mirror of https://github.com/hashicorp/consul
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
781 lines
22 KiB
781 lines
22 KiB
package xds |
|
|
|
import ( |
|
"path/filepath" |
|
"sort" |
|
"testing" |
|
"time" |
|
|
|
envoy_route_v3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3" |
|
|
|
"github.com/golang/protobuf/ptypes" |
|
testinf "github.com/mitchellh/go-testing-interface" |
|
"github.com/stretchr/testify/require" |
|
|
|
"github.com/hashicorp/consul/agent/connect" |
|
"github.com/hashicorp/consul/agent/consul/discoverychain" |
|
"github.com/hashicorp/consul/agent/proxycfg" |
|
"github.com/hashicorp/consul/agent/structs" |
|
"github.com/hashicorp/consul/agent/xds/proxysupport" |
|
"github.com/hashicorp/consul/sdk/testutil" |
|
) |
|
|
|
func TestRoutesFromSnapshot(t *testing.T) { |
|
|
|
tests := []struct { |
|
name string |
|
create func(t testinf.T) *proxycfg.ConfigSnapshot |
|
// Setup is called before the test starts. It is passed the snapshot from |
|
// create func and is allowed to modify it in any way to setup the |
|
// test input. |
|
setup func(snap *proxycfg.ConfigSnapshot) |
|
overrideGoldenName string |
|
}{ |
|
{ |
|
name: "defaults-no-chain", |
|
create: proxycfg.TestConfigSnapshot, |
|
setup: nil, // Default snapshot |
|
}, |
|
{ |
|
name: "connect-proxy-with-chain", |
|
create: proxycfg.TestConfigSnapshotDiscoveryChain, |
|
setup: nil, |
|
}, |
|
{ |
|
name: "connect-proxy-with-chain-external-sni", |
|
create: proxycfg.TestConfigSnapshotDiscoveryChainExternalSNI, |
|
setup: nil, |
|
}, |
|
{ |
|
name: "connect-proxy-with-chain-and-overrides", |
|
create: proxycfg.TestConfigSnapshotDiscoveryChainWithOverrides, |
|
setup: nil, |
|
}, |
|
{ |
|
name: "splitter-with-resolver-redirect", |
|
create: proxycfg.TestConfigSnapshotDiscoveryChain_SplitterWithResolverRedirectMultiDC, |
|
setup: nil, |
|
}, |
|
{ |
|
name: "connect-proxy-with-chain-and-splitter", |
|
create: proxycfg.TestConfigSnapshotDiscoveryChainWithSplitter, |
|
setup: nil, |
|
}, |
|
{ |
|
name: "connect-proxy-with-grpc-router", |
|
create: proxycfg.TestConfigSnapshotDiscoveryChainWithGRPCRouter, |
|
setup: nil, |
|
}, |
|
{ |
|
name: "connect-proxy-with-chain-and-router", |
|
create: proxycfg.TestConfigSnapshotDiscoveryChainWithRouter, |
|
setup: nil, |
|
}, |
|
{ |
|
name: "connect-proxy-lb-in-resolver", |
|
create: proxycfg.TestConfigSnapshotDiscoveryChainWithLB, |
|
setup: nil, |
|
}, |
|
// TODO(rb): test match stanza skipped for grpc |
|
// Start ingress gateway test cases |
|
{ |
|
name: "ingress-defaults-no-chain", |
|
create: proxycfg.TestConfigSnapshotIngressGateway, |
|
setup: nil, // Default snapshot |
|
}, |
|
{ |
|
name: "ingress-with-chain", |
|
create: proxycfg.TestConfigSnapshotIngress, |
|
setup: nil, |
|
}, |
|
{ |
|
name: "ingress-with-chain-external-sni", |
|
create: proxycfg.TestConfigSnapshotIngressExternalSNI, |
|
setup: nil, |
|
}, |
|
{ |
|
name: "ingress-with-chain-and-overrides", |
|
create: proxycfg.TestConfigSnapshotIngressWithOverrides, |
|
setup: nil, |
|
}, |
|
{ |
|
name: "ingress-splitter-with-resolver-redirect", |
|
create: proxycfg.TestConfigSnapshotIngress_SplitterWithResolverRedirectMultiDC, |
|
setup: nil, |
|
}, |
|
{ |
|
name: "ingress-with-chain-and-splitter", |
|
create: proxycfg.TestConfigSnapshotIngressWithSplitter, |
|
setup: nil, |
|
}, |
|
{ |
|
name: "ingress-with-grpc-router", |
|
create: proxycfg.TestConfigSnapshotIngressWithGRPCRouter, |
|
setup: nil, |
|
}, |
|
{ |
|
name: "ingress-with-chain-and-router", |
|
create: proxycfg.TestConfigSnapshotIngressWithRouter, |
|
setup: nil, |
|
}, |
|
{ |
|
name: "ingress-lb-in-resolver", |
|
create: proxycfg.TestConfigSnapshotIngressWithLB, |
|
setup: nil, |
|
}, |
|
{ |
|
name: "ingress-http-multiple-services", |
|
create: proxycfg.TestConfigSnapshotIngress_HTTPMultipleServices, |
|
setup: func(snap *proxycfg.ConfigSnapshot) { |
|
snap.IngressGateway.Upstreams = map[proxycfg.IngressListenerKey]structs.Upstreams{ |
|
{Protocol: "http", Port: 8080}: { |
|
{ |
|
DestinationName: "foo", |
|
LocalBindPort: 8080, |
|
IngressHosts: []string{ |
|
"test1.example.com", |
|
"test2.example.com", |
|
"test2.example.com:8080", |
|
}, |
|
}, |
|
{ |
|
DestinationName: "bar", |
|
LocalBindPort: 8080, |
|
}, |
|
}, |
|
{Protocol: "http", Port: 443}: { |
|
{ |
|
DestinationName: "baz", |
|
LocalBindPort: 443, |
|
}, |
|
{ |
|
DestinationName: "qux", |
|
LocalBindPort: 443, |
|
}, |
|
}, |
|
} |
|
snap.IngressGateway.Listeners = map[proxycfg.IngressListenerKey]structs.IngressListener{ |
|
{Protocol: "http", Port: 8080}: { |
|
Port: 8080, |
|
Services: []structs.IngressService{ |
|
{ |
|
Name: "foo", |
|
}, |
|
{ |
|
Name: "bar", |
|
}, |
|
}, |
|
}, |
|
{Protocol: "http", Port: 443}: { |
|
Port: 443, |
|
Services: []structs.IngressService{ |
|
{ |
|
Name: "baz", |
|
}, |
|
{ |
|
Name: "qux", |
|
}, |
|
}, |
|
}, |
|
} |
|
|
|
// We do not add baz/qux here so that we test the chain.IsDefault() case |
|
entries := []structs.ConfigEntry{ |
|
&structs.ProxyConfigEntry{ |
|
Kind: structs.ProxyDefaults, |
|
Name: structs.ProxyConfigGlobal, |
|
Config: map[string]interface{}{ |
|
"protocol": "http", |
|
}, |
|
}, |
|
&structs.ServiceResolverConfigEntry{ |
|
Kind: structs.ServiceResolver, |
|
Name: "foo", |
|
ConnectTimeout: 22 * time.Second, |
|
}, |
|
&structs.ServiceResolverConfigEntry{ |
|
Kind: structs.ServiceResolver, |
|
Name: "bar", |
|
ConnectTimeout: 22 * time.Second, |
|
}, |
|
} |
|
fooChain := discoverychain.TestCompileConfigEntries(t, "foo", "default", "default", "dc1", connect.TestClusterID+".consul", nil, entries...) |
|
barChain := discoverychain.TestCompileConfigEntries(t, "bar", "default", "default", "dc1", connect.TestClusterID+".consul", nil, entries...) |
|
bazChain := discoverychain.TestCompileConfigEntries(t, "baz", "default", "default", "dc1", connect.TestClusterID+".consul", nil, entries...) |
|
quxChain := discoverychain.TestCompileConfigEntries(t, "qux", "default", "default", "dc1", connect.TestClusterID+".consul", nil, entries...) |
|
|
|
snap.IngressGateway.DiscoveryChain = map[string]*structs.CompiledDiscoveryChain{ |
|
"foo": fooChain, |
|
"bar": barChain, |
|
"baz": bazChain, |
|
"qux": quxChain, |
|
} |
|
}, |
|
}, |
|
{ |
|
name: "ingress-with-chain-and-router-header-manip", |
|
create: proxycfg.TestConfigSnapshotIngressWithRouter, |
|
setup: func(snap *proxycfg.ConfigSnapshot) { |
|
k := proxycfg.IngressListenerKey{Port: 9191, Protocol: "http"} |
|
l := snap.IngressGateway.Listeners[k] |
|
l.Services[0].RequestHeaders = &structs.HTTPHeaderModifiers{ |
|
Add: map[string]string{ |
|
"foo": "bar", |
|
}, |
|
Set: map[string]string{ |
|
"bar": "baz", |
|
}, |
|
Remove: []string{"qux"}, |
|
} |
|
l.Services[0].ResponseHeaders = &structs.HTTPHeaderModifiers{ |
|
Add: map[string]string{ |
|
"foo": "bar", |
|
}, |
|
Set: map[string]string{ |
|
"bar": "baz", |
|
}, |
|
Remove: []string{"qux"}, |
|
} |
|
snap.IngressGateway.Listeners[k] = l |
|
}, |
|
}, |
|
{ |
|
name: "ingress-with-sds-listener-level", |
|
create: proxycfg.TestConfigSnapshotIngressWithRouter, |
|
setup: setupIngressWithTwoHTTPServices(t, ingressSDSOpts{ |
|
// Listener-level SDS means all services share the default route. |
|
listenerSDS: true, |
|
}), |
|
}, |
|
{ |
|
name: "ingress-with-sds-listener-level-wildcard", |
|
create: proxycfg.TestConfigSnapshotIngressWithRouter, |
|
setup: setupIngressWithTwoHTTPServices(t, ingressSDSOpts{ |
|
// Listener-level SDS means all services share the default route. |
|
listenerSDS: true, |
|
wildcard: true, |
|
}), |
|
}, |
|
{ |
|
name: "ingress-with-sds-service-level", |
|
create: proxycfg.TestConfigSnapshotIngressWithRouter, |
|
setup: setupIngressWithTwoHTTPServices(t, ingressSDSOpts{ |
|
listenerSDS: false, |
|
// Services should get separate routes and no default since they all |
|
// have custom certs. |
|
webSDS: true, |
|
fooSDS: true, |
|
}), |
|
}, |
|
{ |
|
name: "ingress-with-sds-service-level-mixed-tls", |
|
create: proxycfg.TestConfigSnapshotIngressWithRouter, |
|
setup: setupIngressWithTwoHTTPServices(t, ingressSDSOpts{ |
|
listenerSDS: false, |
|
// Web needs a separate route as it has custom filter chain but foo |
|
// should use default route for listener. |
|
webSDS: true, |
|
fooSDS: false, |
|
}), |
|
}, |
|
{ |
|
name: "terminating-gateway-lb-config", |
|
create: proxycfg.TestConfigSnapshotTerminatingGateway, |
|
setup: func(snap *proxycfg.ConfigSnapshot) { |
|
snap.TerminatingGateway.ServiceResolvers = map[structs.ServiceName]*structs.ServiceResolverConfigEntry{ |
|
structs.NewServiceName("web", nil): { |
|
Kind: structs.ServiceResolver, |
|
Name: "web", |
|
DefaultSubset: "v2", |
|
Subsets: map[string]structs.ServiceResolverSubset{ |
|
"v1": { |
|
Filter: "Service.Meta.Version == 1", |
|
}, |
|
"v2": { |
|
Filter: "Service.Meta.Version == 2", |
|
OnlyPassing: true, |
|
}, |
|
}, |
|
LoadBalancer: &structs.LoadBalancer{ |
|
Policy: "ring_hash", |
|
RingHashConfig: &structs.RingHashConfig{ |
|
MinimumRingSize: 20, |
|
MaximumRingSize: 50, |
|
}, |
|
HashPolicies: []structs.HashPolicy{ |
|
{ |
|
Field: structs.HashPolicyCookie, |
|
FieldValue: "chocolate-chip", |
|
Terminal: true, |
|
}, |
|
{ |
|
Field: structs.HashPolicyHeader, |
|
FieldValue: "x-user-id", |
|
}, |
|
{ |
|
SourceIP: true, |
|
Terminal: true, |
|
}, |
|
}, |
|
}, |
|
}, |
|
} |
|
snap.TerminatingGateway.ServiceConfigs[structs.NewServiceName("web", nil)] = &structs.ServiceConfigResponse{ |
|
ProxyConfig: map[string]interface{}{"protocol": "http"}, |
|
} |
|
}, |
|
}, |
|
} |
|
|
|
latestEnvoyVersion := proxysupport.EnvoyVersions[0] |
|
for _, envoyVersion := range proxysupport.EnvoyVersions { |
|
sf, err := determineSupportedProxyFeaturesFromString(envoyVersion) |
|
require.NoError(t, err) |
|
t.Run("envoy-"+envoyVersion, func(t *testing.T) { |
|
for _, tt := range tests { |
|
t.Run(tt.name, func(t *testing.T) { |
|
// Sanity check default with no overrides first |
|
snap := tt.create(t) |
|
|
|
// We need to replace the TLS certs with deterministic ones to make golden |
|
// files workable. Note we don't update these otherwise they'd change |
|
// golden files for every test case and so not be any use! |
|
setupTLSRootsAndLeaf(t, snap) |
|
|
|
if tt.setup != nil { |
|
tt.setup(snap) |
|
} |
|
|
|
g := newResourceGenerator(testutil.Logger(t), nil, nil, false) |
|
g.ProxyFeatures = sf |
|
|
|
routes, err := g.routesFromSnapshot(snap) |
|
require.NoError(t, err) |
|
|
|
sort.Slice(routes, func(i, j int) bool { |
|
return routes[i].(*envoy_route_v3.RouteConfiguration).Name < routes[j].(*envoy_route_v3.RouteConfiguration).Name |
|
}) |
|
r, err := createResponse(RouteType, "00000001", "00000001", routes) |
|
require.NoError(t, err) |
|
|
|
t.Run("current", func(t *testing.T) { |
|
gotJSON := protoToJSON(t, r) |
|
|
|
gName := tt.name |
|
if tt.overrideGoldenName != "" { |
|
gName = tt.overrideGoldenName |
|
} |
|
|
|
require.JSONEq(t, goldenEnvoy(t, filepath.Join("routes", gName), envoyVersion, latestEnvoyVersion, gotJSON), gotJSON) |
|
}) |
|
}) |
|
} |
|
}) |
|
} |
|
} |
|
|
|
func TestEnvoyLBConfig_InjectToRouteAction(t *testing.T) { |
|
var tests = []struct { |
|
name string |
|
lb *structs.LoadBalancer |
|
expected *envoy_route_v3.RouteAction |
|
}{ |
|
{ |
|
name: "empty", |
|
lb: &structs.LoadBalancer{ |
|
Policy: "", |
|
}, |
|
// we only modify route actions for hash-based LB policies |
|
expected: &envoy_route_v3.RouteAction{}, |
|
}, |
|
{ |
|
name: "least request", |
|
lb: &structs.LoadBalancer{ |
|
Policy: structs.LBPolicyLeastRequest, |
|
LeastRequestConfig: &structs.LeastRequestConfig{ |
|
ChoiceCount: 3, |
|
}, |
|
}, |
|
// we only modify route actions for hash-based LB policies |
|
expected: &envoy_route_v3.RouteAction{}, |
|
}, |
|
{ |
|
name: "headers", |
|
lb: &structs.LoadBalancer{ |
|
Policy: "ring_hash", |
|
RingHashConfig: &structs.RingHashConfig{ |
|
MinimumRingSize: 3, |
|
MaximumRingSize: 7, |
|
}, |
|
HashPolicies: []structs.HashPolicy{ |
|
{ |
|
Field: structs.HashPolicyHeader, |
|
FieldValue: "x-route-key", |
|
Terminal: true, |
|
}, |
|
}, |
|
}, |
|
expected: &envoy_route_v3.RouteAction{ |
|
HashPolicy: []*envoy_route_v3.RouteAction_HashPolicy{ |
|
{ |
|
PolicySpecifier: &envoy_route_v3.RouteAction_HashPolicy_Header_{ |
|
Header: &envoy_route_v3.RouteAction_HashPolicy_Header{ |
|
HeaderName: "x-route-key", |
|
}, |
|
}, |
|
Terminal: true, |
|
}, |
|
}, |
|
}, |
|
}, |
|
{ |
|
name: "cookies", |
|
lb: &structs.LoadBalancer{ |
|
Policy: structs.LBPolicyMaglev, |
|
HashPolicies: []structs.HashPolicy{ |
|
{ |
|
Field: structs.HashPolicyCookie, |
|
FieldValue: "red-velvet", |
|
Terminal: true, |
|
}, |
|
{ |
|
Field: structs.HashPolicyCookie, |
|
FieldValue: "oatmeal", |
|
}, |
|
}, |
|
}, |
|
expected: &envoy_route_v3.RouteAction{ |
|
HashPolicy: []*envoy_route_v3.RouteAction_HashPolicy{ |
|
{ |
|
PolicySpecifier: &envoy_route_v3.RouteAction_HashPolicy_Cookie_{ |
|
Cookie: &envoy_route_v3.RouteAction_HashPolicy_Cookie{ |
|
Name: "red-velvet", |
|
}, |
|
}, |
|
Terminal: true, |
|
}, |
|
{ |
|
PolicySpecifier: &envoy_route_v3.RouteAction_HashPolicy_Cookie_{ |
|
Cookie: &envoy_route_v3.RouteAction_HashPolicy_Cookie{ |
|
Name: "oatmeal", |
|
}, |
|
}, |
|
}, |
|
}, |
|
}, |
|
}, |
|
{ |
|
name: "non-zero session ttl gets zeroed out", |
|
lb: &structs.LoadBalancer{ |
|
Policy: structs.LBPolicyMaglev, |
|
HashPolicies: []structs.HashPolicy{ |
|
{ |
|
Field: structs.HashPolicyCookie, |
|
FieldValue: "oatmeal", |
|
CookieConfig: &structs.CookieConfig{ |
|
TTL: 10 * time.Second, |
|
Session: true, |
|
}, |
|
}, |
|
}, |
|
}, |
|
expected: &envoy_route_v3.RouteAction{ |
|
HashPolicy: []*envoy_route_v3.RouteAction_HashPolicy{ |
|
{ |
|
PolicySpecifier: &envoy_route_v3.RouteAction_HashPolicy_Cookie_{ |
|
Cookie: &envoy_route_v3.RouteAction_HashPolicy_Cookie{ |
|
Name: "oatmeal", |
|
Ttl: ptypes.DurationProto(0 * time.Second), |
|
}, |
|
}, |
|
}, |
|
}, |
|
}, |
|
}, |
|
{ |
|
name: "zero value ttl omitted if not session cookie", |
|
lb: &structs.LoadBalancer{ |
|
Policy: structs.LBPolicyMaglev, |
|
HashPolicies: []structs.HashPolicy{ |
|
{ |
|
Field: structs.HashPolicyCookie, |
|
FieldValue: "oatmeal", |
|
CookieConfig: &structs.CookieConfig{ |
|
Path: "/oven", |
|
}, |
|
}, |
|
}, |
|
}, |
|
expected: &envoy_route_v3.RouteAction{ |
|
HashPolicy: []*envoy_route_v3.RouteAction_HashPolicy{ |
|
{ |
|
PolicySpecifier: &envoy_route_v3.RouteAction_HashPolicy_Cookie_{ |
|
Cookie: &envoy_route_v3.RouteAction_HashPolicy_Cookie{ |
|
Name: "oatmeal", |
|
Path: "/oven", |
|
Ttl: nil, |
|
}, |
|
}, |
|
}, |
|
}, |
|
}, |
|
}, |
|
{ |
|
name: "source addr", |
|
lb: &structs.LoadBalancer{ |
|
Policy: structs.LBPolicyMaglev, |
|
HashPolicies: []structs.HashPolicy{ |
|
{ |
|
SourceIP: true, |
|
Terminal: true, |
|
}, |
|
}, |
|
}, |
|
expected: &envoy_route_v3.RouteAction{ |
|
HashPolicy: []*envoy_route_v3.RouteAction_HashPolicy{ |
|
{ |
|
PolicySpecifier: &envoy_route_v3.RouteAction_HashPolicy_ConnectionProperties_{ |
|
ConnectionProperties: &envoy_route_v3.RouteAction_HashPolicy_ConnectionProperties{ |
|
SourceIp: true, |
|
}, |
|
}, |
|
Terminal: true, |
|
}, |
|
}, |
|
}, |
|
}, |
|
{ |
|
name: "kitchen sink", |
|
lb: &structs.LoadBalancer{ |
|
Policy: structs.LBPolicyMaglev, |
|
HashPolicies: []structs.HashPolicy{ |
|
{ |
|
SourceIP: true, |
|
Terminal: true, |
|
}, |
|
{ |
|
Field: structs.HashPolicyCookie, |
|
FieldValue: "oatmeal", |
|
CookieConfig: &structs.CookieConfig{ |
|
TTL: 10 * time.Second, |
|
Path: "/oven", |
|
}, |
|
}, |
|
{ |
|
Field: structs.HashPolicyCookie, |
|
FieldValue: "chocolate-chip", |
|
CookieConfig: &structs.CookieConfig{ |
|
Session: true, |
|
Path: "/oven", |
|
}, |
|
}, |
|
{ |
|
Field: structs.HashPolicyHeader, |
|
FieldValue: "special-header", |
|
Terminal: true, |
|
}, |
|
}, |
|
}, |
|
expected: &envoy_route_v3.RouteAction{ |
|
HashPolicy: []*envoy_route_v3.RouteAction_HashPolicy{ |
|
{ |
|
PolicySpecifier: &envoy_route_v3.RouteAction_HashPolicy_ConnectionProperties_{ |
|
ConnectionProperties: &envoy_route_v3.RouteAction_HashPolicy_ConnectionProperties{ |
|
SourceIp: true, |
|
}, |
|
}, |
|
Terminal: true, |
|
}, |
|
{ |
|
PolicySpecifier: &envoy_route_v3.RouteAction_HashPolicy_Cookie_{ |
|
Cookie: &envoy_route_v3.RouteAction_HashPolicy_Cookie{ |
|
Name: "oatmeal", |
|
Ttl: ptypes.DurationProto(10 * time.Second), |
|
Path: "/oven", |
|
}, |
|
}, |
|
}, |
|
{ |
|
PolicySpecifier: &envoy_route_v3.RouteAction_HashPolicy_Cookie_{ |
|
Cookie: &envoy_route_v3.RouteAction_HashPolicy_Cookie{ |
|
Name: "chocolate-chip", |
|
Ttl: ptypes.DurationProto(0 * time.Second), |
|
Path: "/oven", |
|
}, |
|
}, |
|
}, |
|
{ |
|
PolicySpecifier: &envoy_route_v3.RouteAction_HashPolicy_Header_{ |
|
Header: &envoy_route_v3.RouteAction_HashPolicy_Header{ |
|
HeaderName: "special-header", |
|
}, |
|
}, |
|
Terminal: true, |
|
}, |
|
}, |
|
}, |
|
}, |
|
} |
|
|
|
for _, tc := range tests { |
|
t.Run(tc.name, func(t *testing.T) { |
|
var ra envoy_route_v3.RouteAction |
|
err := injectLBToRouteAction(tc.lb, &ra) |
|
require.NoError(t, err) |
|
|
|
require.Equal(t, tc.expected, &ra) |
|
}) |
|
} |
|
} |
|
|
|
type ingressSDSOpts struct { |
|
listenerSDS, webSDS, fooSDS, wildcard bool |
|
entMetas map[string]*structs.EnterpriseMeta |
|
} |
|
|
|
// setupIngressWithTwoHTTPServices can be used with |
|
// proxycfg.TestConfigSnapshotIngressWithRouter to generate a setup func for an |
|
// ingress listener with multiple HTTP services and varying SDS configurations |
|
// since those affect how we generate routes. |
|
func setupIngressWithTwoHTTPServices(t *testing.T, o ingressSDSOpts) func(snap *proxycfg.ConfigSnapshot) { |
|
return func(snap *proxycfg.ConfigSnapshot) { |
|
|
|
snap.IngressGateway.TLSConfig.SDS = nil |
|
|
|
webUpstream := structs.Upstream{ |
|
DestinationName: "web", |
|
// We use empty not default here because of the way upstream identifiers |
|
// vary between OSS and Enterprise currently causing test conflicts. In |
|
// real life `proxycfg` always sets ingress upstream namespaces to |
|
// `NamespaceOrDefault` which shouldn't matter because we should be |
|
// consistent within a single binary it's just inconvenient if OSS and |
|
// enterprise tests generate different output. |
|
DestinationNamespace: o.entMetas["web"].NamespaceOrEmpty(), |
|
DestinationPartition: o.entMetas["web"].PartitionOrEmpty(), |
|
LocalBindPort: 9191, |
|
IngressHosts: []string{ |
|
"www.example.com", |
|
}, |
|
} |
|
fooUpstream := structs.Upstream{ |
|
DestinationName: "foo", |
|
DestinationNamespace: o.entMetas["foo"].NamespaceOrEmpty(), |
|
DestinationPartition: o.entMetas["foo"].PartitionOrEmpty(), |
|
LocalBindPort: 9191, |
|
IngressHosts: []string{ |
|
"foo.example.com", |
|
}, |
|
} |
|
|
|
// Setup additional HTTP service on same listener with default router |
|
snap.IngressGateway.Upstreams = map[proxycfg.IngressListenerKey]structs.Upstreams{ |
|
{Protocol: "http", Port: 9191}: {webUpstream, fooUpstream}, |
|
} |
|
il := structs.IngressListener{ |
|
Port: 9191, |
|
Services: []structs.IngressService{ |
|
{ |
|
Name: "web", |
|
Hosts: []string{"www.example.com"}, |
|
}, |
|
{ |
|
Name: "foo", |
|
Hosts: []string{"foo.example.com"}, |
|
}, |
|
}, |
|
} |
|
for i, svc := range il.Services { |
|
if em, ok := o.entMetas[svc.Name]; ok && em != nil { |
|
il.Services[i].EnterpriseMeta = *em |
|
} |
|
} |
|
|
|
// Now set the appropriate SDS configs |
|
if o.listenerSDS { |
|
il.TLS = &structs.GatewayTLSConfig{ |
|
SDS: &structs.GatewayTLSSDSConfig{ |
|
ClusterName: "listener-cluster", |
|
CertResource: "listener-cert", |
|
}, |
|
} |
|
} |
|
if o.webSDS { |
|
il.Services[0].TLS = &structs.GatewayServiceTLSConfig{ |
|
SDS: &structs.GatewayTLSSDSConfig{ |
|
ClusterName: "web-cluster", |
|
CertResource: "www-cert", |
|
}, |
|
} |
|
} |
|
if o.fooSDS { |
|
il.Services[1].TLS = &structs.GatewayServiceTLSConfig{ |
|
SDS: &structs.GatewayTLSSDSConfig{ |
|
ClusterName: "foo-cluster", |
|
CertResource: "foo-cert", |
|
}, |
|
} |
|
} |
|
|
|
if o.wildcard { |
|
// undo all that and set just a single wildcard config with no TLS to test |
|
// the lookup path where we have to compare an actual resolved upstream to |
|
// a wildcard config. |
|
il.Services = []structs.IngressService{ |
|
{ |
|
Name: "*", |
|
}, |
|
} |
|
// We also don't support user-specified hosts with wildcard so remove |
|
// those from the upstreams. |
|
ups := snap.IngressGateway.Upstreams[proxycfg.IngressListenerKey{Protocol: "http", Port: 9191}] |
|
for i := range ups { |
|
ups[i].IngressHosts = nil |
|
} |
|
snap.IngressGateway.Upstreams[proxycfg.IngressListenerKey{Protocol: "http", Port: 9191}] = ups |
|
} |
|
|
|
snap.IngressGateway.Listeners[proxycfg.IngressListenerKey{Protocol: "http", Port: 9191}] = il |
|
|
|
entries := []structs.ConfigEntry{ |
|
&structs.ProxyConfigEntry{ |
|
Kind: structs.ProxyDefaults, |
|
Name: structs.ProxyConfigGlobal, |
|
Config: map[string]interface{}{ |
|
"protocol": "http", |
|
}, |
|
}, |
|
&structs.ServiceResolverConfigEntry{ |
|
Kind: structs.ServiceResolver, |
|
Name: "web", |
|
ConnectTimeout: 22 * time.Second, |
|
}, |
|
&structs.ServiceResolverConfigEntry{ |
|
Kind: structs.ServiceResolver, |
|
Name: "foo", |
|
ConnectTimeout: 22 * time.Second, |
|
}, |
|
} |
|
for i, e := range entries { |
|
switch v := e.(type) { |
|
// Add other Service types here if we ever need them above |
|
case *structs.ServiceResolverConfigEntry: |
|
if em, ok := o.entMetas[v.Name]; ok && em != nil { |
|
v.EnterpriseMeta = *em |
|
entries[i] = v |
|
} |
|
} |
|
} |
|
|
|
webChain := discoverychain.TestCompileConfigEntries(t, "web", |
|
o.entMetas["web"].NamespaceOrDefault(), |
|
o.entMetas["web"].PartitionOrDefault(), "dc1", |
|
connect.TestClusterID+".consul", nil, entries...) |
|
fooChain := discoverychain.TestCompileConfigEntries(t, "foo", |
|
o.entMetas["foo"].NamespaceOrDefault(), |
|
o.entMetas["web"].PartitionOrDefault(), "dc1", |
|
connect.TestClusterID+".consul", nil, entries...) |
|
|
|
snap.IngressGateway.DiscoveryChain[webUpstream.Identifier()] = webChain |
|
snap.IngressGateway.DiscoveryChain[fooUpstream.Identifier()] = fooChain |
|
} |
|
}
|
|
|