-
Notifications
You must be signed in to change notification settings - Fork 321
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #176 from hashicorp/connect-sidecar
Add new lifecycle-sidecar command
- Loading branch information
Showing
12 changed files
with
644 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| package connectinject | ||
|
|
||
| import ( | ||
| corev1 "k8s.io/api/core/v1" | ||
| "strings" | ||
| ) | ||
|
|
||
| func (h *Handler) lifecycleSidecar(pod *corev1.Pod) corev1.Container { | ||
| command := []string{ | ||
| "consul-k8s", | ||
| "lifecycle-sidecar", | ||
| "-service-config", "/consul/connect-inject/service.hcl", | ||
| } | ||
| if h.AuthMethod != "" { | ||
| command = append(command, "-token-file=/consul/connect-inject/acl-token") | ||
| } | ||
| if period, ok := pod.Annotations[annotationSyncPeriod]; ok { | ||
| command = append(command, "-sync-period="+strings.TrimSpace(period)) | ||
| } | ||
|
|
||
| return corev1.Container{ | ||
| Name: "consul-connect-lifecycle-sidecar", | ||
| Image: h.ImageConsulK8S, | ||
| Env: []corev1.EnvVar{ | ||
| { | ||
| Name: "HOST_IP", | ||
| ValueFrom: &corev1.EnvVarSource{ | ||
| FieldRef: &corev1.ObjectFieldSelector{FieldPath: "status.hostIP"}, | ||
| }, | ||
| }, | ||
| // Kubernetes will interpolate HOST_IP when creating this environment | ||
| // variable. | ||
| { | ||
| Name: "CONSUL_HTTP_ADDR", | ||
| Value: "$(HOST_IP):8500", | ||
| }, | ||
| }, | ||
| VolumeMounts: []corev1.VolumeMount{ | ||
| { | ||
| Name: volumeName, | ||
| MountPath: "/consul/connect-inject", | ||
| }, | ||
| }, | ||
| Command: command, | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,113 @@ | ||
| package connectinject | ||
|
|
||
| import ( | ||
| "github.com/hashicorp/go-hclog" | ||
| "github.com/stretchr/testify/require" | ||
| corev1 "k8s.io/api/core/v1" | ||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| "testing" | ||
| ) | ||
|
|
||
| // NOTE: This is tested here rather than in handler_test because doing it there | ||
| // would require a lot of boilerplate to get at the underlying patches that would | ||
| // complicate understanding the tests (which are simple). | ||
|
|
||
| // Test that the lifecycle sidecar is as expected. | ||
| func TestLifecycleSidecar_Default(t *testing.T) { | ||
| handler := Handler{ | ||
| Log: hclog.Default().Named("handler"), | ||
| ImageConsulK8S: "hashicorp/consul-k8s:9.9.9", | ||
| } | ||
| container := handler.lifecycleSidecar(&corev1.Pod{ | ||
| Spec: corev1.PodSpec{ | ||
| Containers: []corev1.Container{ | ||
| { | ||
| Name: "web", | ||
| }, | ||
| }, | ||
| }, | ||
| }) | ||
| require.Equal(t, corev1.Container{ | ||
| Name: "consul-connect-lifecycle-sidecar", | ||
| Image: "hashicorp/consul-k8s:9.9.9", | ||
| Env: []corev1.EnvVar{ | ||
| { | ||
| Name: "HOST_IP", | ||
| ValueFrom: &corev1.EnvVarSource{ | ||
| FieldRef: &corev1.ObjectFieldSelector{FieldPath: "status.hostIP"}, | ||
| }, | ||
| }, | ||
| { | ||
| Name: "CONSUL_HTTP_ADDR", | ||
| Value: "$(HOST_IP):8500", | ||
| }, | ||
| }, | ||
| VolumeMounts: []corev1.VolumeMount{ | ||
| { | ||
| Name: volumeName, | ||
| MountPath: "/consul/connect-inject", | ||
| }, | ||
| }, | ||
| Command: []string{ | ||
| "consul-k8s", "lifecycle-sidecar", | ||
| "-service-config", "/consul/connect-inject/service.hcl", | ||
| }, | ||
| }, container) | ||
| } | ||
|
|
||
| // Test that if there's an auth method we set the -token-file flag | ||
| // and if there isn't we don't. | ||
| func TestLifecycleSidecar_AuthMethod(t *testing.T) { | ||
| for _, authMethod := range []string{"", "auth-method"} { | ||
| t.Run("authmethod: "+authMethod, func(t *testing.T) { | ||
| handler := Handler{ | ||
| Log: hclog.Default().Named("handler"), | ||
| AuthMethod: authMethod, | ||
| ImageConsulK8S: "hashicorp/consul-k8s:9.9.9", | ||
| } | ||
| container := handler.lifecycleSidecar(&corev1.Pod{ | ||
| Spec: corev1.PodSpec{ | ||
| Containers: []corev1.Container{ | ||
| { | ||
| Name: "web", | ||
| }, | ||
| }, | ||
| }, | ||
| }) | ||
|
|
||
| if authMethod == "" { | ||
| require.NotContains(t, container.Command, "-token-file=/consul/connect-inject/acl-token") | ||
| } else { | ||
| require.Contains(t, | ||
| container.Command, | ||
| "-token-file=/consul/connect-inject/acl-token", | ||
| ) | ||
| } | ||
| }) | ||
| } | ||
| } | ||
|
|
||
| // Test that if there's an annotation on the original pod that changes the sync | ||
| // period we use that value. | ||
| func TestLifecycleSidecar_SyncPeriodAnnotation(t *testing.T) { | ||
| handler := Handler{ | ||
| Log: hclog.Default().Named("handler"), | ||
| ImageConsulK8S: "hashicorp/consul-k8s:9.9.9", | ||
| } | ||
| container := handler.lifecycleSidecar(&corev1.Pod{ | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Annotations: map[string]string{ | ||
| "consul.hashicorp.com/connect-sync-period": "55s", | ||
| }, | ||
| }, | ||
| Spec: corev1.PodSpec{ | ||
| Containers: []corev1.Container{ | ||
| { | ||
| Name: "web", | ||
| }, | ||
| }, | ||
| }, | ||
| }) | ||
|
|
||
| require.Contains(t, container.Command, "-sync-period=55s") | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.