Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

e2e test for connect with consul acls #6982

Merged
merged 8 commits into from
Jan 31, 2020
Merged

e2e test for connect with consul acls #6982

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
5b2bb63
e2e: e2e test for connect with consul acls
shoenig Jan 13, 2020
8062cde
e2e: remove forgotten unused field from new struct
shoenig Jan 24, 2020
814b50e
e2e: do not use eventually when waiting for allocs
shoenig Jan 24, 2020
968f040
e2e: uncomment test case that is not broken
shoenig Jan 24, 2020
676af6a
e2e: use hclfmt on consul acls policy config files
shoenig Jan 27, 2020
02aeb17
e2e: agent token was only being set for server0
shoenig Jan 27, 2020
e4d7b5f
e2e: remove redundant extra API call for getting allocs
shoenig Jan 27, 2020
45920e9
e2e: setup consul ACLs a little more correctly
shoenig Jan 28, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 12 additions & 7 deletions client/allocrunner/taskrunner/task_runner_hooks.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,13 +109,18 @@ func (tr *TaskRunner) initHooks() {
// If this is a Connect sidecar proxy (or a Connect Native) service,
// add the sidsHook for requesting a Service Identity token (if ACLs).
if task.UsesConnect() {
tr.runnerHooks = append(tr.runnerHooks, newSIDSHook(sidsHookConfig{
alloc: tr.Alloc(),
task: tr.Task(),
sidsClient: tr.siClient,
lifecycle: tr,
logger: hookLogger,
}))
// Enable the Service Identity hook only if the Nomad client is configured
// with a consul token, indicating that Consul ACLs are enabled
if tr.clientConfig.ConsulConfig.Token != "" {
tr.runnerHooks = append(tr.runnerHooks, newSIDSHook(sidsHookConfig{
alloc: tr.Alloc(),
task: tr.Task(),
sidsClient: tr.siClient,
lifecycle: tr,
logger: hookLogger,
}))
}

// envoy bootstrap must execute after sidsHook maybe sets SI token
tr.runnerHooks = append(tr.runnerHooks, newEnvoyBootstrapHook(&envoyBootstrapHookConfig{
alloc: alloc,
Expand Down
14 changes: 13 additions & 1 deletion client/allocrunner/taskrunner/task_runner_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1095,7 +1095,7 @@ func (_ *mockEnvoyBootstrapHook) Name() string {
return "mock_envoy_bootstrap"
}

func (m *mockEnvoyBootstrapHook) Prestart(_ context.Context, _ *interfaces.TaskPrestartRequest, resp *interfaces.TaskPrestartResponse) error {
func (_ *mockEnvoyBootstrapHook) Prestart(_ context.Context, _ *interfaces.TaskPrestartRequest, resp *interfaces.TaskPrestartResponse) error {
resp.Done = true
return nil
}
Expand Down Expand Up @@ -1127,6 +1127,10 @@ func TestTaskRunner_BlockForSIDSToken(t *testing.T) {
trConfig, cleanup := testTaskRunnerConfig(t, alloc, task.Name)
defer cleanup()

// set a consul token on the Nomad client's consul config, because that is
// what gates the action of requesting SI token(s)
trConfig.ClientConfig.ConsulConfig.Token = uuid.Generate()

// control when we get a Consul SI token
token := uuid.Generate()
waitCh := make(chan struct{})
Expand Down Expand Up @@ -1191,6 +1195,10 @@ func TestTaskRunner_DeriveSIToken_Retry(t *testing.T) {
trConfig, cleanup := testTaskRunnerConfig(t, alloc, task.Name)
defer cleanup()

// set a consul token on the Nomad client's consul config, because that is
// what gates the action of requesting SI token(s)
trConfig.ClientConfig.ConsulConfig.Token = uuid.Generate()

// control when we get a Consul SI token (recoverable failure on first call)
token := uuid.Generate()
deriveCount := 0
Expand Down Expand Up @@ -1251,6 +1259,10 @@ func TestTaskRunner_DeriveSIToken_Unrecoverable(t *testing.T) {
trConfig, cleanup := testTaskRunnerConfig(t, alloc, task.Name)
defer cleanup()

// set a consul token on the Nomad client's consul config, because that is
// what gates the action of requesting SI token(s)
trConfig.ClientConfig.ConsulConfig.Token = uuid.Generate()

// SI token derivation suffers a non-retryable error
siClient := trConfig.ConsulSI.(*consulapi.MockServiceIdentitiesClient)
siClient.SetDeriveTokenError(alloc.ID, []string{task.Name}, errors.New("non-recoverable"))
Expand Down
6 changes: 3 additions & 3 deletions e2e/affinities/affinities.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ func (tc *BasicAffinityTest) TestSingleAffinities(f *framework.F) {
uuid := uuid.Generate()
jobId := "aff" + uuid[0:8]
tc.jobIds = append(tc.jobIds, jobId)
allocs := e2eutil.RegisterAndWaitForAllocs(f.T(), nomadClient, "affinities/input/single_affinity.nomad", jobId)
allocs := e2eutil.RegisterAndWaitForAllocs(f.T(), nomadClient, "affinities/input/single_affinity.nomad", jobId, "")

jobAllocs := nomadClient.Allocations()
require := require.New(f.T())
Expand All @@ -59,7 +59,7 @@ func (tc *BasicAffinityTest) TestMultipleAffinities(f *framework.F) {
uuid := uuid.Generate()
jobId := "multiaff" + uuid[0:8]
tc.jobIds = append(tc.jobIds, jobId)
allocs := e2eutil.RegisterAndWaitForAllocs(f.T(), nomadClient, "affinities/input/multiple_affinities.nomad", jobId)
allocs := e2eutil.RegisterAndWaitForAllocs(f.T(), nomadClient, "affinities/input/multiple_affinities.nomad", jobId, "")

jobAllocs := nomadClient.Allocations()
require := require.New(f.T())
Expand Down Expand Up @@ -101,7 +101,7 @@ func (tc *BasicAffinityTest) TestAntiAffinities(f *framework.F) {
uuid := uuid.Generate()
jobId := "antiaff" + uuid[0:8]
tc.jobIds = append(tc.jobIds, jobId)
allocs := e2eutil.RegisterAndWaitForAllocs(f.T(), nomadClient, "affinities/input/anti_affinities.nomad", jobId)
allocs := e2eutil.RegisterAndWaitForAllocs(f.T(), nomadClient, "affinities/input/anti_affinities.nomad", jobId, "")

jobAllocs := nomadClient.Allocations()
require := require.New(f.T())
Expand Down
6 changes: 3 additions & 3 deletions e2e/clientstate/clientstate.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,7 +100,7 @@ func (tc *ClientStateTC) TestClientState_Kill(f *framework.F) {
f.NoError(err)

jobID := "sleeper-" + uuid.Generate()[:8]
allocs := e2eutil.RegisterAndWaitForAllocs(t, client, "clientstate/sleeper.nomad", jobID)
allocs := e2eutil.RegisterAndWaitForAllocs(t, client, "clientstate/sleeper.nomad", jobID, "")
f.Len(allocs, 1)

alloc, _, err := client.Allocations().Info(allocs[0].ID, nil)
Expand Down Expand Up @@ -242,7 +242,7 @@ func (tc *ClientStateTC) TestClientState_KillDuringRestart(f *framework.F) {
f.NoError(err)

jobID := "restarter-" + uuid.Generate()[:8]
allocs := e2eutil.RegisterAndWaitForAllocs(t, client, "clientstate/restarter.nomad", jobID)
allocs := e2eutil.RegisterAndWaitForAllocs(t, client, "clientstate/restarter.nomad", jobID, "")
f.Len(allocs, 1)

alloc, _, err := client.Allocations().Info(allocs[0].ID, nil)
Expand Down Expand Up @@ -363,7 +363,7 @@ func (tc *ClientStateTC) TestClientState_Corrupt(f *framework.F) {
f.NoError(err)

jobID := "sleeper-" + uuid.Generate()[:8]
allocs := e2eutil.RegisterAndWaitForAllocs(t, client, "clientstate/sleeper.nomad", jobID)
allocs := e2eutil.RegisterAndWaitForAllocs(t, client, "clientstate/sleeper.nomad", jobID, "")
f.Len(allocs, 1)

alloc, _, err := client.Allocations().Info(allocs[0].ID, nil)
Expand Down
Loading