-
Notifications
You must be signed in to change notification settings - Fork 339
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix(kuma-cp) deleted default policy is created on Kuma CP restart (#2507
- Loading branch information
1 parent
71862d8
commit fbd0831
Showing
9 changed files
with
240 additions
and
37 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
97 changes: 97 additions & 0 deletions
97
pkg/plugins/runtime/k8s/controllers/mesh_defaults_controller_test.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,97 @@ | ||
| package controllers_test | ||
|
|
||
| import ( | ||
| "context" | ||
|
|
||
| . "github.com/onsi/ginkgo" | ||
| . "github.com/onsi/gomega" | ||
| kube_types "k8s.io/apimachinery/pkg/types" | ||
| kube_ctrl "sigs.k8s.io/controller-runtime" | ||
| kube_client "sigs.k8s.io/controller-runtime/pkg/client" | ||
| kube_client_fake "sigs.k8s.io/controller-runtime/pkg/client/fake" | ||
| kube_reconcile "sigs.k8s.io/controller-runtime/pkg/reconcile" | ||
|
|
||
| "github.com/kumahq/kuma/pkg/core/resources/apis/mesh" | ||
| "github.com/kumahq/kuma/pkg/core/resources/apis/system" | ||
| resources_manager "github.com/kumahq/kuma/pkg/core/resources/manager" | ||
| core_model "github.com/kumahq/kuma/pkg/core/resources/model" | ||
| core_store "github.com/kumahq/kuma/pkg/core/resources/store" | ||
| secret_cipher "github.com/kumahq/kuma/pkg/core/secrets/cipher" | ||
| secret_manager "github.com/kumahq/kuma/pkg/core/secrets/manager" | ||
| "github.com/kumahq/kuma/pkg/plugins/resources/k8s" | ||
| "github.com/kumahq/kuma/pkg/plugins/runtime/k8s/controllers" | ||
| secrets_k8s "github.com/kumahq/kuma/pkg/plugins/secrets/k8s" | ||
| ) | ||
|
|
||
| var _ = Describe("MeshDefaultsReconciler", func() { | ||
|
|
||
| var kubeClient kube_client.Client | ||
| var resourceManager resources_manager.ResourceManager | ||
| var reconciler kube_reconcile.Reconciler | ||
|
|
||
| BeforeEach(func() { | ||
| kubeClient = kube_client_fake.NewFakeClientWithScheme(k8sClientScheme) | ||
| store, err := k8s.NewStore(kubeClient, k8sClientScheme, k8s.NewSimpleConverter()) | ||
| Expect(err).ToNot(HaveOccurred()) | ||
| secretStore, err := secrets_k8s.NewStore(kubeClient, kubeClient, "default") | ||
| Expect(err).ToNot(HaveOccurred()) | ||
|
|
||
| resourceManager = resources_manager.NewResourceManager(store) | ||
| customizableManager := resources_manager.NewCustomizableResourceManager(resourceManager, nil) | ||
| customizableManager.Customize( | ||
| system.SecretType, | ||
| secret_manager.NewSecretManager( | ||
| secretStore, | ||
| secret_cipher.None(), | ||
| secret_manager.ValidateDelete(func(ctx context.Context, secretName string, secretMesh string) error { return nil })), | ||
| ) | ||
|
|
||
| reconciler = &controllers.MeshDefaultsReconciler{ | ||
| ResourceManager: customizableManager, | ||
| } | ||
| }) | ||
|
|
||
| createMesh := func() { | ||
| Expect( | ||
| resourceManager.Create(context.Background(), mesh.NewMeshResource(), core_store.CreateByKey("default", core_model.NoMesh)), | ||
| ).To(Succeed()) | ||
| } | ||
|
|
||
| hasTrafficPermissions := func() bool { | ||
| trafficPermissions := &mesh.TrafficPermissionResourceList{} | ||
| Expect( | ||
| resourceManager.List(context.Background(), trafficPermissions, core_store.ListByMesh("default")), | ||
| ).To(Succeed()) | ||
| return len(trafficPermissions.Items) == 1 | ||
| } | ||
|
|
||
| reconcile := func() { | ||
| _, err := reconciler.Reconcile(kube_ctrl.Request{ | ||
| NamespacedName: kube_types.NamespacedName{ | ||
| Name: "default", | ||
| }, | ||
| }) | ||
| Expect(err).ToNot(HaveOccurred()) | ||
| } | ||
|
|
||
| deleteTrafficPermission := func() { | ||
| Expect( | ||
| resourceManager.Delete(context.Background(), mesh.NewTrafficPermissionResource(), | ||
| core_store.DeleteByKey("allow-all-default", "default")), | ||
| ).To(Succeed()) | ||
| } | ||
|
|
||
| It("should not create a new default policy if it was deleted", func() { | ||
| createMesh() | ||
| Expect(hasTrafficPermissions()).To(BeFalse()) | ||
|
|
||
| reconcile() | ||
| Expect(hasTrafficPermissions()).To(BeTrue()) | ||
|
|
||
| deleteTrafficPermission() | ||
| Expect(hasTrafficPermissions()).To(BeFalse()) | ||
|
|
||
| reconcile() | ||
| Expect(hasTrafficPermissions()).To(BeFalse()) | ||
| }) | ||
| }) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| package kubernetes_test | ||
|
|
||
| import ( | ||
| "testing" | ||
|
|
||
| "github.com/kumahq/kuma/pkg/test" | ||
| "github.com/kumahq/kuma/test/framework" | ||
| ) | ||
|
|
||
| func TestE2ETrafficPermissionKubernetes(t *testing.T) { | ||
| if framework.IsK8sClustersStarted() { | ||
| test.RunSpecs(t, "Traffic Permission Kubernetes Suite") | ||
| } else { | ||
| t.SkipNow() | ||
| } | ||
| } |
83 changes: 83 additions & 0 deletions
83
test/e2e/trafficpermission/kubernetes/traffic_permission_k8s.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,83 @@ | ||
| package kubernetes | ||
|
|
||
| import ( | ||
| "strings" | ||
| "time" | ||
|
|
||
| "github.com/gruntwork-io/terratest/modules/k8s" | ||
| . "github.com/onsi/ginkgo" | ||
| . "github.com/onsi/gomega" | ||
|
|
||
| config_core "github.com/kumahq/kuma/pkg/config/core" | ||
| . "github.com/kumahq/kuma/test/framework" | ||
| ) | ||
|
|
||
| func TrafficPermission() { | ||
| var k8sCluster Cluster | ||
| var optsKubernetes = KumaK8sDeployOpts | ||
|
|
||
| E2EBeforeSuite(func() { | ||
| k8sClusters, err := NewK8sClusters([]string{Kuma1}, Silent) | ||
| Expect(err).ToNot(HaveOccurred()) | ||
|
|
||
| k8sCluster = k8sClusters.GetCluster(Kuma1) | ||
|
|
||
| Expect(Kuma(config_core.Standalone, optsKubernetes...)(k8sCluster)).To(Succeed()) | ||
| Expect(k8sCluster.VerifyKuma()).To(Succeed()) | ||
| }) | ||
|
|
||
| E2EAfterSuite(func() { | ||
| Expect(k8sCluster.DeleteKuma(optsKubernetes...)).To(Succeed()) | ||
| Expect(k8sCluster.DismissCluster()).To(Succeed()) | ||
| }) | ||
|
|
||
| removeDefaultTrafficPermission := func() { | ||
| err := k8s.RunKubectlE(k8sCluster.GetTesting(), k8sCluster.GetKubectlOptions(), "delete", "trafficpermission", "allow-all-default") | ||
| Expect(err).ToNot(HaveOccurred()) | ||
| } | ||
|
|
||
| noDefaultTrafficPermission := func() { | ||
| Eventually(func() bool { | ||
| out, err := k8s.RunKubectlAndGetOutputE(k8sCluster.GetTesting(), k8sCluster.GetKubectlOptions(), "get", "trafficpermissions") | ||
| if err != nil { | ||
| return false | ||
| } | ||
| return !strings.Contains(out, "allow-all-default") | ||
| }, "30s", "1s").Should(BeTrue()) | ||
| } | ||
|
|
||
| defaultPoliciesCreated := func() { | ||
| Eventually(func() bool { | ||
| out, err := k8s.RunKubectlAndGetOutputE(k8sCluster.GetTesting(), k8sCluster.GetKubectlOptions(), "get", "meshes", "-o", "yaml") | ||
| if err != nil { | ||
| return false | ||
| } | ||
| return strings.Contains(out, "k8s.kuma.io/mesh-defaults-generated") | ||
| }, "30s", "1s").Should(BeTrue()) | ||
| } | ||
|
|
||
| restartKumaCP := func() { | ||
| pods := k8sCluster.GetKuma().(*K8sControlPlane).GetKumaCPPods() | ||
| Expect(pods).To(HaveLen(1)) | ||
| err := k8s.RunKubectlE(k8sCluster.GetTesting(), k8sCluster.GetKubectlOptions(), "delete", "pod", pods[0].GetName(), "-n", pods[0].GetNamespace()) | ||
| Expect(err).ToNot(HaveOccurred()) | ||
| Expect(k8sCluster.(*K8sCluster).WaitApp(KumaServiceName, KumaNamespace, 1)).To(Succeed()) | ||
| } | ||
|
|
||
| It("should not create deleted default traffic permission after Kuma CP restart", func() { | ||
| // given | ||
| defaultPoliciesCreated() | ||
|
|
||
| // when | ||
| removeDefaultTrafficPermission() | ||
| // then | ||
| noDefaultTrafficPermission() | ||
|
|
||
| // when | ||
| restartKumaCP() | ||
| // and when | ||
| time.Sleep(10 * time.Second) | ||
| // then | ||
| noDefaultTrafficPermission() | ||
| }) | ||
| } |
9 changes: 9 additions & 0 deletions
9
test/e2e/trafficpermission/kubernetes/traffic_permission_k8s_test.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| package kubernetes_test | ||
|
|
||
| import ( | ||
| . "github.com/onsi/ginkgo" | ||
|
|
||
| "github.com/kumahq/kuma/test/e2e/trafficpermission/kubernetes" | ||
| ) | ||
|
|
||
| var _ = Describe("Traffic Permission on Kubernetes", kubernetes.TrafficPermission) |