IPv6/dual-stack integration tests

bin/_test-helpers.sh

@@ -14,7 +14,9 @@ testdir="$bindir"/../test/integration
 
 export default_test_names=(deep deep-native-sidecar viz external helm-upgrade uninstall upgrade-edge default-policy-deny rsa-ca)
 export external_resource_test_names=(external-resources)
-export all_test_names=(cluster-domain cni-calico-deep multicluster "${default_test_names[*]}" "${external_resource_test_names[*]}")
+# TODO(alpeb): add test cni-calico-deep-dual-stack
+export dual_stack_test_names=(deep-dual-stack)
+export all_test_names=(cluster-domain cni-calico-deep multicluster "${default_test_names[*]}" "${external_resource_test_names[*]}" "${dual_stack_test_names[*]}")
 images_load_default=(proxy controller policy-controller web metrics-api tap)
 
 tests_usage() {
@@ -448,6 +450,10 @@ run_deep-native-sidecar_test() {
   run_test "$testdir/deep/..." --native-sidecar
 }
 
+run_deep-dual-stack_test() {
+  run_test "$testdir/deep/..." --dual-stack
+}
+
 run_default-policy-deny_test() {
   export default_inbound_policy='deny'
   run_test "$testdir/install/..."

test/integration/deep/dualstack/dualstack_test.go

@@ -0,0 +1,180 @@
+package dualstack
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/linkerd/linkerd2/testutil"
+)
+
+type IP struct {
+	IP string `json:"ip"`
+}
+
+var TestHelper *testutil.TestHelper
+
+func TestMain(m *testing.M) {
+	TestHelper = testutil.NewTestHelper()
+	// Block test execution until control plane is running
+	TestHelper.WaitUntilDeployReady(testutil.LinkerdDeployReplicasEdge)
+	os.Exit(m.Run())
+}
+
+// TestDualStack creates an injected pod that starts two servers, one listening
+// on the IPv4 wildcard address and serving the string "IPv4", and another
+// listening on the IPv6 wildcard address and serving the string "IPv6". They
+// are fronted by a DualStack Service. We test that we can reach those two IPs
+// directly, and that making a request to the service's FQDN always hits the
+// IPv6 endpoint.
+func TestDualStack(t *testing.T) {
+	if !TestHelper.DualStack() {
+		t.Skip("Skipping Skip DualStack test")
+	}
+
+	TestHelper.WithDataPlaneNamespace(context.Background(), "dualstack-test", map[string]string{}, t, func(t *testing.T, ns string) {
+		out, err := TestHelper.Kubectl("",
+			"create", "configmap", "go-app",
+			"--from-file=main.go=testdata/ipfamilies-server.go",
+			"-n", ns,
+		)
+		if err != nil {
+			testutil.AnnotatedFatalf(t, "unexpected error", "unexpected error: %v\noutput:\n%s", err, out)
+		}
+
+		out, err = TestHelper.Kubectl("",
+			"apply", "-f", "testdata/ipfamilies-server-client.yml",
+			"-n", ns,
+		)
+		if err != nil {
+			testutil.AnnotatedFatalf(t, "unexpected error", "unexpected error: %v\noutput:\n%s", err, out)
+		}
+
+		checkPods(t, ns, "ipfamilies-server")
+		checkPods(t, ns, "client")
+
+		var clientIPv6, serverIPv4, serverIPv6 string
+
+		t.Run("Retrieve pod IPs", func(t *testing.T) {
+			cmd := []string{
+				"get", "po",
+				"-o", "jsonpath='{.items[*].status.podIPs}'",
+				"-n", ns,
+			}
+
+			out, err = TestHelper.Kubectl("", append(cmd, "-l", "app=server")...)
+			if err != nil {
+				testutil.AnnotatedFatalf(t, "unexpected error", "unexpected error: %v\noutput:\n%s", err, out)
+			}
+
+			var IPs []IP
+			out = strings.Trim(out, "'")
+			if err = json.Unmarshal([]byte(out), &IPs); err != nil {
+				testutil.AnnotatedFatalf(t, "error unmarshaling JSON", "error unmarshaling JSON '%s': %s", out, err)
+			}
+			if len(IPs) != 2 {
+				testutil.AnnotatedFatalf(t, "unexpected number of IPs", "expected 2 IPs, got %s", fmt.Sprint(len(IPs)))
+			}
+			serverIPv4 = IPs[0].IP
+			serverIPv6 = IPs[1].IP
+
+			out, err = TestHelper.Kubectl("", append(cmd, "-l", "app=client")...)
+			if err != nil {
+				testutil.AnnotatedFatalf(t, "unexpected error", "unexpected error: %v\noutput:\n%s", err, out)
+			}
+
+			out = strings.Trim(out, "'")
+			if err = json.Unmarshal([]byte(out), &IPs); err != nil {
+				testutil.AnnotatedFatalf(t, "error unmarshaling JSON", "error unmarshaling JSON '%s': %s", out, err)
+			}
+			if len(IPs) != 2 {
+				testutil.AnnotatedFatalf(t, "unexpected number of IPs", "expected 2 IPs, got %s", fmt.Sprint(len(IPs)))
+			}
+			clientIPv6 = IPs[1].IP
+		})
+
+		t.Run("Apply policy", func(t *testing.T) {
+			file, err := os.Open("testdata/ipfamilies-policy.yml")
+			if err != nil {
+				testutil.AnnotatedFatalf(t, "unexpected error", "unexpected error: %v", err)
+			}
+			defer file.Close()
+			manifest, err := io.ReadAll(file)
+			if err != nil {
+				testutil.AnnotatedFatalf(t, "unexpected error", "unexpected error: %v", err)
+			}
+			in := strings.ReplaceAll(string(manifest), "{IPv6}", clientIPv6)
+			out, err = TestHelper.KubectlApply(in, ns)
+			if err != nil {
+				testutil.AnnotatedFatalf(t, "unexpected error", "unexpected error: %v\noutput:\n%s", err, out)
+			}
+		})
+
+		t.Run("Hit IPv4 addr directly", func(t *testing.T) {
+			out, err = TestHelper.Kubectl("",
+				"exec", "deploy/client",
+				"-c", "curl",
+				"-n", ns,
+				"--",
+				"curl", "-s", "http://"+serverIPv4+":8080",
+			)
+			if err != nil {
+				testutil.AnnotatedFatalf(t, "unexpected error", "unexpected error: %v\noutput:\n%s", err, out)
+			}
+			if out != "IPv4\n" {
+				testutil.AnnotatedFatalf(t, "unexpected output", "expected 'IPv4', received '%s'", out)
+			}
+		})
+
+		t.Run("Hit IPv6 addr directly", func(t *testing.T) {
+			out, err = TestHelper.Kubectl("",
+				"exec", "deploy/client",
+				"-c", "curl",
+				"-n", ns,
+				"--",
+				"curl", "-s", "http://["+serverIPv6+"]:8080",
+			)
+			if err != nil {
+				testutil.AnnotatedFatalf(t, "unexpected error", "unexpected error: %v\noutput:\n%s", err, out)
+			}
+			if out != "IPv6\n" {
+				testutil.AnnotatedFatalf(t, "expected 'IPv6', received '%s'", out)
+			}
+		})
+
+		t.Run("Hit FQDN directly (should always resolve to IPv6)", func(t *testing.T) {
+			for i := 0; i < 10; i++ {
+				out, err = TestHelper.Kubectl("",
+					"exec", "deploy/client",
+					"-c", "curl",
+					"-n", ns,
+					"--",
+					"curl", "-s", "http://ipfamilies-server:8080",
+				)
+				if err != nil {
+					testutil.AnnotatedFatalf(t, "unexpected error", "unexpected error: %v\noutput:\n%s", err, out)
+				}
+				if out != "IPv6\n" {
+					testutil.AnnotatedFatalf(t, "expected 'IPv6', received '%s'", out)
+				}
+			}
+		})
+	})
+}
+
+func checkPods(t *testing.T, ns, pod string) {
+	t.Helper()
+
+	if err := TestHelper.CheckPods(context.Background(), ns, pod, 1); err != nil {
+		//nolint:errorlint
+		if rce, ok := err.(*testutil.RestartCountError); ok {
+			testutil.AnnotatedWarn(t, "CheckPods timed-out", rce)
+		} else {
+			testutil.AnnotatedError(t, "CheckPods timed-out", err)
+		}
+	}
+}

test/integration/deep/dualstack/testdata/ipfamilies-policy.yml

@@ -0,0 +1,32 @@
+apiVersion: policy.linkerd.io/v1beta2
+kind: Server
+metadata:
+  name: ipfamilies
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: ipfamilies-server
+  port: http
+  proxyProtocol: HTTP/1
+---
+apiVersion: policy.linkerd.io/v1alpha1
+kind: AuthorizationPolicy
+metadata:
+  name: ipfamilies
+spec:
+  targetRef:
+    group: policy.linkerd.io
+    kind: Server
+    name: ipfamilies
+  requiredAuthenticationRefs:
+    - name: ipfamilies
+      kind: NetworkAuthentication
+      group: policy.linkerd.io
+---
+apiVersion: policy.linkerd.io/v1alpha1
+kind: NetworkAuthentication
+metadata:
+  name: ipfamilies
+spec:
+  networks:
+  - cidr: {IPv6}/128

test/integration/deep/dualstack/testdata/ipfamilies-server-client.yml

@@ -0,0 +1,73 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ipfamilies-server
+spec:
+  selector:
+    matchLabels:
+      app: server
+  template:
+    metadata:
+      annotations:
+        linkerd.io/inject: enabled
+      labels:
+        app: server
+    spec:
+      containers:
+      - image: ghcr.io/alpeb/family-server:v1
+        image: golang:1.22-alpine
+        name: ipfamilies-server
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+        command: ["/bin/sh"]
+        args:
+        - -c
+        - 'go run /go/src/app/main.go'
+        volumeMounts:
+        - name: go-app
+          mountPath: /go/src/app
+      volumes:
+      - name: go-app
+        configMap:
+          name: go-app
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: ipfamilies-server
+spec:
+  ipFamilies:
+  - IPv4
+  - IPv6
+  ipFamilyPolicy: RequireDualStack
+  ports:
+  - name: http
+    port: 8080
+    protocol: TCP
+    targetPort: http
+  selector:
+    app: server
+  type: ClusterIP
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: client
+spec:
+  selector:
+    matchLabels:
+      app: client
+  template:
+    metadata:
+      annotations:
+        linkerd.io/inject: enabled
+      labels:
+        app: client
+    spec:
+      containers:
+      - name: curl
+        image: curlimages/curl
+        command: [ "sh", "-c", "--" ]
+        args: [ "sleep infinity" ]

test/integration/deep/dualstack/testdata/ipfamilies-server.go

@@ -0,0 +1,41 @@
+package main
+
+import (
+	"fmt"
+	"log"
+	"net"
+	"net/http"
+)
+
+type (
+	ipv4Handler struct{}
+	ipv6Handler struct{}
+)
+
+func (ipv4Handler) ServeHTTP(w http.ResponseWriter, _ *http.Request) {
+	fmt.Fprintf(w, "IPv4\n")
+}
+
+func (ipv6Handler) ServeHTTP(w http.ResponseWriter, _ *http.Request) {
+	fmt.Fprintf(w, "IPv6\n")
+}
+
+func main() {
+	log.Print("Server started")
+
+	go func() {
+		ln, err := net.Listen("tcp4", "0.0.0.0:8080")
+		if err != nil {
+			log.Fatal(err)
+		}
+		srv := &http.Server{Handler: ipv4Handler{}}
+		log.Fatal(srv.Serve(ln))
+	}()
+
+	ln, err := net.Listen("tcp6", "[::]:8080")
+	if err != nil {
+		log.Fatal(err)
+	}
+	srv := &http.Server{Handler: ipv6Handler{}}
+	log.Fatal(srv.Serve(ln))
+}

test/integration/deep/endpoints/endpoints_test.go

@@ -108,7 +108,7 @@ func createTestCaseTable(controlNs, endpointNs string) []testCase {
 			expectedRE: `\[
   \{
     "namespace": "(\S*)",
-    "ip": "\d+\.\d+\.\d+\.\d+",
+    "ip": "[a-f0-9.:]+",
     "port": 8086,
     "pod": "linkerd-destination\-[a-f0-9]+\-[a-z0-9]+",
     "service": "linkerd-dst\.\S*",
@@ -125,7 +125,7 @@ func createTestCaseTable(controlNs, endpointNs string) []testCase {
 			expectedRE: `\[
   \{
     "namespace": "(\S*)",
-    "ip": "\d+\.\d+\.\d+\.\d+",
+    "ip": "[a-f0-9.:]+",
     "port": 8080,
     "pod": "linkerd-identity\-[a-f0-9]+\-[a-z0-9]+",
     "service": "linkerd-identity\.\S*",
@@ -142,7 +142,7 @@ func createTestCaseTable(controlNs, endpointNs string) []testCase {
 			expectedRE: `\[
   \{
     "namespace": "(\S*)",
-    "ip": "\d+\.\d+\.\d+\.\d+",
+    "ip": "[a-f0-9.:]+",
     "port": 8443,
     "pod": "linkerd-proxy-injector-[a-f0-9]+\-[a-z0-9]+",
     "service": "linkerd-proxy-injector\.\S*",
@@ -159,7 +159,7 @@ func createTestCaseTable(controlNs, endpointNs string) []testCase {
 			expectedRE: `\[
   \{
     "namespace": "(\S*)",
-    "ip": "\d+\.\d+\.\d+\.\d+",
+    "ip": "[a-f0-9.:]+",
     "port": 8080,
     "pod": "nginx-[a-f0-9]+\-[a-z0-9]+",
     "service": "nginx\.\S*",

test/integration/deep/install_test.go

@@ -126,6 +126,10 @@ func TestInstall(t *testing.T) {
 		cmd = append(cmd, "--set", "proxy.nativeSidecar=true")
 	}
 
+	if TestHelper.DualStack() {
+		cmd = append(cmd, "--set", "disableIPv6=false")
+	}
+
 	// Pipe cmd & args to `linkerd`
 	out, err = TestHelper.LinkerdRun(cmd...)
 	if err != nil {