Add Istio upstream tests

.github/workflows/composite-actions/kubernetes-e2e-tests/action.yaml

@@ -26,6 +26,7 @@ runs:
     env:
       GO_TEST_USER_ARGS: ${{ inputs.test-args }} -run "${{ inputs.run-regex }}"
       CLUSTER_NAME: ${{ inputs.cluster-name }}
+      CLUSTER_ID: ${{ inputs.cluster-id }}
       TEST_PKG: ./test/kubernetes/e2e/tests
     shell: bash
     run: make go-test

.github/workflows/pr-kubernetes-tests.yaml

@@ -117,9 +117,10 @@ jobs:
         cluster-name: kind
         test-args: ${{ matrix.test.go-test-args }}
         run-regex: ${{ matrix.test.go-test-run-regex }}
+        cluster-id: ${{ matrix.test.cluster-id }}
     - name: Archive bug report directory on failure
       if: ${{ failure() }}
       uses: actions/upload-artifact@v4
       with:
         name: bug-report
-        path: ./_test/bug_report
+        path: ./_test/bug_report/${{ matrix.test.cluster-id }}

Makefile

@@ -81,6 +81,11 @@ TEST_ASSET_DIR ?= $(ROOTDIR)/_test
 BUG_REPORT_DIR := $(TEST_ASSET_DIR)/bug_report
 $(BUG_REPORT_DIR):
 	mkdir -p $(BUG_REPORT_DIR)
+	# Create bug report directory for each cluster in ci (cluster_one, cluster_two, etc.)
+	mkdir -p $(BUG_REPORT_DIR)/cluster_one
+	mkdir -p $(BUG_REPORT_DIR)/cluster_two
+	mkdir -p $(BUG_REPORT_DIR)/cluster_three
+	mkdir -p $(BUG_REPORT_DIR)/cluster_four
 
 # Used to install ca-certificates in GLOO_DISTROLESS_BASE_IMAGE
 PACKAGE_DONOR_IMAGE ?= debian:11

changelog/v1.17.0-beta28/add-istio-upstream-tests.yaml

@@ -0,0 +1,7 @@
+changelog:
+  - type: NON_USER_FACING
+    issueLink: https://github.com/solo-io/solo-projects/issues/6048
+    resolvesIssue: false
+    description: >-
+      Add Upstream resource e2e tests for Istio integration with disabled peer auth. Adds upgrade/downgrade tests 
+      for Upstream sslConfig switching to Istio auto mtls.

go.mod

@@ -54,8 +54,8 @@ require (
 	github.com/solo-io/protoc-gen-openapi v0.2.2
 	github.com/solo-io/skv2 v0.36.5
 
-	// Pinned to the latest `gloo-repo-branch` tag of solo-apis (`sa-k8s-1.28-bump`)
-	github.com/solo-io/solo-apis v0.0.0-20231206142556-d2e3ed6d4476
+	// Pinned to the latest `gloo-repo-branch` tag of solo-apis (`gloo-v1.17.0-beta25`)
+	github.com/solo-io/solo-apis v0.0.0-20240503163415-57628abb2459
 	github.com/solo-io/solo-kit v0.34.2
 	github.com/spf13/afero v1.9.2
 	github.com/spf13/cobra v1.8.0

go.sum

@@ -1983,8 +1983,8 @@ github.com/solo-io/protoc-gen-openapi v0.2.2 h1:OzyOAxiZuMAaLYWMNoTl2v9E7IXcl7UE
 github.com/solo-io/protoc-gen-openapi v0.2.2/go.mod h1:osEjRl1miHqlq4Wl/8SEqHFoyydptPL1EzEdM9c4vfE=
 github.com/solo-io/skv2 v0.36.5 h1:DV2mbY8vSQFXpmKN0KsKAagWHQWUP1sRjM42YGCAos4=
 github.com/solo-io/skv2 v0.36.5/go.mod h1:0GKILLOrQiTKvGsf7UEFZJiDxJHrp0yKJQ6NbHzn+vY=
-github.com/solo-io/solo-apis v0.0.0-20231206142556-d2e3ed6d4476 h1:qtImo1deMtbVHKKkepwKfu1CDJBjGPvTmADtXVWBynE=
-github.com/solo-io/solo-apis v0.0.0-20231206142556-d2e3ed6d4476/go.mod h1:/2NUdNZ37KAhD1AfwFGR54rOK7ldDvmro17c0YRriKk=
+github.com/solo-io/solo-apis v0.0.0-20240503163415-57628abb2459 h1:fL/ZdBcFcxnQq5LZPP8h6eAMyrBai26JJqiCZ3j6HGo=
+github.com/solo-io/solo-apis v0.0.0-20240503163415-57628abb2459/go.mod h1:QXQQr/+kzCA+/GR/jzPuUqQY+aaTU+9Xht3xWm6eAfk=
 github.com/solo-io/solo-kit v0.34.2 h1:qcQGvhGEBDY5zvDMcP7z4BjAi+v66BtNLm984hZQK/s=
 github.com/solo-io/solo-kit v0.34.2/go.mod h1:HkrxDRo+uR0FZUJi+SGAUkbrUNWC6V0FD7GGXbtC0UU=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=

test/gomega/matchers/pod.go

@@ -9,9 +9,12 @@ import (
 
 // ExpectedPod is a struct that represents the expected pod.
 type ExpectedPod struct {
-	// ContainerName is the name of the container. Required.
+	// ContainerName is the name of the container. Optional.
 	ContainerName string
 
+	// Status is the pod phase status (e.g. Running, Pending, Succeeded, Failed). Optional.
+	Status corev1.PodPhase
+
 	// TODO(npolshak): Add more fields to match on as needed
 }
 
@@ -29,18 +32,51 @@ func (pm *podMatcher) Match(actual interface{}) (bool, error) {
 	if !ok {
 		return false, fmt.Errorf("expected a pod, got %T", actual)
 	}
-	for _, container := range pod.Spec.Containers {
-		if container.Name == pm.expectedPod.ContainerName {
-			return true, nil
+	if pm.expectedPod.ContainerName != "" {
+		foundContainer := false
+		for _, container := range pod.Spec.Containers {
+			if container.Name == pm.expectedPod.ContainerName {
+				foundContainer = true
+			}
+		}
+		if !foundContainer {
+			return false, nil
+		}
+	}
+
+	if pm.expectedPod.Status != "" {
+		if pod.Status.Phase != pm.expectedPod.Status {
+			return false, nil
 		}
 	}
-	return false, nil
+
+	return true, nil
 }
 
 func (pm *podMatcher) FailureMessage(actual interface{}) string {
-	return fmt.Sprintf("Expected pod to have container '%s', but it was not found", pm.expectedPod.ContainerName)
+	var errorMsg string
+	if pm.expectedPod.ContainerName != "" {
+		errorMsg += fmt.Sprintf("Expected pod to have container '%s', but it was not found", pm.expectedPod.ContainerName)
+	}
+	if pm.expectedPod.Status != "" {
+		errorMsg += fmt.Sprintf("Expected pod to have status '%s', but it was not found", pm.expectedPod.Status)
+	}
+	return errorMsg
 }
 
 func (pm *podMatcher) NegatedFailureMessage(actual interface{}) string {
-	return fmt.Sprintf("Expected pod not to have container '%s', but it was found", pm.expectedPod.ContainerName)
+	pod := actual.(corev1.Pod)
+
+	var errorMsg string
+	if pm.expectedPod.ContainerName != "" {
+		containers := ""
+		for _, container := range pod.Spec.Containers {
+			containers += container.Name + ", "
+		}
+		errorMsg += fmt.Sprintf("Expected pod to have container '%s', but it found %s", pm.expectedPod.ContainerName, containers)
+	}
+	if pm.expectedPod.Status != "" {
+		errorMsg += fmt.Sprintf("Expected pod to have status '%s', but it found %s", pm.expectedPod.Status, pod.Status.Phase)
+	}
+	return errorMsg
 }

test/kubernetes/e2e/features/istio/generate/generate.go

@@ -23,12 +23,36 @@ func main() {
 	log.Println("starting generate for istio examples")
 
 	// use the Gloo Edge Gateway api resources with automtls enabled
-	edgeGatewayApiResources := istio.GetGlooGatewayEdgeResources(exampleNs)
-	automtlsGeneratedExample := filepath.Join(util.MustGetThisDir(), "generated_example", fmt.Sprintf("automtls-enabled-%s", istio.EdgeApisRoutingResourcesFileName))
+	edgeGatewayApiResources := istio.GetGlooGatewayEdgeResources(exampleNs, istio.UpstreamConfigOpts{})
+	automtlsGeneratedExample := filepath.Join(util.MustGetThisDir(), "generated_example", fmt.Sprintf("automtls-enabled-%s", istio.EdgeApisRoutingFileName))
 	err := resources.WriteResourcesToFile(edgeGatewayApiResources, automtlsGeneratedExample)
 	if err != nil {
 		panic(err)
 	}
 
+	// automtls disabled
+	edgeGatewayApiResources = istio.GetGlooGatewayEdgeResources(exampleNs, istio.UpstreamConfigOpts{DisableIstioAutoMtls: true})
+	disableAutomtlsGeneratedExample := filepath.Join(util.MustGetThisDir(), "generated_example", fmt.Sprintf("automtls-disabled-%s", istio.EdgeApisRoutingFileName))
+	err = resources.WriteResourcesToFile(edgeGatewayApiResources, disableAutomtlsGeneratedExample)
+	if err != nil {
+		panic(err)
+	}
+
+	// Upstream sslConfig is set
+	edgeGatewayApiResources = istio.GetGlooGatewayEdgeResources(exampleNs, istio.UpstreamConfigOpts{SetSslConfig: true})
+	upstreamSslConfigGeneratedExample := filepath.Join(util.MustGetThisDir(), "generated_example", fmt.Sprintf("sslconfig-%s", istio.EdgeApisRoutingFileName))
+	err = resources.WriteResourcesToFile(edgeGatewayApiResources, upstreamSslConfigGeneratedExample)
+	if err != nil {
+		panic(err)
+	}
+
+	// Upstream sslConfig is set and automtls is disabled
+	edgeGatewayApiResources = istio.GetGlooGatewayEdgeResources(exampleNs, istio.UpstreamConfigOpts{SetSslConfig: true, DisableIstioAutoMtls: true})
+	sslConfigAndDisableAutomtlsGeneratedExample := filepath.Join(util.MustGetThisDir(), "generated_example", fmt.Sprintf("sslconfig-and-automtls-disabled-%s", istio.EdgeApisRoutingFileName))
+	err = resources.WriteResourcesToFile(edgeGatewayApiResources, sslConfigAndDisableAutomtlsGeneratedExample)
+	if err != nil {
+		panic(err)
+	}
+
 	log.Println("finished generate for istio examples")
 }

test/kubernetes/e2e/features/istio/generate/generated_example/automtls-disabled-edge-apis-routing.gen.yaml

@@ -0,0 +1,34 @@
+apiVersion: gateway.solo.io/v1
+kind: VirtualService
+metadata:
+  name: httpbin-vs
+  namespace: gloo-system
+spec:
+  virtualHost:
+    domains:
+    - httpbin
+    routes:
+    - matchers:
+      - prefix: /
+      routeAction:
+        single:
+          upstream:
+            name: httpbin-upstream
+            namespace: gloo-system
+status: {}
+---
+apiVersion: gloo.solo.io/v1
+kind: Upstream
+metadata:
+  name: httpbin-upstream
+  namespace: gloo-system
+spec:
+  disableIstioAutoMtls: true
+  kube:
+    selector:
+      app: httpbin
+    serviceName: httpbin
+    serviceNamespace: httpbin
+    servicePort: 8000
+status: {}
+---

test/kubernetes/e2e/features/istio/generate/generated_example/automtls-enabled-edge-apis-routing.gen.yaml

@@ -23,6 +23,7 @@ metadata:
   name: httpbin-upstream
   namespace: gloo-system
 spec:
+  disableIstioAutoMtls: false
   kube:
     selector:
       app: httpbin

test/kubernetes/e2e/features/istio/generate/generated_example/sslconfig-and-automtls-disabled-edge-apis-routing.gen.yaml

@@ -0,0 +1,42 @@
+apiVersion: gateway.solo.io/v1
+kind: VirtualService
+metadata:
+  name: httpbin-vs
+  namespace: gloo-system
+spec:
+  virtualHost:
+    domains:
+    - httpbin
+    routes:
+    - matchers:
+      - prefix: /
+      routeAction:
+        single:
+          upstream:
+            name: httpbin-upstream
+            namespace: gloo-system
+status: {}
+---
+apiVersion: gloo.solo.io/v1
+kind: Upstream
+metadata:
+  name: httpbin-upstream
+  namespace: gloo-system
+spec:
+  disableIstioAutoMtls: true
+  kube:
+    selector:
+      app: httpbin
+    serviceName: httpbin
+    serviceNamespace: httpbin
+    servicePort: 8000
+  sslConfig:
+    alpnProtocols:
+    - istio
+    sds:
+      certificatesSecretName: istio_server_cert
+      clusterName: gateway_proxy_sds
+      targetUri: 127.0.0.1:8234
+      validationContextName: istio_validation_context
+status: {}
+---

test/kubernetes/e2e/features/istio/generate/generated_example/sslconfig-edge-apis-routing.gen.yaml

@@ -0,0 +1,42 @@
+apiVersion: gateway.solo.io/v1
+kind: VirtualService
+metadata:
+  name: httpbin-vs
+  namespace: gloo-system
+spec:
+  virtualHost:
+    domains:
+    - httpbin
+    routes:
+    - matchers:
+      - prefix: /
+      routeAction:
+        single:
+          upstream:
+            name: httpbin-upstream
+            namespace: gloo-system
+status: {}
+---
+apiVersion: gloo.solo.io/v1
+kind: Upstream
+metadata:
+  name: httpbin-upstream
+  namespace: gloo-system
+spec:
+  disableIstioAutoMtls: false
+  kube:
+    selector:
+      app: httpbin
+    serviceName: httpbin
+    serviceNamespace: httpbin
+    servicePort: 8000
+  sslConfig:
+    alpnProtocols:
+    - istio
+    sds:
+      certificatesSecretName: istio_server_cert
+      clusterName: gateway_proxy_sds
+      targetUri: 127.0.0.1:8234
+      validationContextName: istio_validation_context
+status: {}
+---