-
Notifications
You must be signed in to change notification settings - Fork 1.2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
internal encryption e2e tests (#14092)
* allow activator configstore to track network config * add new security mode metrics tag * activator now adds security mode tag to metrics * based on security mode from config in context * queue adds security mode tag to metrics * security mode set as env var based on config from reconciler * test: add test image for reading request metrics * test: add internal encryption e2e tests * run update-deps * first pass: change internal encryption test to read logs * remove metricreader image * update internal encryption test readme * run update-deps * remove securitymode metric * address linter suggestions * more lint suggestions * clean up test * make internal encryption test alpha only * also only run for Contour and Kourier right now * cleanup leftovers from metrics stuff * address nits * fix typo * address PR feedback * fix failing test * use correct symbol when looking for TLS access log * refactor toggle_feature * was having some bash issues with properly interpretting the patch * use new flag name * we have switched to system-internal-tls
- Loading branch information
Showing
7 changed files
with
228 additions
and
23 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| # System Internal TLS E2E Tests | ||
|
|
||
| In order to test System Internal TLS, this test turns enables request logging and sets the request log template to `TLS: {{.Request.TLS}}`. | ||
|
|
||
| The test setup will enable System Internal TLS, and then configure the logging settings. | ||
|
|
||
| The test then deploys and attempts to reach the HelloWorld test image. | ||
|
|
||
| Assuming the request succeeds, the test combs the logs for the Activator and QueueProxy looking for the TLS lines. | ||
|
|
||
| It counts the lines where `TLS: <nil>` appears, which indicates that TLS was not used. If that count is greater than 0, the test will fail. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,165 @@ | ||
| //go:build e2e | ||
| // +build e2e | ||
|
|
||
| /* | ||
| Copyright 2023 The Knative Authors | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| */ | ||
|
|
||
| package systeminternaltls | ||
|
|
||
| import ( | ||
| "bufio" | ||
| "bytes" | ||
| "context" | ||
| "fmt" | ||
| "io" | ||
| "strings" | ||
| "testing" | ||
|
|
||
| corev1 "k8s.io/api/core/v1" | ||
| v1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| "k8s.io/client-go/rest" | ||
| "knative.dev/pkg/system" | ||
| pkgTest "knative.dev/pkg/test" | ||
| "knative.dev/pkg/test/spoof" | ||
| "knative.dev/serving/test" | ||
| v1test "knative.dev/serving/test/v1" | ||
| ) | ||
|
|
||
| // TestInternalEncrytion tests the TLS connections between system components. | ||
| func TestInternalEncryption(t *testing.T) { | ||
| if !test.ServingFlags.EnableAlphaFeatures { | ||
| t.Skip("Alpha features not enabled") | ||
| } | ||
|
|
||
| if !(strings.Contains(test.ServingFlags.IngressClass, "kourier") || strings.Contains(test.ServingFlags.IngressClass, "contour")) { | ||
| t.Skip("Skip this test for non-kourier or non-contour ingress.") | ||
| } | ||
|
|
||
| t.Parallel() | ||
| clients := test.Setup(t) | ||
|
|
||
| names := test.ResourceNames{ | ||
| Service: test.ObjectNameForTest(t), | ||
| Image: test.HelloWorld, | ||
| } | ||
|
|
||
| test.EnsureTearDown(t, clients, &names) | ||
|
|
||
| t.Log("Creating a new Service") | ||
| resources, err := v1test.CreateServiceReady(t, clients, &names) | ||
| if err != nil { | ||
| t.Fatalf("Failed to create initial Service: %v: %v", names.Service, err) | ||
| } | ||
|
|
||
| //The request made here should be enough to trigger some request logs on the Activator and QueueProxy | ||
| t.Log("Checking Endpoint state") | ||
| url := resources.Route.Status.URL.URL() | ||
| if _, err := pkgTest.CheckEndpointState( | ||
| context.Background(), | ||
| clients.KubeClient, | ||
| t.Logf, | ||
| url, | ||
| spoof.MatchesAllOf(spoof.IsStatusOK, spoof.MatchesBody(test.HelloWorldText)), | ||
| "HelloWorldText", | ||
| test.ServingFlags.ResolvableDomain, | ||
| test.AddRootCAtoTransport(context.Background(), t.Logf, clients, test.ServingFlags.HTTPS), | ||
| ); err != nil { | ||
| t.Fatalf("The endpoint %s for Route %s didn't serve the expected text %q: %v", url, names.Route, test.HelloWorldText, err) | ||
| } | ||
|
|
||
| t.Log("Checking Activator logs") | ||
| pods, err := clients.KubeClient.CoreV1().Pods(system.Namespace()).List(context.TODO(), v1.ListOptions{ | ||
| LabelSelector: "app=activator", | ||
| }) | ||
| if err != nil { | ||
| t.Fatalf("Failed to get pods: %v", err) | ||
| } | ||
| if len(pods.Items) == 0 { | ||
| t.Fatalf("No pods detected for activator: %v", err) | ||
| } | ||
| activatorPod := pods.Items[0] | ||
|
|
||
| req := clients.KubeClient.CoreV1().Pods(activatorPod.Namespace).GetLogs(activatorPod.Name, &corev1.PodLogOptions{}) | ||
| activatorTLSCount, err := scanPodLogs(req, matchTLSLog) | ||
|
|
||
| if err != nil { | ||
| t.Fatalf("Failed checking activator logs: %s", err) | ||
| } else if activatorTLSCount == 0 { | ||
| t.Fatal("TLS not used on requests to activator") | ||
| } | ||
|
|
||
| t.Log("Checking Queue-Proxy logs") | ||
| pods, err = clients.KubeClient.CoreV1().Pods("serving-tests").List(context.TODO(), v1.ListOptions{ | ||
| LabelSelector: fmt.Sprintf("serving.knative.dev/configuration=%s", names.Config), | ||
| }) | ||
| if err != nil { | ||
| t.Fatalf("Failed to get pods: %v", err) | ||
| } | ||
| if len(pods.Items) == 0 { | ||
| t.Fatalf("No pods detected for test app: %v", err) | ||
| } | ||
| helloWorldPod := pods.Items[0] | ||
| req = clients.KubeClient.CoreV1().Pods(helloWorldPod.Namespace).GetLogs(helloWorldPod.Name, &corev1.PodLogOptions{Container: "queue-proxy"}) | ||
| queueTLSCount, err := scanPodLogs(req, matchTLSLog) | ||
|
|
||
| if err != nil { | ||
| t.Fatalf("Failed checking queue-proxy logs: %s", err) | ||
| } else if queueTLSCount == 0 { | ||
| t.Fatal("TLS not used on requests to queue-proxy") | ||
| } | ||
| } | ||
|
|
||
| func scanPodLogs(req *rest.Request, matcher func(string) bool) (matchCount int, err error) { | ||
|
|
||
| podLogs, err := req.Stream(context.Background()) | ||
| if err != nil { | ||
| err = fmt.Errorf("Failed to stream activator logs: %w", err) | ||
| return | ||
| } | ||
|
|
||
| buf := new(bytes.Buffer) | ||
| _, err = io.Copy(buf, podLogs) | ||
| podLogs.Close() | ||
| if err != nil { | ||
| err = fmt.Errorf("Failed to read activator logs from buffer: %w", err) | ||
| return | ||
| } | ||
|
|
||
| scanner := bufio.NewScanner(buf) | ||
| for scanner.Scan() { | ||
| if matcher(scanner.Text()) { | ||
| matchCount++ | ||
| } | ||
| } | ||
|
|
||
| if err = scanner.Err(); err != nil { | ||
| err = fmt.Errorf("Failed scanning activator logs: %w", err) | ||
| return | ||
| } | ||
|
|
||
| return | ||
| } | ||
|
|
||
| func matchTLSLog(line string) bool { | ||
| if strings.Contains(line, "TLS") { | ||
| if strings.Contains(line, "TLS: <nil>") { | ||
| return false | ||
| } else if strings.Contains(line, "TLS: {") { | ||
| return true | ||
| } | ||
| } | ||
| return false | ||
| } |