Support Consul namespaces for service-intentions #362

lkysow · 2020-10-15T00:02:07Z

Changes proposed in this PR:

Fix support for service-intentions and Consul enterprise. Previously the defaults we were setting for the namespace fields weren't getting applied to the object in the webhook because we weren't returning any patches. When the entry got into the controller, its destination.namespace field was "". We would then attempt to create a namespace with name "" which would fail. In addition, if the namespace creation didn't error out, we would create the config entry in the namespace "default" instead of what we wanted to be the default namespace (e.g. if mirroring we wanted the namespace to equal the kube namespace).
In this PR, we reject requests that have source.namespace or destination.namespace specified and consul namespaces are disabled.
Additionally, if a destination namespace is explicitly specified, and namespaces are enabled, we create the service intention in the specified destination namespace.
In case the destination namespace is not specified and namespaces are enabled, we use our existing logic to determine the consul namespace, depending on mirroring, mirror-prefix and destination consul namespace values.
This PR allows validates that atleast one source value is set on an intention.
It also ensures that exposePaths.protocol does not fail is "" is set as it's value as that defaulting is managed by Consul.
How I've tested this PR:
Acceptance tests are passing Test controller against consul:1.9.0-beta1 consul-helm#645 using this image. Previously they were failing for Consul enterprise.

Closes #367

How I expect reviewers to test this PR:

code, review acceptance tests

Checklist:

Tests added
CHANGELOG entry added (HashiCorp engineers only, community PRs should not add a changelog entry)

lkysow · 2020-10-15T00:03:34Z

api/v1alpha1/serviceintentions_webhook.go

+
+// defaultingPatches returns the patches needed to set fields to their
+// defaults.
+func (v *ServiceIntentionsWebhook) defaultingPatches(err error, svcIntentions *ServiceIntentions) ([]jsonpatch.Operation, error) {


This only returns patches in consul ent but I didn't short-circuit in case we add defaulting logic for oss later.

This comment just stopped me from mentioning we should short circuit it 😛

lkysow · 2020-10-15T00:03:55Z

api/v1alpha1/serviceintentions_webhook_test.go

 	"k8s.io/api/admission/v1beta1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 )

-func TestValidateServiceIntentions_Create(t *testing.T) {
+func TestHandle_ServiceIntentions_Create(t *testing.T) {


These tests actually call Handle() unlike the other webhook tests that do call Validate()

lkysow · 2020-10-15T00:04:36Z

api/v1alpha1/serviceintentions_webhook_test.go

+// Test that we return patches to set Consul namespace fields to their defaults.
+// This test also tests OSS where we expect no patches since OSS has no
+// Consul namespaces.
+func TestHandle_ServiceIntentions_Patches(t *testing.T) {


I added a new test rather than adding permutations to the existing tests because I thought that would make them too complicated.

lkysow · 2020-10-15T00:05:42Z

api/v1alpha1/serviceintentions_webhook.go

-	svcIntentions.Default()
+	defaultingPatches, err := v.defaultingPatches(err, &svcIntentions)
+	if err != nil {
+		return admission.Errored(http.StatusInternalServerError, err)


Not sure if this should be 500 or 400. If there's an error, it will happen every time but the error could be due to the input or our internal defaulting logic.

It would be an input issue if the json unmarshal failed but I think that's not possible since it would have to be legal json to be posted to the webhook I believe?

You're right. If malformed JSON makes it here, it's probably because the API server messed up in some weird way. I'm OK with a 500 here, given i'd expect the API server to return a 400

thisisnotashwin

LOVE IT!

api/v1alpha1/serviceintentions_types_test.go

thisisnotashwin · 2020-10-15T00:24:14Z

api/v1alpha1/serviceintentions_webhook.go

+
+// defaultingPatches returns the patches needed to set fields to their
+// defaults.
+func (v *ServiceIntentionsWebhook) defaultingPatches(err error, svcIntentions *ServiceIntentions) ([]jsonpatch.Operation, error) {


This comment just stopped me from mentioning we should short circuit it 😛

thisisnotashwin · 2020-10-15T00:26:25Z

api/v1alpha1/serviceintentions_webhook.go

-	svcIntentions.Default()
+	defaultingPatches, err := v.defaultingPatches(err, &svcIntentions)
+	if err != nil {
+		return admission.Errored(http.StatusInternalServerError, err)


You're right. If malformed JSON makes it here, it's probably because the API server messed up in some weird way. I'm OK with a 500 here, given i'd expect the API server to return a 400

api/v1alpha1/serviceintentions_webhook_test.go

ishustava

Looks great! I tested it out on a cluster too with both single namespace and namespace mirroring settings.

ishustava · 2020-10-29T17:43:36Z

api/v1alpha1/serviceintentions_types_test.go

+			destinationNamespace: "",
+			mirroring:            false,
+			prefix:               "",
+			sourceNamespace:      "bar",


the source namespace doesn't change between test cases, so I think we could probably remove that from params.

lkysow

@ashwin-venkatesh this looks good. I can't approve my own PRs :D

thisisnotashwin · 2020-10-30T21:12:34Z

@ashwin-venkatesh this looks good. I can't approve my own PRs :D

LOL..ill approve it for you ;)

- Use Defaulting to ensure the correct destination namespace is set on the spec.destination of the config entry. Additionally, explicity set the destination namespace on the service intention config entry. Utilize this namespace to ensure the config entry is managed in the expected Consul namespace.

- Do not fail if empty string value is provided for exposePath.Protocol. Consul defaults it to the correct value.

thisisnotashwin

🦊

lkysow commented Oct 15, 2020

View reviewed changes

thisisnotashwin reviewed Oct 15, 2020

View reviewed changes

thisisnotashwin force-pushed the ent-service-intentions branch from 67315e6 to 1e90da5 Compare October 28, 2020 22:07

thisisnotashwin marked this pull request as ready for review October 28, 2020 22:22

thisisnotashwin requested review from thisisnotashwin, a team and ishustava and removed request for a team October 28, 2020 22:22

thisisnotashwin added type/bug Something isn't working theme/crds labels Oct 28, 2020

thisisnotashwin mentioned this pull request Oct 29, 2020

CRDs: when I provide an expose section to proxy-defaults, it should use consul's default protocol rather than failing #367

Closed

ishustava approved these changes Oct 30, 2020

View reviewed changes

lkysow commented Oct 30, 2020

View reviewed changes

lkysow mentioned this pull request Oct 30, 2020

Test controller against consul:1.9.0-beta1 hashicorp/consul-helm#645

Closed

lkysow and others added 4 commits October 30, 2020 17:14

Support Consul namespaces for service-intentions

71fa7e6

Validate at least one source in specified for a service intention

72ee1c3

- Do not fail if empty string value is provided for exposePath.Protocol. Consul defaults it to the correct value.

Remove redundant source namespace field

9ce9fab

thisisnotashwin force-pushed the ent-service-intentions branch from 31e50e4 to 9ce9fab Compare October 30, 2020 21:15

thisisnotashwin approved these changes Oct 30, 2020

View reviewed changes

thisisnotashwin merged commit 739ea4a into master Oct 30, 2020

thisisnotashwin deleted the ent-service-intentions branch October 30, 2020 21:26

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support Consul namespaces for service-intentions #362

Support Consul namespaces for service-intentions #362

lkysow commented Oct 15, 2020 •

edited by thisisnotashwin

Loading

lkysow Oct 15, 2020

thisisnotashwin Oct 15, 2020

lkysow Oct 15, 2020

lkysow Oct 15, 2020

lkysow Oct 15, 2020 •

edited

Loading

thisisnotashwin Oct 15, 2020

thisisnotashwin left a comment

thisisnotashwin Oct 15, 2020

thisisnotashwin Oct 15, 2020

ishustava left a comment

ishustava Oct 29, 2020

lkysow left a comment

thisisnotashwin commented Oct 30, 2020

thisisnotashwin left a comment

Support Consul namespaces for service-intentions #362

Support Consul namespaces for service-intentions #362

Conversation

lkysow commented Oct 15, 2020 • edited by thisisnotashwin Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lkysow Oct 15, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

thisisnotashwin left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ishustava left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lkysow left a comment

Choose a reason for hiding this comment

thisisnotashwin commented Oct 30, 2020

thisisnotashwin left a comment

Choose a reason for hiding this comment

lkysow commented Oct 15, 2020 •

edited by thisisnotashwin

Loading

lkysow Oct 15, 2020 •

edited

Loading