v2tenancy: namespace mirroring acceptance tests (#3590)

acceptance/framework/connhelper/connect_helper.go

@@ -294,7 +294,7 @@ func (c *ConnectHelper) SetupAppNamespace(t *testing.T) {
 }
 
 // CreateResolverRedirect creates a resolver that redirects to a static-server, a corresponding k8s service,
-// and intentions. This helper is primarly used to ensure that the virtual-ips are persisted to consul properly.
+// and intentions. This helper is primarily used to ensure that the virtual-ips are persisted to consul properly.
 func (c *ConnectHelper) CreateResolverRedirect(t *testing.T) {
 	logger.Log(t, "creating resolver redirect")
 	opts := c.KubectlOptsForApp(t)

acceptance/framework/resource/helpers.go

@@ -0,0 +1,94 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package resource
+
+import (
+	"context"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/hashicorp/consul/sdk/testutil"
+	"github.com/hashicorp/consul/sdk/testutil/retry"
+)
+
+// ResourceTester is a helper for making assertions about resources.
+type ResourceTester struct {
+	// resourceClient is the client to use for resource operations.
+	resourceClient pbresource.ResourceServiceClient
+	// timeout is the total time across which to apply retries.
+	timeout time.Duration
+	// wait is the wait time between retries.
+	wait time.Duration
+	// token is the token to use for requests when ACLs are enabled.
+	token string
+}
+
+func NewResourceTester(resourceClient pbresource.ResourceServiceClient) *ResourceTester {
+	return &ResourceTester{
+		resourceClient: resourceClient,
+		timeout:        7 * time.Second,
+		wait:           25 * time.Millisecond,
+	}
+}
+
+func (rt *ResourceTester) retry(t testutil.TestingTB, fn func(r *retry.R)) {
+	t.Helper()
+	retryer := &retry.Timer{Timeout: rt.timeout, Wait: rt.wait}
+	retry.RunWith(retryer, t, fn)
+}
+
+func (rt *ResourceTester) Context(t testutil.TestingTB) context.Context {
+	ctx := testutil.TestContext(t)
+
+	if rt.token != "" {
+		md := metadata.New(map[string]string{
+			"x-consul-token": rt.token,
+		})
+		ctx = metadata.NewOutgoingContext(ctx, md)
+	}
+
+	return ctx
+}
+
+func (rt *ResourceTester) RequireResourceExists(t testutil.TestingTB, id *pbresource.ID) *pbresource.Resource {
+	t.Helper()
+
+	rsp, err := rt.resourceClient.Read(rt.Context(t), &pbresource.ReadRequest{Id: id})
+	require.NoError(t, err, "error reading %s with type %v", id.Name, id.Type)
+	require.NotNil(t, rsp)
+	return rsp.Resource
+}
+
+func (rt *ResourceTester) RequireResourceNotFound(t testutil.TestingTB, id *pbresource.ID) {
+	t.Helper()
+
+	rsp, err := rt.resourceClient.Read(rt.Context(t), &pbresource.ReadRequest{Id: id})
+	require.Error(t, err)
+	require.Equal(t, codes.NotFound, status.Code(err))
+	require.Nil(t, rsp)
+}
+
+func (rt *ResourceTester) WaitForResourceExists(t testutil.TestingTB, id *pbresource.ID) *pbresource.Resource {
+	t.Helper()
+
+	var res *pbresource.Resource
+	rt.retry(t, func(r *retry.R) {
+		res = rt.RequireResourceExists(r, id)
+	})
+
+	return res
+}
+
+func (rt *ResourceTester) WaitForResourceNotFound(t testutil.TestingTB, id *pbresource.ID) {
+	t.Helper()
+
+	rt.retry(t, func(r *retry.R) {
+		rt.RequireResourceNotFound(r, id)
+	})
+}

acceptance/tests/mesh_v2/mesh_inject_test.go

@@ -37,7 +37,6 @@ func TestMeshInject_MultiportService(t *testing.T) {
 
 			helmValues := map[string]string{
 				"global.experiments[0]": "resource-apis",
-				"global.image":          "ndhanushkodi/consul-dev:expose2",
 				// The UI is not supported for v2 in 1.17, so for now it must be disabled.
 				"ui.enabled":            "false",
 				"connectInject.enabled": "true",

acceptance/tests/tenancy_v2/namespace_test.go

@@ -0,0 +1,62 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package tenancy_v2
+
+import (
+	"testing"
+
+	"github.com/hashicorp/consul-k8s/acceptance/framework/consul"
+	"github.com/hashicorp/consul-k8s/acceptance/framework/helpers"
+	"github.com/hashicorp/consul-k8s/acceptance/framework/k8s"
+	"github.com/hashicorp/consul-k8s/acceptance/framework/logger"
+	"github.com/hashicorp/consul-k8s/acceptance/framework/resource"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	pbtenancy "github.com/hashicorp/consul/proto-public/pbtenancy/v2beta1"
+)
+
+// TestTenancy_Namespace_Mirrored tests consul namespaces are created/deleted
+// to mirror k8s namespaces in the default partition.
+func TestTenancy_Namespace_Mirrored(t *testing.T) {
+	cfg := suite.Config()
+	cfg.SkipWhenCNI(t)
+	ctx := suite.Environment().DefaultContext(t)
+
+	serverHelmValues := map[string]string{
+		"server.enabled":        "true",
+		"global.experiments[0]": "resource-apis",
+		"global.experiments[1]": "v2tenancy",
+		// The UI is not supported for v2 in 1.17, so for now it must be disabled.
+		"ui.enabled": "false",
+	}
+
+	serverReleaseName := helpers.RandomName()
+	serverCluster := consul.NewHelmCluster(t, serverHelmValues, ctx, cfg, serverReleaseName)
+	serverCluster.Create(t)
+
+	logger.Log(t, "creating namespace ns1 in k8s")
+	k8s.RunKubectl(t, ctx.KubectlOptions(t), "create", "namespace", "ns1")
+
+	logger.Log(t, "waiting for namespace ns1 to be created in consul")
+	serverResourceClient := serverCluster.ResourceClient(t, false)
+	rtest := resource.NewResourceTester(serverResourceClient)
+	rtest.WaitForResourceExists(t, &pbresource.ID{
+		Name: "ns1",
+		Type: pbtenancy.NamespaceType,
+		Tenancy: &pbresource.Tenancy{
+			Partition: "default",
+		},
+	})
+
+	logger.Log(t, "deleting namespace ns1 in k8s")
+	k8s.RunKubectl(t, ctx.KubectlOptions(t), "delete", "namespace", "ns1")
+
+	logger.Log(t, "waiting for namespace ns1 to be deleted in consul")
+	rtest.WaitForResourceNotFound(t, &pbresource.ID{
+		Name: "ns1",
+		Type: pbtenancy.NamespaceType,
+		Tenancy: &pbresource.Tenancy{
+			Partition: "default",
+		},
+	})
+}