Skip to content

Commit b74196d

Browse files
zirainzirain
committed
fix e2e
Signed-off-by: zirain <zirain2009@gmail.com>
1 parent 94f7ad6 commit b74196d

8 files changed

+144
-67
lines changed

‎test/e2e/e2e_test.go

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,12 @@ func TestE2E(t *testing.T) {
7171
)
7272
}
7373

74+
enabledFeatures := sets.New(features.SupportGateway)
75+
if tests.EnabledClusterTrustBundle() {
76+
tlog.Logf(t, "ClusterTrustBundle feature is enabled")
77+
enabledFeatures.Insert(tests.ClusterTrustBundleFeature)
78+
}
79+
7480
cSuite, err := suite.NewConformanceTestSuite(suite.ConformanceOptions{
7581
Client: c,
7682
RestConfig: cfg,
@@ -81,7 +87,7 @@ func TestE2E(t *testing.T) {
8187
RunTest: *flags.RunTest,
8288
// SupportedFeatures cannot be empty, so we set it to SupportGateway
8389
// All e2e tests should leave Features empty.
84-
SupportedFeatures: sets.New(features.SupportGateway),
90+
SupportedFeatures: enabledFeatures,
8591
SkipTests: skipTests,
8692
AllowCRDsMismatch: *flags.AllowCRDsMismatch,
8793
Hook: Hook,

‎test/e2e/testdata/backend-tls-clustertrustbundle.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ metadata:
3333
namespace: gateway-conformance-infra
3434
spec:
3535
parentRefs:
36-
- name: same-namespace
36+
- name: all-namespaces
3737
rules:
3838
- matches:
3939
- path:

‎test/e2e/testdata/httproute-with-dynamic-resolver-backend-with-clustertrustbundle.yaml

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,21 @@
1+
apiVersion: gateway.networking.k8s.io/v1
2+
kind: HTTPRoute
3+
metadata:
4+
name: httproute-clustertrustbundle
5+
namespace: gateway-conformance-infra
6+
spec:
7+
parentRefs:
8+
- name: all-namespaces
9+
rules:
10+
- backendRefs:
11+
- group: gateway.envoyproxy.io
12+
kind: Backend
13+
name: backend-clustertrustbundle
14+
matches:
15+
- path:
16+
type: PathPrefix
17+
value: /with-clustertrustbundle
18+
---
119
# keep this same as configmap backend-ca-certificate
220
apiVersion: certificates.k8s.io/v1beta1
321
kind: ClusterTrustBundle
@@ -29,7 +47,7 @@ spec:
2947
apiVersion: gateway.envoyproxy.io/v1alpha1
3048
kind: Backend
3149
metadata:
32-
name: backend-dynamic-resolver-clustertrustbundle
50+
name: backend-clustertrustbundle
3351
namespace: gateway-conformance-infra
3452
spec:
3553
type: DynamicResolver

‎test/e2e/testdata/httproute-with-dynamic-resolver-backend-with-tls.yaml

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,6 @@ spec:
1515
- path:
1616
type: PathPrefix
1717
value: /with-tls
18-
- backendRefs:
19-
- group: gateway.envoyproxy.io
20-
kind: Backend
21-
name: backend-dynamic-resolver-clustertrustbundle
22-
matches:
23-
- path:
24-
type: PathPrefix
25-
value: /with-clustertrustbundle
2618
---
2719
apiVersion: gateway.envoyproxy.io/v1alpha1
2820
kind: Backend

‎test/e2e/tests/backend_tls.go

Lines changed: 16 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -14,23 +14,17 @@ import (
1414
"sigs.k8s.io/gateway-api/conformance/utils/http"
1515
"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
1616
"sigs.k8s.io/gateway-api/conformance/utils/suite"
17+
"sigs.k8s.io/gateway-api/pkg/features"
1718
)
1819

19-
var backendTLSTestManifests []string
20-
2120
func init() {
22-
ConformanceTests = append(ConformanceTests, BackendTLSTest)
23-
24-
backendTLSTestManifests = []string{"testdata/backend-tls.yaml"}
25-
if EnabledClusterTrustBundle() {
26-
backendTLSTestManifests = append(backendTLSTestManifests, "testdata/backend-tls-clustertrustbundle.yaml")
27-
}
21+
ConformanceTests = append(ConformanceTests, BackendTLSTest, BackendClusterTrustBundleTest)
2822
}
2923

3024
var BackendTLSTest = suite.ConformanceTest{
3125
ShortName: "BackendTLS",
3226
Description: "Connect to backend with TLS",
33-
Manifests: backendTLSTestManifests,
27+
Manifests: []string{"testdata/backend-tls.yaml"},
3428
Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
3529
gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ConformanceInfraNamespace}
3630
t.Run("with a backend TLS Policy", func(t *testing.T) {
@@ -109,12 +103,21 @@ var BackendTLSTest = suite.ConformanceTest{
109103

110104
http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, expectedResponse)
111105
})
106+
},
107+
}
112108

109+
var BackendClusterTrustBundleTest = suite.ConformanceTest{
110+
ShortName: "BackendTLSClusterTrustBundle",
111+
Description: "Connect to backend with TLS",
112+
Manifests: []string{
113+
"testdata/backend-tls-clustertrustbundle.yaml",
114+
},
115+
Features: []features.FeatureName{
116+
ClusterTrustBundleFeature,
117+
},
118+
Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
119+
gwNN := types.NamespacedName{Name: AllNamespacesGateway, Namespace: ConformanceInfraNamespace}
113120
t.Run("with ClusterTrustBundle", func(t *testing.T) {
114-
if !EnabledClusterTrustBundle() {
115-
t.Skipf("Skipping test as ClusterTrustBundle is not enabled")
116-
}
117-
118121
routeNN := types.NamespacedName{Name: "http-with-backend-tls-trust-bundle", Namespace: ConformanceInfraNamespace}
119122
gwAddr := kubernetes.GatewayAndHTTPRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), routeNN)
120123

‎test/e2e/tests/client_mtls.go

Lines changed: 55 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -24,23 +24,17 @@ import (
2424
"sigs.k8s.io/gateway-api/conformance/utils/roundtripper"
2525
"sigs.k8s.io/gateway-api/conformance/utils/suite"
2626
"sigs.k8s.io/gateway-api/conformance/utils/tlog"
27+
"sigs.k8s.io/gateway-api/pkg/features"
2728
)
2829

29-
var clientMTLSTestManifests []string
30-
3130
func init() {
32-
ConformanceTests = append(ConformanceTests, ClientMTLSTest)
33-
34-
clientMTLSTestManifests = []string{"testdata/client-mtls.yaml"}
35-
if EnabledClusterTrustBundle() {
36-
clientMTLSTestManifests = append(clientMTLSTestManifests, "testdata/client-mtls-trustbundle.yaml")
37-
}
31+
ConformanceTests = append(ConformanceTests, ClientMTLSTest, ClientMTLSClusterTrustBundleTest)
3832
}
3933

4034
var ClientMTLSTest = suite.ConformanceTest{
4135
ShortName: "ClientMTLS",
4236
Description: "Use Gateway with Client MTLS policy",
43-
Manifests: clientMTLSTestManifests,
37+
Manifests: []string{"testdata/client-mtls.yaml"},
4438
Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
4539
t.Run("Client MTLS with ClusterTrustBundle", func(t *testing.T) {
4640
if !EnabledClusterTrustBundle() {
@@ -204,6 +198,58 @@ var ClientMTLSTest = suite.ConformanceTest{
204198
},
205199
}
206200

201+
var ClientMTLSClusterTrustBundleTest = suite.ConformanceTest{
202+
ShortName: "ClientMTLSClusterTrustBundle",
203+
Description: "Use Gateway with Client MTLS policy",
204+
Manifests: []string{"testdata/client-mtls-trustbundle.yaml"},
205+
Features: []features.FeatureName{
206+
ClusterTrustBundleFeature,
207+
},
208+
Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
209+
t.Run("Client MTLS with ClusterTrustBundle", func(t *testing.T) {
210+
ns := "gateway-conformance-infra"
211+
routeNN := types.NamespacedName{Name: "client-mtls-clustertrustbundle", Namespace: ns}
212+
gwNN := types.NamespacedName{Name: "client-mtls-clustertrustbundle", Namespace: ns}
213+
gwAddr := kubernetes.GatewayAndHTTPRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), routeNN)
214+
certNN := types.NamespacedName{Name: "client-example-com", Namespace: ns}
215+
216+
expected := http.ExpectedResponse{
217+
Request: http.Request{
218+
Host: "www.example.com",
219+
Path: "/cluster-trust-bundle",
220+
},
221+
ExpectedRequest: &http.ExpectedRequest{
222+
Request: http.Request{
223+
Host: "www.example.com",
224+
Path: "/cluster-trust-bundle",
225+
Headers: map[string]string{
226+
"X-Forwarded-Client-Cert": "Hash=42a13e4b02c8a6d2ae5bf2fdaa032e24fdbabbaa79b6017fd0db6c077e6999e0;Subject=\"O=example organization,CN=client.example.com\"",
227+
},
228+
},
229+
},
230+
Response: http.Response{
231+
StatusCode: 200,
232+
},
233+
Namespace: ns,
234+
}
235+
236+
req := http.MakeRequest(t, &expected, gwAddr, "HTTPS", "https")
237+
238+
// This test uses the same key/cert pair as both a client cert and server cert
239+
// Both backend and client treat the self-signed cert as a trusted CA
240+
cPem, keyPem, caPem, err := GetTLSSecret(suite.Client, certNN)
241+
if err != nil {
242+
t.Fatalf("unexpected error finding TLS secret: %v", err)
243+
}
244+
245+
combined := string(cPem) + "\n" + string(caPem)
246+
247+
WaitForConsistentMTLSResponse(t, suite.RoundTripper, req, expected, suite.TimeoutConfig.RequiredConsecutiveSuccesses, suite.TimeoutConfig.MaxTimeToConsistency,
248+
[]byte(combined), keyPem, "www.example.com")
249+
})
250+
},
251+
}
252+
207253
func WaitForConsistentMTLSResponse(t *testing.T, r roundtripper.RoundTripper, req roundtripper.Request, expected http.ExpectedResponse, threshold int, maxTimeToConsistency time.Duration, cPem, keyPem []byte, server string) {
208254
http.AwaitConvergence(t, threshold, maxTimeToConsistency, func(elapsed time.Duration) bool {
209255
req.KeyPem = keyPem

‎test/e2e/tests/httproute_with_dynamic_resolver_backend.go

Lines changed: 41 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -14,23 +14,15 @@ import (
1414
"sigs.k8s.io/gateway-api/conformance/utils/http"
1515
"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
1616
"sigs.k8s.io/gateway-api/conformance/utils/suite"
17+
"sigs.k8s.io/gateway-api/pkg/features"
1718
)
1819

19-
var dynamicResolverBackendWithTLSTestManifests []string
20-
2120
func init() {
2221
ConformanceTests = append(ConformanceTests,
2322
DynamicResolverBackendTest,
24-
DynamicResolverBackendWithTLSTest)
23+
DynamicResolverBackendWithTLSTest,
24+
DynamicResolverBackendWithClusterTrustBundleTest)
2525

26-
dynamicResolverBackendWithTLSTestManifests = []string{
27-
"testdata/httproute-with-dynamic-resolver-backend-with-tls.yaml",
28-
"testdata/httproute-with-dynamic-resolver-backend-with-tls-system-ca.yaml",
29-
}
30-
if EnabledClusterTrustBundle() {
31-
dynamicResolverBackendWithTLSTestManifests = append(dynamicResolverBackendWithTLSTestManifests,
32-
"testdata/httproute-with-dynamic-resolver-backend-with-clustertrustbundle.yaml")
33-
}
3426
}
3527

3628
var DynamicResolverBackendTest = suite.ConformanceTest{
@@ -111,32 +103,13 @@ var DynamicResolverBackendTest = suite.ConformanceTest{
111103
var DynamicResolverBackendWithTLSTest = suite.ConformanceTest{
112104
ShortName: "DynamicResolverBackendWithTLS",
113105
Description: "Routes with a backend ref to a dynamic resolver backend",
114-
Manifests: dynamicResolverBackendWithTLSTestManifests,
106+
Manifests: []string{
107+
"testdata/httproute-with-dynamic-resolver-backend-with-tls.yaml",
108+
"testdata/httproute-with-dynamic-resolver-backend-with-tls-system-ca.yaml",
109+
},
115110
Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
116111
ns := "gateway-conformance-infra"
117112
gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ns}
118-
t.Run("ClusterTrustBundle", func(t *testing.T) {
119-
if !EnabledClusterTrustBundle() {
120-
t.Skipf("Skipping test as ClusterTrustBundle is not enabled")
121-
}
122-
123-
routeNN := types.NamespacedName{Name: "httproute-with-dynamic-resolver-backend-tls", Namespace: ns}
124-
gwAddr := kubernetes.GatewayAndHTTPRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), routeNN)
125-
BackendMustBeAccepted(t, suite.Client, types.NamespacedName{Name: "backend-dynamic-resolver-clustertrustbundle", Namespace: ns})
126-
127-
expectedResponse := http.ExpectedResponse{
128-
Request: http.Request{
129-
Host: "backend-dynamic-resolver-tls.gateway-conformance-infra.svc.cluster.local:443",
130-
Path: "/with-clustertrustbundle",
131-
},
132-
Response: http.Response{
133-
StatusCode: 200,
134-
},
135-
Namespace: ns,
136-
}
137-
138-
http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, expectedResponse)
139-
})
140113
t.Run("TLS", func(t *testing.T) {
141114
routeNN := types.NamespacedName{Name: "httproute-with-dynamic-resolver-backend-tls", Namespace: ns}
142115
gwAddr := kubernetes.GatewayAndHTTPRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), routeNN)
@@ -178,3 +151,37 @@ var DynamicResolverBackendWithTLSTest = suite.ConformanceTest{
178151
})
179152
},
180153
}
154+
155+
var DynamicResolverBackendWithClusterTrustBundleTest = suite.ConformanceTest{
156+
ShortName: "DynamicResolverBackendWithClusterTrustBundle",
157+
Description: "Routes with a backend ref to a dynamic resolver backend",
158+
Manifests: []string{
159+
"testdata/httproute-with-dynamic-resolver-backend-with-tls.yaml",
160+
"testdata/httproute-with-dynamic-resolver-backend-with-clustertrustbundle.yaml",
161+
},
162+
Features: []features.FeatureName{
163+
ClusterTrustBundleFeature,
164+
},
165+
Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
166+
ns := "gateway-conformance-infra"
167+
gwNN := types.NamespacedName{Name: AllNamespacesGateway, Namespace: ns}
168+
t.Run("ClusterTrustBundle", func(t *testing.T) {
169+
routeNN := types.NamespacedName{Name: "httproute-clustertrustbundle", Namespace: ns}
170+
gwAddr := kubernetes.GatewayAndHTTPRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), routeNN)
171+
BackendMustBeAccepted(t, suite.Client, types.NamespacedName{Name: "backend-clustertrustbundle", Namespace: ns})
172+
173+
expectedResponse := http.ExpectedResponse{
174+
Request: http.Request{
175+
Host: "backend-dynamic-resolver-tls.gateway-conformance-infra.svc.cluster.local:443",
176+
Path: "/with-clustertrustbundle",
177+
},
178+
Response: http.Response{
179+
StatusCode: 200,
180+
},
181+
Namespace: ns,
182+
}
183+
184+
http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, expectedResponse)
185+
})
186+
},
187+
}

‎test/e2e/tests/utils.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ import (
4242
k8sutils "sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
4343
"sigs.k8s.io/gateway-api/conformance/utils/suite"
4444
"sigs.k8s.io/gateway-api/conformance/utils/tlog"
45+
"sigs.k8s.io/gateway-api/pkg/features"
4546

4647
egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
4748
"github.com/envoyproxy/gateway/internal/kubernetes"
@@ -60,8 +61,12 @@ var (
6061
)
6162

6263
const (
64+
ClusterTrustBundleFeature features.FeatureName = "ClusterTrustBundle"
65+
6366
ConformanceInfraNamespace = "gateway-conformance-infra"
6467

68+
AllNamespacesGateway = "all-namespaces"
69+
6570
defaultServiceStartupTimeout = 5 * time.Minute
6671
)
6772

0 commit comments

Comments
 (0)