-
Notifications
You must be signed in to change notification settings - Fork 4.4k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Wire up traffic permissions (#18812)
Wire up traffic permissions
- Loading branch information
1 parent
d3dad14
commit 21fdbba
Showing
32 changed files
with
1,085 additions
and
511 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
38 changes: 38 additions & 0 deletions
38
internal/mesh/internal/cache/sidecarproxycache/identities_cache.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| // Copyright (c) HashiCorp, Inc. | ||
| // SPDX-License-Identifier: BUSL-1.1 | ||
|
|
||
| package sidecarproxycache | ||
|
|
||
| import ( | ||
| auth "github.com/hashicorp/consul/internal/auth" | ||
| "github.com/hashicorp/consul/internal/mesh/internal/types" | ||
| "github.com/hashicorp/consul/internal/resource" | ||
| "github.com/hashicorp/consul/internal/resource/mappers/bimapper" | ||
| "github.com/hashicorp/consul/proto-public/pbresource" | ||
| ) | ||
|
|
||
| // IdentitiesCache tracks mappings between workload identities and proxy IDs | ||
| // that a configuration applies to. It is the responsibility of the controller to | ||
| // keep this cache up-to-date. | ||
| type IdentitiesCache struct { | ||
| mapper *bimapper.Mapper | ||
| } | ||
|
|
||
| func NewIdentitiesCache() *IdentitiesCache { | ||
| return &IdentitiesCache{ | ||
| mapper: bimapper.New(types.ProxyStateTemplateType, auth.WorkloadIdentityType), | ||
| } | ||
| } | ||
|
|
||
| func (c *IdentitiesCache) ProxyIDsByWorkloadIdentity(id *pbresource.ID) []*pbresource.ID { | ||
| return c.mapper.ItemIDsForLink(id) | ||
| } | ||
|
|
||
| func (c *IdentitiesCache) TrackPair(identityID *pbresource.ID, proxyID *pbresource.ID) { | ||
| c.mapper.TrackItem(proxyID, []resource.ReferenceOrID{identityID}) | ||
| } | ||
|
|
||
| // UntrackProxyID removes tracking for the given proxy state template ID. | ||
| func (c *IdentitiesCache) UntrackProxyID(proxyID *pbresource.ID) { | ||
| c.mapper.UntrackItem(proxyID) | ||
| } |
59 changes: 59 additions & 0 deletions
59
internal/mesh/internal/cache/sidecarproxycache/identities_cache_test.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| // Copyright (c) HashiCorp, Inc. | ||
| // SPDX-License-Identifier: BUSL-1.1 | ||
|
|
||
| package sidecarproxycache | ||
|
|
||
| import ( | ||
| "testing" | ||
|
|
||
| "github.com/stretchr/testify/require" | ||
|
|
||
| "github.com/hashicorp/consul/internal/auth" | ||
| "github.com/hashicorp/consul/internal/mesh/internal/types" | ||
| "github.com/hashicorp/consul/internal/resource" | ||
| "github.com/hashicorp/consul/internal/resource/resourcetest" | ||
| "github.com/hashicorp/consul/proto-public/pbresource" | ||
| ) | ||
|
|
||
| func TestIdentitiesCache(t *testing.T) { | ||
| cache := NewIdentitiesCache() | ||
|
|
||
| identityID1 := resourcetest.Resource(auth.WorkloadIdentityType, "workload-identity-1"). | ||
| WithTenancy(resource.DefaultNamespacedTenancy()).ID() | ||
| identityID2 := resourcetest.Resource(auth.WorkloadIdentityType, "workload-identity-2"). | ||
| WithTenancy(resource.DefaultNamespacedTenancy()).ID() | ||
|
|
||
| proxyID1 := resourcetest.Resource(types.ProxyStateTemplateType, "service-workload-1"). | ||
| WithTenancy(resource.DefaultNamespacedTenancy()).ID() | ||
| proxyID2 := resourcetest.Resource(types.ProxyStateTemplateType, "service-workload-2"). | ||
| WithTenancy(resource.DefaultNamespacedTenancy()).ID() | ||
|
|
||
| // Empty cache | ||
| require.Nil(t, cache.ProxyIDsByWorkloadIdentity(identityID1)) | ||
| require.Nil(t, cache.ProxyIDsByWorkloadIdentity(identityID2)) | ||
|
|
||
| // Insert value and fetch it. | ||
| cache.TrackPair(identityID1, proxyID1) | ||
| require.Equal(t, []*pbresource.ID{proxyID1}, cache.ProxyIDsByWorkloadIdentity(identityID1)) | ||
| require.Nil(t, cache.ProxyIDsByWorkloadIdentity(identityID2)) | ||
|
|
||
| // Insert another value referencing the same identity. | ||
| cache.TrackPair(identityID1, proxyID2) | ||
| require.ElementsMatch(t, []*pbresource.ID{proxyID1, proxyID2}, cache.ProxyIDsByWorkloadIdentity(identityID1)) | ||
| require.Nil(t, cache.ProxyIDsByWorkloadIdentity(identityID2)) | ||
|
|
||
| // Now proxy 1 uses identity 2 | ||
| cache.TrackPair(identityID2, proxyID1) | ||
| require.Equal(t, []*pbresource.ID{proxyID1}, cache.ProxyIDsByWorkloadIdentity(identityID2)) | ||
| require.Equal(t, []*pbresource.ID{proxyID2}, cache.ProxyIDsByWorkloadIdentity(identityID1)) | ||
|
|
||
| // Untrack proxy 2 | ||
| cache.UntrackProxyID(proxyID2) | ||
| require.Equal(t, []*pbresource.ID{proxyID1}, cache.ProxyIDsByWorkloadIdentity(identityID2)) | ||
| require.Nil(t, cache.ProxyIDsByWorkloadIdentity(identityID1)) | ||
|
|
||
| // Untrack proxy 1 | ||
| cache.UntrackProxyID(proxyID1) | ||
| require.Nil(t, cache.ProxyIDsByWorkloadIdentity(identityID2)) | ||
| require.Nil(t, cache.ProxyIDsByWorkloadIdentity(identityID1)) | ||
| } |
Oops, something went wrong.