acceptance-tests: disable DNS by default in tests to avoid false posi…

…tives
hashicorp · Jul 27, 2021 · 76119e4 · 76119e4
1 parent 64ea736
commit 76119e4
Show file tree

Hide file tree

Showing 4 changed files with 18 additions and 21 deletions.
diff --git a/.circleci/config.yml b/.circleci/config.yml
@@ -55,7 +55,7 @@ commands:
         type: string
       consul-k8s-image:
         type: string
-        default: "docker.mirror.hashicorp.services/hashicorpdev/consul-k8s:latest"
+        default: "hashicorpdev/consul-k8s:2dfffed"
     steps:
       - when:
           condition: << parameters.failfast >>

diff --git a/test/acceptance/framework/consul/consul_cluster.go b/test/acceptance/framework/consul/consul_cluster.go
@@ -77,6 +77,10 @@ func NewHelmCluster(
 		"server.bootstrapExpect":       "1",
 		"connectInject.envoyExtraArgs": "--log-level debug",
 		"connectInject.logLevel":       "debug",
+		// Disable DNS since enabling it changes the policy for the anonymous token,
+		// which could result in tests passing due to that token having privileges to read services
+		// (false positive).
+		"dns.enabled": "false",
 	}
 	valuesFromConfig, err := cfg.HelmValuesFromConfig()
 	require.NoError(t, err)

diff --git a/test/acceptance/framework/consul/consul_cluster_test.go b/test/acceptance/framework/consul/consul_cluster_test.go
@@ -29,6 +29,7 @@ func TestNewHelmCluster(t *testing.T) {
 				"connectInject.envoyExtraArgs":                  "--log-level debug",
 				"connectInject.logLevel":                        "debug",
 				"connectInject.transparentProxy.defaultEnabled": "false",
+				"dns.enabled":                                   "false",
 			},
 		},
 		{
@@ -40,6 +41,7 @@ func TestNewHelmCluster(t *testing.T) {
 				"connectInject.envoyExtraArgs":                  "--foo",
 				"connectInject.logLevel":                        "debug",
 				"connectInject.transparentProxy.defaultEnabled": "true",
+				"dns.enabled":                                   "true",
 				"feature.enabled":                               "true",
 			},
 			want: map[string]string{
@@ -49,6 +51,7 @@ func TestNewHelmCluster(t *testing.T) {
 				"connectInject.envoyExtraArgs":                  "--foo",
 				"connectInject.logLevel":                        "debug",
 				"connectInject.transparentProxy.defaultEnabled": "true",
+				"dns.enabled":                                   "true",
 				"feature.enabled":                               "true",
 			},
 		},

diff --git a/test/acceptance/tests/consul-dns/consul_dns_test.go b/test/acceptance/tests/consul-dns/consul_dns_test.go
@@ -3,6 +3,7 @@ package consuldns
 import (
 	"context"
 	"fmt"
+	"strconv"
 	"testing"
 
 	"github.com/hashicorp/consul-helm/test/acceptance/framework/consul"
@@ -16,30 +17,19 @@ import (
 const podName = "dns-pod"
 
 func TestConsulDNS(t *testing.T) {
-	cases := []struct {
-		name       string
-		helmValues map[string]string
-	}{
-		{
-			"Default installation",
-			nil,
-		},
-		{
-			"Secure installation (with TLS and ACLs enabled)",
-			map[string]string{
-				"global.tls.enabled":           "true",
-				"global.acls.manageSystemACLs": "true",
-			},
-		},
-	}
-
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
+	for _, secure := range []bool{false, true} {
+		name := fmt.Sprintf("secure: %t", secure)
+		t.Run(name, func(t *testing.T) {
 			env := suite.Environment()
 			ctx := env.DefaultContext(t)
 			releaseName := helpers.RandomName()
 
-			cluster := consul.NewHelmCluster(t, c.helmValues, ctx, suite.Config(), releaseName)
+			helmValues := map[string]string{
+				"dns.enabled":                  "true",
+				"global.tls.enabled":           strconv.FormatBool(secure),
+				"global.acls.manageSystemACLs": strconv.FormatBool(secure),
+			}
+			cluster := consul.NewHelmCluster(t, helmValues, ctx, suite.Config(), releaseName)
 			cluster.Create(t)
 
 			k8sClient := ctx.KubernetesClient(t)