?dc=dc2", apiUID.String()),
|
2019-08-02 03:03:34 +00:00
|
|
|
Result: &structs.DiscoveryChainResponse{
|
2021-10-22 23:15:05 +00:00
|
|
|
Chain: discoverychain.TestCompileConfigEntries(t, "api-failover-local", "default", "default", "dc2", "trustdomain.consul",
|
2019-08-02 03:03:34 +00:00
|
|
|
func(req *discoverychain.CompileRequest) {
|
|
|
|
req.OverrideMeshGateway.Mode = structs.MeshGatewayModeLocal
|
|
|
|
}),
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2022-01-20 16:12:04 +00:00
|
|
|
CorrelationID: fmt.Sprintf("discovery-chain:%s-failover-direct?dc=dc2", apiUID.String()),
|
2019-08-02 03:03:34 +00:00
|
|
|
Result: &structs.DiscoveryChainResponse{
|
2021-10-22 23:15:05 +00:00
|
|
|
Chain: discoverychain.TestCompileConfigEntries(t, "api-failover-direct", "default", "default", "dc2", "trustdomain.consul",
|
2019-08-02 03:03:34 +00:00
|
|
|
func(req *discoverychain.CompileRequest) {
|
|
|
|
req.OverrideMeshGateway.Mode = structs.MeshGatewayModeNone
|
|
|
|
}),
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2022-01-20 16:12:04 +00:00
|
|
|
CorrelationID: fmt.Sprintf("discovery-chain:%s-dc2", apiUID.String()),
|
2019-08-02 03:03:34 +00:00
|
|
|
Result: &structs.DiscoveryChainResponse{
|
2021-10-22 23:15:05 +00:00
|
|
|
Chain: discoverychain.TestCompileConfigEntries(t, "api-dc2", "default", "default", "dc1", "trustdomain.consul",
|
2019-08-02 03:03:34 +00:00
|
|
|
func(req *discoverychain.CompileRequest) {
|
|
|
|
req.OverrideMeshGateway.Mode = meshGatewayProxyConfigValue
|
2021-09-07 20:29:32 +00:00
|
|
|
}, &structs.ServiceResolverConfigEntry{
|
2019-08-02 03:03:34 +00:00
|
|
|
Kind: structs.ServiceResolver,
|
|
|
|
Name: "api-dc2",
|
|
|
|
Redirect: &structs.ServiceResolverRedirect{
|
|
|
|
Service: "api",
|
|
|
|
Datacenter: "dc2",
|
|
|
|
},
|
2021-09-07 20:29:32 +00:00
|
|
|
}),
|
2019-08-02 03:03:34 +00:00
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
2022-08-30 15:46:34 +00:00
|
|
|
{
|
|
|
|
CorrelationID: fmt.Sprintf("discovery-chain:%s-failover-to-peer", apiUID.String()),
|
|
|
|
Result: &structs.DiscoveryChainResponse{
|
|
|
|
Chain: discoverychain.TestCompileConfigEntries(t, "api-failover-to-peer", "default", "default", "dc1", "trustdomain.consul",
|
|
|
|
func(req *discoverychain.CompileRequest) {
|
|
|
|
req.OverrideMeshGateway.Mode = meshGatewayProxyConfigValue
|
|
|
|
}, &structs.ServiceResolverConfigEntry{
|
|
|
|
Kind: structs.ServiceResolver,
|
|
|
|
Name: "api-failover-to-peer",
|
|
|
|
Failover: map[string]structs.ServiceResolverFailover{
|
|
|
|
"*": {
|
|
|
|
Targets: []structs.ServiceResolverFailoverTarget{
|
|
|
|
{Peer: "cluster-01"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}),
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
2019-08-02 03:03:34 +00:00
|
|
|
},
|
2019-10-17 21:46:49 +00:00
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid())
|
2022-03-30 18:43:59 +00:00
|
|
|
require.True(t, snap.MeshGateway.isEmpty())
|
2019-10-17 21:46:49 +00:00
|
|
|
require.Equal(t, indexedRoots, snap.Roots)
|
|
|
|
|
|
|
|
require.Equal(t, issuedCert, snap.ConnectProxy.Leaf)
|
2022-08-30 15:46:34 +00:00
|
|
|
require.Len(t, snap.ConnectProxy.DiscoveryChain, 6, "%+v", snap.ConnectProxy.DiscoveryChain)
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedUpstreams, 6, "%+v", snap.ConnectProxy.WatchedUpstreams)
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedUpstreamEndpoints, 6, "%+v", snap.ConnectProxy.WatchedUpstreamEndpoints)
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedGateways, 6, "%+v", snap.ConnectProxy.WatchedGateways)
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedGatewayEndpoints, 6, "%+v", snap.ConnectProxy.WatchedGatewayEndpoints)
|
2019-10-17 21:46:49 +00:00
|
|
|
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedServiceChecks, 0, "%+v", snap.ConnectProxy.WatchedServiceChecks)
|
2020-01-24 15:04:58 +00:00
|
|
|
require.Len(t, snap.ConnectProxy.PreparedQueryEndpoints, 0, "%+v", snap.ConnectProxy.PreparedQueryEndpoints)
|
2020-08-27 17:20:58 +00:00
|
|
|
|
2022-08-30 15:46:34 +00:00
|
|
|
require.Equal(t, 1, snap.ConnectProxy.ConfigSnapshotUpstreams.PeerUpstreamEndpoints.Len())
|
|
|
|
require.Equal(t, 1, snap.ConnectProxy.ConfigSnapshotUpstreams.UpstreamPeerTrustBundles.Len())
|
|
|
|
|
2020-08-27 17:20:58 +00:00
|
|
|
require.True(t, snap.ConnectProxy.IntentionsSet)
|
2022-07-01 15:15:49 +00:00
|
|
|
require.Equal(t, ixnMatch, snap.ConnectProxy.Intentions)
|
2022-03-30 18:43:59 +00:00
|
|
|
require.True(t, snap.ConnectProxy.MeshConfigSet)
|
2022-12-07 19:07:42 +00:00
|
|
|
|
|
|
|
if meshGatewayProxyConfigValue == structs.MeshGatewayModeLocal {
|
|
|
|
require.True(t, snap.ConnectProxy.WatchedLocalGWEndpoints.IsWatched("dc1"))
|
|
|
|
_, ok := snap.ConnectProxy.WatchedLocalGWEndpoints.Get("dc1")
|
|
|
|
require.False(t, ok)
|
|
|
|
}
|
2019-10-17 21:46:49 +00:00
|
|
|
},
|
2019-08-02 03:03:34 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
stage1 := verificationStage{
|
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2022-06-01 15:18:06 +00:00
|
|
|
fmt.Sprintf("upstream-target:api.default.default.dc1:%s", apiUID.String()): genVerifyServiceSpecificRequest("api", "", "dc1", true),
|
|
|
|
fmt.Sprintf("upstream-target:api-failover-remote.default.default.dc2:%s-failover-remote?dc=dc2", apiUID.String()): genVerifyServiceSpecificRequest("api-failover-remote", "", "dc2", true),
|
|
|
|
fmt.Sprintf("upstream-target:api-failover-local.default.default.dc2:%s-failover-local?dc=dc2", apiUID.String()): genVerifyServiceSpecificRequest("api-failover-local", "", "dc2", true),
|
|
|
|
fmt.Sprintf("upstream-target:api-failover-direct.default.default.dc2:%s-failover-direct?dc=dc2", apiUID.String()): genVerifyServiceSpecificRequest("api-failover-direct", "", "dc2", true),
|
2022-08-30 15:46:34 +00:00
|
|
|
upstreamPeerWatchIDPrefix + fmt.Sprintf("%s-failover-to-peer?peer=cluster-01", apiUID.String()): genVerifyServiceSpecificPeeredRequest("api-failover-to-peer", "", "", "cluster-01", true),
|
2022-01-20 16:12:04 +00:00
|
|
|
fmt.Sprintf("mesh-gateway:dc2:%s-failover-remote?dc=dc2", apiUID.String()): genVerifyGatewayWatch("dc2"),
|
|
|
|
fmt.Sprintf("mesh-gateway:dc1:%s-failover-local?dc=dc2", apiUID.String()): genVerifyGatewayWatch("dc1"),
|
2019-08-02 03:03:34 +00:00
|
|
|
},
|
2019-10-17 21:46:49 +00:00
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid())
|
2022-03-30 18:43:59 +00:00
|
|
|
require.True(t, snap.MeshGateway.isEmpty())
|
2019-10-17 21:46:49 +00:00
|
|
|
require.Equal(t, indexedRoots, snap.Roots)
|
|
|
|
|
|
|
|
require.Equal(t, issuedCert, snap.ConnectProxy.Leaf)
|
2022-08-30 15:46:34 +00:00
|
|
|
require.Len(t, snap.ConnectProxy.DiscoveryChain, 6, "%+v", snap.ConnectProxy.DiscoveryChain)
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedUpstreams, 6, "%+v", snap.ConnectProxy.WatchedUpstreams)
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedUpstreamEndpoints, 6, "%+v", snap.ConnectProxy.WatchedUpstreamEndpoints)
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedGateways, 6, "%+v", snap.ConnectProxy.WatchedGateways)
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedGatewayEndpoints, 6, "%+v", snap.ConnectProxy.WatchedGatewayEndpoints)
|
2019-10-17 21:46:49 +00:00
|
|
|
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedServiceChecks, 0, "%+v", snap.ConnectProxy.WatchedServiceChecks)
|
2020-01-24 15:04:58 +00:00
|
|
|
require.Len(t, snap.ConnectProxy.PreparedQueryEndpoints, 0, "%+v", snap.ConnectProxy.PreparedQueryEndpoints)
|
2020-08-27 17:20:58 +00:00
|
|
|
|
2022-08-30 15:46:34 +00:00
|
|
|
require.Equal(t, 1, snap.ConnectProxy.ConfigSnapshotUpstreams.PeerUpstreamEndpoints.Len())
|
|
|
|
require.Equal(t, 1, snap.ConnectProxy.ConfigSnapshotUpstreams.UpstreamPeerTrustBundles.Len())
|
|
|
|
|
2020-08-27 17:20:58 +00:00
|
|
|
require.True(t, snap.ConnectProxy.IntentionsSet)
|
2022-07-01 15:15:49 +00:00
|
|
|
require.Equal(t, ixnMatch, snap.ConnectProxy.Intentions)
|
2022-12-07 19:07:42 +00:00
|
|
|
|
|
|
|
if meshGatewayProxyConfigValue == structs.MeshGatewayModeLocal {
|
|
|
|
require.True(t, snap.ConnectProxy.WatchedLocalGWEndpoints.IsWatched("dc1"))
|
|
|
|
_, ok := snap.ConnectProxy.WatchedLocalGWEndpoints.Get("dc1")
|
|
|
|
require.False(t, ok)
|
|
|
|
}
|
2019-10-17 21:46:49 +00:00
|
|
|
},
|
2019-08-02 03:03:34 +00:00
|
|
|
}
|
|
|
|
|
2019-08-05 18:30:35 +00:00
|
|
|
if meshGatewayProxyConfigValue == structs.MeshGatewayModeLocal {
|
2022-01-20 16:12:04 +00:00
|
|
|
stage1.requiredWatches[fmt.Sprintf("mesh-gateway:dc1:%s-dc2", apiUID.String())] = genVerifyGatewayWatch("dc1")
|
2019-08-02 03:03:34 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return testCase{
|
|
|
|
ns: ns,
|
|
|
|
sourceDC: "dc1",
|
|
|
|
stages: []verificationStage{stage0, stage1},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-07-01 15:15:49 +00:00
|
|
|
dbIxnMatch := structs.Intentions{
|
|
|
|
{
|
|
|
|
ID: "abc-123",
|
|
|
|
SourceNS: "default",
|
|
|
|
SourceName: "api",
|
|
|
|
DestinationNS: "default",
|
|
|
|
DestinationName: "db",
|
|
|
|
Action: structs.IntentionActionAllow,
|
2020-08-27 17:20:58 +00:00
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
dbConfig := &structs.ServiceConfigResponse{
|
|
|
|
ProxyConfig: map[string]interface{}{
|
|
|
|
"protocol": "grpc",
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
2022-05-12 20:34:17 +00:00
|
|
|
dbResolver := &structs.ConfigEntryResponse{
|
|
|
|
Entry: &structs.ServiceResolverConfigEntry{
|
|
|
|
Name: "db",
|
|
|
|
Kind: structs.ServiceResolver,
|
|
|
|
Redirect: &structs.ServiceResolverRedirect{
|
|
|
|
Service: "db",
|
|
|
|
Datacenter: "dc2",
|
2020-08-27 17:20:58 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
2019-07-12 21:19:37 +00:00
|
|
|
cases := map[string]testCase{
|
2020-06-16 17:19:31 +00:00
|
|
|
"initial-gateway": {
|
2019-07-12 21:19:37 +00:00
|
|
|
ns: structs.NodeService{
|
|
|
|
Kind: structs.ServiceKindMeshGateway,
|
|
|
|
ID: "mesh-gateway",
|
|
|
|
Service: "mesh-gateway",
|
|
|
|
Address: "10.0.1.1",
|
|
|
|
Port: 443,
|
2022-09-23 01:24:13 +00:00
|
|
|
Meta: map[string]string{
|
|
|
|
structs.MetaWANFederationKey: "1",
|
|
|
|
},
|
2019-07-12 21:19:37 +00:00
|
|
|
},
|
|
|
|
sourceDC: "dc1",
|
|
|
|
stages: []verificationStage{
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2019-07-12 21:19:37 +00:00
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2022-06-06 19:20:41 +00:00
|
|
|
datacentersWatchID: verifyDatacentersWatch,
|
|
|
|
serviceListWatchID: genVerifyDCSpecificWatch("dc1"),
|
|
|
|
rootsWatchID: genVerifyDCSpecificWatch("dc1"),
|
|
|
|
exportedServiceListWatchID: genVerifyDCSpecificWatch("dc1"),
|
2022-06-15 19:36:18 +00:00
|
|
|
meshConfigEntryID: genVerifyMeshConfigWatch("dc1"),
|
|
|
|
peeringTrustBundlesWatchID: genVerifyTrustBundleListWatchForMeshGateway(""),
|
2022-09-23 01:24:13 +00:00
|
|
|
consulServerListWatchID: genVerifyServiceSpecificPeeredRequest(structs.ConsulServiceName, "", "dc1", "", false),
|
2019-07-12 21:19:37 +00:00
|
|
|
},
|
2019-10-17 21:46:49 +00:00
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.False(t, snap.Valid(), "gateway without root is not valid")
|
2022-03-30 18:43:59 +00:00
|
|
|
require.True(t, snap.ConnectProxy.isEmpty())
|
2019-10-17 21:46:49 +00:00
|
|
|
},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2019-10-17 21:46:49 +00:00
|
|
|
rootWatchEvent(),
|
2022-06-06 19:20:41 +00:00
|
|
|
{
|
|
|
|
CorrelationID: exportedServiceListWatchID,
|
|
|
|
Result: &structs.IndexedExportedServiceList{
|
|
|
|
Services: nil,
|
|
|
|
},
|
|
|
|
},
|
2022-06-15 19:36:18 +00:00
|
|
|
{
|
|
|
|
CorrelationID: meshConfigEntryID,
|
|
|
|
Result: &structs.ConfigEntryResponse{},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
CorrelationID: peeringTrustBundlesWatchID,
|
|
|
|
Result: &pbpeering.TrustBundleListByServiceResponse{
|
|
|
|
Bundles: nil,
|
|
|
|
},
|
|
|
|
},
|
2019-10-17 21:46:49 +00:00
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.False(t, snap.Valid(), "gateway without services is valid")
|
2022-03-30 18:43:59 +00:00
|
|
|
require.True(t, snap.ConnectProxy.isEmpty())
|
2019-10-17 21:46:49 +00:00
|
|
|
require.Equal(t, indexedRoots, snap.Roots)
|
|
|
|
require.Empty(t, snap.MeshGateway.WatchedServices)
|
|
|
|
require.False(t, snap.MeshGateway.WatchedServicesSet)
|
2021-10-23 19:19:51 +00:00
|
|
|
require.Empty(t, snap.MeshGateway.WatchedGateways)
|
2019-10-17 21:46:49 +00:00
|
|
|
require.Empty(t, snap.MeshGateway.ServiceGroups)
|
|
|
|
require.Empty(t, snap.MeshGateway.ServiceResolvers)
|
|
|
|
require.Empty(t, snap.MeshGateway.GatewayGroups)
|
2022-10-06 13:54:14 +00:00
|
|
|
require.Empty(t, snap.MeshGateway.WatchedPeeringServices)
|
|
|
|
require.Empty(t, snap.MeshGateway.WatchedPeers)
|
|
|
|
require.Empty(t, snap.MeshGateway.PeeringServices)
|
2019-10-17 21:46:49 +00:00
|
|
|
},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2019-10-17 21:46:49 +00:00
|
|
|
CorrelationID: serviceListWatchID,
|
2020-01-24 15:04:58 +00:00
|
|
|
Result: &structs.IndexedServiceList{
|
|
|
|
Services: make(structs.ServiceList, 0),
|
2019-10-17 21:46:49 +00:00
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
2020-04-10 18:06:08 +00:00
|
|
|
require.True(t, snap.Valid(), "gateway with empty service list is valid")
|
2022-03-30 18:43:59 +00:00
|
|
|
require.True(t, snap.ConnectProxy.isEmpty())
|
2019-10-17 21:46:49 +00:00
|
|
|
require.Equal(t, indexedRoots, snap.Roots)
|
|
|
|
require.Empty(t, snap.MeshGateway.WatchedServices)
|
|
|
|
require.True(t, snap.MeshGateway.WatchedServicesSet)
|
2021-10-23 19:19:51 +00:00
|
|
|
require.Empty(t, snap.MeshGateway.WatchedGateways)
|
2019-10-17 21:46:49 +00:00
|
|
|
require.Empty(t, snap.MeshGateway.ServiceGroups)
|
|
|
|
require.Empty(t, snap.MeshGateway.ServiceResolvers)
|
|
|
|
require.Empty(t, snap.MeshGateway.GatewayGroups)
|
|
|
|
},
|
2019-07-12 21:19:37 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
"mesh-gateway-do-not-cancel-service-watches": {
|
2020-04-02 15:12:13 +00:00
|
|
|
ns: structs.NodeService{
|
|
|
|
Kind: structs.ServiceKindMeshGateway,
|
|
|
|
ID: "mesh-gateway",
|
|
|
|
Service: "mesh-gateway",
|
|
|
|
Address: "10.0.1.1",
|
|
|
|
Port: 443,
|
|
|
|
},
|
|
|
|
sourceDC: "dc1",
|
|
|
|
stages: []verificationStage{
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2020-04-02 15:12:13 +00:00
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2022-06-06 19:20:41 +00:00
|
|
|
datacentersWatchID: verifyDatacentersWatch,
|
|
|
|
serviceListWatchID: genVerifyDCSpecificWatch("dc1"),
|
|
|
|
rootsWatchID: genVerifyDCSpecificWatch("dc1"),
|
|
|
|
exportedServiceListWatchID: genVerifyDCSpecificWatch("dc1"),
|
2022-06-15 19:36:18 +00:00
|
|
|
meshConfigEntryID: genVerifyMeshConfigWatch("dc1"),
|
|
|
|
peeringTrustBundlesWatchID: genVerifyTrustBundleListWatchForMeshGateway(""),
|
2020-04-02 15:12:13 +00:00
|
|
|
},
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2020-04-02 15:12:13 +00:00
|
|
|
rootWatchEvent(),
|
2022-06-06 19:20:41 +00:00
|
|
|
{
|
|
|
|
CorrelationID: exportedServiceListWatchID,
|
|
|
|
Result: &structs.IndexedExportedServiceList{
|
|
|
|
Services: nil,
|
|
|
|
},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2020-04-02 15:12:13 +00:00
|
|
|
CorrelationID: serviceListWatchID,
|
|
|
|
Result: &structs.IndexedServiceList{
|
|
|
|
Services: structs.ServiceList{
|
|
|
|
{Name: "web"},
|
|
|
|
},
|
|
|
|
},
|
2022-06-15 19:36:18 +00:00
|
|
|
},
|
|
|
|
{
|
|
|
|
CorrelationID: meshConfigEntryID,
|
|
|
|
Result: &structs.ConfigEntryResponse{},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
CorrelationID: peeringTrustBundlesWatchID,
|
2022-10-06 13:54:14 +00:00
|
|
|
Result: peerTrustBundles,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
CorrelationID: peeringServiceListWatchID + "peer-a",
|
|
|
|
Result: &structs.IndexedServiceList{
|
|
|
|
Services: structs.ServiceList{
|
|
|
|
{Name: "service-1"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
CorrelationID: peeringServiceListWatchID + "peer-b",
|
|
|
|
Result: &structs.IndexedServiceList{
|
|
|
|
Services: structs.ServiceList{
|
|
|
|
{Name: "service-10"},
|
|
|
|
},
|
2022-06-15 19:36:18 +00:00
|
|
|
},
|
2020-04-02 15:12:13 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
2020-04-10 18:06:08 +00:00
|
|
|
require.True(t, snap.Valid(), "gateway with service list is valid")
|
2020-04-02 15:12:13 +00:00
|
|
|
require.Len(t, snap.MeshGateway.WatchedServices, 1)
|
|
|
|
require.True(t, snap.MeshGateway.WatchedServicesSet)
|
2022-10-06 13:54:14 +00:00
|
|
|
require.Len(t, snap.MeshGateway.WatchedPeers, 2)
|
|
|
|
require.Len(t, snap.MeshGateway.WatchedPeeringServices, 2)
|
|
|
|
require.Len(t, snap.MeshGateway.WatchedPeeringServices["peer-a"], 1)
|
|
|
|
require.Len(t, snap.MeshGateway.WatchedPeeringServices["peer-b"], 1)
|
2020-04-02 15:12:13 +00:00
|
|
|
},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2020-04-02 15:12:13 +00:00
|
|
|
CorrelationID: serviceListWatchID,
|
|
|
|
Result: &structs.IndexedServiceList{
|
|
|
|
Services: structs.ServiceList{
|
|
|
|
{Name: "web"},
|
|
|
|
{Name: "api"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
2022-10-06 13:54:14 +00:00
|
|
|
{
|
|
|
|
CorrelationID: peeringServiceListWatchID + "peer-a",
|
|
|
|
Result: &structs.IndexedServiceList{
|
|
|
|
Services: structs.ServiceList{
|
|
|
|
{Name: "service-1"},
|
|
|
|
{Name: "service-2"},
|
|
|
|
{Name: "service-3"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
CorrelationID: peeringServiceListWatchID + "peer-b",
|
|
|
|
Result: &structs.IndexedServiceList{
|
|
|
|
Services: structs.ServiceList{},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
2020-04-02 15:12:13 +00:00
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
2020-04-10 18:06:08 +00:00
|
|
|
require.True(t, snap.Valid(), "gateway with service list is valid")
|
2020-04-02 15:12:13 +00:00
|
|
|
require.Len(t, snap.MeshGateway.WatchedServices, 2)
|
|
|
|
require.True(t, snap.MeshGateway.WatchedServicesSet)
|
2022-10-06 13:54:14 +00:00
|
|
|
require.Len(t, snap.MeshGateway.WatchedPeers, 2)
|
|
|
|
require.Len(t, snap.MeshGateway.WatchedPeeringServices, 2)
|
|
|
|
require.Len(t, snap.MeshGateway.WatchedPeeringServices["peer-a"], 3)
|
|
|
|
require.Len(t, snap.MeshGateway.WatchedPeeringServices["peer-b"], 0)
|
2020-04-02 15:12:13 +00:00
|
|
|
},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2020-06-03 21:28:45 +00:00
|
|
|
CorrelationID: "mesh-gateway:dc4",
|
2022-09-01 14:46:30 +00:00
|
|
|
Result: &structs.IndexedCheckServiceNodes{
|
2020-06-03 21:28:45 +00:00
|
|
|
Nodes: TestGatewayNodesDC4Hostname(t),
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid(), "gateway with service list is valid")
|
|
|
|
require.Len(t, snap.MeshGateway.WatchedServices, 2)
|
|
|
|
require.True(t, snap.MeshGateway.WatchedServicesSet)
|
|
|
|
|
|
|
|
expect := structs.CheckServiceNodes{
|
|
|
|
structs.CheckServiceNode{
|
|
|
|
Node: &structs.Node{
|
|
|
|
ID: "mesh-gateway-1",
|
|
|
|
Node: "mesh-gateway",
|
|
|
|
Address: "10.30.1.1",
|
|
|
|
Datacenter: "dc4",
|
|
|
|
},
|
|
|
|
Service: structs.TestNodeServiceMeshGatewayWithAddrs(t,
|
|
|
|
"10.30.1.1", 8443,
|
|
|
|
structs.ServiceAddress{Address: "10.0.1.1", Port: 8443},
|
|
|
|
structs.ServiceAddress{Address: "123.us-west-2.elb.notaws.com", Port: 443}),
|
|
|
|
},
|
|
|
|
structs.CheckServiceNode{
|
|
|
|
Node: &structs.Node{
|
|
|
|
ID: "mesh-gateway-2",
|
|
|
|
Node: "mesh-gateway",
|
|
|
|
Address: "10.30.1.2",
|
|
|
|
Datacenter: "dc4",
|
|
|
|
},
|
|
|
|
Service: structs.TestNodeServiceMeshGatewayWithAddrs(t,
|
|
|
|
"10.30.1.2", 8443,
|
|
|
|
structs.ServiceAddress{Address: "10.30.1.2", Port: 8443},
|
|
|
|
structs.ServiceAddress{Address: "456.us-west-2.elb.notaws.com", Port: 443}),
|
|
|
|
},
|
|
|
|
}
|
|
|
|
require.Equal(t, snap.MeshGateway.HostnameDatacenters["dc4"], expect)
|
|
|
|
},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2020-06-03 21:28:45 +00:00
|
|
|
CorrelationID: federationStateListGatewaysWatchID,
|
|
|
|
Result: &structs.DatacenterIndexedCheckServiceNodes{
|
|
|
|
DatacenterNodes: map[string]structs.CheckServiceNodes{
|
|
|
|
"dc5": TestGatewayNodesDC5Hostname(t),
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid(), "gateway with service list is valid")
|
|
|
|
require.Len(t, snap.MeshGateway.WatchedServices, 2)
|
|
|
|
require.True(t, snap.MeshGateway.WatchedServicesSet)
|
|
|
|
|
|
|
|
expect := structs.CheckServiceNodes{
|
|
|
|
structs.CheckServiceNode{
|
|
|
|
Node: &structs.Node{
|
|
|
|
ID: "mesh-gateway-1",
|
|
|
|
Node: "mesh-gateway",
|
|
|
|
Address: "10.30.1.1",
|
|
|
|
Datacenter: "dc5",
|
|
|
|
},
|
|
|
|
Service: structs.TestNodeServiceMeshGatewayWithAddrs(t,
|
|
|
|
"10.30.1.1", 8443,
|
|
|
|
structs.ServiceAddress{Address: "10.0.1.1", Port: 8443},
|
|
|
|
structs.ServiceAddress{Address: "123.us-west-2.elb.notaws.com", Port: 443}),
|
|
|
|
},
|
|
|
|
structs.CheckServiceNode{
|
|
|
|
Node: &structs.Node{
|
|
|
|
ID: "mesh-gateway-2",
|
|
|
|
Node: "mesh-gateway",
|
|
|
|
Address: "10.30.1.2",
|
|
|
|
Datacenter: "dc5",
|
|
|
|
},
|
|
|
|
Service: structs.TestNodeServiceMeshGatewayWithAddrs(t,
|
|
|
|
"10.30.1.2", 8443,
|
|
|
|
structs.ServiceAddress{Address: "10.30.1.2", Port: 8443},
|
|
|
|
structs.ServiceAddress{Address: "456.us-west-2.elb.notaws.com", Port: 443}),
|
|
|
|
},
|
|
|
|
}
|
|
|
|
require.Equal(t, snap.MeshGateway.HostnameDatacenters["dc5"], expect)
|
|
|
|
},
|
|
|
|
},
|
2020-04-02 15:12:13 +00:00
|
|
|
},
|
|
|
|
},
|
2022-09-23 01:24:13 +00:00
|
|
|
"mesh-gateway-peering-control-plane": {
|
|
|
|
ns: structs.NodeService{
|
|
|
|
Kind: structs.ServiceKindMeshGateway,
|
|
|
|
ID: "mesh-gateway",
|
|
|
|
Service: "mesh-gateway",
|
|
|
|
Address: "10.0.1.1",
|
|
|
|
Port: 443,
|
|
|
|
},
|
|
|
|
sourceDC: "dc1",
|
|
|
|
stages: []verificationStage{
|
|
|
|
{
|
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
|
|
|
datacentersWatchID: verifyDatacentersWatch,
|
|
|
|
serviceListWatchID: genVerifyDCSpecificWatch("dc1"),
|
|
|
|
rootsWatchID: genVerifyDCSpecificWatch("dc1"),
|
|
|
|
exportedServiceListWatchID: genVerifyDCSpecificWatch("dc1"),
|
|
|
|
meshConfigEntryID: genVerifyMeshConfigWatch("dc1"),
|
|
|
|
peeringTrustBundlesWatchID: genVerifyTrustBundleListWatchForMeshGateway(""),
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.False(t, snap.Valid(), "gateway without root is not valid")
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
events: []UpdateEvent{
|
|
|
|
rootWatchEvent(),
|
|
|
|
{
|
|
|
|
CorrelationID: meshConfigEntryID,
|
|
|
|
Result: &structs.ConfigEntryResponse{
|
|
|
|
Entry: &structs.MeshConfigEntry{
|
|
|
|
Peering: &structs.PeeringMeshConfig{
|
|
|
|
PeerThroughMeshGateways: true,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
CorrelationID: exportedServiceListWatchID,
|
|
|
|
Result: &structs.IndexedExportedServiceList{
|
|
|
|
Services: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
CorrelationID: serviceListWatchID,
|
|
|
|
Result: &structs.IndexedServiceList{
|
|
|
|
Services: structs.ServiceList{},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
CorrelationID: peeringTrustBundlesWatchID,
|
|
|
|
Result: &pbpeering.TrustBundleListByServiceResponse{
|
|
|
|
Bundles: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.Equal(t, indexedRoots, snap.Roots)
|
|
|
|
require.True(t, snap.MeshGateway.WatchedServicesSet)
|
|
|
|
require.True(t, snap.MeshGateway.PeeringTrustBundlesSet)
|
|
|
|
require.True(t, snap.MeshGateway.MeshConfigSet)
|
|
|
|
|
|
|
|
require.True(t, snap.Valid(), "gateway without services is valid")
|
|
|
|
require.True(t, snap.ConnectProxy.isEmpty())
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
|
|
|
consulServerListWatchID: genVerifyServiceSpecificPeeredRequest(structs.ConsulServiceName, "", "dc1", "", false),
|
2022-09-26 16:50:17 +00:00
|
|
|
peerServersWatchID: genVerifyPeeringListWatchForMeshGateway(),
|
2022-09-23 01:24:13 +00:00
|
|
|
},
|
|
|
|
events: []UpdateEvent{
|
|
|
|
{
|
|
|
|
CorrelationID: consulServerListWatchID,
|
|
|
|
Result: &structs.IndexedCheckServiceNodes{
|
|
|
|
Nodes: structs.CheckServiceNodes{
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Datacenter: "dc1",
|
|
|
|
Node: "node1",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
},
|
|
|
|
Service: &structs.NodeService{
|
|
|
|
ID: structs.ConsulServiceID,
|
|
|
|
Service: structs.ConsulServiceName,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Datacenter: "dc1",
|
|
|
|
Node: "replica1",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
},
|
|
|
|
Service: &structs.NodeService{
|
|
|
|
ID: structs.ConsulServiceID,
|
|
|
|
Service: structs.ConsulServiceName,
|
|
|
|
Meta: map[string]string{"read_replica": "true"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid())
|
2022-09-26 16:50:17 +00:00
|
|
|
require.NotNil(t, snap.MeshGateway.PeerServersWatchCancel)
|
2022-09-23 01:24:13 +00:00
|
|
|
|
2022-09-26 16:50:17 +00:00
|
|
|
servers, ok := snap.MeshGateway.WatchedLocalServers.Get(structs.ConsulServiceName)
|
2022-09-23 01:24:13 +00:00
|
|
|
require.True(t, ok)
|
|
|
|
|
|
|
|
expect := structs.CheckServiceNodes{
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Datacenter: "dc1",
|
|
|
|
Node: "node1",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
},
|
|
|
|
Service: &structs.NodeService{
|
|
|
|
ID: structs.ConsulServiceID,
|
|
|
|
Service: structs.ConsulServiceName,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Datacenter: "dc1",
|
|
|
|
Node: "replica1",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
},
|
|
|
|
Service: &structs.NodeService{
|
|
|
|
ID: structs.ConsulServiceID,
|
|
|
|
Service: structs.ConsulServiceName,
|
|
|
|
Meta: map[string]string{"read_replica": "true"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
require.Equal(t, expect, servers)
|
|
|
|
},
|
|
|
|
},
|
2022-09-26 16:50:17 +00:00
|
|
|
{
|
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
|
|
|
consulServerListWatchID: genVerifyServiceSpecificPeeredRequest(structs.ConsulServiceName, "", "dc1", "", false),
|
|
|
|
peerServersWatchID: genVerifyPeeringListWatchForMeshGateway(),
|
|
|
|
},
|
|
|
|
events: []UpdateEvent{
|
|
|
|
{
|
|
|
|
CorrelationID: peerServersWatchID,
|
|
|
|
Result: &pbpeering.PeeringListResponse{
|
|
|
|
Peerings: []*pbpeering.Peering{
|
|
|
|
{
|
|
|
|
Name: "peer-bar",
|
|
|
|
PeerServerName: "server.bar.peering.bar-domain",
|
|
|
|
PeerServerAddresses: []string{"1.2.3.4:8443", "2.3.4.5:8443"},
|
|
|
|
ModifyIndex: 30,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Name: "peer-broken",
|
|
|
|
PeerServerName: "server.broken.peering.broken-domain",
|
|
|
|
PeerServerAddresses: []string{},
|
|
|
|
ModifyIndex: 45,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Name: "peer-foo-zap",
|
|
|
|
PeerServerName: "server.foo.peering.foo-domain",
|
|
|
|
PeerServerAddresses: []string{"elb.now-aws.com:8443", "1.2.3.4:8443"},
|
|
|
|
ModifyIndex: 20,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Name: "peer-foo-zip",
|
|
|
|
PeerServerName: "server.foo.peering.foo-domain",
|
|
|
|
PeerServerAddresses: []string{"1.2.3.4:8443", "2.3.4.5:8443"},
|
|
|
|
ModifyIndex: 12,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid())
|
|
|
|
require.NotNil(t, snap.MeshGateway.PeerServersWatchCancel)
|
|
|
|
|
|
|
|
expect := map[string]PeerServersValue{
|
|
|
|
"server.foo.peering.foo-domain": {
|
|
|
|
Addresses: []structs.ServiceAddress{{Address: "elb.now-aws.com", Port: 8443}},
|
|
|
|
UseCDS: true,
|
|
|
|
Index: 20,
|
|
|
|
},
|
|
|
|
"server.bar.peering.bar-domain": {
|
|
|
|
Addresses: []structs.ServiceAddress{{Address: "1.2.3.4", Port: 8443}, {Address: "2.3.4.5", Port: 8443}},
|
|
|
|
UseCDS: false,
|
|
|
|
Index: 30,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
require.Equal(t, expect, snap.MeshGateway.PeerServers)
|
|
|
|
},
|
|
|
|
},
|
2022-09-23 01:24:13 +00:00
|
|
|
{
|
|
|
|
events: []UpdateEvent{
|
|
|
|
{
|
|
|
|
CorrelationID: meshConfigEntryID,
|
|
|
|
Result: &structs.ConfigEntryResponse{
|
|
|
|
Entry: &structs.MeshConfigEntry{
|
|
|
|
Peering: &structs.PeeringMeshConfig{
|
|
|
|
PeerThroughMeshGateways: false,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid())
|
|
|
|
require.NotNil(t, snap.MeshConfig())
|
|
|
|
|
2022-09-26 16:50:17 +00:00
|
|
|
require.Nil(t, snap.MeshGateway.PeerServersWatchCancel)
|
|
|
|
require.Empty(t, snap.MeshGateway.PeerServers)
|
|
|
|
|
|
|
|
require.False(t, snap.MeshGateway.WatchedLocalServers.IsWatched(structs.ConsulServiceName))
|
|
|
|
servers, ok := snap.MeshGateway.WatchedLocalServers.Get(structs.ConsulServiceName)
|
2022-09-23 01:24:13 +00:00
|
|
|
require.False(t, ok)
|
|
|
|
require.Empty(t, servers)
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
events: []UpdateEvent{
|
|
|
|
{
|
|
|
|
CorrelationID: meshConfigEntryID,
|
|
|
|
Result: &structs.ConfigEntryResponse{
|
|
|
|
Entry: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid())
|
|
|
|
require.Nil(t, snap.MeshConfig())
|
|
|
|
|
2022-09-26 16:50:17 +00:00
|
|
|
require.False(t, snap.MeshGateway.WatchedLocalServers.IsWatched(structs.ConsulServiceName))
|
|
|
|
servers, ok := snap.MeshGateway.WatchedLocalServers.Get(structs.ConsulServiceName)
|
2022-09-23 01:24:13 +00:00
|
|
|
require.False(t, ok)
|
|
|
|
require.Empty(t, servers)
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
"ingress-gateway": {
|
2020-04-16 21:00:48 +00:00
|
|
|
ns: structs.NodeService{
|
|
|
|
Kind: structs.ServiceKindIngressGateway,
|
|
|
|
ID: "ingress-gateway",
|
|
|
|
Service: "ingress-gateway",
|
|
|
|
Address: "10.0.1.1",
|
|
|
|
},
|
|
|
|
sourceDC: "dc1",
|
|
|
|
stages: []verificationStage{
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2020-04-16 21:00:48 +00:00
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2022-03-30 18:43:59 +00:00
|
|
|
meshConfigEntryID: genVerifyMeshConfigWatch("dc1"),
|
2020-04-27 23:36:20 +00:00
|
|
|
gatewayConfigWatchID: genVerifyConfigEntryWatch(structs.IngressGateway, "ingress-gateway", "dc1"),
|
2022-06-01 15:18:06 +00:00
|
|
|
rootsWatchID: genVerifyDCSpecificWatch("dc1"),
|
2020-04-27 23:36:20 +00:00
|
|
|
gatewayServicesWatchID: genVerifyGatewayServiceWatch("ingress-gateway", "dc1"),
|
2020-04-16 21:00:48 +00:00
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.False(t, snap.Valid(), "gateway without root is not valid")
|
2022-03-30 18:43:59 +00:00
|
|
|
require.True(t, snap.IngressGateway.isEmpty())
|
2020-04-16 21:00:48 +00:00
|
|
|
},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2020-04-16 21:00:48 +00:00
|
|
|
rootWatchEvent(),
|
2022-03-30 18:43:59 +00:00
|
|
|
{
|
|
|
|
CorrelationID: meshConfigEntryID,
|
|
|
|
Result: &structs.ConfigEntryResponse{},
|
|
|
|
},
|
2020-04-16 21:00:48 +00:00
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
2020-04-27 23:36:20 +00:00
|
|
|
require.False(t, snap.Valid(), "gateway without config entry is not valid")
|
2020-04-16 21:00:48 +00:00
|
|
|
require.Equal(t, indexedRoots, snap.Roots)
|
|
|
|
},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2021-09-28 11:25:48 +00:00
|
|
|
ingressConfigWatchEvent(false, false),
|
2020-04-16 21:00:48 +00:00
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
2020-04-27 23:36:20 +00:00
|
|
|
require.False(t, snap.Valid(), "gateway without hosts set is not valid")
|
2021-08-24 13:09:01 +00:00
|
|
|
require.True(t, snap.IngressGateway.GatewayConfigLoaded)
|
|
|
|
require.False(t, snap.IngressGateway.TLSConfig.Enabled)
|
2020-04-16 21:00:48 +00:00
|
|
|
},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2020-04-16 21:00:48 +00:00
|
|
|
CorrelationID: gatewayServicesWatchID,
|
|
|
|
Result: &structs.IndexedGatewayServices{
|
|
|
|
Services: structs.GatewayServices{
|
|
|
|
{
|
2020-06-12 14:57:41 +00:00
|
|
|
Gateway: structs.NewServiceName("ingress-gateway", nil),
|
|
|
|
Service: structs.NewServiceName("api", nil),
|
2020-04-21 21:06:23 +00:00
|
|
|
Port: 9999,
|
|
|
|
Protocol: "http",
|
2020-04-16 21:00:48 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
2020-04-27 23:36:20 +00:00
|
|
|
require.False(t, snap.Valid(), "gateway without leaf is not valid")
|
|
|
|
require.True(t, snap.IngressGateway.HostsSet)
|
|
|
|
require.Len(t, snap.IngressGateway.Hosts, 0)
|
2020-04-16 21:00:48 +00:00
|
|
|
require.Len(t, snap.IngressGateway.Upstreams, 1)
|
2020-04-21 21:06:23 +00:00
|
|
|
key := IngressListenerKey{Protocol: "http", Port: 9999}
|
|
|
|
require.Equal(t, snap.IngressGateway.Upstreams[key], structs.Upstreams{
|
|
|
|
{
|
|
|
|
DestinationNamespace: "default",
|
2021-08-20 16:57:45 +00:00
|
|
|
DestinationPartition: "default",
|
2020-04-21 21:06:23 +00:00
|
|
|
DestinationName: "api",
|
|
|
|
LocalBindPort: 9999,
|
|
|
|
Config: map[string]interface{}{
|
|
|
|
"protocol": "http",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
})
|
2020-04-16 21:00:48 +00:00
|
|
|
require.Len(t, snap.IngressGateway.WatchedDiscoveryChains, 1)
|
2022-01-20 16:12:04 +00:00
|
|
|
require.Contains(t, snap.IngressGateway.WatchedDiscoveryChains, apiUID)
|
2020-04-16 21:00:48 +00:00
|
|
|
},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2020-04-27 23:36:20 +00:00
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
|
|
|
leafWatchID: genVerifyLeafWatch("ingress-gateway", "dc1"),
|
|
|
|
},
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2020-04-27 23:36:20 +00:00
|
|
|
CorrelationID: leafWatchID,
|
|
|
|
Result: issuedCert,
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid(), "gateway with root and leaf certs is valid")
|
|
|
|
require.Equal(t, issuedCert, snap.IngressGateway.Leaf)
|
|
|
|
},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2020-04-16 21:00:48 +00:00
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2022-01-20 16:12:04 +00:00
|
|
|
"discovery-chain:" + apiUID.String(): genVerifyDiscoveryChainWatch(&structs.DiscoveryChainRequest{
|
2020-04-16 21:00:48 +00:00
|
|
|
Name: "api",
|
|
|
|
EvaluateInDatacenter: "dc1",
|
|
|
|
EvaluateInNamespace: "default",
|
2021-09-07 20:29:32 +00:00
|
|
|
EvaluateInPartition: "default",
|
2020-04-16 21:00:48 +00:00
|
|
|
Datacenter: "dc1",
|
2022-11-07 15:00:11 +00:00
|
|
|
QueryOptions: structs.QueryOptions{
|
|
|
|
Token: aclToken,
|
|
|
|
},
|
2020-04-16 21:00:48 +00:00
|
|
|
}),
|
|
|
|
},
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2022-01-20 16:12:04 +00:00
|
|
|
CorrelationID: "discovery-chain:" + apiUID.String(),
|
2020-04-16 21:00:48 +00:00
|
|
|
Result: &structs.DiscoveryChainResponse{
|
2021-10-22 23:15:05 +00:00
|
|
|
Chain: discoverychain.TestCompileConfigEntries(t, "api", "default", "default", "dc1", "trustdomain.consul", nil),
|
2020-04-16 21:00:48 +00:00
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.Len(t, snap.IngressGateway.WatchedUpstreams, 1)
|
2022-01-20 16:12:04 +00:00
|
|
|
require.Len(t, snap.IngressGateway.WatchedUpstreams[apiUID], 1)
|
2020-04-16 21:00:48 +00:00
|
|
|
},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2020-04-16 21:00:48 +00:00
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2022-06-01 15:18:06 +00:00
|
|
|
"upstream-target:api.default.default.dc1:" + apiUID.String(): genVerifyServiceSpecificRequest("api", "", "dc1", true),
|
2020-04-16 21:00:48 +00:00
|
|
|
},
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2022-01-20 16:12:04 +00:00
|
|
|
CorrelationID: "upstream-target:api.default.default.dc1:" + apiUID.String(),
|
2020-04-16 21:00:48 +00:00
|
|
|
Result: &structs.IndexedCheckServiceNodes{
|
|
|
|
Nodes: structs.CheckServiceNodes{
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Node: "node1",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
},
|
|
|
|
Service: &structs.NodeService{
|
|
|
|
ID: "api1",
|
|
|
|
Service: "api",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.Len(t, snap.IngressGateway.WatchedUpstreamEndpoints, 1)
|
2022-01-20 16:12:04 +00:00
|
|
|
require.Contains(t, snap.IngressGateway.WatchedUpstreamEndpoints, apiUID)
|
|
|
|
require.Len(t, snap.IngressGateway.WatchedUpstreamEndpoints[apiUID], 1)
|
|
|
|
require.Contains(t, snap.IngressGateway.WatchedUpstreamEndpoints[apiUID], "api.default.default.dc1")
|
|
|
|
require.Equal(t, snap.IngressGateway.WatchedUpstreamEndpoints[apiUID]["api.default.default.dc1"],
|
2020-04-16 21:00:48 +00:00
|
|
|
structs.CheckServiceNodes{
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Node: "node1",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
},
|
|
|
|
Service: &structs.NodeService{
|
|
|
|
ID: "api1",
|
|
|
|
Service: "api",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
)
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
"ingress-gateway-with-tls-update-upstreams": {
|
2020-04-16 23:24:11 +00:00
|
|
|
ns: structs.NodeService{
|
|
|
|
Kind: structs.ServiceKindIngressGateway,
|
|
|
|
ID: "ingress-gateway",
|
|
|
|
Service: "ingress-gateway",
|
|
|
|
Address: "10.0.1.1",
|
|
|
|
},
|
|
|
|
sourceDC: "dc1",
|
|
|
|
stages: []verificationStage{
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2020-04-16 23:24:11 +00:00
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2022-03-30 18:43:59 +00:00
|
|
|
meshConfigEntryID: genVerifyMeshConfigWatch("dc1"),
|
2020-04-27 23:36:20 +00:00
|
|
|
gatewayConfigWatchID: genVerifyConfigEntryWatch(structs.IngressGateway, "ingress-gateway", "dc1"),
|
2022-06-01 15:18:06 +00:00
|
|
|
rootsWatchID: genVerifyDCSpecificWatch("dc1"),
|
2020-04-27 23:36:20 +00:00
|
|
|
gatewayServicesWatchID: genVerifyGatewayServiceWatch("ingress-gateway", "dc1"),
|
2020-04-16 23:24:11 +00:00
|
|
|
},
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2020-04-16 23:24:11 +00:00
|
|
|
rootWatchEvent(),
|
2022-03-30 18:43:59 +00:00
|
|
|
{
|
|
|
|
CorrelationID: meshConfigEntryID,
|
|
|
|
Result: &structs.ConfigEntryResponse{},
|
|
|
|
},
|
2021-09-28 11:25:48 +00:00
|
|
|
ingressConfigWatchEvent(true, false),
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2020-04-16 23:24:11 +00:00
|
|
|
CorrelationID: gatewayServicesWatchID,
|
|
|
|
Result: &structs.IndexedGatewayServices{
|
|
|
|
Services: structs.GatewayServices{
|
|
|
|
{
|
2020-06-12 14:57:41 +00:00
|
|
|
Gateway: structs.NewServiceName("ingress-gateway", nil),
|
|
|
|
Service: structs.NewServiceName("api", nil),
|
2020-04-27 23:36:20 +00:00
|
|
|
Hosts: []string{"test.example.com"},
|
2020-04-16 23:24:11 +00:00
|
|
|
Port: 9999,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2020-04-27 23:36:20 +00:00
|
|
|
CorrelationID: leafWatchID,
|
|
|
|
Result: issuedCert,
|
|
|
|
Err: nil,
|
|
|
|
},
|
2020-04-16 23:24:11 +00:00
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid())
|
2021-08-24 13:09:01 +00:00
|
|
|
require.True(t, snap.IngressGateway.GatewayConfigLoaded)
|
|
|
|
require.True(t, snap.IngressGateway.TLSConfig.Enabled)
|
2020-04-27 23:36:20 +00:00
|
|
|
require.True(t, snap.IngressGateway.HostsSet)
|
|
|
|
require.Len(t, snap.IngressGateway.Hosts, 1)
|
2020-04-16 23:24:11 +00:00
|
|
|
require.Len(t, snap.IngressGateway.Upstreams, 1)
|
|
|
|
require.Len(t, snap.IngressGateway.WatchedDiscoveryChains, 1)
|
2022-01-20 16:12:04 +00:00
|
|
|
require.Contains(t, snap.IngressGateway.WatchedDiscoveryChains, apiUID)
|
2020-04-16 23:24:11 +00:00
|
|
|
},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2020-04-27 23:36:20 +00:00
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
|
|
|
leafWatchID: genVerifyLeafWatchWithDNSSANs("ingress-gateway", "dc1", []string{
|
|
|
|
"test.example.com",
|
|
|
|
"*.ingress.consul.",
|
2020-05-07 22:04:06 +00:00
|
|
|
"*.ingress.dc1.consul.",
|
2020-04-27 23:36:20 +00:00
|
|
|
"*.ingress.alt.consul.",
|
2020-05-07 22:04:06 +00:00
|
|
|
"*.ingress.dc1.alt.consul.",
|
2020-04-27 23:36:20 +00:00
|
|
|
}),
|
|
|
|
},
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2020-04-16 23:24:11 +00:00
|
|
|
CorrelationID: gatewayServicesWatchID,
|
|
|
|
Result: &structs.IndexedGatewayServices{},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid())
|
|
|
|
require.Len(t, snap.IngressGateway.Upstreams, 0)
|
|
|
|
require.Len(t, snap.IngressGateway.WatchedDiscoveryChains, 0)
|
|
|
|
require.NotContains(t, snap.IngressGateway.WatchedDiscoveryChains, "api")
|
2021-09-28 11:25:48 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
"ingress-gateway-with-mixed-tls": {
|
|
|
|
ns: structs.NodeService{
|
|
|
|
Kind: structs.ServiceKindIngressGateway,
|
|
|
|
ID: "ingress-gateway",
|
|
|
|
Service: "ingress-gateway",
|
|
|
|
Address: "10.0.1.1",
|
|
|
|
},
|
|
|
|
sourceDC: "dc1",
|
|
|
|
stages: []verificationStage{
|
|
|
|
{
|
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2022-03-30 18:43:59 +00:00
|
|
|
meshConfigEntryID: genVerifyMeshConfigWatch("dc1"),
|
2021-09-28 11:25:48 +00:00
|
|
|
gatewayConfigWatchID: genVerifyConfigEntryWatch(structs.IngressGateway, "ingress-gateway", "dc1"),
|
2022-06-01 15:18:06 +00:00
|
|
|
rootsWatchID: genVerifyDCSpecificWatch("dc1"),
|
2021-09-28 11:25:48 +00:00
|
|
|
gatewayServicesWatchID: genVerifyGatewayServiceWatch("ingress-gateway", "dc1"),
|
|
|
|
},
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2021-09-28 11:25:48 +00:00
|
|
|
rootWatchEvent(),
|
2022-03-30 18:43:59 +00:00
|
|
|
{
|
|
|
|
CorrelationID: meshConfigEntryID,
|
|
|
|
Result: &structs.ConfigEntryResponse{},
|
|
|
|
},
|
2021-09-28 11:25:48 +00:00
|
|
|
ingressConfigWatchEvent(false, true),
|
|
|
|
{
|
|
|
|
CorrelationID: gatewayServicesWatchID,
|
|
|
|
Result: &structs.IndexedGatewayServices{
|
|
|
|
Services: structs.GatewayServices{
|
|
|
|
{
|
|
|
|
Gateway: structs.NewServiceName("ingress-gateway", nil),
|
|
|
|
Service: structs.NewServiceName("api", nil),
|
|
|
|
Hosts: []string{"test.example.com"},
|
|
|
|
Port: 9999,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
CorrelationID: leafWatchID,
|
|
|
|
Result: issuedCert,
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid())
|
|
|
|
require.True(t, snap.IngressGateway.GatewayConfigLoaded)
|
|
|
|
// GW level TLS should be disabled
|
|
|
|
require.False(t, snap.IngressGateway.TLSConfig.Enabled)
|
|
|
|
// Mixed listener TLS
|
|
|
|
l, ok := snap.IngressGateway.Listeners[IngressListenerKey{"tcp", 8080}]
|
|
|
|
require.True(t, ok)
|
|
|
|
require.NotNil(t, l.TLS)
|
|
|
|
require.True(t, l.TLS.Enabled)
|
|
|
|
l, ok = snap.IngressGateway.Listeners[IngressListenerKey{"tcp", 9090}]
|
|
|
|
require.True(t, ok)
|
|
|
|
require.Nil(t, l.TLS)
|
|
|
|
|
|
|
|
require.True(t, snap.IngressGateway.HostsSet)
|
|
|
|
require.Len(t, snap.IngressGateway.Hosts, 1)
|
|
|
|
require.Len(t, snap.IngressGateway.Upstreams, 1)
|
|
|
|
require.Len(t, snap.IngressGateway.WatchedDiscoveryChains, 1)
|
2022-01-20 16:12:04 +00:00
|
|
|
require.Contains(t, snap.IngressGateway.WatchedDiscoveryChains, apiUID)
|
2021-09-28 11:25:48 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
|
|
|
// This is the real point of this test - ensure we still generate
|
|
|
|
// the right DNS SANs for the whole gateway even when only a subset
|
|
|
|
// of listeners have TLS enabled.
|
|
|
|
leafWatchID: genVerifyLeafWatchWithDNSSANs("ingress-gateway", "dc1", []string{
|
|
|
|
"test.example.com",
|
|
|
|
"*.ingress.consul.",
|
|
|
|
"*.ingress.dc1.consul.",
|
|
|
|
"*.ingress.alt.consul.",
|
|
|
|
"*.ingress.dc1.alt.consul.",
|
|
|
|
}),
|
|
|
|
},
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2021-09-28 11:25:48 +00:00
|
|
|
{
|
|
|
|
CorrelationID: gatewayServicesWatchID,
|
|
|
|
Result: &structs.IndexedGatewayServices{},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid())
|
|
|
|
require.Len(t, snap.IngressGateway.Upstreams, 0)
|
|
|
|
require.Len(t, snap.IngressGateway.WatchedDiscoveryChains, 0)
|
|
|
|
require.NotContains(t, snap.IngressGateway.WatchedDiscoveryChains, "api")
|
2020-04-16 23:24:11 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
"terminating-gateway-initial": {
|
2020-04-10 18:06:08 +00:00
|
|
|
ns: structs.NodeService{
|
|
|
|
Kind: structs.ServiceKindTerminatingGateway,
|
|
|
|
ID: "terminating-gateway",
|
|
|
|
Service: "terminating-gateway",
|
|
|
|
Address: "10.0.1.1",
|
|
|
|
},
|
|
|
|
sourceDC: "dc1",
|
|
|
|
stages: []verificationStage{
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2020-04-10 18:06:08 +00:00
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2022-06-01 15:18:06 +00:00
|
|
|
meshConfigEntryID: genVerifyMeshConfigWatch("dc1"),
|
|
|
|
rootsWatchID: genVerifyDCSpecificWatch("dc1"),
|
|
|
|
gatewayServicesWatchID: genVerifyGatewayServiceWatch("terminating-gateway", "dc1"),
|
2020-04-10 18:06:08 +00:00
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.False(t, snap.Valid(), "gateway without root is not valid")
|
2022-03-30 18:43:59 +00:00
|
|
|
require.True(t, snap.ConnectProxy.isEmpty())
|
|
|
|
require.True(t, snap.MeshGateway.isEmpty())
|
|
|
|
require.True(t, snap.IngressGateway.isEmpty())
|
2020-04-10 18:06:08 +00:00
|
|
|
},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2020-04-10 18:06:08 +00:00
|
|
|
rootWatchEvent(),
|
2022-03-30 18:43:59 +00:00
|
|
|
{
|
|
|
|
CorrelationID: meshConfigEntryID,
|
|
|
|
Result: &structs.ConfigEntryResponse{},
|
|
|
|
},
|
2020-04-10 18:06:08 +00:00
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid(), "gateway without services is valid")
|
2022-03-30 18:43:59 +00:00
|
|
|
require.True(t, snap.ConnectProxy.isEmpty())
|
|
|
|
require.True(t, snap.MeshGateway.isEmpty())
|
|
|
|
require.True(t, snap.IngressGateway.isEmpty())
|
|
|
|
require.False(t, snap.TerminatingGateway.isEmpty())
|
|
|
|
require.Nil(t, snap.TerminatingGateway.MeshConfig)
|
2020-04-10 18:06:08 +00:00
|
|
|
require.Equal(t, indexedRoots, snap.Roots)
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
"terminating-gateway-handle-update": {
|
2020-04-10 18:06:08 +00:00
|
|
|
ns: structs.NodeService{
|
|
|
|
Kind: structs.ServiceKindTerminatingGateway,
|
|
|
|
ID: "terminating-gateway",
|
|
|
|
Service: "terminating-gateway",
|
|
|
|
Address: "10.0.1.1",
|
|
|
|
},
|
|
|
|
sourceDC: "dc1",
|
|
|
|
stages: []verificationStage{
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2020-04-10 18:06:08 +00:00
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2022-06-01 15:18:06 +00:00
|
|
|
meshConfigEntryID: genVerifyMeshConfigWatch("dc1"),
|
|
|
|
rootsWatchID: genVerifyDCSpecificWatch("dc1"),
|
|
|
|
gatewayServicesWatchID: genVerifyGatewayServiceWatch("terminating-gateway", "dc1"),
|
2020-04-10 18:06:08 +00:00
|
|
|
},
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2020-04-10 18:06:08 +00:00
|
|
|
rootWatchEvent(),
|
2022-03-30 18:43:59 +00:00
|
|
|
{
|
|
|
|
CorrelationID: meshConfigEntryID,
|
|
|
|
Result: &structs.ConfigEntryResponse{},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2020-04-10 18:06:08 +00:00
|
|
|
CorrelationID: gatewayServicesWatchID,
|
|
|
|
Result: &structs.IndexedGatewayServices{
|
|
|
|
Services: structs.GatewayServices{
|
|
|
|
{
|
2020-08-27 17:20:58 +00:00
|
|
|
Service: db,
|
2020-06-12 14:57:41 +00:00
|
|
|
Gateway: structs.NewServiceName("terminating-gateway", nil),
|
2020-04-10 18:06:08 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid(), "gateway with service list is valid")
|
2020-08-27 17:20:58 +00:00
|
|
|
require.Len(t, snap.TerminatingGateway.ValidServices(), 0)
|
|
|
|
|
2020-04-10 18:06:08 +00:00
|
|
|
require.Len(t, snap.TerminatingGateway.WatchedServices, 1)
|
2020-08-27 17:20:58 +00:00
|
|
|
require.Contains(t, snap.TerminatingGateway.WatchedServices, db)
|
2020-04-10 18:06:08 +00:00
|
|
|
},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2020-04-10 18:06:08 +00:00
|
|
|
CorrelationID: gatewayServicesWatchID,
|
|
|
|
Result: &structs.IndexedGatewayServices{
|
|
|
|
Services: structs.GatewayServices{
|
|
|
|
{
|
2020-08-27 17:20:58 +00:00
|
|
|
Service: db,
|
2020-06-12 14:57:41 +00:00
|
|
|
Gateway: structs.NewServiceName("terminating-gateway", nil),
|
2020-04-10 18:06:08 +00:00
|
|
|
},
|
|
|
|
{
|
2020-08-27 17:20:58 +00:00
|
|
|
Service: billing,
|
2020-06-12 14:57:41 +00:00
|
|
|
Gateway: structs.NewServiceName("terminating-gateway", nil),
|
2020-04-10 18:06:08 +00:00
|
|
|
},
|
2020-06-03 21:28:45 +00:00
|
|
|
{
|
2020-08-27 17:20:58 +00:00
|
|
|
Service: api,
|
2020-06-12 14:57:41 +00:00
|
|
|
Gateway: structs.NewServiceName("terminating-gateway", nil),
|
2020-06-03 21:28:45 +00:00
|
|
|
},
|
2020-04-10 18:06:08 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid(), "gateway with service list is valid")
|
2020-08-27 17:20:58 +00:00
|
|
|
require.Len(t, snap.TerminatingGateway.ValidServices(), 0)
|
|
|
|
|
2020-06-03 21:28:45 +00:00
|
|
|
require.Len(t, snap.TerminatingGateway.WatchedServices, 3)
|
2020-04-10 18:06:08 +00:00
|
|
|
require.Contains(t, snap.TerminatingGateway.WatchedServices, db)
|
|
|
|
require.Contains(t, snap.TerminatingGateway.WatchedServices, billing)
|
2020-06-03 21:28:45 +00:00
|
|
|
require.Contains(t, snap.TerminatingGateway.WatchedServices, api)
|
2020-04-10 18:06:08 +00:00
|
|
|
|
2020-06-03 21:28:45 +00:00
|
|
|
require.Len(t, snap.TerminatingGateway.WatchedIntentions, 3)
|
2020-04-10 18:06:08 +00:00
|
|
|
require.Contains(t, snap.TerminatingGateway.WatchedIntentions, db)
|
|
|
|
require.Contains(t, snap.TerminatingGateway.WatchedIntentions, billing)
|
2020-06-03 21:28:45 +00:00
|
|
|
require.Contains(t, snap.TerminatingGateway.WatchedIntentions, api)
|
2020-04-10 18:06:08 +00:00
|
|
|
|
2020-06-03 21:28:45 +00:00
|
|
|
require.Len(t, snap.TerminatingGateway.WatchedLeaves, 3)
|
2020-04-10 18:06:08 +00:00
|
|
|
require.Contains(t, snap.TerminatingGateway.WatchedLeaves, db)
|
|
|
|
require.Contains(t, snap.TerminatingGateway.WatchedLeaves, billing)
|
2020-06-03 21:28:45 +00:00
|
|
|
require.Contains(t, snap.TerminatingGateway.WatchedLeaves, api)
|
2020-04-14 14:59:23 +00:00
|
|
|
|
2020-08-27 17:20:58 +00:00
|
|
|
require.Len(t, snap.TerminatingGateway.WatchedConfigs, 3)
|
|
|
|
require.Contains(t, snap.TerminatingGateway.WatchedConfigs, db)
|
|
|
|
require.Contains(t, snap.TerminatingGateway.WatchedConfigs, billing)
|
|
|
|
require.Contains(t, snap.TerminatingGateway.WatchedConfigs, api)
|
|
|
|
|
2020-06-03 21:28:45 +00:00
|
|
|
require.Len(t, snap.TerminatingGateway.WatchedResolvers, 3)
|
2020-04-14 14:59:23 +00:00
|
|
|
require.Contains(t, snap.TerminatingGateway.WatchedResolvers, db)
|
|
|
|
require.Contains(t, snap.TerminatingGateway.WatchedResolvers, billing)
|
2020-06-03 21:28:45 +00:00
|
|
|
require.Contains(t, snap.TerminatingGateway.WatchedResolvers, api)
|
2020-04-27 22:25:37 +00:00
|
|
|
|
2020-06-03 21:28:45 +00:00
|
|
|
require.Len(t, snap.TerminatingGateway.GatewayServices, 3)
|
2020-04-27 22:25:37 +00:00
|
|
|
require.Contains(t, snap.TerminatingGateway.GatewayServices, db)
|
|
|
|
require.Contains(t, snap.TerminatingGateway.GatewayServices, billing)
|
2020-06-03 21:28:45 +00:00
|
|
|
require.Contains(t, snap.TerminatingGateway.GatewayServices, api)
|
2020-04-10 18:06:08 +00:00
|
|
|
},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2020-04-10 18:06:08 +00:00
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2022-06-01 15:18:06 +00:00
|
|
|
"external-service:" + db.String(): genVerifyServiceSpecificRequest("db", "", "dc1", false),
|
2020-04-10 18:06:08 +00:00
|
|
|
},
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2021-04-15 19:54:40 +00:00
|
|
|
CorrelationID: "external-service:" + db.String(),
|
2020-04-10 18:06:08 +00:00
|
|
|
Result: &structs.IndexedCheckServiceNodes{
|
|
|
|
Nodes: structs.CheckServiceNodes{
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Node: "node1",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
},
|
|
|
|
Service: &structs.NodeService{
|
|
|
|
ID: "db",
|
|
|
|
Service: "db",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
2020-08-27 17:20:58 +00:00
|
|
|
require.True(t, snap.Valid(), "gateway with service list is valid")
|
|
|
|
require.Len(t, snap.TerminatingGateway.ValidServices(), 0)
|
|
|
|
|
2020-04-10 18:06:08 +00:00
|
|
|
require.Len(t, snap.TerminatingGateway.ServiceGroups, 1)
|
2020-08-27 17:20:58 +00:00
|
|
|
require.Equal(t, snap.TerminatingGateway.ServiceGroups[db],
|
2020-04-10 18:06:08 +00:00
|
|
|
structs.CheckServiceNodes{
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Node: "node1",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
},
|
|
|
|
Service: &structs.NodeService{
|
|
|
|
ID: "db",
|
|
|
|
Service: "db",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
)
|
|
|
|
},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2020-06-03 21:28:45 +00:00
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2022-06-01 15:18:06 +00:00
|
|
|
"external-service:" + api.String(): genVerifyServiceSpecificRequest("api", "", "dc1", false),
|
2020-06-03 21:28:45 +00:00
|
|
|
},
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2021-04-15 19:54:40 +00:00
|
|
|
CorrelationID: "external-service:" + api.String(),
|
2020-06-03 21:28:45 +00:00
|
|
|
Result: &structs.IndexedCheckServiceNodes{
|
|
|
|
Nodes: structs.CheckServiceNodes{
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Node: "node1",
|
|
|
|
Address: "10.0.1.1",
|
|
|
|
},
|
|
|
|
Service: &structs.NodeService{
|
|
|
|
ID: "api",
|
|
|
|
Service: "api",
|
|
|
|
Address: "api.mydomain",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Node: "node2",
|
|
|
|
Address: "10.0.1.2",
|
|
|
|
},
|
|
|
|
Service: &structs.NodeService{
|
|
|
|
ID: "api",
|
|
|
|
Service: "api",
|
|
|
|
Address: "api.altdomain",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Node: "node3",
|
|
|
|
Address: "10.0.1.3",
|
|
|
|
},
|
|
|
|
Service: &structs.NodeService{
|
|
|
|
ID: "api",
|
|
|
|
Service: "api",
|
|
|
|
Address: "10.0.1.3",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
2020-08-27 17:20:58 +00:00
|
|
|
require.True(t, snap.Valid(), "gateway with service list is valid")
|
|
|
|
require.Len(t, snap.TerminatingGateway.ValidServices(), 0)
|
|
|
|
|
2020-06-03 21:28:45 +00:00
|
|
|
require.Len(t, snap.TerminatingGateway.ServiceGroups, 2)
|
|
|
|
expect := structs.CheckServiceNodes{
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Node: "node1",
|
|
|
|
Address: "10.0.1.1",
|
|
|
|
},
|
|
|
|
Service: &structs.NodeService{
|
|
|
|
ID: "api",
|
|
|
|
Service: "api",
|
|
|
|
Address: "api.mydomain",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Node: "node2",
|
|
|
|
Address: "10.0.1.2",
|
|
|
|
},
|
|
|
|
Service: &structs.NodeService{
|
|
|
|
ID: "api",
|
|
|
|
Service: "api",
|
|
|
|
Address: "api.altdomain",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Node: "node3",
|
|
|
|
Address: "10.0.1.3",
|
|
|
|
},
|
|
|
|
Service: &structs.NodeService{
|
|
|
|
ID: "api",
|
|
|
|
Service: "api",
|
|
|
|
Address: "10.0.1.3",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
2020-08-27 17:20:58 +00:00
|
|
|
require.Equal(t, snap.TerminatingGateway.ServiceGroups[api], expect)
|
2020-06-03 21:28:45 +00:00
|
|
|
|
|
|
|
// The instance in node3 should not be present in HostnameDatacenters because it has a valid IP
|
2020-08-27 17:20:58 +00:00
|
|
|
require.ElementsMatch(t, snap.TerminatingGateway.HostnameServices[api], expect[:2])
|
2020-06-03 21:28:45 +00:00
|
|
|
},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2020-04-10 18:06:08 +00:00
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2021-04-15 19:54:40 +00:00
|
|
|
"service-leaf:" + db.String(): genVerifyLeafWatch("db", "dc1"),
|
2020-04-10 18:06:08 +00:00
|
|
|
},
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2021-04-15 19:54:40 +00:00
|
|
|
CorrelationID: "service-leaf:" + db.String(),
|
2020-04-10 18:06:08 +00:00
|
|
|
Result: issuedCert,
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
2020-08-27 17:20:58 +00:00
|
|
|
require.True(t, snap.Valid(), "gateway with service list is valid")
|
|
|
|
require.Len(t, snap.TerminatingGateway.ValidServices(), 0)
|
|
|
|
|
|
|
|
require.Equal(t, snap.TerminatingGateway.ServiceLeaves[db], issuedCert)
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2021-04-15 19:54:40 +00:00
|
|
|
serviceIntentionsIDPrefix + db.String(): genVerifyIntentionWatch("db", "dc1"),
|
2020-08-27 17:20:58 +00:00
|
|
|
},
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2020-08-27 17:20:58 +00:00
|
|
|
{
|
2021-04-15 19:54:40 +00:00
|
|
|
CorrelationID: serviceIntentionsIDPrefix + db.String(),
|
2020-08-27 17:20:58 +00:00
|
|
|
Result: dbIxnMatch,
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid(), "gateway with service list is valid")
|
|
|
|
require.Len(t, snap.TerminatingGateway.ValidServices(), 0)
|
|
|
|
|
|
|
|
require.Len(t, snap.TerminatingGateway.Intentions, 1)
|
|
|
|
dbIxn, ok := snap.TerminatingGateway.Intentions[db]
|
|
|
|
require.True(t, ok)
|
2022-07-01 15:15:49 +00:00
|
|
|
require.Equal(t, dbIxnMatch, dbIxn)
|
2020-08-27 17:20:58 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2021-04-15 19:54:40 +00:00
|
|
|
serviceConfigIDPrefix + db.String(): genVerifyResolvedConfigWatch("db", "dc1"),
|
2020-08-27 17:20:58 +00:00
|
|
|
},
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2020-08-27 17:20:58 +00:00
|
|
|
{
|
2021-04-15 19:54:40 +00:00
|
|
|
CorrelationID: serviceConfigIDPrefix + db.String(),
|
2020-08-27 17:20:58 +00:00
|
|
|
Result: dbConfig,
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid(), "gateway with service list is valid")
|
|
|
|
require.Len(t, snap.TerminatingGateway.ValidServices(), 0)
|
|
|
|
|
|
|
|
require.Len(t, snap.TerminatingGateway.ServiceConfigs, 1)
|
|
|
|
require.Equal(t, snap.TerminatingGateway.ServiceConfigs[db], dbConfig)
|
2020-04-10 18:06:08 +00:00
|
|
|
},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2020-04-14 14:59:23 +00:00
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2021-04-15 19:54:40 +00:00
|
|
|
"service-resolver:" + db.String(): genVerifyResolverWatch("db", "dc1", structs.ServiceResolver),
|
2020-04-14 14:59:23 +00:00
|
|
|
},
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2021-04-15 19:54:40 +00:00
|
|
|
CorrelationID: "service-resolver:" + db.String(),
|
2020-08-27 17:20:58 +00:00
|
|
|
Result: dbResolver,
|
|
|
|
Err: nil,
|
2020-04-14 14:59:23 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
2020-08-27 17:20:58 +00:00
|
|
|
require.True(t, snap.Valid(), "gateway with service list is valid")
|
|
|
|
// Finally we have everything we need
|
|
|
|
require.Equal(t, []structs.ServiceName{db}, snap.TerminatingGateway.ValidServices())
|
|
|
|
|
|
|
|
require.Len(t, snap.TerminatingGateway.ServiceResolversSet, 1)
|
|
|
|
require.True(t, snap.TerminatingGateway.ServiceResolversSet[db])
|
|
|
|
|
|
|
|
require.Len(t, snap.TerminatingGateway.ServiceResolvers, 1)
|
2022-05-12 20:34:17 +00:00
|
|
|
require.Equal(t, dbResolver.Entry, snap.TerminatingGateway.ServiceResolvers[db])
|
2020-04-14 14:59:23 +00:00
|
|
|
},
|
|
|
|
},
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2020-06-16 17:19:31 +00:00
|
|
|
{
|
2020-04-10 18:06:08 +00:00
|
|
|
CorrelationID: gatewayServicesWatchID,
|
|
|
|
Result: &structs.IndexedGatewayServices{
|
|
|
|
Services: structs.GatewayServices{
|
|
|
|
{
|
2020-08-27 17:20:58 +00:00
|
|
|
Service: billing,
|
2020-06-12 14:57:41 +00:00
|
|
|
Gateway: structs.NewServiceName("terminating-gateway", nil),
|
2020-04-10 18:06:08 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid(), "gateway with service list is valid")
|
2020-08-27 17:20:58 +00:00
|
|
|
require.Len(t, snap.TerminatingGateway.ValidServices(), 0)
|
2020-04-10 18:06:08 +00:00
|
|
|
|
2020-04-20 19:33:19 +00:00
|
|
|
// All the watches should have been cancelled for db
|
2020-04-10 18:06:08 +00:00
|
|
|
require.Len(t, snap.TerminatingGateway.WatchedServices, 1)
|
|
|
|
require.Contains(t, snap.TerminatingGateway.WatchedServices, billing)
|
|
|
|
|
|
|
|
require.Len(t, snap.TerminatingGateway.WatchedIntentions, 1)
|
|
|
|
require.Contains(t, snap.TerminatingGateway.WatchedIntentions, billing)
|
|
|
|
|
|
|
|
require.Len(t, snap.TerminatingGateway.WatchedLeaves, 1)
|
|
|
|
require.Contains(t, snap.TerminatingGateway.WatchedLeaves, billing)
|
|
|
|
|
2020-04-14 14:59:23 +00:00
|
|
|
require.Len(t, snap.TerminatingGateway.WatchedResolvers, 1)
|
|
|
|
require.Contains(t, snap.TerminatingGateway.WatchedResolvers, billing)
|
|
|
|
|
2020-04-27 22:25:37 +00:00
|
|
|
require.Len(t, snap.TerminatingGateway.GatewayServices, 1)
|
|
|
|
require.Contains(t, snap.TerminatingGateway.GatewayServices, billing)
|
|
|
|
|
2020-06-03 21:28:45 +00:00
|
|
|
// There was no update event for billing's leaf/endpoints/resolvers, so length is 0
|
2020-04-10 18:06:08 +00:00
|
|
|
require.Len(t, snap.TerminatingGateway.ServiceGroups, 0)
|
|
|
|
require.Len(t, snap.TerminatingGateway.ServiceLeaves, 0)
|
2020-04-14 14:59:23 +00:00
|
|
|
require.Len(t, snap.TerminatingGateway.ServiceResolvers, 0)
|
2020-06-03 21:28:45 +00:00
|
|
|
require.Len(t, snap.TerminatingGateway.HostnameServices, 0)
|
2020-04-10 18:06:08 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2021-03-17 19:40:39 +00:00
|
|
|
"transparent-proxy-initial": {
|
|
|
|
ns: structs.NodeService{
|
|
|
|
Kind: structs.ServiceKindConnectProxy,
|
|
|
|
ID: "api-proxy",
|
|
|
|
Service: "api-proxy",
|
|
|
|
Address: "10.0.1.1",
|
|
|
|
Proxy: structs.ConnectProxyConfig{
|
|
|
|
DestinationServiceName: "api",
|
2021-04-12 15:35:14 +00:00
|
|
|
Mode: structs.ProxyModeTransparent,
|
2021-04-15 19:54:40 +00:00
|
|
|
Upstreams: structs.Upstreams{
|
|
|
|
{
|
|
|
|
DestinationName: "db",
|
|
|
|
},
|
|
|
|
},
|
2021-03-17 19:40:39 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
sourceDC: "dc1",
|
|
|
|
stages: []verificationStage{
|
|
|
|
{
|
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2022-07-14 18:45:51 +00:00
|
|
|
intentionsWatchID: genVerifyIntentionWatch("api", "dc1"),
|
|
|
|
intentionUpstreamsID: genVerifyServiceSpecificRequest("api", "", "dc1", false),
|
|
|
|
intentionUpstreamsDestinationID: genVerifyServiceSpecificRequest("api", "", "dc1", false),
|
|
|
|
meshConfigEntryID: genVerifyMeshConfigWatch("dc1"),
|
|
|
|
rootsWatchID: genVerifyDCSpecificWatch("dc1"),
|
|
|
|
leafWatchID: genVerifyLeafWatch("api", "dc1"),
|
2021-03-17 19:40:39 +00:00
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.False(t, snap.Valid(), "proxy without roots/leaf/intentions is not valid")
|
2022-03-30 18:43:59 +00:00
|
|
|
require.True(t, snap.MeshGateway.isEmpty())
|
|
|
|
require.True(t, snap.IngressGateway.isEmpty())
|
|
|
|
require.True(t, snap.TerminatingGateway.isEmpty())
|
2021-04-15 19:54:40 +00:00
|
|
|
|
2022-03-30 18:43:59 +00:00
|
|
|
require.False(t, snap.ConnectProxy.isEmpty())
|
2022-01-20 16:12:04 +00:00
|
|
|
expectUpstreams := map[UpstreamID]*structs.Upstream{
|
|
|
|
dbUID: {
|
2021-04-15 19:54:40 +00:00
|
|
|
DestinationName: "db",
|
|
|
|
DestinationNamespace: structs.IntentionDefaultNamespace,
|
Update filter chain creation for sidecar/ingress listeners (#11245)
The duo of `makeUpstreamFilterChainForDiscoveryChain` and `makeListenerForDiscoveryChain` were really hard to reason about, and led to concealing a bug in their branching logic. There were several issues here:
- They tried to accomplish too much: determining filter name, cluster name, and whether RDS should be used.
- They embedded logic to handle significantly different kinds of upstream listeners (passthrough, prepared query, typical services, and catch-all)
- They needed to coalesce different data sources (Upstream and CompiledDiscoveryChain)
Rather than handling all of those tasks inside of these functions, this PR pulls out the RDS/clusterName/filterName logic.
This refactor also fixed a bug with the handling of [UpstreamDefaults](https://www.consul.io/docs/connect/config-entries/service-defaults#defaults). These defaults get stored as UpstreamConfig in the proxy snapshot with a DestinationName of "*", since they apply to all upstreams. However, this wildcard destination name must not be used when creating the name of the associated upstream cluster. The coalescing logic in the original functions here was in some situations creating clusters with a `*.` prefix, which is not a valid destination.
2021-11-09 21:43:51 +00:00
|
|
|
DestinationPartition: structs.IntentionDefaultNamespace,
|
2021-04-15 19:54:40 +00:00
|
|
|
},
|
|
|
|
}
|
|
|
|
require.Equal(t, expectUpstreams, snap.ConnectProxy.UpstreamConfig)
|
2021-03-17 19:40:39 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2021-03-17 19:40:39 +00:00
|
|
|
rootWatchEvent(),
|
|
|
|
{
|
|
|
|
CorrelationID: leafWatchID,
|
|
|
|
Result: issuedCert,
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
CorrelationID: intentionsWatchID,
|
|
|
|
Result: TestIntentions(),
|
|
|
|
Err: nil,
|
|
|
|
},
|
2021-04-06 18:19:59 +00:00
|
|
|
{
|
2021-04-28 22:13:29 +00:00
|
|
|
CorrelationID: meshConfigEntryID,
|
2021-04-06 18:19:59 +00:00
|
|
|
Result: &structs.ConfigEntryResponse{
|
|
|
|
Entry: nil, // no explicit config
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
2021-03-17 19:40:39 +00:00
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid(), "proxy with roots/leaf/intentions is valid")
|
|
|
|
require.Equal(t, indexedRoots, snap.Roots)
|
|
|
|
require.Equal(t, issuedCert, snap.Leaf())
|
2022-07-01 15:15:49 +00:00
|
|
|
require.Equal(t, TestIntentions(), snap.ConnectProxy.Intentions)
|
2022-03-30 18:43:59 +00:00
|
|
|
require.True(t, snap.MeshGateway.isEmpty())
|
|
|
|
require.True(t, snap.IngressGateway.isEmpty())
|
|
|
|
require.True(t, snap.TerminatingGateway.isEmpty())
|
2021-04-28 22:13:29 +00:00
|
|
|
require.True(t, snap.ConnectProxy.MeshConfigSet)
|
|
|
|
require.Nil(t, snap.ConnectProxy.MeshConfig)
|
2021-03-17 19:40:39 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
"transparent-proxy-handle-update": {
|
|
|
|
ns: structs.NodeService{
|
|
|
|
Kind: structs.ServiceKindConnectProxy,
|
|
|
|
ID: "api-proxy",
|
|
|
|
Service: "api-proxy",
|
|
|
|
Address: "10.0.1.1",
|
|
|
|
Proxy: structs.ConnectProxyConfig{
|
|
|
|
DestinationServiceName: "api",
|
2021-04-12 15:35:14 +00:00
|
|
|
Mode: structs.ProxyModeTransparent,
|
2021-04-06 20:48:54 +00:00
|
|
|
Upstreams: structs.Upstreams{
|
|
|
|
{
|
|
|
|
CentrallyConfigured: true,
|
|
|
|
DestinationName: structs.WildcardSpecifier,
|
|
|
|
DestinationNamespace: structs.WildcardSpecifier,
|
|
|
|
Config: map[string]interface{}{
|
|
|
|
"connect_timeout_ms": 6000,
|
|
|
|
},
|
2021-04-06 21:16:58 +00:00
|
|
|
MeshGateway: structs.MeshGatewayConfig{Mode: structs.MeshGatewayModeRemote},
|
2021-04-06 20:48:54 +00:00
|
|
|
},
|
|
|
|
},
|
2021-03-17 19:40:39 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
sourceDC: "dc1",
|
|
|
|
stages: []verificationStage{
|
|
|
|
// Empty on initialization
|
|
|
|
{
|
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2022-07-14 18:45:51 +00:00
|
|
|
intentionsWatchID: genVerifyIntentionWatch("api", "dc1"),
|
|
|
|
intentionUpstreamsID: genVerifyServiceSpecificRequest("api", "", "dc1", false),
|
|
|
|
intentionUpstreamsDestinationID: genVerifyServiceSpecificRequest("api", "", "dc1", false),
|
|
|
|
meshConfigEntryID: genVerifyMeshConfigWatch("dc1"),
|
|
|
|
rootsWatchID: genVerifyDCSpecificWatch("dc1"),
|
|
|
|
leafWatchID: genVerifyLeafWatch("api", "dc1"),
|
2021-03-17 19:40:39 +00:00
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.False(t, snap.Valid(), "proxy without roots/leaf/intentions is not valid")
|
2022-03-30 18:43:59 +00:00
|
|
|
require.True(t, snap.MeshGateway.isEmpty())
|
|
|
|
require.True(t, snap.IngressGateway.isEmpty())
|
|
|
|
require.True(t, snap.TerminatingGateway.isEmpty())
|
2021-04-06 20:48:54 +00:00
|
|
|
|
|
|
|
// Centrally configured upstream defaults should be stored so that upstreams from intentions can inherit them
|
|
|
|
require.Len(t, snap.ConnectProxy.UpstreamConfig, 1)
|
2021-04-12 23:04:33 +00:00
|
|
|
|
2021-07-22 18:20:45 +00:00
|
|
|
wc := structs.NewServiceName(structs.WildcardSpecifier, structs.WildcardEnterpriseMetaInDefaultPartition())
|
2022-01-20 16:12:04 +00:00
|
|
|
wcUID := NewUpstreamIDFromServiceName(wc)
|
|
|
|
require.Contains(t, snap.ConnectProxy.UpstreamConfig, wcUID)
|
2021-03-17 19:40:39 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
// Valid snapshot after roots, leaf, and intentions
|
|
|
|
{
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2021-03-17 19:40:39 +00:00
|
|
|
rootWatchEvent(),
|
|
|
|
{
|
|
|
|
CorrelationID: leafWatchID,
|
|
|
|
Result: issuedCert,
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
CorrelationID: intentionsWatchID,
|
|
|
|
Result: TestIntentions(),
|
|
|
|
Err: nil,
|
|
|
|
},
|
2021-04-06 18:19:59 +00:00
|
|
|
{
|
2021-04-28 22:13:29 +00:00
|
|
|
CorrelationID: meshConfigEntryID,
|
2021-04-06 18:19:59 +00:00
|
|
|
Result: &structs.ConfigEntryResponse{
|
2021-04-28 22:13:29 +00:00
|
|
|
Entry: &structs.MeshConfigEntry{
|
|
|
|
TransparentProxy: structs.TransparentProxyMeshConfig{},
|
2021-04-06 18:19:59 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
2021-03-17 19:40:39 +00:00
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid(), "proxy with roots/leaf/intentions is valid")
|
|
|
|
require.Equal(t, indexedRoots, snap.Roots)
|
|
|
|
require.Equal(t, issuedCert, snap.Leaf())
|
2022-07-01 15:15:49 +00:00
|
|
|
require.Equal(t, TestIntentions(), snap.ConnectProxy.Intentions)
|
2022-03-30 18:43:59 +00:00
|
|
|
require.True(t, snap.MeshGateway.isEmpty())
|
|
|
|
require.True(t, snap.IngressGateway.isEmpty())
|
|
|
|
require.True(t, snap.TerminatingGateway.isEmpty())
|
2021-04-28 22:13:29 +00:00
|
|
|
require.True(t, snap.ConnectProxy.MeshConfigSet)
|
|
|
|
require.NotNil(t, snap.ConnectProxy.MeshConfig)
|
2021-03-17 19:40:39 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
// Receiving an intention should lead to spinning up a discovery chain watch
|
|
|
|
{
|
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2022-07-14 18:45:51 +00:00
|
|
|
intentionsWatchID: genVerifyIntentionWatch("api", "dc1"),
|
|
|
|
intentionUpstreamsID: genVerifyServiceSpecificRequest("api", "", "dc1", false),
|
|
|
|
intentionUpstreamsDestinationID: genVerifyServiceSpecificRequest("api", "", "dc1", false),
|
|
|
|
rootsWatchID: genVerifyDCSpecificWatch("dc1"),
|
|
|
|
leafWatchID: genVerifyLeafWatch("api", "dc1"),
|
2021-03-17 19:40:39 +00:00
|
|
|
},
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2021-03-17 19:40:39 +00:00
|
|
|
{
|
|
|
|
CorrelationID: intentionUpstreamsID,
|
|
|
|
Result: &structs.IndexedServiceList{
|
|
|
|
Services: structs.ServiceList{
|
|
|
|
db,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid(), "should still be valid")
|
|
|
|
|
2022-01-20 16:12:04 +00:00
|
|
|
require.Equal(t, map[UpstreamID]struct{}{dbUID: {}}, snap.ConnectProxy.IntentionUpstreams)
|
2021-12-13 22:13:33 +00:00
|
|
|
|
2021-03-17 19:40:39 +00:00
|
|
|
// Should start watch for db's chain
|
2022-01-20 16:12:04 +00:00
|
|
|
require.Contains(t, snap.ConnectProxy.WatchedDiscoveryChains, dbUID)
|
2021-03-17 19:40:39 +00:00
|
|
|
|
|
|
|
// Should not have results yet
|
|
|
|
require.Empty(t, snap.ConnectProxy.DiscoveryChain)
|
2021-04-06 20:48:54 +00:00
|
|
|
|
|
|
|
require.Len(t, snap.ConnectProxy.UpstreamConfig, 2)
|
2022-01-20 16:12:04 +00:00
|
|
|
cfg, ok := snap.ConnectProxy.UpstreamConfig[dbUID]
|
2021-04-06 20:48:54 +00:00
|
|
|
require.True(t, ok)
|
|
|
|
|
|
|
|
// Upstream config should have been inherited from defaults under wildcard key
|
|
|
|
require.Equal(t, cfg.Config["connect_timeout_ms"], 6000)
|
2021-03-17 19:40:39 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
// Discovery chain updates should be stored
|
|
|
|
{
|
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2022-01-20 16:12:04 +00:00
|
|
|
"discovery-chain:" + dbUID.String(): genVerifyDiscoveryChainWatch(&structs.DiscoveryChainRequest{
|
2021-04-06 20:48:54 +00:00
|
|
|
Name: "db",
|
|
|
|
EvaluateInDatacenter: "dc1",
|
|
|
|
EvaluateInNamespace: "default",
|
2021-09-16 21:05:28 +00:00
|
|
|
EvaluateInPartition: "default",
|
2021-04-06 20:48:54 +00:00
|
|
|
Datacenter: "dc1",
|
|
|
|
OverrideConnectTimeout: 6 * time.Second,
|
2021-04-06 21:16:58 +00:00
|
|
|
OverrideMeshGateway: structs.MeshGatewayConfig{Mode: structs.MeshGatewayModeRemote},
|
2022-11-07 15:00:11 +00:00
|
|
|
QueryOptions: structs.QueryOptions{
|
|
|
|
Token: aclToken,
|
|
|
|
},
|
2021-03-17 19:40:39 +00:00
|
|
|
}),
|
|
|
|
},
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2021-03-17 19:40:39 +00:00
|
|
|
{
|
2022-01-20 16:12:04 +00:00
|
|
|
CorrelationID: "discovery-chain:" + dbUID.String(),
|
2021-03-17 19:40:39 +00:00
|
|
|
Result: &structs.DiscoveryChainResponse{
|
2021-10-22 23:15:05 +00:00
|
|
|
Chain: discoverychain.TestCompileConfigEntries(t, "db", "default", "default", "dc1", "trustdomain.consul", nil),
|
2021-03-17 19:40:39 +00:00
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedUpstreams, 1)
|
2022-01-20 16:12:04 +00:00
|
|
|
require.Len(t, snap.ConnectProxy.WatchedUpstreams[dbUID], 1)
|
2021-03-17 19:40:39 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2022-06-01 15:18:06 +00:00
|
|
|
"upstream-target:db.default.default.dc1:" + dbUID.String(): genVerifyServiceSpecificRequest("db", "", "dc1", true),
|
2021-03-17 19:40:39 +00:00
|
|
|
},
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2021-03-17 19:40:39 +00:00
|
|
|
{
|
2022-01-20 16:12:04 +00:00
|
|
|
CorrelationID: "upstream-target:db.default.default.dc1:" + dbUID.String(),
|
2021-03-17 19:40:39 +00:00
|
|
|
Result: &structs.IndexedCheckServiceNodes{
|
|
|
|
Nodes: structs.CheckServiceNodes{
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
2022-02-10 00:16:00 +00:00
|
|
|
Datacenter: "dc1",
|
|
|
|
Node: "node1",
|
|
|
|
Address: "10.0.0.1",
|
2021-03-17 19:40:39 +00:00
|
|
|
},
|
|
|
|
Service: &structs.NodeService{
|
2021-06-09 20:34:17 +00:00
|
|
|
Kind: structs.ServiceKindConnectProxy,
|
|
|
|
ID: "db-sidecar-proxy",
|
|
|
|
Service: "db-sidecar-proxy",
|
|
|
|
Address: "10.10.10.10",
|
|
|
|
TaggedAddresses: map[string]structs.ServiceAddress{
|
|
|
|
structs.TaggedAddressWAN: {Address: "17.5.7.8"},
|
|
|
|
structs.TaggedAddressWANIPv6: {Address: "2607:f0d0:1002:51::4"},
|
|
|
|
},
|
|
|
|
Proxy: structs.ConnectProxyConfig{
|
|
|
|
DestinationServiceName: "db",
|
|
|
|
TransparentProxy: structs.TransparentProxyConfig{
|
|
|
|
DialedDirectly: true,
|
|
|
|
},
|
|
|
|
},
|
2022-01-28 06:49:06 +00:00
|
|
|
RaftIndex: structs.RaftIndex{
|
|
|
|
ModifyIndex: 12,
|
|
|
|
},
|
2021-06-09 20:34:17 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
2022-02-10 00:16:00 +00:00
|
|
|
Datacenter: "dc1",
|
|
|
|
Node: "node2",
|
|
|
|
Address: "10.0.0.2",
|
2022-01-28 06:49:06 +00:00
|
|
|
RaftIndex: structs.RaftIndex{
|
|
|
|
ModifyIndex: 21,
|
|
|
|
},
|
2021-06-09 20:34:17 +00:00
|
|
|
},
|
|
|
|
Service: &structs.NodeService{
|
|
|
|
Kind: structs.ServiceKindConnectProxy,
|
|
|
|
ID: "db-sidecar-proxy2",
|
|
|
|
Service: "db-sidecar-proxy",
|
|
|
|
Proxy: structs.ConnectProxyConfig{
|
|
|
|
DestinationServiceName: "db",
|
|
|
|
TransparentProxy: structs.TransparentProxyConfig{
|
|
|
|
DialedDirectly: true,
|
|
|
|
},
|
|
|
|
},
|
2021-03-17 19:40:39 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedUpstreamEndpoints, 1)
|
2022-01-20 16:12:04 +00:00
|
|
|
require.Contains(t, snap.ConnectProxy.WatchedUpstreamEndpoints, dbUID)
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedUpstreamEndpoints[dbUID], 1)
|
|
|
|
require.Contains(t, snap.ConnectProxy.WatchedUpstreamEndpoints[dbUID], "db.default.default.dc1")
|
|
|
|
require.Equal(t, snap.ConnectProxy.WatchedUpstreamEndpoints[dbUID]["db.default.default.dc1"],
|
2021-03-17 19:40:39 +00:00
|
|
|
structs.CheckServiceNodes{
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
2022-02-10 00:16:00 +00:00
|
|
|
Datacenter: "dc1",
|
|
|
|
Node: "node1",
|
|
|
|
Address: "10.0.0.1",
|
2021-03-17 19:40:39 +00:00
|
|
|
},
|
|
|
|
Service: &structs.NodeService{
|
2021-06-09 20:34:17 +00:00
|
|
|
Kind: structs.ServiceKindConnectProxy,
|
|
|
|
ID: "db-sidecar-proxy",
|
|
|
|
Service: "db-sidecar-proxy",
|
|
|
|
Address: "10.10.10.10",
|
|
|
|
TaggedAddresses: map[string]structs.ServiceAddress{
|
|
|
|
structs.TaggedAddressWAN: {Address: "17.5.7.8"},
|
|
|
|
structs.TaggedAddressWANIPv6: {Address: "2607:f0d0:1002:51::4"},
|
|
|
|
},
|
|
|
|
Proxy: structs.ConnectProxyConfig{
|
|
|
|
DestinationServiceName: "db",
|
|
|
|
TransparentProxy: structs.TransparentProxyConfig{
|
|
|
|
DialedDirectly: true,
|
|
|
|
},
|
|
|
|
},
|
2022-01-28 06:49:06 +00:00
|
|
|
RaftIndex: structs.RaftIndex{
|
|
|
|
ModifyIndex: 12,
|
|
|
|
},
|
2021-06-09 20:34:17 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
2022-02-10 00:16:00 +00:00
|
|
|
Datacenter: "dc1",
|
|
|
|
Node: "node2",
|
|
|
|
Address: "10.0.0.2",
|
2022-01-28 06:49:06 +00:00
|
|
|
RaftIndex: structs.RaftIndex{
|
|
|
|
ModifyIndex: 21,
|
|
|
|
},
|
2021-06-09 20:34:17 +00:00
|
|
|
},
|
|
|
|
Service: &structs.NodeService{
|
|
|
|
Kind: structs.ServiceKindConnectProxy,
|
|
|
|
ID: "db-sidecar-proxy2",
|
|
|
|
Service: "db-sidecar-proxy",
|
|
|
|
Proxy: structs.ConnectProxyConfig{
|
|
|
|
DestinationServiceName: "db",
|
|
|
|
TransparentProxy: structs.TransparentProxyConfig{
|
|
|
|
DialedDirectly: true,
|
|
|
|
},
|
|
|
|
},
|
2021-03-17 19:40:39 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
)
|
2021-06-09 20:34:17 +00:00
|
|
|
// The LAN service address is used below because transparent proxying
|
|
|
|
// does not support querying service nodes in other DCs, and the WAN address
|
|
|
|
// should not be used in DC-local calls.
|
2022-01-28 03:52:26 +00:00
|
|
|
require.Equal(t, snap.ConnectProxy.PassthroughUpstreams, map[UpstreamID]map[string]map[string]struct{}{
|
2022-01-20 16:12:04 +00:00
|
|
|
dbUID: {
|
2022-01-28 03:52:26 +00:00
|
|
|
"db.default.default.dc1": map[string]struct{}{
|
2021-06-09 20:34:17 +00:00
|
|
|
"10.10.10.10": {},
|
|
|
|
"10.0.0.2": {},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
})
|
2022-01-28 06:49:06 +00:00
|
|
|
require.Equal(t, snap.ConnectProxy.PassthroughIndices, map[string]indexedTarget{
|
|
|
|
"10.0.0.2": {
|
|
|
|
upstreamID: dbUID,
|
|
|
|
targetID: "db.default.default.dc1",
|
|
|
|
idx: 21,
|
|
|
|
},
|
|
|
|
"10.10.10.10": {
|
|
|
|
upstreamID: dbUID,
|
|
|
|
targetID: "db.default.default.dc1",
|
|
|
|
idx: 12,
|
|
|
|
},
|
|
|
|
})
|
2021-03-17 19:40:39 +00:00
|
|
|
},
|
|
|
|
},
|
2021-05-04 14:45:19 +00:00
|
|
|
// Discovery chain updates should be stored
|
|
|
|
{
|
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2022-01-20 16:12:04 +00:00
|
|
|
"discovery-chain:" + dbUID.String(): genVerifyDiscoveryChainWatch(&structs.DiscoveryChainRequest{
|
2021-05-04 14:45:19 +00:00
|
|
|
Name: "db",
|
|
|
|
EvaluateInDatacenter: "dc1",
|
|
|
|
EvaluateInNamespace: "default",
|
2021-09-16 21:05:28 +00:00
|
|
|
EvaluateInPartition: "default",
|
2021-05-04 14:45:19 +00:00
|
|
|
Datacenter: "dc1",
|
|
|
|
OverrideConnectTimeout: 6 * time.Second,
|
|
|
|
OverrideMeshGateway: structs.MeshGatewayConfig{Mode: structs.MeshGatewayModeRemote},
|
2022-11-07 15:00:11 +00:00
|
|
|
QueryOptions: structs.QueryOptions{
|
|
|
|
Token: aclToken,
|
|
|
|
},
|
2021-05-04 14:45:19 +00:00
|
|
|
}),
|
|
|
|
},
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2021-05-04 14:45:19 +00:00
|
|
|
{
|
2022-01-20 16:12:04 +00:00
|
|
|
CorrelationID: "discovery-chain:" + dbUID.String(),
|
2021-05-04 14:45:19 +00:00
|
|
|
Result: &structs.DiscoveryChainResponse{
|
2021-10-22 23:15:05 +00:00
|
|
|
Chain: discoverychain.TestCompileConfigEntries(t, "db", "default", "default", "dc1", "trustdomain.consul", nil, &structs.ServiceResolverConfigEntry{
|
2021-09-07 20:29:32 +00:00
|
|
|
Kind: structs.ServiceResolver,
|
|
|
|
Name: "db",
|
|
|
|
Redirect: &structs.ServiceResolverRedirect{
|
|
|
|
Service: "mysql",
|
2021-05-04 14:45:19 +00:00
|
|
|
},
|
2021-09-07 20:29:32 +00:00
|
|
|
}),
|
2021-05-04 14:45:19 +00:00
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedUpstreams, 1)
|
2022-01-20 16:12:04 +00:00
|
|
|
require.Len(t, snap.ConnectProxy.WatchedUpstreams[dbUID], 2)
|
2021-05-04 14:45:19 +00:00
|
|
|
|
|
|
|
// In transparent mode we watch the upstream's endpoints even if the upstream is not a target of its chain.
|
|
|
|
// This will happen in cases like redirects.
|
2022-01-20 16:12:04 +00:00
|
|
|
require.Contains(t, snap.ConnectProxy.WatchedUpstreams[dbUID], "db.default.default.dc1")
|
|
|
|
require.Contains(t, snap.ConnectProxy.WatchedUpstreams[dbUID], "mysql.default.default.dc1")
|
2021-05-04 14:45:19 +00:00
|
|
|
},
|
|
|
|
},
|
2022-01-28 01:56:47 +00:00
|
|
|
{
|
|
|
|
// Receive a new upstream target event without proxy1.
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2022-01-28 01:56:47 +00:00
|
|
|
{
|
|
|
|
CorrelationID: "upstream-target:db.default.default.dc1:" + dbUID.String(),
|
|
|
|
Result: &structs.IndexedCheckServiceNodes{
|
|
|
|
Nodes: structs.CheckServiceNodes{
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
2022-02-10 00:16:00 +00:00
|
|
|
Datacenter: "dc1",
|
|
|
|
Node: "node2",
|
|
|
|
Address: "10.0.0.2",
|
2022-01-28 06:49:06 +00:00
|
|
|
RaftIndex: structs.RaftIndex{
|
|
|
|
ModifyIndex: 21,
|
|
|
|
},
|
2022-01-28 01:56:47 +00:00
|
|
|
},
|
|
|
|
Service: &structs.NodeService{
|
|
|
|
Kind: structs.ServiceKindConnectProxy,
|
|
|
|
ID: "db-sidecar-proxy2",
|
|
|
|
Service: "db-sidecar-proxy",
|
|
|
|
Proxy: structs.ConnectProxyConfig{
|
|
|
|
DestinationServiceName: "db",
|
|
|
|
TransparentProxy: structs.TransparentProxyConfig{
|
|
|
|
DialedDirectly: true,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedUpstreamEndpoints, 1)
|
|
|
|
require.Contains(t, snap.ConnectProxy.WatchedUpstreamEndpoints, dbUID)
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedUpstreamEndpoints[dbUID], 1)
|
|
|
|
require.Contains(t, snap.ConnectProxy.WatchedUpstreamEndpoints[dbUID], "db.default.default.dc1")
|
|
|
|
|
|
|
|
// THe endpoint and passthrough address for proxy1 should be gone.
|
|
|
|
require.Equal(t, snap.ConnectProxy.WatchedUpstreamEndpoints[dbUID]["db.default.default.dc1"],
|
|
|
|
structs.CheckServiceNodes{
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
2022-02-10 00:16:00 +00:00
|
|
|
Datacenter: "dc1",
|
|
|
|
Node: "node2",
|
|
|
|
Address: "10.0.0.2",
|
2022-01-28 06:49:06 +00:00
|
|
|
RaftIndex: structs.RaftIndex{
|
|
|
|
ModifyIndex: 21,
|
|
|
|
},
|
2022-01-28 01:56:47 +00:00
|
|
|
},
|
|
|
|
Service: &structs.NodeService{
|
|
|
|
Kind: structs.ServiceKindConnectProxy,
|
|
|
|
ID: "db-sidecar-proxy2",
|
|
|
|
Service: "db-sidecar-proxy",
|
|
|
|
Proxy: structs.ConnectProxyConfig{
|
|
|
|
DestinationServiceName: "db",
|
|
|
|
TransparentProxy: structs.TransparentProxyConfig{
|
|
|
|
DialedDirectly: true,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
)
|
2022-01-28 03:52:26 +00:00
|
|
|
require.Equal(t, snap.ConnectProxy.PassthroughUpstreams, map[UpstreamID]map[string]map[string]struct{}{
|
2022-01-28 01:56:47 +00:00
|
|
|
dbUID: {
|
2022-01-28 03:52:26 +00:00
|
|
|
"db.default.default.dc1": map[string]struct{}{
|
2022-01-28 01:56:47 +00:00
|
|
|
"10.0.0.2": {},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
})
|
2022-01-28 06:49:06 +00:00
|
|
|
require.Equal(t, snap.ConnectProxy.PassthroughIndices, map[string]indexedTarget{
|
|
|
|
"10.0.0.2": {
|
|
|
|
upstreamID: dbUID,
|
|
|
|
targetID: "db.default.default.dc1",
|
|
|
|
idx: 21,
|
|
|
|
},
|
|
|
|
})
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
// Receive a new upstream target event with a conflicting passthrough address
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2022-01-28 06:49:06 +00:00
|
|
|
{
|
|
|
|
CorrelationID: "upstream-target:api.default.default.dc1:" + apiUID.String(),
|
|
|
|
Result: &structs.IndexedCheckServiceNodes{
|
|
|
|
Nodes: structs.CheckServiceNodes{
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
2022-02-10 00:16:00 +00:00
|
|
|
Datacenter: "dc1",
|
|
|
|
Node: "node2",
|
2022-01-28 06:49:06 +00:00
|
|
|
},
|
|
|
|
Service: &structs.NodeService{
|
|
|
|
Kind: structs.ServiceKindConnectProxy,
|
|
|
|
ID: "api-sidecar-proxy",
|
|
|
|
Service: "api-sidecar-proxy",
|
|
|
|
Address: "10.0.0.2",
|
|
|
|
Proxy: structs.ConnectProxyConfig{
|
|
|
|
DestinationServiceName: "api",
|
|
|
|
TransparentProxy: structs.TransparentProxyConfig{
|
|
|
|
DialedDirectly: true,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
RaftIndex: structs.RaftIndex{
|
|
|
|
ModifyIndex: 32,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedUpstreamEndpoints, 2)
|
|
|
|
require.Contains(t, snap.ConnectProxy.WatchedUpstreamEndpoints, apiUID)
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedUpstreamEndpoints[apiUID], 1)
|
|
|
|
require.Contains(t, snap.ConnectProxy.WatchedUpstreamEndpoints[apiUID], "api.default.default.dc1")
|
|
|
|
|
|
|
|
// THe endpoint and passthrough address for proxy1 should be gone.
|
|
|
|
require.Equal(t, snap.ConnectProxy.WatchedUpstreamEndpoints[apiUID]["api.default.default.dc1"],
|
|
|
|
structs.CheckServiceNodes{
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
2022-02-10 00:16:00 +00:00
|
|
|
Datacenter: "dc1",
|
|
|
|
Node: "node2",
|
2022-01-28 06:49:06 +00:00
|
|
|
},
|
|
|
|
Service: &structs.NodeService{
|
|
|
|
Kind: structs.ServiceKindConnectProxy,
|
|
|
|
ID: "api-sidecar-proxy",
|
|
|
|
Service: "api-sidecar-proxy",
|
|
|
|
Address: "10.0.0.2",
|
|
|
|
Proxy: structs.ConnectProxyConfig{
|
|
|
|
DestinationServiceName: "api",
|
|
|
|
TransparentProxy: structs.TransparentProxyConfig{
|
|
|
|
DialedDirectly: true,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
RaftIndex: structs.RaftIndex{
|
|
|
|
ModifyIndex: 32,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
)
|
|
|
|
require.Equal(t, snap.ConnectProxy.PassthroughUpstreams, map[UpstreamID]map[string]map[string]struct{}{
|
|
|
|
apiUID: {
|
|
|
|
// This target has a higher index so the old passthrough address should be discarded.
|
|
|
|
"api.default.default.dc1": map[string]struct{}{
|
|
|
|
"10.0.0.2": {},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
})
|
|
|
|
require.Equal(t, snap.ConnectProxy.PassthroughIndices, map[string]indexedTarget{
|
|
|
|
"10.0.0.2": {
|
|
|
|
upstreamID: apiUID,
|
|
|
|
targetID: "api.default.default.dc1",
|
|
|
|
idx: 32,
|
|
|
|
},
|
|
|
|
})
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
// Event with no nodes should clean up addrs
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2022-01-28 06:49:06 +00:00
|
|
|
{
|
|
|
|
CorrelationID: "upstream-target:api.default.default.dc1:" + apiUID.String(),
|
|
|
|
Result: &structs.IndexedCheckServiceNodes{
|
|
|
|
Nodes: structs.CheckServiceNodes{},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedUpstreamEndpoints, 2)
|
|
|
|
require.Contains(t, snap.ConnectProxy.WatchedUpstreamEndpoints, apiUID)
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedUpstreamEndpoints[apiUID], 1)
|
|
|
|
require.Contains(t, snap.ConnectProxy.WatchedUpstreamEndpoints[apiUID], "api.default.default.dc1")
|
|
|
|
|
|
|
|
// The endpoint and passthrough address for proxy1 should be gone.
|
|
|
|
require.Empty(t, snap.ConnectProxy.WatchedUpstreamEndpoints[apiUID]["api.default.default.dc1"])
|
|
|
|
require.Empty(t, snap.ConnectProxy.PassthroughUpstreams[apiUID]["api.default.default.dc1"])
|
|
|
|
require.Empty(t, snap.ConnectProxy.PassthroughIndices)
|
2022-01-28 01:56:47 +00:00
|
|
|
},
|
|
|
|
},
|
2021-03-17 19:40:39 +00:00
|
|
|
{
|
2022-01-28 06:49:06 +00:00
|
|
|
// Empty list of upstreams should clean up map keys
|
2021-03-17 19:40:39 +00:00
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2022-07-14 18:45:51 +00:00
|
|
|
intentionsWatchID: genVerifyIntentionWatch("api", "dc1"),
|
|
|
|
intentionUpstreamsID: genVerifyServiceSpecificRequest("api", "", "dc1", false),
|
|
|
|
intentionUpstreamsDestinationID: genVerifyServiceSpecificRequest("api", "", "dc1", false),
|
|
|
|
rootsWatchID: genVerifyDCSpecificWatch("dc1"),
|
|
|
|
leafWatchID: genVerifyLeafWatch("api", "dc1"),
|
2021-03-17 19:40:39 +00:00
|
|
|
},
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2021-03-17 19:40:39 +00:00
|
|
|
{
|
|
|
|
CorrelationID: intentionUpstreamsID,
|
|
|
|
Result: &structs.IndexedServiceList{
|
|
|
|
Services: structs.ServiceList{},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid(), "should still be valid")
|
|
|
|
|
|
|
|
// Empty intention upstreams leads to cancelling all associated watches
|
|
|
|
require.Empty(t, snap.ConnectProxy.WatchedDiscoveryChains)
|
|
|
|
require.Empty(t, snap.ConnectProxy.WatchedUpstreams)
|
|
|
|
require.Empty(t, snap.ConnectProxy.WatchedUpstreamEndpoints)
|
|
|
|
require.Empty(t, snap.ConnectProxy.WatchedGateways)
|
|
|
|
require.Empty(t, snap.ConnectProxy.WatchedGatewayEndpoints)
|
|
|
|
require.Empty(t, snap.ConnectProxy.DiscoveryChain)
|
2021-12-13 22:13:33 +00:00
|
|
|
require.Empty(t, snap.ConnectProxy.IntentionUpstreams)
|
2022-01-28 01:56:47 +00:00
|
|
|
require.Empty(t, snap.ConnectProxy.PassthroughUpstreams)
|
2022-01-28 06:49:06 +00:00
|
|
|
require.Empty(t, snap.ConnectProxy.PassthroughIndices)
|
2021-03-17 19:40:39 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2022-07-14 18:45:51 +00:00
|
|
|
"transparent-proxy-handle-update-destination": {
|
|
|
|
ns: structs.NodeService{
|
|
|
|
Kind: structs.ServiceKindConnectProxy,
|
|
|
|
ID: "api-proxy",
|
|
|
|
Service: "api-proxy",
|
|
|
|
Address: "10.0.1.1",
|
|
|
|
Proxy: structs.ConnectProxyConfig{
|
|
|
|
DestinationServiceName: "api",
|
|
|
|
Mode: structs.ProxyModeTransparent,
|
|
|
|
Upstreams: structs.Upstreams{
|
|
|
|
{
|
|
|
|
CentrallyConfigured: true,
|
|
|
|
DestinationName: structs.WildcardSpecifier,
|
|
|
|
DestinationNamespace: structs.WildcardSpecifier,
|
|
|
|
Config: map[string]interface{}{
|
|
|
|
"connect_timeout_ms": 6000,
|
|
|
|
},
|
|
|
|
MeshGateway: structs.MeshGatewayConfig{Mode: structs.MeshGatewayModeRemote},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
sourceDC: "dc1",
|
|
|
|
stages: []verificationStage{
|
|
|
|
// Empty on initialization
|
|
|
|
{
|
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
|
|
|
intentionsWatchID: genVerifyIntentionWatch("api", "dc1"),
|
|
|
|
intentionUpstreamsID: genVerifyServiceSpecificRequest("api", "", "dc1", false),
|
|
|
|
intentionUpstreamsDestinationID: genVerifyServiceSpecificRequest("api", "", "dc1", false),
|
|
|
|
meshConfigEntryID: genVerifyMeshConfigWatch("dc1"),
|
|
|
|
rootsWatchID: genVerifyDCSpecificWatch("dc1"),
|
|
|
|
leafWatchID: genVerifyLeafWatch("api", "dc1"),
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.False(t, snap.Valid(), "proxy without roots/leaf/intentions is not valid")
|
|
|
|
require.True(t, snap.MeshGateway.isEmpty())
|
|
|
|
require.True(t, snap.IngressGateway.isEmpty())
|
|
|
|
require.True(t, snap.TerminatingGateway.isEmpty())
|
|
|
|
|
|
|
|
// Centrally configured upstream defaults should be stored so that upstreams from intentions can inherit them
|
|
|
|
require.Len(t, snap.ConnectProxy.UpstreamConfig, 1)
|
|
|
|
|
|
|
|
wc := structs.NewServiceName(structs.WildcardSpecifier, structs.WildcardEnterpriseMetaInDefaultPartition())
|
|
|
|
wcUID := NewUpstreamIDFromServiceName(wc)
|
|
|
|
require.Contains(t, snap.ConnectProxy.UpstreamConfig, wcUID)
|
|
|
|
},
|
|
|
|
},
|
|
|
|
// Valid snapshot after roots, leaf, and intentions
|
|
|
|
{
|
|
|
|
events: []UpdateEvent{
|
|
|
|
rootWatchEvent(),
|
|
|
|
{
|
|
|
|
CorrelationID: leafWatchID,
|
|
|
|
Result: issuedCert,
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
CorrelationID: intentionsWatchID,
|
|
|
|
Result: TestIntentions(),
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
CorrelationID: meshConfigEntryID,
|
|
|
|
Result: &structs.ConfigEntryResponse{
|
|
|
|
Entry: &structs.MeshConfigEntry{
|
|
|
|
TransparentProxy: structs.TransparentProxyMeshConfig{},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid(), "proxy with roots/leaf/intentions is valid")
|
|
|
|
require.Equal(t, indexedRoots, snap.Roots)
|
|
|
|
require.Equal(t, issuedCert, snap.Leaf())
|
|
|
|
require.Equal(t, TestIntentions(), snap.ConnectProxy.Intentions)
|
|
|
|
require.True(t, snap.MeshGateway.isEmpty())
|
|
|
|
require.True(t, snap.IngressGateway.isEmpty())
|
|
|
|
require.True(t, snap.TerminatingGateway.isEmpty())
|
|
|
|
require.True(t, snap.ConnectProxy.MeshConfigSet)
|
|
|
|
require.NotNil(t, snap.ConnectProxy.MeshConfig)
|
|
|
|
},
|
|
|
|
},
|
|
|
|
// Receiving an intention should lead to spinning up a DestinationConfigEntryID
|
|
|
|
{
|
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
|
|
|
intentionsWatchID: genVerifyIntentionWatch("api", "dc1"),
|
|
|
|
intentionUpstreamsID: genVerifyServiceSpecificRequest("api", "", "dc1", false),
|
|
|
|
intentionUpstreamsDestinationID: genVerifyServiceSpecificRequest("api", "", "dc1", false),
|
|
|
|
rootsWatchID: genVerifyDCSpecificWatch("dc1"),
|
|
|
|
leafWatchID: genVerifyLeafWatch("api", "dc1"),
|
|
|
|
},
|
|
|
|
events: []UpdateEvent{
|
|
|
|
{
|
|
|
|
CorrelationID: intentionUpstreamsDestinationID,
|
|
|
|
Result: &structs.IndexedServiceList{
|
|
|
|
Services: structs.ServiceList{
|
|
|
|
db,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid(), "should still be valid")
|
|
|
|
|
|
|
|
// Watches have a key allocated even if the value is not set
|
|
|
|
require.Equal(t, 1, snap.ConnectProxy.DestinationsUpstream.Len())
|
|
|
|
},
|
|
|
|
},
|
|
|
|
// DestinationConfigEntryID updates should be stored
|
|
|
|
{
|
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
|
|
|
DestinationConfigEntryID + dbUID.String(): genVerifyConfigEntryWatch(structs.ServiceDefaults, db.Name, "dc1"),
|
|
|
|
},
|
|
|
|
events: []UpdateEvent{
|
|
|
|
{
|
|
|
|
CorrelationID: DestinationConfigEntryID + dbUID.String(),
|
|
|
|
Result: &structs.ConfigEntryResponse{
|
|
|
|
Entry: &structs.ServiceConfigEntry{Name: "db", Destination: &structs.DestinationConfig{}},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
CorrelationID: DestinationGatewayID + dbUID.String(),
|
|
|
|
Result: &structs.IndexedCheckServiceNodes{
|
|
|
|
Nodes: structs.CheckServiceNodes{
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Node: "foo",
|
|
|
|
Partition: api.PartitionOrDefault(),
|
|
|
|
Datacenter: "dc1",
|
|
|
|
},
|
|
|
|
Service: &structs.NodeService{
|
|
|
|
Service: "gtwy1",
|
|
|
|
TaggedAddresses: map[string]structs.ServiceAddress{
|
|
|
|
structs.ServiceGatewayVirtualIPTag(structs.ServiceName{Name: "db", EnterpriseMeta: *structs.DefaultEnterpriseMetaInDefaultPartition()}): {Address: "172.0.0.1", Port: 443},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Checks: structs.HealthChecks{},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid(), "should still be valid")
|
|
|
|
require.Equal(t, 1, snap.ConnectProxy.DestinationsUpstream.Len())
|
|
|
|
require.Equal(t, 1, snap.ConnectProxy.DestinationGateways.Len())
|
|
|
|
snap.ConnectProxy.DestinationsUpstream.ForEachKey(func(uid UpstreamID) bool {
|
|
|
|
_, ok := snap.ConnectProxy.DestinationsUpstream.Get(uid)
|
|
|
|
require.True(t, ok)
|
|
|
|
return true
|
|
|
|
})
|
|
|
|
dbDest, ok := snap.ConnectProxy.DestinationsUpstream.Get(dbUID)
|
|
|
|
require.True(t, ok)
|
|
|
|
require.Equal(t, structs.ServiceConfigEntry{Name: "db", Destination: &structs.DestinationConfig{}}, *dbDest)
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2021-06-15 18:00:26 +00:00
|
|
|
// Receiving an empty upstreams from Intentions list shouldn't delete explicit upstream watches
|
|
|
|
"transparent-proxy-handle-update-explicit-cross-dc": {
|
|
|
|
ns: structs.NodeService{
|
|
|
|
Kind: structs.ServiceKindConnectProxy,
|
|
|
|
ID: "api-proxy",
|
|
|
|
Service: "api-proxy",
|
|
|
|
Address: "10.0.1.1",
|
|
|
|
Proxy: structs.ConnectProxyConfig{
|
|
|
|
DestinationServiceName: "api",
|
|
|
|
Mode: structs.ProxyModeTransparent,
|
|
|
|
Upstreams: structs.Upstreams{
|
|
|
|
{
|
|
|
|
CentrallyConfigured: true,
|
|
|
|
DestinationName: structs.WildcardSpecifier,
|
|
|
|
DestinationNamespace: structs.WildcardSpecifier,
|
|
|
|
Config: map[string]interface{}{
|
|
|
|
"connect_timeout_ms": 6000,
|
|
|
|
},
|
|
|
|
MeshGateway: structs.MeshGatewayConfig{Mode: structs.MeshGatewayModeRemote},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
DestinationName: db.Name,
|
|
|
|
DestinationNamespace: db.NamespaceOrDefault(),
|
|
|
|
Datacenter: "dc2",
|
2021-12-14 00:51:13 +00:00
|
|
|
LocalBindPort: 8080,
|
2021-06-15 18:00:26 +00:00
|
|
|
MeshGateway: structs.MeshGatewayConfig{Mode: structs.MeshGatewayModeLocal},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
sourceDC: "dc1",
|
|
|
|
stages: []verificationStage{
|
|
|
|
// Empty on initialization
|
|
|
|
{
|
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2022-07-14 18:45:51 +00:00
|
|
|
intentionsWatchID: genVerifyIntentionWatch("api", "dc1"),
|
|
|
|
intentionUpstreamsID: genVerifyServiceSpecificRequest("api", "", "dc1", false),
|
|
|
|
intentionUpstreamsDestinationID: genVerifyServiceSpecificRequest("api", "", "dc1", false),
|
|
|
|
meshConfigEntryID: genVerifyMeshConfigWatch("dc1"),
|
2022-01-20 16:12:04 +00:00
|
|
|
"discovery-chain:" + upstreamIDForDC2(dbUID).String(): genVerifyDiscoveryChainWatch(&structs.DiscoveryChainRequest{
|
2021-06-15 18:00:26 +00:00
|
|
|
Name: "db",
|
|
|
|
EvaluateInDatacenter: "dc2",
|
|
|
|
EvaluateInNamespace: "default",
|
2021-09-07 20:29:32 +00:00
|
|
|
EvaluateInPartition: "default",
|
2021-06-15 18:00:26 +00:00
|
|
|
Datacenter: "dc1",
|
|
|
|
OverrideMeshGateway: structs.MeshGatewayConfig{Mode: structs.MeshGatewayModeLocal},
|
2022-11-07 15:00:11 +00:00
|
|
|
QueryOptions: structs.QueryOptions{
|
|
|
|
Token: aclToken,
|
|
|
|
},
|
2021-06-15 18:00:26 +00:00
|
|
|
}),
|
2022-06-01 15:18:06 +00:00
|
|
|
rootsWatchID: genVerifyDCSpecificWatch("dc1"),
|
|
|
|
leafWatchID: genVerifyLeafWatch("api", "dc1"),
|
2021-06-15 18:00:26 +00:00
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.False(t, snap.Valid(), "proxy without roots/leaf/intentions is not valid")
|
2022-03-30 18:43:59 +00:00
|
|
|
require.True(t, snap.MeshGateway.isEmpty())
|
|
|
|
require.True(t, snap.IngressGateway.isEmpty())
|
|
|
|
require.True(t, snap.TerminatingGateway.isEmpty())
|
2021-06-15 18:00:26 +00:00
|
|
|
|
|
|
|
// Centrally configured upstream defaults should be stored so that upstreams from intentions can inherit them
|
|
|
|
require.Len(t, snap.ConnectProxy.UpstreamConfig, 2)
|
|
|
|
|
2021-07-22 18:20:45 +00:00
|
|
|
wc := structs.NewServiceName(structs.WildcardSpecifier, structs.WildcardEnterpriseMetaInDefaultPartition())
|
2022-01-20 16:12:04 +00:00
|
|
|
wcUID := NewUpstreamIDFromServiceName(wc)
|
|
|
|
require.Contains(t, snap.ConnectProxy.UpstreamConfig, wcUID)
|
|
|
|
require.Contains(t, snap.ConnectProxy.UpstreamConfig, upstreamIDForDC2(dbUID))
|
2021-06-15 18:00:26 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
// Valid snapshot after roots, leaf, and intentions
|
|
|
|
{
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2021-06-15 18:00:26 +00:00
|
|
|
rootWatchEvent(),
|
|
|
|
{
|
|
|
|
CorrelationID: leafWatchID,
|
|
|
|
Result: issuedCert,
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
CorrelationID: intentionsWatchID,
|
|
|
|
Result: TestIntentions(),
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
CorrelationID: meshConfigEntryID,
|
|
|
|
Result: &structs.ConfigEntryResponse{
|
|
|
|
Entry: &structs.MeshConfigEntry{
|
|
|
|
TransparentProxy: structs.TransparentProxyMeshConfig{},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid(), "proxy with roots/leaf/intentions is valid")
|
|
|
|
require.Equal(t, indexedRoots, snap.Roots)
|
|
|
|
require.Equal(t, issuedCert, snap.Leaf())
|
2022-07-01 15:15:49 +00:00
|
|
|
require.Equal(t, TestIntentions(), snap.ConnectProxy.Intentions)
|
2022-03-30 18:43:59 +00:00
|
|
|
require.True(t, snap.MeshGateway.isEmpty())
|
|
|
|
require.True(t, snap.IngressGateway.isEmpty())
|
|
|
|
require.True(t, snap.TerminatingGateway.isEmpty())
|
2021-06-15 18:00:26 +00:00
|
|
|
require.True(t, snap.ConnectProxy.MeshConfigSet)
|
|
|
|
require.NotNil(t, snap.ConnectProxy.MeshConfig)
|
|
|
|
},
|
|
|
|
},
|
|
|
|
// Discovery chain updates should be stored
|
|
|
|
{
|
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2022-01-20 16:12:04 +00:00
|
|
|
"discovery-chain:" + upstreamIDForDC2(dbUID).String(): genVerifyDiscoveryChainWatch(&structs.DiscoveryChainRequest{
|
2021-06-15 18:00:26 +00:00
|
|
|
Name: "db",
|
|
|
|
EvaluateInDatacenter: "dc2",
|
|
|
|
EvaluateInNamespace: "default",
|
2021-09-07 20:29:32 +00:00
|
|
|
EvaluateInPartition: "default",
|
2021-06-15 18:00:26 +00:00
|
|
|
Datacenter: "dc1",
|
|
|
|
OverrideMeshGateway: structs.MeshGatewayConfig{Mode: structs.MeshGatewayModeLocal},
|
2022-11-07 15:00:11 +00:00
|
|
|
QueryOptions: structs.QueryOptions{
|
|
|
|
Token: aclToken,
|
|
|
|
},
|
2021-06-15 18:00:26 +00:00
|
|
|
}),
|
|
|
|
},
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2021-06-15 18:00:26 +00:00
|
|
|
{
|
2022-01-20 16:12:04 +00:00
|
|
|
CorrelationID: "discovery-chain:" + upstreamIDForDC2(dbUID).String(),
|
2021-06-15 18:00:26 +00:00
|
|
|
Result: &structs.DiscoveryChainResponse{
|
2021-10-22 23:15:05 +00:00
|
|
|
Chain: discoverychain.TestCompileConfigEntries(t, "db", "default", "default", "dc2", "trustdomain.consul",
|
2021-06-15 18:00:26 +00:00
|
|
|
func(req *discoverychain.CompileRequest) {
|
|
|
|
req.OverrideMeshGateway.Mode = structs.MeshGatewayModeLocal
|
|
|
|
}),
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedGateways, 1)
|
2022-01-20 16:12:04 +00:00
|
|
|
require.Len(t, snap.ConnectProxy.WatchedGateways[upstreamIDForDC2(dbUID)], 1)
|
2021-06-15 18:00:26 +00:00
|
|
|
require.Len(t, snap.ConnectProxy.WatchedUpstreams, 1)
|
2022-01-20 16:12:04 +00:00
|
|
|
require.Len(t, snap.ConnectProxy.WatchedUpstreams[upstreamIDForDC2(dbUID)], 1)
|
2021-06-15 18:00:26 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
// Empty list of upstreams should only clean up implicit upstreams. The explicit upstream db should not
|
|
|
|
// be deleted from the snapshot.
|
|
|
|
{
|
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
2022-07-14 18:45:51 +00:00
|
|
|
intentionsWatchID: genVerifyIntentionWatch("api", "dc1"),
|
|
|
|
intentionUpstreamsID: genVerifyServiceSpecificRequest("api", "", "dc1", false),
|
|
|
|
intentionUpstreamsDestinationID: genVerifyServiceSpecificRequest("api", "", "dc1", false),
|
2022-01-20 16:12:04 +00:00
|
|
|
"discovery-chain:" + upstreamIDForDC2(dbUID).String(): genVerifyDiscoveryChainWatch(&structs.DiscoveryChainRequest{
|
2021-06-15 18:00:26 +00:00
|
|
|
Name: "db",
|
|
|
|
EvaluateInDatacenter: "dc2",
|
|
|
|
EvaluateInNamespace: "default",
|
2021-09-07 20:29:32 +00:00
|
|
|
EvaluateInPartition: "default",
|
2021-06-15 18:00:26 +00:00
|
|
|
Datacenter: "dc1",
|
|
|
|
OverrideMeshGateway: structs.MeshGatewayConfig{Mode: structs.MeshGatewayModeLocal},
|
2022-11-07 15:00:11 +00:00
|
|
|
QueryOptions: structs.QueryOptions{
|
|
|
|
Token: aclToken,
|
|
|
|
},
|
2021-06-15 18:00:26 +00:00
|
|
|
}),
|
2022-06-01 15:18:06 +00:00
|
|
|
rootsWatchID: genVerifyDCSpecificWatch("dc1"),
|
|
|
|
leafWatchID: genVerifyLeafWatch("api", "dc1"),
|
2021-06-15 18:00:26 +00:00
|
|
|
},
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2021-06-15 18:00:26 +00:00
|
|
|
{
|
|
|
|
CorrelationID: intentionUpstreamsID,
|
|
|
|
Result: &structs.IndexedServiceList{
|
|
|
|
Services: structs.ServiceList{},
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid(), "should still be valid")
|
2021-12-13 22:13:33 +00:00
|
|
|
require.Empty(t, snap.ConnectProxy.IntentionUpstreams)
|
2021-06-15 18:00:26 +00:00
|
|
|
|
|
|
|
// Explicit upstream discovery chain watches don't get stored in these maps because they don't
|
|
|
|
// get canceled unless the proxy registration is modified.
|
|
|
|
require.Empty(t, snap.ConnectProxy.WatchedDiscoveryChains)
|
|
|
|
|
|
|
|
// Explicit upstreams should not be deleted when the empty update event happens since that is
|
|
|
|
// for intention upstreams.
|
|
|
|
require.Len(t, snap.ConnectProxy.DiscoveryChain, 1)
|
2022-01-20 16:12:04 +00:00
|
|
|
require.Contains(t, snap.ConnectProxy.DiscoveryChain, upstreamIDForDC2(dbUID))
|
2021-06-15 18:00:26 +00:00
|
|
|
require.Len(t, snap.ConnectProxy.WatchedGateways, 1)
|
2022-01-20 16:12:04 +00:00
|
|
|
require.Len(t, snap.ConnectProxy.WatchedGateways[upstreamIDForDC2(dbUID)], 1)
|
2021-06-15 18:00:26 +00:00
|
|
|
require.Len(t, snap.ConnectProxy.WatchedUpstreams, 1)
|
2022-01-20 16:12:04 +00:00
|
|
|
require.Len(t, snap.ConnectProxy.WatchedUpstreams[upstreamIDForDC2(dbUID)], 1)
|
2021-06-15 18:00:26 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2022-07-13 16:14:57 +00:00
|
|
|
"transparent-proxy-initial-with-peers": {
|
|
|
|
ns: structs.NodeService{
|
|
|
|
Kind: structs.ServiceKindConnectProxy,
|
|
|
|
ID: "api-proxy",
|
|
|
|
Service: "api-proxy",
|
|
|
|
Address: "10.0.1.1",
|
|
|
|
Proxy: structs.ConnectProxyConfig{
|
|
|
|
DestinationServiceName: "api",
|
Fix mesh gateway configuration with proxy-defaults (#15186)
* Fix mesh gateway proxy-defaults not affecting upstreams.
* Clarify distinction with upstream settings
Top-level mesh gateway mode in proxy-defaults and service-defaults gets
merged into NodeService.Proxy.MeshGateway, and only gets merged with
the mode attached to an an upstream in proxycfg/xds.
* Fix mgw mode usage for peered upstreams
There were a couple issues with how mgw mode was being handled for
peered upstreams.
For starters, mesh gateway mode from proxy-defaults
and the top-level of service-defaults gets stored in
NodeService.Proxy.MeshGateway, but the upstream watch for peered data
was only considering the mesh gateway config attached in
NodeService.Proxy.Upstreams[i]. This means that applying a mesh gateway
mode via global proxy-defaults or service-defaults on the downstream
would not have an effect.
Separately, transparent proxy watches for peered upstreams didn't
consider mesh gateway mode at all.
This commit addresses the first issue by ensuring that we overlay the
upstream config for peered upstreams as we do for non-peered. The second
issue is addressed by re-using setupWatchesForPeeredUpstream when
handling transparent proxy updates.
Note that for transparent proxies we do not yet support mesh gateway
mode per upstream, so the NodeService.Proxy.MeshGateway mode is used.
* Fix upstream mesh gateway mode handling in xds
This commit ensures that when determining the mesh gateway mode for
peered upstreams we consider the NodeService.Proxy.MeshGateway config as
a baseline.
In absense of this change, setting a mesh gateway mode via
proxy-defaults or the top-level of service-defaults will not have an
effect for peered upstreams.
* Merge service/proxy defaults in cfg resolver
Previously the mesh gateway mode for connect proxies would be
merged at three points:
1. On servers, in ComputeResolvedServiceConfig.
2. On clients, in MergeServiceConfig.
3. On clients, in proxycfg/xds.
The first merge returns a ServiceConfigResponse where there is a
top-level MeshGateway config from proxy/service-defaults, along with
per-upstream config.
The second merge combines per-upstream config specified at the service
instance with per-upstream config specified centrally.
The third merge combines the NodeService.Proxy.MeshGateway
config containing proxy/service-defaults data with the per-upstream
mode. This third merge is easy to miss, which led to peered upstreams
not considering the mesh gateway mode from proxy-defaults.
This commit removes the third merge, and ensures that all mesh gateway
config is available at the upstream. This way proxycfg/xds do not need
to do additional overlays.
* Ensure that proxy-defaults is considered in wc
Upstream defaults become a synthetic Upstream definition under a
wildcard key "*". Now that proxycfg/xds expect Upstream definitions to
have the final MeshGateway values, this commit ensures that values from
proxy-defaults/service-defaults are the default for this synthetic
upstream.
* Add changelog.
Co-authored-by: freddygv <freddy@hashicorp.com>
2022-11-09 16:14:29 +00:00
|
|
|
MeshGateway: structs.MeshGatewayConfig{
|
|
|
|
Mode: structs.MeshGatewayModeLocal,
|
|
|
|
},
|
|
|
|
Mode: structs.ProxyModeTransparent,
|
2022-07-13 16:14:57 +00:00
|
|
|
Upstreams: structs.Upstreams{
|
|
|
|
{
|
|
|
|
DestinationName: "api-a",
|
|
|
|
DestinationPeer: "peer-a",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
sourceDC: "dc1",
|
|
|
|
stages: []verificationStage{
|
|
|
|
{
|
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
|
|
|
peeringTrustBundlesWatchID: genVerifyTrustBundleListWatch("api"),
|
|
|
|
peeredUpstreamsID: genVerifyPartitionSpecificRequest(acl.DefaultEnterpriseMeta().PartitionOrDefault(), "dc1"),
|
|
|
|
meshConfigEntryID: genVerifyMeshConfigWatch("dc1"),
|
|
|
|
rootsWatchID: genVerifyDCSpecificWatch("dc1"),
|
|
|
|
leafWatchID: genVerifyLeafWatch("api", "dc1"),
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.False(t, snap.Valid(), "proxy without roots/leaf/intentions is not valid")
|
|
|
|
require.True(t, snap.MeshGateway.isEmpty())
|
|
|
|
require.True(t, snap.IngressGateway.isEmpty())
|
|
|
|
require.True(t, snap.TerminatingGateway.isEmpty())
|
|
|
|
|
|
|
|
require.False(t, snap.ConnectProxy.isEmpty())
|
|
|
|
|
|
|
|
// This is explicitly defined from proxy config
|
|
|
|
expectUpstreams := map[UpstreamID]*structs.Upstream{
|
|
|
|
extApiUID: {
|
|
|
|
DestinationName: "api-a",
|
|
|
|
DestinationNamespace: structs.IntentionDefaultNamespace,
|
|
|
|
DestinationPartition: structs.IntentionDefaultNamespace,
|
|
|
|
DestinationPeer: "peer-a",
|
|
|
|
},
|
|
|
|
}
|
|
|
|
require.Equal(t, expectUpstreams, snap.ConnectProxy.UpstreamConfig)
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
// Initial events
|
|
|
|
events: []UpdateEvent{
|
|
|
|
rootWatchEvent(),
|
|
|
|
{
|
|
|
|
CorrelationID: leafWatchID,
|
|
|
|
Result: issuedCert,
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
CorrelationID: intentionsWatchID,
|
|
|
|
Result: TestIntentions(),
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
CorrelationID: peeringTrustBundlesWatchID,
|
|
|
|
Result: peerTrustBundles,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
CorrelationID: peeredUpstreamsID,
|
|
|
|
Result: &structs.IndexedPeeredServiceList{
|
|
|
|
Services: []structs.PeeredServiceName{
|
|
|
|
{
|
|
|
|
ServiceName: apiA,
|
|
|
|
Peer: "peer-a",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
// This service is dynamic (not from static config)
|
|
|
|
ServiceName: db,
|
|
|
|
Peer: "peer-a",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
CorrelationID: meshConfigEntryID,
|
|
|
|
Result: &structs.ConfigEntryResponse{
|
|
|
|
Entry: nil, // no explicit config
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid(), "proxy with roots/leaf/intentions is valid")
|
|
|
|
require.Equal(t, indexedRoots, snap.Roots)
|
|
|
|
require.Equal(t, issuedCert, snap.Leaf())
|
|
|
|
require.True(t, snap.MeshGateway.isEmpty())
|
|
|
|
require.True(t, snap.IngressGateway.isEmpty())
|
|
|
|
require.True(t, snap.TerminatingGateway.isEmpty())
|
|
|
|
require.True(t, snap.ConnectProxy.MeshConfigSet)
|
|
|
|
require.Nil(t, snap.ConnectProxy.MeshConfig)
|
|
|
|
|
|
|
|
// Check PeeredUpstream is populated
|
|
|
|
expect := map[UpstreamID]struct{}{
|
|
|
|
extDBUID: {},
|
|
|
|
extApiUID: {},
|
|
|
|
}
|
|
|
|
require.Equal(t, expect, snap.ConnectProxy.PeeredUpstreams)
|
|
|
|
|
|
|
|
require.True(t, snap.ConnectProxy.PeerUpstreamEndpoints.IsWatched(extApiUID))
|
|
|
|
_, ok := snap.ConnectProxy.PeerUpstreamEndpoints.Get(extApiUID)
|
|
|
|
require.False(t, ok, "expected initialized but empty PeerUpstreamEndpoint")
|
|
|
|
|
|
|
|
require.True(t, snap.ConnectProxy.PeerUpstreamEndpoints.IsWatched(extDBUID))
|
|
|
|
_, ok = snap.ConnectProxy.PeerUpstreamEndpoints.Get(extDBUID)
|
|
|
|
require.False(t, ok, "expected initialized but empty PeerUpstreamEndpoint")
|
|
|
|
|
|
|
|
require.True(t, snap.ConnectProxy.UpstreamPeerTrustBundles.IsWatched("peer-a"))
|
|
|
|
_, ok = snap.ConnectProxy.UpstreamPeerTrustBundles.Get("peer-a")
|
|
|
|
require.False(t, ok, "expected initialized but empty PeerTrustBundle")
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
|
|
|
upstreamPeerWatchIDPrefix + extApiUID.String(): genVerifyServiceSpecificPeeredRequest("api-a", "", "dc1", "peer-a", true),
|
|
|
|
upstreamPeerWatchIDPrefix + extDBUID.String(): genVerifyServiceSpecificPeeredRequest("db", "", "dc1", "peer-a", true),
|
|
|
|
peerTrustBundleIDPrefix + "peer-a": genVerifyTrustBundleReadWatch("peer-a"),
|
Fix mesh gateway configuration with proxy-defaults (#15186)
* Fix mesh gateway proxy-defaults not affecting upstreams.
* Clarify distinction with upstream settings
Top-level mesh gateway mode in proxy-defaults and service-defaults gets
merged into NodeService.Proxy.MeshGateway, and only gets merged with
the mode attached to an an upstream in proxycfg/xds.
* Fix mgw mode usage for peered upstreams
There were a couple issues with how mgw mode was being handled for
peered upstreams.
For starters, mesh gateway mode from proxy-defaults
and the top-level of service-defaults gets stored in
NodeService.Proxy.MeshGateway, but the upstream watch for peered data
was only considering the mesh gateway config attached in
NodeService.Proxy.Upstreams[i]. This means that applying a mesh gateway
mode via global proxy-defaults or service-defaults on the downstream
would not have an effect.
Separately, transparent proxy watches for peered upstreams didn't
consider mesh gateway mode at all.
This commit addresses the first issue by ensuring that we overlay the
upstream config for peered upstreams as we do for non-peered. The second
issue is addressed by re-using setupWatchesForPeeredUpstream when
handling transparent proxy updates.
Note that for transparent proxies we do not yet support mesh gateway
mode per upstream, so the NodeService.Proxy.MeshGateway mode is used.
* Fix upstream mesh gateway mode handling in xds
This commit ensures that when determining the mesh gateway mode for
peered upstreams we consider the NodeService.Proxy.MeshGateway config as
a baseline.
In absense of this change, setting a mesh gateway mode via
proxy-defaults or the top-level of service-defaults will not have an
effect for peered upstreams.
* Merge service/proxy defaults in cfg resolver
Previously the mesh gateway mode for connect proxies would be
merged at three points:
1. On servers, in ComputeResolvedServiceConfig.
2. On clients, in MergeServiceConfig.
3. On clients, in proxycfg/xds.
The first merge returns a ServiceConfigResponse where there is a
top-level MeshGateway config from proxy/service-defaults, along with
per-upstream config.
The second merge combines per-upstream config specified at the service
instance with per-upstream config specified centrally.
The third merge combines the NodeService.Proxy.MeshGateway
config containing proxy/service-defaults data with the per-upstream
mode. This third merge is easy to miss, which led to peered upstreams
not considering the mesh gateway mode from proxy-defaults.
This commit removes the third merge, and ensures that all mesh gateway
config is available at the upstream. This way proxycfg/xds do not need
to do additional overlays.
* Ensure that proxy-defaults is considered in wc
Upstream defaults become a synthetic Upstream definition under a
wildcard key "*". Now that proxycfg/xds expect Upstream definitions to
have the final MeshGateway values, this commit ensures that values from
proxy-defaults/service-defaults are the default for this synthetic
upstream.
* Add changelog.
Co-authored-by: freddygv <freddy@hashicorp.com>
2022-11-09 16:14:29 +00:00
|
|
|
"mesh-gateway:dc1": genVerifyGatewayWatch("dc1"),
|
2022-07-13 16:14:57 +00:00
|
|
|
},
|
|
|
|
events: []UpdateEvent{
|
|
|
|
{
|
|
|
|
CorrelationID: peerTrustBundleIDPrefix + "peer-a",
|
|
|
|
Result: &pbpeering.TrustBundleReadResponse{
|
|
|
|
Bundle: peerTrustBundles.Bundles[0],
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid(), "proxy with roots/leaf/intentions is valid")
|
|
|
|
require.Equal(t, indexedRoots, snap.Roots)
|
|
|
|
require.Equal(t, issuedCert, snap.Leaf())
|
|
|
|
require.True(t, snap.MeshGateway.isEmpty())
|
|
|
|
require.True(t, snap.IngressGateway.isEmpty())
|
|
|
|
require.True(t, snap.TerminatingGateway.isEmpty())
|
|
|
|
require.True(t, snap.ConnectProxy.MeshConfigSet)
|
|
|
|
require.Nil(t, snap.ConnectProxy.MeshConfig)
|
|
|
|
|
|
|
|
// Check PeeredUpstream is populated
|
|
|
|
expect := map[UpstreamID]struct{}{
|
|
|
|
extDBUID: {},
|
|
|
|
extApiUID: {},
|
|
|
|
}
|
|
|
|
require.Equal(t, expect, snap.ConnectProxy.PeeredUpstreams)
|
|
|
|
|
|
|
|
// Expect two entries (DB and api-a)
|
|
|
|
require.Equal(t, 2, snap.ConnectProxy.PeerUpstreamEndpoints.Len())
|
|
|
|
|
|
|
|
// db does not have endpoints yet
|
|
|
|
ep, _ := snap.ConnectProxy.PeerUpstreamEndpoints.Get(extDBUID)
|
|
|
|
require.Nil(t, ep)
|
|
|
|
|
|
|
|
// Expect a trust bundle
|
|
|
|
ptb, ok := snap.ConnectProxy.UpstreamPeerTrustBundles.Get("peer-a")
|
|
|
|
require.True(t, ok)
|
|
|
|
prototest.AssertDeepEqual(t, peerTrustBundles.Bundles[0], ptb)
|
|
|
|
|
Fix mesh gateway configuration with proxy-defaults (#15186)
* Fix mesh gateway proxy-defaults not affecting upstreams.
* Clarify distinction with upstream settings
Top-level mesh gateway mode in proxy-defaults and service-defaults gets
merged into NodeService.Proxy.MeshGateway, and only gets merged with
the mode attached to an an upstream in proxycfg/xds.
* Fix mgw mode usage for peered upstreams
There were a couple issues with how mgw mode was being handled for
peered upstreams.
For starters, mesh gateway mode from proxy-defaults
and the top-level of service-defaults gets stored in
NodeService.Proxy.MeshGateway, but the upstream watch for peered data
was only considering the mesh gateway config attached in
NodeService.Proxy.Upstreams[i]. This means that applying a mesh gateway
mode via global proxy-defaults or service-defaults on the downstream
would not have an effect.
Separately, transparent proxy watches for peered upstreams didn't
consider mesh gateway mode at all.
This commit addresses the first issue by ensuring that we overlay the
upstream config for peered upstreams as we do for non-peered. The second
issue is addressed by re-using setupWatchesForPeeredUpstream when
handling transparent proxy updates.
Note that for transparent proxies we do not yet support mesh gateway
mode per upstream, so the NodeService.Proxy.MeshGateway mode is used.
* Fix upstream mesh gateway mode handling in xds
This commit ensures that when determining the mesh gateway mode for
peered upstreams we consider the NodeService.Proxy.MeshGateway config as
a baseline.
In absense of this change, setting a mesh gateway mode via
proxy-defaults or the top-level of service-defaults will not have an
effect for peered upstreams.
* Merge service/proxy defaults in cfg resolver
Previously the mesh gateway mode for connect proxies would be
merged at three points:
1. On servers, in ComputeResolvedServiceConfig.
2. On clients, in MergeServiceConfig.
3. On clients, in proxycfg/xds.
The first merge returns a ServiceConfigResponse where there is a
top-level MeshGateway config from proxy/service-defaults, along with
per-upstream config.
The second merge combines per-upstream config specified at the service
instance with per-upstream config specified centrally.
The third merge combines the NodeService.Proxy.MeshGateway
config containing proxy/service-defaults data with the per-upstream
mode. This third merge is easy to miss, which led to peered upstreams
not considering the mesh gateway mode from proxy-defaults.
This commit removes the third merge, and ensures that all mesh gateway
config is available at the upstream. This way proxycfg/xds do not need
to do additional overlays.
* Ensure that proxy-defaults is considered in wc
Upstream defaults become a synthetic Upstream definition under a
wildcard key "*". Now that proxycfg/xds expect Upstream definitions to
have the final MeshGateway values, this commit ensures that values from
proxy-defaults/service-defaults are the default for this synthetic
upstream.
* Add changelog.
Co-authored-by: freddygv <freddy@hashicorp.com>
2022-11-09 16:14:29 +00:00
|
|
|
// Ensure that maps for non-peering endpoints are not populated.
|
2022-07-13 16:14:57 +00:00
|
|
|
require.Empty(t, snap.ConnectProxy.WatchedUpstreamEndpoints[extDBUID])
|
|
|
|
require.Empty(t, snap.ConnectProxy.PassthroughUpstreams[extDBUID])
|
|
|
|
require.Empty(t, snap.ConnectProxy.PassthroughIndices)
|
Fix mesh gateway configuration with proxy-defaults (#15186)
* Fix mesh gateway proxy-defaults not affecting upstreams.
* Clarify distinction with upstream settings
Top-level mesh gateway mode in proxy-defaults and service-defaults gets
merged into NodeService.Proxy.MeshGateway, and only gets merged with
the mode attached to an an upstream in proxycfg/xds.
* Fix mgw mode usage for peered upstreams
There were a couple issues with how mgw mode was being handled for
peered upstreams.
For starters, mesh gateway mode from proxy-defaults
and the top-level of service-defaults gets stored in
NodeService.Proxy.MeshGateway, but the upstream watch for peered data
was only considering the mesh gateway config attached in
NodeService.Proxy.Upstreams[i]. This means that applying a mesh gateway
mode via global proxy-defaults or service-defaults on the downstream
would not have an effect.
Separately, transparent proxy watches for peered upstreams didn't
consider mesh gateway mode at all.
This commit addresses the first issue by ensuring that we overlay the
upstream config for peered upstreams as we do for non-peered. The second
issue is addressed by re-using setupWatchesForPeeredUpstream when
handling transparent proxy updates.
Note that for transparent proxies we do not yet support mesh gateway
mode per upstream, so the NodeService.Proxy.MeshGateway mode is used.
* Fix upstream mesh gateway mode handling in xds
This commit ensures that when determining the mesh gateway mode for
peered upstreams we consider the NodeService.Proxy.MeshGateway config as
a baseline.
In absense of this change, setting a mesh gateway mode via
proxy-defaults or the top-level of service-defaults will not have an
effect for peered upstreams.
* Merge service/proxy defaults in cfg resolver
Previously the mesh gateway mode for connect proxies would be
merged at three points:
1. On servers, in ComputeResolvedServiceConfig.
2. On clients, in MergeServiceConfig.
3. On clients, in proxycfg/xds.
The first merge returns a ServiceConfigResponse where there is a
top-level MeshGateway config from proxy/service-defaults, along with
per-upstream config.
The second merge combines per-upstream config specified at the service
instance with per-upstream config specified centrally.
The third merge combines the NodeService.Proxy.MeshGateway
config containing proxy/service-defaults data with the per-upstream
mode. This third merge is easy to miss, which led to peered upstreams
not considering the mesh gateway mode from proxy-defaults.
This commit removes the third merge, and ensures that all mesh gateway
config is available at the upstream. This way proxycfg/xds do not need
to do additional overlays.
* Ensure that proxy-defaults is considered in wc
Upstream defaults become a synthetic Upstream definition under a
wildcard key "*". Now that proxycfg/xds expect Upstream definitions to
have the final MeshGateway values, this commit ensures that values from
proxy-defaults/service-defaults are the default for this synthetic
upstream.
* Add changelog.
Co-authored-by: freddygv <freddy@hashicorp.com>
2022-11-09 16:14:29 +00:00
|
|
|
|
|
|
|
// Local gateway is watched but there are no endpoints
|
|
|
|
require.True(t, snap.ConnectProxy.WatchedLocalGWEndpoints.IsWatched("dc1"))
|
|
|
|
_, ok = snap.ConnectProxy.WatchedLocalGWEndpoints.Get("dc1")
|
|
|
|
require.False(t, ok)
|
2022-07-13 16:14:57 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
events: []UpdateEvent{
|
|
|
|
{
|
|
|
|
CorrelationID: upstreamPeerWatchIDPrefix + extDBUID.String(),
|
|
|
|
Result: &structs.IndexedCheckServiceNodes{
|
|
|
|
Nodes: structs.CheckServiceNodes{
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Node: "node1",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
PeerName: "peer-a",
|
|
|
|
},
|
|
|
|
Service: &structs.NodeService{
|
|
|
|
ID: "db",
|
|
|
|
Service: "db",
|
|
|
|
PeerName: "peer-a",
|
|
|
|
Connect: structs.ServiceConnect{},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
Fix mesh gateway configuration with proxy-defaults (#15186)
* Fix mesh gateway proxy-defaults not affecting upstreams.
* Clarify distinction with upstream settings
Top-level mesh gateway mode in proxy-defaults and service-defaults gets
merged into NodeService.Proxy.MeshGateway, and only gets merged with
the mode attached to an an upstream in proxycfg/xds.
* Fix mgw mode usage for peered upstreams
There were a couple issues with how mgw mode was being handled for
peered upstreams.
For starters, mesh gateway mode from proxy-defaults
and the top-level of service-defaults gets stored in
NodeService.Proxy.MeshGateway, but the upstream watch for peered data
was only considering the mesh gateway config attached in
NodeService.Proxy.Upstreams[i]. This means that applying a mesh gateway
mode via global proxy-defaults or service-defaults on the downstream
would not have an effect.
Separately, transparent proxy watches for peered upstreams didn't
consider mesh gateway mode at all.
This commit addresses the first issue by ensuring that we overlay the
upstream config for peered upstreams as we do for non-peered. The second
issue is addressed by re-using setupWatchesForPeeredUpstream when
handling transparent proxy updates.
Note that for transparent proxies we do not yet support mesh gateway
mode per upstream, so the NodeService.Proxy.MeshGateway mode is used.
* Fix upstream mesh gateway mode handling in xds
This commit ensures that when determining the mesh gateway mode for
peered upstreams we consider the NodeService.Proxy.MeshGateway config as
a baseline.
In absense of this change, setting a mesh gateway mode via
proxy-defaults or the top-level of service-defaults will not have an
effect for peered upstreams.
* Merge service/proxy defaults in cfg resolver
Previously the mesh gateway mode for connect proxies would be
merged at three points:
1. On servers, in ComputeResolvedServiceConfig.
2. On clients, in MergeServiceConfig.
3. On clients, in proxycfg/xds.
The first merge returns a ServiceConfigResponse where there is a
top-level MeshGateway config from proxy/service-defaults, along with
per-upstream config.
The second merge combines per-upstream config specified at the service
instance with per-upstream config specified centrally.
The third merge combines the NodeService.Proxy.MeshGateway
config containing proxy/service-defaults data with the per-upstream
mode. This third merge is easy to miss, which led to peered upstreams
not considering the mesh gateway mode from proxy-defaults.
This commit removes the third merge, and ensures that all mesh gateway
config is available at the upstream. This way proxycfg/xds do not need
to do additional overlays.
* Ensure that proxy-defaults is considered in wc
Upstream defaults become a synthetic Upstream definition under a
wildcard key "*". Now that proxycfg/xds expect Upstream definitions to
have the final MeshGateway values, this commit ensures that values from
proxy-defaults/service-defaults are the default for this synthetic
upstream.
* Add changelog.
Co-authored-by: freddygv <freddy@hashicorp.com>
2022-11-09 16:14:29 +00:00
|
|
|
{
|
|
|
|
CorrelationID: "mesh-gateway:dc1",
|
|
|
|
Result: &structs.IndexedCheckServiceNodes{
|
|
|
|
Nodes: structs.CheckServiceNodes{
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Node: "node1",
|
|
|
|
Address: "10.1.2.3",
|
|
|
|
},
|
|
|
|
Service: structs.TestNodeServiceMeshGateway(t),
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2022-07-13 16:14:57 +00:00
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid(), "proxy with roots/leaf/intentions is valid")
|
|
|
|
|
|
|
|
// Check PeeredUpstream is populated
|
|
|
|
expect := map[UpstreamID]struct{}{
|
|
|
|
extApiUID: {},
|
|
|
|
extDBUID: {},
|
|
|
|
}
|
|
|
|
require.Equal(t, expect, snap.ConnectProxy.PeeredUpstreams)
|
|
|
|
|
|
|
|
// Expect two entries (api-a, db)
|
|
|
|
require.Equal(t, 2, snap.ConnectProxy.PeerUpstreamEndpoints.Len())
|
|
|
|
|
|
|
|
// db has an endpoint now
|
|
|
|
ep, _ := snap.ConnectProxy.PeerUpstreamEndpoints.Get(extDBUID)
|
|
|
|
require.NotNil(t, ep)
|
|
|
|
require.Len(t, ep, 1)
|
|
|
|
|
Fix mesh gateway configuration with proxy-defaults (#15186)
* Fix mesh gateway proxy-defaults not affecting upstreams.
* Clarify distinction with upstream settings
Top-level mesh gateway mode in proxy-defaults and service-defaults gets
merged into NodeService.Proxy.MeshGateway, and only gets merged with
the mode attached to an an upstream in proxycfg/xds.
* Fix mgw mode usage for peered upstreams
There were a couple issues with how mgw mode was being handled for
peered upstreams.
For starters, mesh gateway mode from proxy-defaults
and the top-level of service-defaults gets stored in
NodeService.Proxy.MeshGateway, but the upstream watch for peered data
was only considering the mesh gateway config attached in
NodeService.Proxy.Upstreams[i]. This means that applying a mesh gateway
mode via global proxy-defaults or service-defaults on the downstream
would not have an effect.
Separately, transparent proxy watches for peered upstreams didn't
consider mesh gateway mode at all.
This commit addresses the first issue by ensuring that we overlay the
upstream config for peered upstreams as we do for non-peered. The second
issue is addressed by re-using setupWatchesForPeeredUpstream when
handling transparent proxy updates.
Note that for transparent proxies we do not yet support mesh gateway
mode per upstream, so the NodeService.Proxy.MeshGateway mode is used.
* Fix upstream mesh gateway mode handling in xds
This commit ensures that when determining the mesh gateway mode for
peered upstreams we consider the NodeService.Proxy.MeshGateway config as
a baseline.
In absense of this change, setting a mesh gateway mode via
proxy-defaults or the top-level of service-defaults will not have an
effect for peered upstreams.
* Merge service/proxy defaults in cfg resolver
Previously the mesh gateway mode for connect proxies would be
merged at three points:
1. On servers, in ComputeResolvedServiceConfig.
2. On clients, in MergeServiceConfig.
3. On clients, in proxycfg/xds.
The first merge returns a ServiceConfigResponse where there is a
top-level MeshGateway config from proxy/service-defaults, along with
per-upstream config.
The second merge combines per-upstream config specified at the service
instance with per-upstream config specified centrally.
The third merge combines the NodeService.Proxy.MeshGateway
config containing proxy/service-defaults data with the per-upstream
mode. This third merge is easy to miss, which led to peered upstreams
not considering the mesh gateway mode from proxy-defaults.
This commit removes the third merge, and ensures that all mesh gateway
config is available at the upstream. This way proxycfg/xds do not need
to do additional overlays.
* Ensure that proxy-defaults is considered in wc
Upstream defaults become a synthetic Upstream definition under a
wildcard key "*". Now that proxycfg/xds expect Upstream definitions to
have the final MeshGateway values, this commit ensures that values from
proxy-defaults/service-defaults are the default for this synthetic
upstream.
* Add changelog.
Co-authored-by: freddygv <freddy@hashicorp.com>
2022-11-09 16:14:29 +00:00
|
|
|
require.Equal(t, 1, snap.ConnectProxy.WatchedLocalGWEndpoints.Len())
|
|
|
|
|
|
|
|
gwEp, _ := snap.ConnectProxy.WatchedLocalGWEndpoints.Get("dc1")
|
|
|
|
require.NotNil(t, gwEp)
|
|
|
|
require.Len(t, gwEp, 1)
|
|
|
|
|
2022-07-13 16:14:57 +00:00
|
|
|
// Expect a trust bundle
|
|
|
|
ptb, ok := snap.ConnectProxy.UpstreamPeerTrustBundles.Get("peer-a")
|
|
|
|
require.True(t, ok)
|
|
|
|
prototest.AssertDeepEqual(t, peerTrustBundles.Bundles[0], ptb)
|
|
|
|
|
Fix mesh gateway configuration with proxy-defaults (#15186)
* Fix mesh gateway proxy-defaults not affecting upstreams.
* Clarify distinction with upstream settings
Top-level mesh gateway mode in proxy-defaults and service-defaults gets
merged into NodeService.Proxy.MeshGateway, and only gets merged with
the mode attached to an an upstream in proxycfg/xds.
* Fix mgw mode usage for peered upstreams
There were a couple issues with how mgw mode was being handled for
peered upstreams.
For starters, mesh gateway mode from proxy-defaults
and the top-level of service-defaults gets stored in
NodeService.Proxy.MeshGateway, but the upstream watch for peered data
was only considering the mesh gateway config attached in
NodeService.Proxy.Upstreams[i]. This means that applying a mesh gateway
mode via global proxy-defaults or service-defaults on the downstream
would not have an effect.
Separately, transparent proxy watches for peered upstreams didn't
consider mesh gateway mode at all.
This commit addresses the first issue by ensuring that we overlay the
upstream config for peered upstreams as we do for non-peered. The second
issue is addressed by re-using setupWatchesForPeeredUpstream when
handling transparent proxy updates.
Note that for transparent proxies we do not yet support mesh gateway
mode per upstream, so the NodeService.Proxy.MeshGateway mode is used.
* Fix upstream mesh gateway mode handling in xds
This commit ensures that when determining the mesh gateway mode for
peered upstreams we consider the NodeService.Proxy.MeshGateway config as
a baseline.
In absense of this change, setting a mesh gateway mode via
proxy-defaults or the top-level of service-defaults will not have an
effect for peered upstreams.
* Merge service/proxy defaults in cfg resolver
Previously the mesh gateway mode for connect proxies would be
merged at three points:
1. On servers, in ComputeResolvedServiceConfig.
2. On clients, in MergeServiceConfig.
3. On clients, in proxycfg/xds.
The first merge returns a ServiceConfigResponse where there is a
top-level MeshGateway config from proxy/service-defaults, along with
per-upstream config.
The second merge combines per-upstream config specified at the service
instance with per-upstream config specified centrally.
The third merge combines the NodeService.Proxy.MeshGateway
config containing proxy/service-defaults data with the per-upstream
mode. This third merge is easy to miss, which led to peered upstreams
not considering the mesh gateway mode from proxy-defaults.
This commit removes the third merge, and ensures that all mesh gateway
config is available at the upstream. This way proxycfg/xds do not need
to do additional overlays.
* Ensure that proxy-defaults is considered in wc
Upstream defaults become a synthetic Upstream definition under a
wildcard key "*". Now that proxycfg/xds expect Upstream definitions to
have the final MeshGateway values, this commit ensures that values from
proxy-defaults/service-defaults are the default for this synthetic
upstream.
* Add changelog.
Co-authored-by: freddygv <freddy@hashicorp.com>
2022-11-09 16:14:29 +00:00
|
|
|
// Ensure that maps for non-peering endpoints are not populated.
|
2022-07-13 16:14:57 +00:00
|
|
|
require.Empty(t, snap.ConnectProxy.WatchedUpstreamEndpoints[extDBUID])
|
|
|
|
require.Empty(t, snap.ConnectProxy.PassthroughUpstreams[extDBUID])
|
|
|
|
require.Empty(t, snap.ConnectProxy.PassthroughIndices)
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
// Empty list of peered upstreams should clean up map keys
|
|
|
|
events: []UpdateEvent{
|
|
|
|
{
|
|
|
|
CorrelationID: peeredUpstreamsID,
|
|
|
|
Result: &structs.IndexedPeeredServiceList{
|
|
|
|
Services: []structs.PeeredServiceName{},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid(), "proxy with roots/leaf/intentions is valid")
|
|
|
|
|
|
|
|
require.Empty(t, snap.ConnectProxy.PeeredUpstreams)
|
|
|
|
|
|
|
|
// db endpoint should have been cleaned up
|
|
|
|
require.False(t, snap.ConnectProxy.PeerUpstreamEndpoints.IsWatched(extDBUID))
|
|
|
|
|
|
|
|
// Expect only api-a endpoint
|
|
|
|
require.Equal(t, 1, snap.ConnectProxy.PeerUpstreamEndpoints.Len())
|
|
|
|
require.Equal(t, 1, snap.ConnectProxy.UpstreamPeerTrustBundles.Len())
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2019-08-02 03:03:34 +00:00
|
|
|
"connect-proxy": newConnectProxyCase(structs.MeshGatewayModeDefault),
|
|
|
|
"connect-proxy-mesh-gateway-local": newConnectProxyCase(structs.MeshGatewayModeLocal),
|
2022-05-04 20:25:25 +00:00
|
|
|
"connect-proxy-with-peers": {
|
|
|
|
ns: structs.NodeService{
|
|
|
|
Kind: structs.ServiceKindConnectProxy,
|
|
|
|
ID: "web-sidecar-proxy",
|
|
|
|
Service: "web-sidecar-proxy",
|
|
|
|
Address: "10.0.1.1",
|
|
|
|
Port: 443,
|
|
|
|
Proxy: structs.ConnectProxyConfig{
|
|
|
|
DestinationServiceName: "web",
|
|
|
|
Upstreams: structs.Upstreams{
|
|
|
|
structs.Upstream{
|
|
|
|
DestinationType: structs.UpstreamDestTypeService,
|
|
|
|
DestinationName: "api",
|
|
|
|
LocalBindPort: 10000,
|
|
|
|
},
|
|
|
|
structs.Upstream{
|
|
|
|
DestinationType: structs.UpstreamDestTypeService,
|
|
|
|
DestinationName: "api-a",
|
|
|
|
DestinationPeer: "peer-a",
|
|
|
|
LocalBindPort: 10001,
|
Fix mesh gateway configuration with proxy-defaults (#15186)
* Fix mesh gateway proxy-defaults not affecting upstreams.
* Clarify distinction with upstream settings
Top-level mesh gateway mode in proxy-defaults and service-defaults gets
merged into NodeService.Proxy.MeshGateway, and only gets merged with
the mode attached to an an upstream in proxycfg/xds.
* Fix mgw mode usage for peered upstreams
There were a couple issues with how mgw mode was being handled for
peered upstreams.
For starters, mesh gateway mode from proxy-defaults
and the top-level of service-defaults gets stored in
NodeService.Proxy.MeshGateway, but the upstream watch for peered data
was only considering the mesh gateway config attached in
NodeService.Proxy.Upstreams[i]. This means that applying a mesh gateway
mode via global proxy-defaults or service-defaults on the downstream
would not have an effect.
Separately, transparent proxy watches for peered upstreams didn't
consider mesh gateway mode at all.
This commit addresses the first issue by ensuring that we overlay the
upstream config for peered upstreams as we do for non-peered. The second
issue is addressed by re-using setupWatchesForPeeredUpstream when
handling transparent proxy updates.
Note that for transparent proxies we do not yet support mesh gateway
mode per upstream, so the NodeService.Proxy.MeshGateway mode is used.
* Fix upstream mesh gateway mode handling in xds
This commit ensures that when determining the mesh gateway mode for
peered upstreams we consider the NodeService.Proxy.MeshGateway config as
a baseline.
In absense of this change, setting a mesh gateway mode via
proxy-defaults or the top-level of service-defaults will not have an
effect for peered upstreams.
* Merge service/proxy defaults in cfg resolver
Previously the mesh gateway mode for connect proxies would be
merged at three points:
1. On servers, in ComputeResolvedServiceConfig.
2. On clients, in MergeServiceConfig.
3. On clients, in proxycfg/xds.
The first merge returns a ServiceConfigResponse where there is a
top-level MeshGateway config from proxy/service-defaults, along with
per-upstream config.
The second merge combines per-upstream config specified at the service
instance with per-upstream config specified centrally.
The third merge combines the NodeService.Proxy.MeshGateway
config containing proxy/service-defaults data with the per-upstream
mode. This third merge is easy to miss, which led to peered upstreams
not considering the mesh gateway mode from proxy-defaults.
This commit removes the third merge, and ensures that all mesh gateway
config is available at the upstream. This way proxycfg/xds do not need
to do additional overlays.
* Ensure that proxy-defaults is considered in wc
Upstream defaults become a synthetic Upstream definition under a
wildcard key "*". Now that proxycfg/xds expect Upstream definitions to
have the final MeshGateway values, this commit ensures that values from
proxy-defaults/service-defaults are the default for this synthetic
upstream.
* Add changelog.
Co-authored-by: freddygv <freddy@hashicorp.com>
2022-11-09 16:14:29 +00:00
|
|
|
MeshGateway: structs.MeshGatewayConfig{
|
|
|
|
Mode: structs.MeshGatewayModeLocal,
|
|
|
|
},
|
2022-05-04 20:25:25 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
sourceDC: "dc1",
|
|
|
|
stages: []verificationStage{
|
|
|
|
// First evaluate peered upstream
|
|
|
|
{
|
|
|
|
requiredWatches: map[string]verifyWatchRequest{
|
|
|
|
fmt.Sprintf("discovery-chain:%s", apiUID.String()): genVerifyDiscoveryChainWatch(&structs.DiscoveryChainRequest{
|
|
|
|
Name: "api",
|
|
|
|
EvaluateInDatacenter: "dc1",
|
|
|
|
EvaluateInNamespace: "default",
|
|
|
|
EvaluateInPartition: "default",
|
|
|
|
Datacenter: "dc1",
|
2022-11-07 15:00:11 +00:00
|
|
|
QueryOptions: structs.QueryOptions{
|
|
|
|
Token: aclToken,
|
|
|
|
},
|
2022-05-04 20:25:25 +00:00
|
|
|
}),
|
2022-06-03 21:42:50 +00:00
|
|
|
rootsWatchID: genVerifyDCSpecificWatch("dc1"),
|
|
|
|
leafWatchID: genVerifyLeafWatch("web", "dc1"),
|
|
|
|
peeringTrustBundlesWatchID: genVerifyTrustBundleListWatch("web"),
|
|
|
|
peerTrustBundleIDPrefix + "peer-a": genVerifyTrustBundleReadWatch("peer-a"),
|
|
|
|
upstreamPeerWatchIDPrefix + extApiUID.String(): genVerifyServiceSpecificPeeredRequest("api-a", "", "dc1", "peer-a", true),
|
Fix mesh gateway configuration with proxy-defaults (#15186)
* Fix mesh gateway proxy-defaults not affecting upstreams.
* Clarify distinction with upstream settings
Top-level mesh gateway mode in proxy-defaults and service-defaults gets
merged into NodeService.Proxy.MeshGateway, and only gets merged with
the mode attached to an an upstream in proxycfg/xds.
* Fix mgw mode usage for peered upstreams
There were a couple issues with how mgw mode was being handled for
peered upstreams.
For starters, mesh gateway mode from proxy-defaults
and the top-level of service-defaults gets stored in
NodeService.Proxy.MeshGateway, but the upstream watch for peered data
was only considering the mesh gateway config attached in
NodeService.Proxy.Upstreams[i]. This means that applying a mesh gateway
mode via global proxy-defaults or service-defaults on the downstream
would not have an effect.
Separately, transparent proxy watches for peered upstreams didn't
consider mesh gateway mode at all.
This commit addresses the first issue by ensuring that we overlay the
upstream config for peered upstreams as we do for non-peered. The second
issue is addressed by re-using setupWatchesForPeeredUpstream when
handling transparent proxy updates.
Note that for transparent proxies we do not yet support mesh gateway
mode per upstream, so the NodeService.Proxy.MeshGateway mode is used.
* Fix upstream mesh gateway mode handling in xds
This commit ensures that when determining the mesh gateway mode for
peered upstreams we consider the NodeService.Proxy.MeshGateway config as
a baseline.
In absense of this change, setting a mesh gateway mode via
proxy-defaults or the top-level of service-defaults will not have an
effect for peered upstreams.
* Merge service/proxy defaults in cfg resolver
Previously the mesh gateway mode for connect proxies would be
merged at three points:
1. On servers, in ComputeResolvedServiceConfig.
2. On clients, in MergeServiceConfig.
3. On clients, in proxycfg/xds.
The first merge returns a ServiceConfigResponse where there is a
top-level MeshGateway config from proxy/service-defaults, along with
per-upstream config.
The second merge combines per-upstream config specified at the service
instance with per-upstream config specified centrally.
The third merge combines the NodeService.Proxy.MeshGateway
config containing proxy/service-defaults data with the per-upstream
mode. This third merge is easy to miss, which led to peered upstreams
not considering the mesh gateway mode from proxy-defaults.
This commit removes the third merge, and ensures that all mesh gateway
config is available at the upstream. This way proxycfg/xds do not need
to do additional overlays.
* Ensure that proxy-defaults is considered in wc
Upstream defaults become a synthetic Upstream definition under a
wildcard key "*". Now that proxycfg/xds expect Upstream definitions to
have the final MeshGateway values, this commit ensures that values from
proxy-defaults/service-defaults are the default for this synthetic
upstream.
* Add changelog.
Co-authored-by: freddygv <freddy@hashicorp.com>
2022-11-09 16:14:29 +00:00
|
|
|
"mesh-gateway:dc1": genVerifyGatewayWatch("dc1"),
|
2022-05-04 20:25:25 +00:00
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.False(t, snap.Valid(), "should not be valid")
|
|
|
|
require.True(t, snap.MeshGateway.isEmpty())
|
|
|
|
|
2022-06-03 21:42:50 +00:00
|
|
|
require.Len(t, snap.ConnectProxy.DiscoveryChain, 0, "%+v", snap.ConnectProxy.DiscoveryChain)
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedDiscoveryChains, 0, "%+v", snap.ConnectProxy.WatchedDiscoveryChains)
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedUpstreams, 0, "%+v", snap.ConnectProxy.WatchedUpstreams)
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedUpstreamEndpoints, 0, "%+v", snap.ConnectProxy.WatchedUpstreamEndpoints)
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedGateways, 0, "%+v", snap.ConnectProxy.WatchedGateways)
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedGatewayEndpoints, 0, "%+v", snap.ConnectProxy.WatchedGatewayEndpoints)
|
|
|
|
|
2022-07-13 16:14:57 +00:00
|
|
|
// watch initialized
|
|
|
|
require.True(t, snap.ConnectProxy.UpstreamPeerTrustBundles.IsWatched("peer-a"))
|
|
|
|
_, ok := snap.ConnectProxy.UpstreamPeerTrustBundles.Get("peer-a")
|
|
|
|
require.False(t, ok) // but no data
|
2022-05-04 20:25:25 +00:00
|
|
|
|
2022-07-13 16:14:57 +00:00
|
|
|
// watch initialized
|
|
|
|
require.True(t, snap.ConnectProxy.PeerUpstreamEndpoints.IsWatched(extApiUID))
|
|
|
|
_, ok = snap.ConnectProxy.PeerUpstreamEndpoints.Get(extApiUID)
|
|
|
|
require.False(t, ok) // but no data
|
2022-06-03 21:42:50 +00:00
|
|
|
|
Fix mesh gateway configuration with proxy-defaults (#15186)
* Fix mesh gateway proxy-defaults not affecting upstreams.
* Clarify distinction with upstream settings
Top-level mesh gateway mode in proxy-defaults and service-defaults gets
merged into NodeService.Proxy.MeshGateway, and only gets merged with
the mode attached to an an upstream in proxycfg/xds.
* Fix mgw mode usage for peered upstreams
There were a couple issues with how mgw mode was being handled for
peered upstreams.
For starters, mesh gateway mode from proxy-defaults
and the top-level of service-defaults gets stored in
NodeService.Proxy.MeshGateway, but the upstream watch for peered data
was only considering the mesh gateway config attached in
NodeService.Proxy.Upstreams[i]. This means that applying a mesh gateway
mode via global proxy-defaults or service-defaults on the downstream
would not have an effect.
Separately, transparent proxy watches for peered upstreams didn't
consider mesh gateway mode at all.
This commit addresses the first issue by ensuring that we overlay the
upstream config for peered upstreams as we do for non-peered. The second
issue is addressed by re-using setupWatchesForPeeredUpstream when
handling transparent proxy updates.
Note that for transparent proxies we do not yet support mesh gateway
mode per upstream, so the NodeService.Proxy.MeshGateway mode is used.
* Fix upstream mesh gateway mode handling in xds
This commit ensures that when determining the mesh gateway mode for
peered upstreams we consider the NodeService.Proxy.MeshGateway config as
a baseline.
In absense of this change, setting a mesh gateway mode via
proxy-defaults or the top-level of service-defaults will not have an
effect for peered upstreams.
* Merge service/proxy defaults in cfg resolver
Previously the mesh gateway mode for connect proxies would be
merged at three points:
1. On servers, in ComputeResolvedServiceConfig.
2. On clients, in MergeServiceConfig.
3. On clients, in proxycfg/xds.
The first merge returns a ServiceConfigResponse where there is a
top-level MeshGateway config from proxy/service-defaults, along with
per-upstream config.
The second merge combines per-upstream config specified at the service
instance with per-upstream config specified centrally.
The third merge combines the NodeService.Proxy.MeshGateway
config containing proxy/service-defaults data with the per-upstream
mode. This third merge is easy to miss, which led to peered upstreams
not considering the mesh gateway mode from proxy-defaults.
This commit removes the third merge, and ensures that all mesh gateway
config is available at the upstream. This way proxycfg/xds do not need
to do additional overlays.
* Ensure that proxy-defaults is considered in wc
Upstream defaults become a synthetic Upstream definition under a
wildcard key "*". Now that proxycfg/xds expect Upstream definitions to
have the final MeshGateway values, this commit ensures that values from
proxy-defaults/service-defaults are the default for this synthetic
upstream.
* Add changelog.
Co-authored-by: freddygv <freddy@hashicorp.com>
2022-11-09 16:14:29 +00:00
|
|
|
// Local gateway is watched but there are no endpoints
|
|
|
|
require.True(t, snap.ConnectProxy.WatchedLocalGWEndpoints.IsWatched("dc1"))
|
|
|
|
_, ok = snap.ConnectProxy.WatchedLocalGWEndpoints.Get("dc1")
|
|
|
|
require.False(t, ok)
|
|
|
|
|
2022-05-04 20:25:25 +00:00
|
|
|
require.Len(t, snap.ConnectProxy.WatchedServiceChecks, 0, "%+v", snap.ConnectProxy.WatchedServiceChecks)
|
|
|
|
require.Len(t, snap.ConnectProxy.PreparedQueryEndpoints, 0, "%+v", snap.ConnectProxy.PreparedQueryEndpoints)
|
2022-06-21 02:47:14 +00:00
|
|
|
require.Len(t, snap.ConnectProxy.InboundPeerTrustBundles, 0, "%+v", snap.ConnectProxy.InboundPeerTrustBundles)
|
|
|
|
require.False(t, snap.ConnectProxy.InboundPeerTrustBundlesSet)
|
2022-05-04 20:25:25 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
// This time add the events
|
2022-05-20 14:47:40 +00:00
|
|
|
events: []UpdateEvent{
|
2022-05-04 20:25:25 +00:00
|
|
|
rootWatchEvent(),
|
2022-06-01 20:31:37 +00:00
|
|
|
{
|
|
|
|
CorrelationID: peeringTrustBundlesWatchID,
|
|
|
|
Result: peerTrustBundles,
|
|
|
|
},
|
2022-05-04 20:25:25 +00:00
|
|
|
{
|
|
|
|
CorrelationID: leafWatchID,
|
|
|
|
Result: issuedCert,
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
CorrelationID: intentionsWatchID,
|
|
|
|
Result: TestIntentions(),
|
|
|
|
Err: nil,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
CorrelationID: meshConfigEntryID,
|
|
|
|
Result: &structs.ConfigEntryResponse{},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
CorrelationID: fmt.Sprintf("discovery-chain:%s", apiUID.String()),
|
|
|
|
Result: &structs.DiscoveryChainResponse{
|
|
|
|
Chain: discoverychain.TestCompileConfigEntries(t, "api", "default", "default", "dc1", "trustdomain.consul", nil),
|
|
|
|
},
|
|
|
|
Err: nil,
|
|
|
|
},
|
2022-06-01 21:53:52 +00:00
|
|
|
{
|
|
|
|
CorrelationID: peerTrustBundleIDPrefix + "peer-a",
|
|
|
|
Result: &pbpeering.TrustBundleReadResponse{
|
|
|
|
Bundle: peerTrustBundles.Bundles[0],
|
|
|
|
},
|
|
|
|
},
|
2022-06-03 21:42:50 +00:00
|
|
|
{
|
|
|
|
CorrelationID: upstreamPeerWatchIDPrefix + extApiUID.String(),
|
|
|
|
Result: &structs.IndexedCheckServiceNodes{
|
|
|
|
Nodes: structs.CheckServiceNodes{
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Node: "node1",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
PeerName: "peer-a",
|
|
|
|
},
|
|
|
|
Service: &structs.NodeService{
|
|
|
|
ID: "api-a-1",
|
|
|
|
Service: "api-a",
|
|
|
|
PeerName: "peer-a",
|
|
|
|
Connect: structs.ServiceConnect{
|
|
|
|
PeerMeta: &structs.PeeringServiceMeta{
|
|
|
|
SNI: []string{
|
|
|
|
"payments.default.default.cloud.external." + peerTrustDomain,
|
|
|
|
},
|
|
|
|
SpiffeID: []string{
|
|
|
|
"spiffe://" + peerTrustDomain + "/ns/default/dc/cloud-dc/svc/payments",
|
|
|
|
},
|
|
|
|
Protocol: "tcp",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
Fix mesh gateway configuration with proxy-defaults (#15186)
* Fix mesh gateway proxy-defaults not affecting upstreams.
* Clarify distinction with upstream settings
Top-level mesh gateway mode in proxy-defaults and service-defaults gets
merged into NodeService.Proxy.MeshGateway, and only gets merged with
the mode attached to an an upstream in proxycfg/xds.
* Fix mgw mode usage for peered upstreams
There were a couple issues with how mgw mode was being handled for
peered upstreams.
For starters, mesh gateway mode from proxy-defaults
and the top-level of service-defaults gets stored in
NodeService.Proxy.MeshGateway, but the upstream watch for peered data
was only considering the mesh gateway config attached in
NodeService.Proxy.Upstreams[i]. This means that applying a mesh gateway
mode via global proxy-defaults or service-defaults on the downstream
would not have an effect.
Separately, transparent proxy watches for peered upstreams didn't
consider mesh gateway mode at all.
This commit addresses the first issue by ensuring that we overlay the
upstream config for peered upstreams as we do for non-peered. The second
issue is addressed by re-using setupWatchesForPeeredUpstream when
handling transparent proxy updates.
Note that for transparent proxies we do not yet support mesh gateway
mode per upstream, so the NodeService.Proxy.MeshGateway mode is used.
* Fix upstream mesh gateway mode handling in xds
This commit ensures that when determining the mesh gateway mode for
peered upstreams we consider the NodeService.Proxy.MeshGateway config as
a baseline.
In absense of this change, setting a mesh gateway mode via
proxy-defaults or the top-level of service-defaults will not have an
effect for peered upstreams.
* Merge service/proxy defaults in cfg resolver
Previously the mesh gateway mode for connect proxies would be
merged at three points:
1. On servers, in ComputeResolvedServiceConfig.
2. On clients, in MergeServiceConfig.
3. On clients, in proxycfg/xds.
The first merge returns a ServiceConfigResponse where there is a
top-level MeshGateway config from proxy/service-defaults, along with
per-upstream config.
The second merge combines per-upstream config specified at the service
instance with per-upstream config specified centrally.
The third merge combines the NodeService.Proxy.MeshGateway
config containing proxy/service-defaults data with the per-upstream
mode. This third merge is easy to miss, which led to peered upstreams
not considering the mesh gateway mode from proxy-defaults.
This commit removes the third merge, and ensures that all mesh gateway
config is available at the upstream. This way proxycfg/xds do not need
to do additional overlays.
* Ensure that proxy-defaults is considered in wc
Upstream defaults become a synthetic Upstream definition under a
wildcard key "*". Now that proxycfg/xds expect Upstream definitions to
have the final MeshGateway values, this commit ensures that values from
proxy-defaults/service-defaults are the default for this synthetic
upstream.
* Add changelog.
Co-authored-by: freddygv <freddy@hashicorp.com>
2022-11-09 16:14:29 +00:00
|
|
|
{
|
|
|
|
CorrelationID: "mesh-gateway:dc1",
|
|
|
|
Result: &structs.IndexedCheckServiceNodes{
|
|
|
|
Nodes: structs.CheckServiceNodes{
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Node: "node1",
|
|
|
|
Address: "10.1.2.3",
|
|
|
|
},
|
|
|
|
Service: structs.TestNodeServiceMeshGateway(t),
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2022-05-04 20:25:25 +00:00
|
|
|
},
|
|
|
|
verifySnapshot: func(t testing.TB, snap *ConfigSnapshot) {
|
|
|
|
require.True(t, snap.Valid())
|
|
|
|
require.True(t, snap.MeshGateway.isEmpty())
|
2022-06-01 20:31:37 +00:00
|
|
|
|
2022-05-04 20:25:25 +00:00
|
|
|
require.Equal(t, indexedRoots, snap.Roots)
|
|
|
|
require.Equal(t, issuedCert, snap.ConnectProxy.Leaf)
|
2022-06-21 02:47:14 +00:00
|
|
|
prototest.AssertDeepEqual(t, peerTrustBundles.Bundles, snap.ConnectProxy.InboundPeerTrustBundles)
|
2022-05-04 20:25:25 +00:00
|
|
|
|
2022-06-03 21:42:50 +00:00
|
|
|
require.Len(t, snap.ConnectProxy.DiscoveryChain, 1, "%+v", snap.ConnectProxy.DiscoveryChain)
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedUpstreams, 1, "%+v", snap.ConnectProxy.WatchedUpstreams)
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedUpstreamEndpoints, 1, "%+v", snap.ConnectProxy.WatchedUpstreamEndpoints)
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedGateways, 1, "%+v", snap.ConnectProxy.WatchedGateways)
|
|
|
|
require.Len(t, snap.ConnectProxy.WatchedGatewayEndpoints, 1, "%+v", snap.ConnectProxy.WatchedGatewayEndpoints)
|
2022-05-04 20:25:25 +00:00
|
|
|
|
2022-07-13 16:14:57 +00:00
|
|
|
tb, ok := snap.ConnectProxy.UpstreamPeerTrustBundles.Get("peer-a")
|
|
|
|
require.True(t, ok)
|
|
|
|
prototest.AssertDeepEqual(t, peerTrustBundles.Bundles[0], tb)
|
2022-06-01 21:53:52 +00:00
|
|
|
|
2022-07-13 16:14:57 +00:00
|
|
|
require.Equal(t, 1, snap.ConnectProxy.PeerUpstreamEndpoints.Len())
|
|
|
|
ep, _ := snap.ConnectProxy.PeerUpstreamEndpoints.Get(extApiUID)
|
|
|
|
require.NotNil(t, ep)
|
2022-06-03 21:42:50 +00:00
|
|
|
|
Fix mesh gateway configuration with proxy-defaults (#15186)
* Fix mesh gateway proxy-defaults not affecting upstreams.
* Clarify distinction with upstream settings
Top-level mesh gateway mode in proxy-defaults and service-defaults gets
merged into NodeService.Proxy.MeshGateway, and only gets merged with
the mode attached to an an upstream in proxycfg/xds.
* Fix mgw mode usage for peered upstreams
There were a couple issues with how mgw mode was being handled for
peered upstreams.
For starters, mesh gateway mode from proxy-defaults
and the top-level of service-defaults gets stored in
NodeService.Proxy.MeshGateway, but the upstream watch for peered data
was only considering the mesh gateway config attached in
NodeService.Proxy.Upstreams[i]. This means that applying a mesh gateway
mode via global proxy-defaults or service-defaults on the downstream
would not have an effect.
Separately, transparent proxy watches for peered upstreams didn't
consider mesh gateway mode at all.
This commit addresses the first issue by ensuring that we overlay the
upstream config for peered upstreams as we do for non-peered. The second
issue is addressed by re-using setupWatchesForPeeredUpstream when
handling transparent proxy updates.
Note that for transparent proxies we do not yet support mesh gateway
mode per upstream, so the NodeService.Proxy.MeshGateway mode is used.
* Fix upstream mesh gateway mode handling in xds
This commit ensures that when determining the mesh gateway mode for
peered upstreams we consider the NodeService.Proxy.MeshGateway config as
a baseline.
In absense of this change, setting a mesh gateway mode via
proxy-defaults or the top-level of service-defaults will not have an
effect for peered upstreams.
* Merge service/proxy defaults in cfg resolver
Previously the mesh gateway mode for connect proxies would be
merged at three points:
1. On servers, in ComputeResolvedServiceConfig.
2. On clients, in MergeServiceConfig.
3. On clients, in proxycfg/xds.
The first merge returns a ServiceConfigResponse where there is a
top-level MeshGateway config from proxy/service-defaults, along with
per-upstream config.
The second merge combines per-upstream config specified at the service
instance with per-upstream config specified centrally.
The third merge combines the NodeService.Proxy.MeshGateway
config containing proxy/service-defaults data with the per-upstream
mode. This third merge is easy to miss, which led to peered upstreams
not considering the mesh gateway mode from proxy-defaults.
This commit removes the third merge, and ensures that all mesh gateway
config is available at the upstream. This way proxycfg/xds do not need
to do additional overlays.
* Ensure that proxy-defaults is considered in wc
Upstream defaults become a synthetic Upstream definition under a
wildcard key "*". Now that proxycfg/xds expect Upstream definitions to
have the final MeshGateway values, this commit ensures that values from
proxy-defaults/service-defaults are the default for this synthetic
upstream.
* Add changelog.
Co-authored-by: freddygv <freddy@hashicorp.com>
2022-11-09 16:14:29 +00:00
|
|
|
require.Equal(t, 1, snap.ConnectProxy.WatchedLocalGWEndpoints.Len())
|
|
|
|
|
|
|
|
gwEp, _ := snap.ConnectProxy.WatchedLocalGWEndpoints.Get("dc1")
|
|
|
|
require.NotNil(t, gwEp)
|
|
|
|
require.Len(t, gwEp, 1)
|
2022-05-04 20:25:25 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2019-07-12 21:19:37 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
for name, tc := range cases {
|
|
|
|
t.Run(name, func(t *testing.T) {
|
2022-05-27 11:38:52 +00:00
|
|
|
proxyID := ProxyID{ServiceID: tc.ns.CompoundServiceID()}
|
2022-06-01 15:18:06 +00:00
|
|
|
|
|
|
|
sc := stateConfig{
|
2020-12-23 23:03:30 +00:00
|
|
|
logger: testutil.Logger(t),
|
|
|
|
source: &structs.QuerySource{
|
|
|
|
Datacenter: tc.sourceDC,
|
|
|
|
},
|
|
|
|
dnsConfig: DNSConfig{
|
|
|
|
Domain: "consul.",
|
|
|
|
AltDomain: "alt.consul.",
|
|
|
|
},
|
2022-06-01 15:18:06 +00:00
|
|
|
}
|
|
|
|
wr := recordWatches(&sc)
|
|
|
|
|
2022-11-07 15:00:11 +00:00
|
|
|
state, err := newState(proxyID, &tc.ns, testSource, aclToken, sc, rate.NewLimiter(rate.Inf, 0))
|
2019-07-12 21:19:37 +00:00
|
|
|
|
|
|
|
// verify building the initial state worked
|
|
|
|
require.NoError(t, err)
|
|
|
|
require.NotNil(t, state)
|
|
|
|
|
|
|
|
// setup the test logger to use the t.Log
|
2020-01-28 23:50:41 +00:00
|
|
|
state.logger = testutil.Logger(t)
|
2019-07-12 21:19:37 +00:00
|
|
|
|
|
|
|
// setup the ctx as initWatches expects this to be there
|
2020-12-23 22:12:36 +00:00
|
|
|
var ctx context.Context
|
|
|
|
ctx, state.cancel = context.WithCancel(context.Background())
|
2019-07-12 21:19:37 +00:00
|
|
|
|
2020-12-23 23:03:30 +00:00
|
|
|
snap, err := state.handler.initialize(ctx)
|
|
|
|
require.NoError(t, err)
|
2021-03-17 19:40:39 +00:00
|
|
|
|
2022-05-04 20:25:25 +00:00
|
|
|
// --------------------------------------------------------------------
|
2019-07-12 21:19:37 +00:00
|
|
|
//
|
|
|
|
// All the nested subtests here are to make failures easier to
|
|
|
|
// correlate back with the test table
|
|
|
|
//
|
2022-05-04 20:25:25 +00:00
|
|
|
// --------------------------------------------------------------------
|
2019-07-12 21:19:37 +00:00
|
|
|
|
|
|
|
for idx, stage := range tc.stages {
|
|
|
|
require.True(t, t.Run(fmt.Sprintf("stage-%d", idx), func(t *testing.T) {
|
|
|
|
for correlationId, verifier := range stage.requiredWatches {
|
|
|
|
require.True(t, t.Run(correlationId, func(t *testing.T) {
|
2022-06-01 15:18:06 +00:00
|
|
|
wr.verify(t, correlationId, verifier)
|
2019-07-12 21:19:37 +00:00
|
|
|
}))
|
|
|
|
}
|
|
|
|
|
|
|
|
// the state is not currently executing the run method in a goroutine
|
|
|
|
// therefore we just tell it about the updates
|
|
|
|
for eveIdx, event := range stage.events {
|
|
|
|
require.True(t, t.Run(fmt.Sprintf("update-%d", eveIdx), func(t *testing.T) {
|
2020-12-23 23:03:30 +00:00
|
|
|
require.NoError(t, state.handler.handleUpdate(ctx, event, &snap))
|
2019-07-12 21:19:37 +00:00
|
|
|
}))
|
|
|
|
}
|
|
|
|
|
|
|
|
// verify the snapshot
|
|
|
|
if stage.verifySnapshot != nil {
|
|
|
|
stage.verifySnapshot(t, &snap)
|
|
|
|
}
|
|
|
|
}))
|
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
2021-10-29 00:41:48 +00:00
|
|
|
|
|
|
|
func Test_hostnameEndpoints(t *testing.T) {
|
|
|
|
type testCase struct {
|
|
|
|
name string
|
|
|
|
localKey GatewayKey
|
|
|
|
nodes structs.CheckServiceNodes
|
|
|
|
want structs.CheckServiceNodes
|
|
|
|
}
|
|
|
|
run := func(t *testing.T, tc testCase) {
|
|
|
|
logger := hclog.New(nil)
|
|
|
|
got := hostnameEndpoints(logger, tc.localKey, tc.nodes)
|
|
|
|
require.Equal(t, tc.want, got)
|
|
|
|
}
|
|
|
|
|
|
|
|
cases := []testCase{
|
|
|
|
{
|
|
|
|
name: "same locality and no LAN hostname endpoints",
|
2022-04-05 21:10:06 +00:00
|
|
|
localKey: GatewayKey{Datacenter: "dc1", Partition: acl.PartitionOrDefault("")},
|
2021-10-29 00:41:48 +00:00
|
|
|
nodes: structs.CheckServiceNodes{
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Node: "mesh-gateway",
|
|
|
|
Datacenter: "dc1",
|
|
|
|
},
|
|
|
|
Service: structs.TestNodeServiceMeshGatewayWithAddrs(t,
|
|
|
|
"10.0.1.1", 8443,
|
|
|
|
structs.ServiceAddress{},
|
|
|
|
structs.ServiceAddress{Address: "123.us-west-1.elb.notaws.com", Port: 443}),
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Node: "mesh-gateway",
|
|
|
|
Datacenter: "dc1",
|
|
|
|
},
|
|
|
|
Service: structs.TestNodeServiceMeshGatewayWithAddrs(t,
|
|
|
|
"10.0.2.2", 8443,
|
|
|
|
structs.ServiceAddress{},
|
|
|
|
structs.ServiceAddress{Address: "123.us-west-2.elb.notaws.com", Port: 443}),
|
|
|
|
},
|
|
|
|
},
|
|
|
|
want: nil,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "same locality and one LAN hostname endpoint",
|
2022-04-05 21:10:06 +00:00
|
|
|
localKey: GatewayKey{Datacenter: "dc1", Partition: acl.PartitionOrDefault("")},
|
2021-10-29 00:41:48 +00:00
|
|
|
nodes: structs.CheckServiceNodes{
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Node: "mesh-gateway",
|
|
|
|
Datacenter: "dc1",
|
|
|
|
},
|
|
|
|
Service: structs.TestNodeServiceMeshGatewayWithAddrs(t,
|
|
|
|
"gateway.mydomain", 8443,
|
|
|
|
structs.ServiceAddress{},
|
|
|
|
structs.ServiceAddress{Address: "123.us-west-1.elb.notaws.com", Port: 443}),
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Node: "mesh-gateway",
|
|
|
|
Datacenter: "dc1",
|
|
|
|
},
|
|
|
|
Service: structs.TestNodeServiceMeshGatewayWithAddrs(t,
|
|
|
|
"10.0.2.2", 8443,
|
|
|
|
structs.ServiceAddress{},
|
|
|
|
structs.ServiceAddress{Address: "123.us-west-2.elb.notaws.com", Port: 443}),
|
|
|
|
},
|
|
|
|
},
|
|
|
|
want: structs.CheckServiceNodes{
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Node: "mesh-gateway",
|
|
|
|
Datacenter: "dc1",
|
|
|
|
},
|
|
|
|
Service: structs.TestNodeServiceMeshGatewayWithAddrs(t,
|
|
|
|
"gateway.mydomain", 8443,
|
|
|
|
structs.ServiceAddress{},
|
|
|
|
structs.ServiceAddress{Address: "123.us-west-1.elb.notaws.com", Port: 443}),
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "different locality and one WAN hostname endpoint",
|
2022-04-05 21:10:06 +00:00
|
|
|
localKey: GatewayKey{Datacenter: "dc2", Partition: acl.PartitionOrDefault("")},
|
2021-10-29 00:41:48 +00:00
|
|
|
nodes: structs.CheckServiceNodes{
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Node: "mesh-gateway",
|
|
|
|
Datacenter: "dc1",
|
|
|
|
},
|
|
|
|
Service: structs.TestNodeServiceMeshGatewayWithAddrs(t,
|
|
|
|
"gateway.mydomain", 8443,
|
|
|
|
structs.ServiceAddress{},
|
|
|
|
structs.ServiceAddress{Address: "8.8.8.8", Port: 443}),
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Node: "mesh-gateway",
|
|
|
|
Datacenter: "dc1",
|
|
|
|
},
|
|
|
|
Service: structs.TestNodeServiceMeshGatewayWithAddrs(t,
|
|
|
|
"10.0.2.2", 8443,
|
|
|
|
structs.ServiceAddress{},
|
|
|
|
structs.ServiceAddress{Address: "123.us-west-2.elb.notaws.com", Port: 443}),
|
|
|
|
},
|
|
|
|
},
|
|
|
|
want: structs.CheckServiceNodes{
|
|
|
|
{
|
|
|
|
Node: &structs.Node{
|
|
|
|
Node: "mesh-gateway",
|
|
|
|
Datacenter: "dc1",
|
|
|
|
},
|
|
|
|
Service: structs.TestNodeServiceMeshGatewayWithAddrs(t,
|
|
|
|
"10.0.2.2", 8443,
|
|
|
|
structs.ServiceAddress{},
|
|
|
|
structs.ServiceAddress{Address: "123.us-west-2.elb.notaws.com", Port: 443}),
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
for _, c := range cases {
|
|
|
|
t.Run(c.name, func(t *testing.T) {
|
|
|
|
run(t, c)
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
2022-11-07 15:00:11 +00:00
|
|
|
|
|
|
|
const aclToken = "foo"
|