2014-01-06 21:21:48 +00:00
|
|
|
package agent
|
|
|
|
|
|
|
|
import (
|
2016-12-13 06:09:35 +00:00
|
|
|
"bytes"
|
2018-04-30 21:23:49 +00:00
|
|
|
"crypto/tls"
|
2018-03-21 17:55:39 +00:00
|
|
|
"crypto/x509"
|
2014-01-06 21:21:48 +00:00
|
|
|
"fmt"
|
2016-11-16 21:45:26 +00:00
|
|
|
"io"
|
2016-11-28 21:08:31 +00:00
|
|
|
"io/ioutil"
|
2014-01-06 21:21:48 +00:00
|
|
|
"net/http"
|
2015-01-15 09:17:35 +00:00
|
|
|
"net/http/httptest"
|
2014-01-06 21:21:48 +00:00
|
|
|
"os"
|
2015-07-30 19:02:37 +00:00
|
|
|
"reflect"
|
2016-03-03 01:08:06 +00:00
|
|
|
"strings"
|
2014-01-06 21:21:48 +00:00
|
|
|
"testing"
|
|
|
|
"time"
|
2015-05-11 23:48:10 +00:00
|
|
|
|
2017-08-23 14:52:48 +00:00
|
|
|
"github.com/hashicorp/consul/acl"
|
2017-10-25 09:18:07 +00:00
|
|
|
"github.com/hashicorp/consul/agent/checks"
|
2017-09-25 18:40:42 +00:00
|
|
|
"github.com/hashicorp/consul/agent/config"
|
2018-03-21 17:20:35 +00:00
|
|
|
"github.com/hashicorp/consul/agent/connect"
|
2017-07-06 10:34:00 +00:00
|
|
|
"github.com/hashicorp/consul/agent/structs"
|
2017-04-19 23:00:11 +00:00
|
|
|
"github.com/hashicorp/consul/api"
|
2018-06-14 12:52:48 +00:00
|
|
|
"github.com/hashicorp/consul/lib"
|
2016-11-16 21:45:26 +00:00
|
|
|
"github.com/hashicorp/consul/logger"
|
2017-04-29 16:34:02 +00:00
|
|
|
"github.com/hashicorp/consul/testutil/retry"
|
2016-06-07 20:24:51 +00:00
|
|
|
"github.com/hashicorp/consul/types"
|
2015-05-11 23:48:10 +00:00
|
|
|
"github.com/hashicorp/serf/serf"
|
2018-04-18 20:05:30 +00:00
|
|
|
"github.com/mitchellh/copystructure"
|
2017-10-10 23:40:59 +00:00
|
|
|
"github.com/pascaldekloe/goe/verify"
|
2018-03-08 18:54:05 +00:00
|
|
|
"github.com/stretchr/testify/assert"
|
2018-04-17 12:29:02 +00:00
|
|
|
"github.com/stretchr/testify/require"
|
2014-01-06 21:21:48 +00:00
|
|
|
)
|
|
|
|
|
2016-12-14 17:33:57 +00:00
|
|
|
func makeReadOnlyAgentACL(t *testing.T, srv *HTTPServer) string {
|
2017-05-09 16:58:12 +00:00
|
|
|
args := map[string]interface{}{
|
2016-12-14 17:33:57 +00:00
|
|
|
"Name": "User Token",
|
|
|
|
"Type": "client",
|
2017-05-09 16:58:12 +00:00
|
|
|
"Rules": `agent "" { policy = "read" }`,
|
2016-12-14 17:33:57 +00:00
|
|
|
}
|
2017-05-09 16:58:12 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/acl/create?token=root", jsonReader(args))
|
2016-12-14 17:33:57 +00:00
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
obj, err := srv.ACLCreate(resp, req)
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
aclResp := obj.(aclCreateResponse)
|
|
|
|
return aclResp.ID
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestAgent_Services(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a := NewTestAgent(t.Name(), "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2014-01-21 01:06:44 +00:00
|
|
|
|
|
|
|
srv1 := &structs.NodeService{
|
|
|
|
ID: "mysql",
|
|
|
|
Service: "mysql",
|
2014-04-03 19:12:23 +00:00
|
|
|
Tags: []string{"master"},
|
2018-05-12 10:27:44 +00:00
|
|
|
Meta: map[string]string{
|
|
|
|
"foo": "bar",
|
|
|
|
},
|
|
|
|
Port: 5000,
|
2014-01-21 01:06:44 +00:00
|
|
|
}
|
2018-04-20 13:24:24 +00:00
|
|
|
require.NoError(t, a.State.AddService(srv1, ""))
|
|
|
|
|
|
|
|
// Add a managed proxy for that service
|
|
|
|
prxy1 := &structs.ConnectManagedProxy{
|
|
|
|
ExecMode: structs.ProxyExecModeScript,
|
2018-04-27 05:16:21 +00:00
|
|
|
Command: []string{"proxy.sh"},
|
2018-04-20 13:24:24 +00:00
|
|
|
Config: map[string]interface{}{
|
|
|
|
"bind_port": 1234,
|
|
|
|
"foo": "bar",
|
|
|
|
},
|
|
|
|
TargetServiceID: "mysql",
|
|
|
|
}
|
2018-05-14 20:55:24 +00:00
|
|
|
_, err := a.State.AddProxy(prxy1, "", "")
|
2018-04-20 13:24:24 +00:00
|
|
|
require.NoError(t, err)
|
2014-01-21 01:06:44 +00:00
|
|
|
|
2017-05-09 11:38:05 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/services", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
obj, err := a.srv.AgentServices(nil, req)
|
2014-01-21 01:06:44 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("Err: %v", err)
|
|
|
|
}
|
2018-04-20 13:24:24 +00:00
|
|
|
val := obj.(map[string]*api.AgentService)
|
|
|
|
assert.Lenf(t, val, 1, "bad services: %v", obj)
|
|
|
|
assert.Equal(t, 5000, val["mysql"].Port)
|
2018-05-12 10:27:44 +00:00
|
|
|
assert.Equal(t, srv1.Meta, val["mysql"].Meta)
|
2018-04-20 13:24:24 +00:00
|
|
|
assert.NotNil(t, val["mysql"].Connect)
|
|
|
|
assert.NotNil(t, val["mysql"].Connect.Proxy)
|
|
|
|
assert.Equal(t, prxy1.ExecMode.String(), string(val["mysql"].Connect.Proxy.ExecMode))
|
|
|
|
assert.Equal(t, prxy1.Command, val["mysql"].Connect.Proxy.Command)
|
|
|
|
assert.Equal(t, prxy1.Config, val["mysql"].Connect.Proxy.Config)
|
2014-01-21 01:06:44 +00:00
|
|
|
}
|
|
|
|
|
2018-03-12 20:05:06 +00:00
|
|
|
// This tests that the agent services endpoint (/v1/agent/services) returns
|
|
|
|
// Connect proxies.
|
2018-04-20 13:24:24 +00:00
|
|
|
func TestAgent_Services_ExternalConnectProxy(t *testing.T) {
|
2018-03-08 18:54:05 +00:00
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
assert := assert.New(t)
|
|
|
|
a := NewTestAgent(t.Name(), "")
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
srv1 := &structs.NodeService{
|
|
|
|
Kind: structs.ServiceKindConnectProxy,
|
2018-03-11 16:31:31 +00:00
|
|
|
ID: "db-proxy",
|
|
|
|
Service: "db-proxy",
|
2018-03-08 18:54:05 +00:00
|
|
|
Port: 5000,
|
|
|
|
ProxyDestination: "db",
|
2014-01-21 01:06:44 +00:00
|
|
|
}
|
2018-03-08 18:54:05 +00:00
|
|
|
a.State.AddService(srv1, "")
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/services", nil)
|
|
|
|
obj, err := a.srv.AgentServices(nil, req)
|
|
|
|
assert.Nil(err)
|
2018-04-20 13:24:24 +00:00
|
|
|
val := obj.(map[string]*api.AgentService)
|
2018-03-08 18:54:05 +00:00
|
|
|
assert.Len(val, 1)
|
2018-03-11 16:31:31 +00:00
|
|
|
actual := val["db-proxy"]
|
2018-04-20 13:24:24 +00:00
|
|
|
assert.Equal(api.ServiceKindConnectProxy, actual.Kind)
|
2018-03-08 18:54:05 +00:00
|
|
|
assert.Equal("db", actual.ProxyDestination)
|
2014-01-21 01:06:44 +00:00
|
|
|
}
|
|
|
|
|
2016-12-14 22:16:46 +00:00
|
|
|
func TestAgent_Services_ACLFilter(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-05-21 07:11:09 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig())
|
|
|
|
defer a.Shutdown()
|
2016-12-14 22:16:46 +00:00
|
|
|
|
2017-07-14 05:33:47 +00:00
|
|
|
srv1 := &structs.NodeService{
|
|
|
|
ID: "mysql",
|
|
|
|
Service: "mysql",
|
|
|
|
Tags: []string{"master"},
|
|
|
|
Port: 5000,
|
|
|
|
}
|
2017-08-28 12:17:13 +00:00
|
|
|
a.State.AddService(srv1, "")
|
2017-07-14 05:33:47 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("no token", func(t *testing.T) {
|
2017-05-09 11:38:05 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/services", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
obj, err := a.srv.AgentServices(nil, req)
|
2016-12-14 22:16:46 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("Err: %v", err)
|
|
|
|
}
|
2018-04-20 13:24:24 +00:00
|
|
|
val := obj.(map[string]*api.AgentService)
|
2016-12-14 22:16:46 +00:00
|
|
|
if len(val) != 0 {
|
|
|
|
t.Fatalf("bad: %v", obj)
|
|
|
|
}
|
2017-05-09 17:46:11 +00:00
|
|
|
})
|
2016-12-14 22:16:46 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("root token", func(t *testing.T) {
|
2017-05-09 11:38:05 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/services?token=root", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
obj, err := a.srv.AgentServices(nil, req)
|
2016-12-14 22:16:46 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("Err: %v", err)
|
|
|
|
}
|
2018-04-20 13:24:24 +00:00
|
|
|
val := obj.(map[string]*api.AgentService)
|
2016-12-14 22:16:46 +00:00
|
|
|
if len(val) != 1 {
|
|
|
|
t.Fatalf("bad: %v", obj)
|
|
|
|
}
|
2017-05-09 17:46:11 +00:00
|
|
|
})
|
2016-12-14 22:16:46 +00:00
|
|
|
}
|
|
|
|
|
2016-12-14 17:33:57 +00:00
|
|
|
func TestAgent_Checks(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a := NewTestAgent(t.Name(), "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2014-01-21 01:06:44 +00:00
|
|
|
|
|
|
|
chk1 := &structs.HealthCheck{
|
2017-05-21 07:11:09 +00:00
|
|
|
Node: a.Config.NodeName,
|
2014-01-21 01:06:44 +00:00
|
|
|
CheckID: "mysql",
|
|
|
|
Name: "mysql",
|
2017-04-19 23:00:11 +00:00
|
|
|
Status: api.HealthPassing,
|
2014-01-21 01:06:44 +00:00
|
|
|
}
|
2017-08-28 12:17:13 +00:00
|
|
|
a.State.AddCheck(chk1, "")
|
2014-01-21 01:06:44 +00:00
|
|
|
|
2017-05-09 11:38:05 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/checks", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
obj, err := a.srv.AgentChecks(nil, req)
|
2014-01-21 01:06:44 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("Err: %v", err)
|
|
|
|
}
|
2016-06-07 20:24:51 +00:00
|
|
|
val := obj.(map[types.CheckID]*structs.HealthCheck)
|
2014-01-21 01:06:44 +00:00
|
|
|
if len(val) != 1 {
|
|
|
|
t.Fatalf("bad checks: %v", obj)
|
|
|
|
}
|
2017-04-19 23:00:11 +00:00
|
|
|
if val["mysql"].Status != api.HealthPassing {
|
2014-01-21 01:06:44 +00:00
|
|
|
t.Fatalf("bad check: %v", obj)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-12-14 22:16:46 +00:00
|
|
|
func TestAgent_Checks_ACLFilter(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-05-21 07:11:09 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig())
|
|
|
|
defer a.Shutdown()
|
2016-12-14 22:16:46 +00:00
|
|
|
|
|
|
|
chk1 := &structs.HealthCheck{
|
2017-05-21 07:11:09 +00:00
|
|
|
Node: a.Config.NodeName,
|
2016-12-14 22:16:46 +00:00
|
|
|
CheckID: "mysql",
|
|
|
|
Name: "mysql",
|
2017-04-19 23:00:11 +00:00
|
|
|
Status: api.HealthPassing,
|
2016-12-14 22:16:46 +00:00
|
|
|
}
|
2017-08-28 12:17:13 +00:00
|
|
|
a.State.AddCheck(chk1, "")
|
2016-12-14 22:16:46 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("no token", func(t *testing.T) {
|
2017-05-09 11:38:05 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/checks", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
obj, err := a.srv.AgentChecks(nil, req)
|
2016-12-14 22:16:46 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("Err: %v", err)
|
|
|
|
}
|
|
|
|
val := obj.(map[types.CheckID]*structs.HealthCheck)
|
|
|
|
if len(val) != 0 {
|
|
|
|
t.Fatalf("bad checks: %v", obj)
|
|
|
|
}
|
2017-05-09 17:46:11 +00:00
|
|
|
})
|
2016-12-14 22:16:46 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("root token", func(t *testing.T) {
|
2017-05-09 11:38:05 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/checks?token=root", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
obj, err := a.srv.AgentChecks(nil, req)
|
2016-12-14 22:16:46 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("Err: %v", err)
|
|
|
|
}
|
|
|
|
val := obj.(map[types.CheckID]*structs.HealthCheck)
|
|
|
|
if len(val) != 1 {
|
|
|
|
t.Fatalf("bad checks: %v", obj)
|
|
|
|
}
|
2017-05-09 17:46:11 +00:00
|
|
|
})
|
2016-12-14 22:16:46 +00:00
|
|
|
}
|
|
|
|
|
2016-12-14 17:33:57 +00:00
|
|
|
func TestAgent_Self(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a := NewTestAgent(t.Name(), `
|
|
|
|
node_meta {
|
|
|
|
somekey = "somevalue"
|
|
|
|
}
|
|
|
|
`)
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2014-05-25 23:59:48 +00:00
|
|
|
|
2017-05-09 11:38:05 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/self", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
obj, err := a.srv.AgentSelf(nil, req)
|
2014-05-25 23:59:48 +00:00
|
|
|
if err != nil {
|
2015-07-30 19:02:37 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
2014-05-25 23:59:48 +00:00
|
|
|
}
|
|
|
|
|
2017-04-21 00:46:29 +00:00
|
|
|
val := obj.(Self)
|
2017-09-25 18:40:42 +00:00
|
|
|
if int(val.Member.Port) != a.Config.SerfPortLAN {
|
2014-05-27 22:09:28 +00:00
|
|
|
t.Fatalf("incorrect port: %v", obj)
|
|
|
|
}
|
|
|
|
|
2017-10-04 17:43:17 +00:00
|
|
|
if val.DebugConfig["SerfPortLAN"].(int) != a.Config.SerfPortLAN {
|
2014-05-25 23:59:48 +00:00
|
|
|
t.Fatalf("incorrect port: %v", obj)
|
|
|
|
}
|
2015-07-30 19:02:37 +00:00
|
|
|
|
2017-08-14 14:36:07 +00:00
|
|
|
cs, err := a.GetLANCoordinate()
|
2015-07-30 19:02:37 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
2017-09-25 18:40:42 +00:00
|
|
|
if c := cs[a.config.SegmentName]; !reflect.DeepEqual(c, val.Coord) {
|
2015-07-30 19:02:37 +00:00
|
|
|
t.Fatalf("coordinates are not equal: %v != %v", c, val.Coord)
|
|
|
|
}
|
2017-08-14 14:36:07 +00:00
|
|
|
delete(val.Meta, structs.MetaSegmentKey) // Added later, not in config.
|
2017-09-25 18:40:42 +00:00
|
|
|
if !reflect.DeepEqual(a.config.NodeMeta, val.Meta) {
|
|
|
|
t.Fatalf("meta fields are not equal: %v != %v", a.config.NodeMeta, val.Meta)
|
2016-12-13 06:09:35 +00:00
|
|
|
}
|
2014-05-25 23:59:48 +00:00
|
|
|
}
|
|
|
|
|
2016-12-14 17:33:57 +00:00
|
|
|
func TestAgent_Self_ACLDeny(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-05-21 07:11:09 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig())
|
|
|
|
defer a.Shutdown()
|
2016-12-14 17:33:57 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("no token", func(t *testing.T) {
|
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/self", nil)
|
2017-08-23 14:52:48 +00:00
|
|
|
if _, err := a.srv.AgentSelf(nil, req); !acl.IsErrPermissionDenied(err) {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2016-12-14 17:33:57 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("agent master token", func(t *testing.T) {
|
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/self?token=towel", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentSelf(nil, req); err != nil {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2016-12-14 17:33:57 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("read-only token", func(t *testing.T) {
|
2017-05-21 07:11:09 +00:00
|
|
|
ro := makeReadOnlyAgentACL(t, a.srv)
|
2017-05-09 17:46:11 +00:00
|
|
|
req, _ := http.NewRequest("GET", fmt.Sprintf("/v1/agent/self?token=%s", ro), nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentSelf(nil, req); err != nil {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2016-12-14 17:33:57 +00:00
|
|
|
}
|
|
|
|
|
2017-08-08 20:05:38 +00:00
|
|
|
func TestAgent_Metrics_ACLDeny(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig())
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
t.Run("no token", func(t *testing.T) {
|
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/metrics", nil)
|
2017-11-07 05:50:04 +00:00
|
|
|
if _, err := a.srv.AgentMetrics(nil, req); !acl.IsErrPermissionDenied(err) {
|
2017-08-08 20:05:38 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
|
|
|
|
|
|
|
t.Run("agent master token", func(t *testing.T) {
|
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/metrics?token=towel", nil)
|
2017-11-07 05:50:04 +00:00
|
|
|
if _, err := a.srv.AgentMetrics(nil, req); err != nil {
|
2017-08-08 20:05:38 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
|
|
|
|
|
|
|
t.Run("read-only token", func(t *testing.T) {
|
|
|
|
ro := makeReadOnlyAgentACL(t, a.srv)
|
|
|
|
req, _ := http.NewRequest("GET", fmt.Sprintf("/v1/agent/metrics?token=%s", ro), nil)
|
2017-11-07 05:50:04 +00:00
|
|
|
if _, err := a.srv.AgentMetrics(nil, req); err != nil {
|
2017-08-08 20:05:38 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
2016-12-14 17:33:57 +00:00
|
|
|
func TestAgent_Reload(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a := NewTestAgent(t.Name(), `
|
|
|
|
acl_enforce_version_8 = false
|
|
|
|
services = [
|
|
|
|
{
|
|
|
|
name = "redis"
|
|
|
|
}
|
|
|
|
]
|
|
|
|
watches = [
|
|
|
|
{
|
|
|
|
datacenter = "dc1"
|
|
|
|
type = "key"
|
|
|
|
key = "test"
|
|
|
|
handler = "true"
|
|
|
|
}
|
|
|
|
]
|
2018-04-08 10:57:01 +00:00
|
|
|
limits = {
|
|
|
|
rpc_rate=1
|
|
|
|
rpc_max_burst=100
|
|
|
|
}
|
2017-09-25 18:40:42 +00:00
|
|
|
`)
|
2017-06-03 19:22:47 +00:00
|
|
|
defer a.Shutdown()
|
2016-11-30 18:29:42 +00:00
|
|
|
|
2017-08-28 12:17:13 +00:00
|
|
|
if a.State.Service("redis") == nil {
|
|
|
|
t.Fatal("missing redis service")
|
2016-11-30 18:29:42 +00:00
|
|
|
}
|
|
|
|
|
2017-09-25 18:40:42 +00:00
|
|
|
cfg2 := TestConfig(config.Source{
|
|
|
|
Name: "reload",
|
|
|
|
Format: "hcl",
|
|
|
|
Data: `
|
|
|
|
data_dir = "` + a.Config.DataDir + `"
|
|
|
|
node_id = "` + string(a.Config.NodeID) + `"
|
|
|
|
node_name = "` + a.Config.NodeName + `"
|
|
|
|
|
|
|
|
acl_enforce_version_8 = false
|
|
|
|
services = [
|
|
|
|
{
|
|
|
|
name = "redis-reloaded"
|
|
|
|
}
|
|
|
|
]
|
2018-04-08 10:57:01 +00:00
|
|
|
limits = {
|
|
|
|
rpc_rate=2
|
|
|
|
rpc_max_burst=200
|
|
|
|
}
|
2017-09-25 18:40:42 +00:00
|
|
|
`,
|
|
|
|
})
|
2016-11-30 18:29:42 +00:00
|
|
|
|
2017-06-24 19:52:41 +00:00
|
|
|
if err := a.ReloadConfig(cfg2); err != nil {
|
2017-06-03 19:22:47 +00:00
|
|
|
t.Fatalf("got error %v want nil", err)
|
2016-11-30 18:29:42 +00:00
|
|
|
}
|
2017-08-28 12:17:13 +00:00
|
|
|
if a.State.Service("redis-reloaded") == nil {
|
|
|
|
t.Fatal("missing redis-reloaded service")
|
2016-11-30 18:29:42 +00:00
|
|
|
}
|
2017-06-24 19:52:41 +00:00
|
|
|
|
2018-04-08 10:57:01 +00:00
|
|
|
if a.config.RPCRateLimit != 2 {
|
|
|
|
t.Fatalf("RPC rate not set correctly. Got %v. Want 2", a.config.RPCRateLimit)
|
|
|
|
}
|
|
|
|
|
|
|
|
if a.config.RPCMaxBurst != 200 {
|
|
|
|
t.Fatalf("RPC max burst not set correctly. Got %v. Want 200", a.config.RPCMaxBurst)
|
|
|
|
}
|
|
|
|
|
2017-09-25 18:40:42 +00:00
|
|
|
for _, wp := range a.watchPlans {
|
2017-06-24 19:52:41 +00:00
|
|
|
if !wp.IsStopped() {
|
|
|
|
t.Fatalf("Reloading configs should stop watch plans of the previous configuration")
|
|
|
|
}
|
|
|
|
}
|
2016-11-30 18:29:42 +00:00
|
|
|
}
|
|
|
|
|
2016-12-14 17:33:57 +00:00
|
|
|
func TestAgent_Reload_ACLDeny(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-05-21 07:11:09 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig())
|
|
|
|
defer a.Shutdown()
|
2016-12-14 17:33:57 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("no token", func(t *testing.T) {
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/reload", nil)
|
2017-08-23 14:52:48 +00:00
|
|
|
if _, err := a.srv.AgentReload(nil, req); !acl.IsErrPermissionDenied(err) {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2016-12-14 17:33:57 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("read-only token", func(t *testing.T) {
|
2017-05-21 07:11:09 +00:00
|
|
|
ro := makeReadOnlyAgentACL(t, a.srv)
|
2017-05-09 17:46:11 +00:00
|
|
|
req, _ := http.NewRequest("PUT", fmt.Sprintf("/v1/agent/reload?token=%s", ro), nil)
|
2017-08-23 14:52:48 +00:00
|
|
|
if _, err := a.srv.AgentReload(nil, req); !acl.IsErrPermissionDenied(err) {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2016-12-14 17:33:57 +00:00
|
|
|
|
|
|
|
// This proves we call the ACL function, and we've got the other reload
|
|
|
|
// test to prove we do the reload, which should be sufficient.
|
|
|
|
// The reload logic is a little complex to set up so isn't worth
|
|
|
|
// repeating again here.
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestAgent_Members(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a := NewTestAgent(t.Name(), "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2014-01-06 21:21:48 +00:00
|
|
|
|
2017-05-09 11:38:05 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/members", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
obj, err := a.srv.AgentMembers(nil, req)
|
2014-01-06 21:21:48 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("Err: %v", err)
|
|
|
|
}
|
|
|
|
val := obj.([]serf.Member)
|
|
|
|
if len(val) == 0 {
|
|
|
|
t.Fatalf("bad members: %v", obj)
|
|
|
|
}
|
|
|
|
|
2017-09-25 18:40:42 +00:00
|
|
|
if int(val[0].Port) != a.Config.SerfPortLAN {
|
2014-01-06 21:21:48 +00:00
|
|
|
t.Fatalf("not lan: %v", obj)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-12-14 17:33:57 +00:00
|
|
|
func TestAgent_Members_WAN(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a := NewTestAgent(t.Name(), "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2014-01-06 21:21:48 +00:00
|
|
|
|
2017-05-09 11:38:05 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/members?wan=true", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
obj, err := a.srv.AgentMembers(nil, req)
|
2014-01-06 21:21:48 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("Err: %v", err)
|
|
|
|
}
|
|
|
|
val := obj.([]serf.Member)
|
|
|
|
if len(val) == 0 {
|
|
|
|
t.Fatalf("bad members: %v", obj)
|
|
|
|
}
|
|
|
|
|
2017-09-25 18:40:42 +00:00
|
|
|
if int(val[0].Port) != a.Config.SerfPortWAN {
|
2014-01-06 21:21:48 +00:00
|
|
|
t.Fatalf("not wan: %v", obj)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-12-14 22:16:46 +00:00
|
|
|
func TestAgent_Members_ACLFilter(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-05-21 07:11:09 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig())
|
|
|
|
defer a.Shutdown()
|
2016-12-14 22:16:46 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("no token", func(t *testing.T) {
|
2017-05-09 11:38:05 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/members", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
obj, err := a.srv.AgentMembers(nil, req)
|
2016-12-14 22:16:46 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("Err: %v", err)
|
|
|
|
}
|
|
|
|
val := obj.([]serf.Member)
|
|
|
|
if len(val) != 0 {
|
|
|
|
t.Fatalf("bad members: %v", obj)
|
|
|
|
}
|
2017-05-09 17:46:11 +00:00
|
|
|
})
|
2016-12-14 22:16:46 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("root token", func(t *testing.T) {
|
2017-05-09 11:38:05 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/members?token=root", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
obj, err := a.srv.AgentMembers(nil, req)
|
2016-12-14 22:16:46 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("Err: %v", err)
|
|
|
|
}
|
|
|
|
val := obj.([]serf.Member)
|
|
|
|
if len(val) != 1 {
|
|
|
|
t.Fatalf("bad members: %v", obj)
|
|
|
|
}
|
2017-05-09 17:46:11 +00:00
|
|
|
})
|
2016-12-14 22:16:46 +00:00
|
|
|
}
|
|
|
|
|
2016-12-14 17:33:57 +00:00
|
|
|
func TestAgent_Join(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a1 := NewTestAgent(t.Name(), "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a1.Shutdown()
|
2017-09-25 18:40:42 +00:00
|
|
|
a2 := NewTestAgent(t.Name(), "")
|
2014-01-06 21:21:48 +00:00
|
|
|
defer a2.Shutdown()
|
|
|
|
|
2017-09-25 18:40:42 +00:00
|
|
|
addr := fmt.Sprintf("127.0.0.1:%d", a2.Config.SerfPortLAN)
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", fmt.Sprintf("/v1/agent/join/%s", addr), nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
obj, err := a1.srv.AgentJoin(nil, req)
|
2014-01-06 21:21:48 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("Err: %v", err)
|
|
|
|
}
|
|
|
|
if obj != nil {
|
|
|
|
t.Fatalf("Err: %v", obj)
|
|
|
|
}
|
|
|
|
|
2017-05-21 07:11:09 +00:00
|
|
|
if len(a1.LANMembers()) != 2 {
|
2014-01-06 21:21:48 +00:00
|
|
|
t.Fatalf("should have 2 members")
|
|
|
|
}
|
2016-10-25 20:46:54 +00:00
|
|
|
|
2017-05-04 22:52:53 +00:00
|
|
|
retry.Run(t, func(r *retry.R) {
|
2017-04-29 16:34:02 +00:00
|
|
|
if got, want := len(a2.LANMembers()), 2; got != want {
|
|
|
|
r.Fatalf("got %d LAN members want %d", got, want)
|
|
|
|
}
|
|
|
|
})
|
2014-01-06 21:21:48 +00:00
|
|
|
}
|
|
|
|
|
2016-12-14 17:33:57 +00:00
|
|
|
func TestAgent_Join_WAN(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a1 := NewTestAgent(t.Name(), "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a1.Shutdown()
|
2017-09-25 18:40:42 +00:00
|
|
|
a2 := NewTestAgent(t.Name(), "")
|
2014-01-06 21:21:48 +00:00
|
|
|
defer a2.Shutdown()
|
|
|
|
|
2017-09-25 18:40:42 +00:00
|
|
|
addr := fmt.Sprintf("127.0.0.1:%d", a2.Config.SerfPortWAN)
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", fmt.Sprintf("/v1/agent/join/%s?wan=true", addr), nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
obj, err := a1.srv.AgentJoin(nil, req)
|
2014-01-06 21:21:48 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("Err: %v", err)
|
|
|
|
}
|
|
|
|
if obj != nil {
|
|
|
|
t.Fatalf("Err: %v", obj)
|
|
|
|
}
|
|
|
|
|
2017-05-21 07:11:09 +00:00
|
|
|
if len(a1.WANMembers()) != 2 {
|
2016-10-25 20:46:54 +00:00
|
|
|
t.Fatalf("should have 2 members")
|
|
|
|
}
|
|
|
|
|
2017-05-04 22:52:53 +00:00
|
|
|
retry.Run(t, func(r *retry.R) {
|
2017-04-29 16:34:02 +00:00
|
|
|
if got, want := len(a2.WANMembers()), 2; got != want {
|
|
|
|
r.Fatalf("got %d WAN members want %d", got, want)
|
|
|
|
}
|
|
|
|
})
|
2014-01-06 21:21:48 +00:00
|
|
|
}
|
|
|
|
|
2016-12-14 17:33:57 +00:00
|
|
|
func TestAgent_Join_ACLDeny(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-05-21 07:11:09 +00:00
|
|
|
a1 := NewTestAgent(t.Name(), TestACLConfig())
|
|
|
|
defer a1.Shutdown()
|
2017-09-25 18:40:42 +00:00
|
|
|
a2 := NewTestAgent(t.Name(), "")
|
2016-12-14 17:33:57 +00:00
|
|
|
defer a2.Shutdown()
|
2017-05-21 07:11:09 +00:00
|
|
|
|
2017-09-25 18:40:42 +00:00
|
|
|
addr := fmt.Sprintf("127.0.0.1:%d", a2.Config.SerfPortLAN)
|
2016-12-14 17:33:57 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("no token", func(t *testing.T) {
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", fmt.Sprintf("/v1/agent/join/%s", addr), nil)
|
2017-08-23 14:52:48 +00:00
|
|
|
if _, err := a1.srv.AgentJoin(nil, req); !acl.IsErrPermissionDenied(err) {
|
2016-12-14 17:33:57 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
2017-05-09 17:46:11 +00:00
|
|
|
})
|
2016-12-14 17:33:57 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("agent master token", func(t *testing.T) {
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", fmt.Sprintf("/v1/agent/join/%s?token=towel", addr), nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
_, err := a1.srv.AgentJoin(nil, req)
|
2016-12-14 17:33:57 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
2017-05-09 17:46:11 +00:00
|
|
|
})
|
2016-12-14 17:33:57 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("read-only token", func(t *testing.T) {
|
2017-05-21 07:11:09 +00:00
|
|
|
ro := makeReadOnlyAgentACL(t, a1.srv)
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", fmt.Sprintf("/v1/agent/join/%s?token=%s", addr, ro), nil)
|
2017-08-23 14:52:48 +00:00
|
|
|
if _, err := a1.srv.AgentJoin(nil, req); !acl.IsErrPermissionDenied(err) {
|
2016-12-14 17:33:57 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
2017-05-09 17:46:11 +00:00
|
|
|
})
|
2016-12-14 17:33:57 +00:00
|
|
|
}
|
|
|
|
|
2017-06-21 04:43:55 +00:00
|
|
|
type mockNotifier struct{ s string }
|
|
|
|
|
|
|
|
func (n *mockNotifier) Notify(state string) error {
|
|
|
|
n.s = state
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestAgent_JoinLANNotify(t *testing.T) {
|
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a1 := NewTestAgent(t.Name(), "")
|
2017-06-21 04:43:55 +00:00
|
|
|
defer a1.Shutdown()
|
|
|
|
|
2017-09-25 18:40:42 +00:00
|
|
|
a2 := NewTestAgent(t.Name(), `
|
|
|
|
server = false
|
|
|
|
bootstrap = false
|
|
|
|
`)
|
2017-06-21 04:43:55 +00:00
|
|
|
defer a2.Shutdown()
|
|
|
|
|
|
|
|
notif := &mockNotifier{}
|
|
|
|
a1.joinLANNotifier = notif
|
|
|
|
|
2017-09-25 18:40:42 +00:00
|
|
|
addr := fmt.Sprintf("127.0.0.1:%d", a2.Config.SerfPortLAN)
|
2017-06-21 04:43:55 +00:00
|
|
|
_, err := a1.JoinLAN([]string{addr})
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
if got, want := notif.s, "READY=1"; got != want {
|
|
|
|
t.Fatalf("got joinLAN notification %q want %q", got, want)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-12-14 17:33:57 +00:00
|
|
|
func TestAgent_Leave(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a1 := NewTestAgent(t.Name(), "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a1.Shutdown()
|
2016-11-30 18:29:42 +00:00
|
|
|
|
2017-09-25 18:40:42 +00:00
|
|
|
a2 := NewTestAgent(t.Name(), `
|
|
|
|
server = false
|
|
|
|
bootstrap = false
|
|
|
|
`)
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a2.Shutdown()
|
2016-11-30 18:29:42 +00:00
|
|
|
|
|
|
|
// Join first
|
2017-09-25 18:40:42 +00:00
|
|
|
addr := fmt.Sprintf("127.0.0.1:%d", a2.Config.SerfPortLAN)
|
2017-05-21 07:11:09 +00:00
|
|
|
_, err := a1.JoinLAN([]string{addr})
|
2016-11-30 18:29:42 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Graceful leave now
|
2017-05-09 11:38:05 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/leave", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
obj, err := a2.srv.AgentLeave(nil, req)
|
2016-11-30 18:29:42 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("Err: %v", err)
|
|
|
|
}
|
|
|
|
if obj != nil {
|
|
|
|
t.Fatalf("Err: %v", obj)
|
|
|
|
}
|
2017-05-04 22:52:53 +00:00
|
|
|
retry.Run(t, func(r *retry.R) {
|
2017-05-21 07:11:09 +00:00
|
|
|
m := a1.LANMembers()
|
2017-04-29 16:34:02 +00:00
|
|
|
if got, want := m[1].Status, serf.StatusLeft; got != want {
|
|
|
|
r.Fatalf("got status %q want %q", got, want)
|
|
|
|
}
|
|
|
|
})
|
2016-11-30 18:29:42 +00:00
|
|
|
}
|
|
|
|
|
2016-12-14 17:33:57 +00:00
|
|
|
func TestAgent_Leave_ACLDeny(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-05-21 07:11:09 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig())
|
|
|
|
defer a.Shutdown()
|
2016-12-14 17:33:57 +00:00
|
|
|
|
2017-05-10 07:08:39 +00:00
|
|
|
t.Run("no token", func(t *testing.T) {
|
2017-05-09 11:38:05 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/leave", nil)
|
2017-08-23 14:52:48 +00:00
|
|
|
if _, err := a.srv.AgentLeave(nil, req); !acl.IsErrPermissionDenied(err) {
|
2016-12-14 17:33:57 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
2017-05-09 17:46:11 +00:00
|
|
|
})
|
2016-12-14 17:33:57 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("read-only token", func(t *testing.T) {
|
2017-05-21 07:11:09 +00:00
|
|
|
ro := makeReadOnlyAgentACL(t, a.srv)
|
2017-05-09 11:38:05 +00:00
|
|
|
req, _ := http.NewRequest("PUT", fmt.Sprintf("/v1/agent/leave?token=%s", ro), nil)
|
2017-08-23 14:52:48 +00:00
|
|
|
if _, err := a.srv.AgentLeave(nil, req); !acl.IsErrPermissionDenied(err) {
|
2016-12-14 17:33:57 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
2017-05-09 17:46:11 +00:00
|
|
|
})
|
2017-05-10 07:08:39 +00:00
|
|
|
|
|
|
|
// this sub-test will change the state so that there is no leader.
|
|
|
|
// it must therefore be the last one in this list.
|
|
|
|
t.Run("agent master token", func(t *testing.T) {
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/leave?token=towel", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentLeave(nil, req); err != nil {
|
2017-05-10 07:08:39 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2016-12-14 17:33:57 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestAgent_ForceLeave(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a1 := NewTestAgent(t.Name(), "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a1.Shutdown()
|
2017-09-25 18:40:42 +00:00
|
|
|
a2 := NewTestAgent(t.Name(), "")
|
2014-01-06 21:21:48 +00:00
|
|
|
|
|
|
|
// Join first
|
2017-09-25 18:40:42 +00:00
|
|
|
addr := fmt.Sprintf("127.0.0.1:%d", a2.Config.SerfPortLAN)
|
2017-05-21 07:11:09 +00:00
|
|
|
_, err := a1.JoinLAN([]string{addr})
|
2014-01-06 21:21:48 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
|
2017-09-25 18:40:42 +00:00
|
|
|
// this test probably needs work
|
2014-01-06 21:21:48 +00:00
|
|
|
a2.Shutdown()
|
|
|
|
|
|
|
|
// Force leave now
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", fmt.Sprintf("/v1/agent/force-leave/%s", a2.Config.NodeName), nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
obj, err := a1.srv.AgentForceLeave(nil, req)
|
2014-01-06 21:21:48 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("Err: %v", err)
|
|
|
|
}
|
|
|
|
if obj != nil {
|
|
|
|
t.Fatalf("Err: %v", obj)
|
|
|
|
}
|
2017-05-04 22:52:53 +00:00
|
|
|
retry.Run(t, func(r *retry.R) {
|
2017-05-21 07:11:09 +00:00
|
|
|
m := a1.LANMembers()
|
2017-04-29 16:34:02 +00:00
|
|
|
if got, want := m[1].Status, serf.StatusLeft; got != want {
|
|
|
|
r.Fatalf("got status %q want %q", got, want)
|
|
|
|
}
|
|
|
|
})
|
|
|
|
|
2014-01-06 21:21:48 +00:00
|
|
|
}
|
2014-01-30 23:51:15 +00:00
|
|
|
|
2016-12-14 17:33:57 +00:00
|
|
|
func TestAgent_ForceLeave_ACLDeny(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-05-21 07:11:09 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig())
|
|
|
|
defer a.Shutdown()
|
2016-12-14 17:33:57 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("no token", func(t *testing.T) {
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/force-leave/nope", nil)
|
2017-08-23 14:52:48 +00:00
|
|
|
if _, err := a.srv.AgentForceLeave(nil, req); !acl.IsErrPermissionDenied(err) {
|
2016-12-14 17:33:57 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
2017-05-09 17:46:11 +00:00
|
|
|
})
|
2016-12-14 17:33:57 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("agent master token", func(t *testing.T) {
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/force-leave/nope?token=towel", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentForceLeave(nil, req); err != nil {
|
2016-12-14 17:33:57 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
2017-05-09 17:46:11 +00:00
|
|
|
})
|
2016-12-14 17:33:57 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("read-only token", func(t *testing.T) {
|
2017-05-21 07:11:09 +00:00
|
|
|
ro := makeReadOnlyAgentACL(t, a.srv)
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", fmt.Sprintf("/v1/agent/force-leave/nope?token=%s", ro), nil)
|
2017-08-23 14:52:48 +00:00
|
|
|
if _, err := a.srv.AgentForceLeave(nil, req); !acl.IsErrPermissionDenied(err) {
|
2016-12-14 17:33:57 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
2017-05-09 17:46:11 +00:00
|
|
|
})
|
2016-12-14 17:33:57 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestAgent_RegisterCheck(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a := NewTestAgent(t.Name(), "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2014-01-30 23:51:15 +00:00
|
|
|
|
2017-06-15 16:46:06 +00:00
|
|
|
args := &structs.CheckDefinition{
|
2014-01-30 23:51:15 +00:00
|
|
|
Name: "test",
|
2017-05-15 19:49:13 +00:00
|
|
|
TTL: 15 * time.Second,
|
2014-01-30 23:51:15 +00:00
|
|
|
}
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/check/register?token=abc123", jsonReader(args))
|
2017-05-21 07:11:09 +00:00
|
|
|
obj, err := a.srv.AgentRegisterCheck(nil, req)
|
2014-01-30 23:51:15 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
if obj != nil {
|
|
|
|
t.Fatalf("bad: %v", obj)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Ensure we have a check mapping
|
2016-06-07 20:24:51 +00:00
|
|
|
checkID := types.CheckID("test")
|
2017-08-28 12:17:13 +00:00
|
|
|
if _, ok := a.State.Checks()[checkID]; !ok {
|
2014-01-30 23:51:15 +00:00
|
|
|
t.Fatalf("missing test check")
|
|
|
|
}
|
|
|
|
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, ok := a.checkTTLs[checkID]; !ok {
|
2014-01-30 23:51:15 +00:00
|
|
|
t.Fatalf("missing test check ttl")
|
|
|
|
}
|
2015-04-28 20:06:02 +00:00
|
|
|
|
|
|
|
// Ensure the token was configured
|
2017-08-28 12:17:13 +00:00
|
|
|
if token := a.State.CheckToken(checkID); token == "" {
|
2015-04-28 20:06:02 +00:00
|
|
|
t.Fatalf("missing token")
|
|
|
|
}
|
2015-05-11 23:48:10 +00:00
|
|
|
|
2015-04-12 00:53:48 +00:00
|
|
|
// By default, checks start in critical state.
|
2017-08-28 12:17:13 +00:00
|
|
|
state := a.State.Checks()[checkID]
|
2017-04-19 23:00:11 +00:00
|
|
|
if state.Status != api.HealthCritical {
|
2015-04-12 00:53:48 +00:00
|
|
|
t.Fatalf("bad: %v", state)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-10-18 18:28:39 +00:00
|
|
|
// This verifies all the forms of the new args-style check that we need to
|
|
|
|
// support as a result of https://github.com/hashicorp/consul/issues/3587.
|
|
|
|
func TestAgent_RegisterCheck_Scripts(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
a := NewTestAgent(t.Name(), `
|
|
|
|
enable_script_checks = true
|
|
|
|
`)
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
tests := []struct {
|
|
|
|
name string
|
|
|
|
check map[string]interface{}
|
|
|
|
}{
|
|
|
|
{
|
|
|
|
"== Consul 1.0.0",
|
|
|
|
map[string]interface{}{
|
|
|
|
"Name": "test",
|
|
|
|
"Interval": "2s",
|
|
|
|
"ScriptArgs": []string{"true"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"> Consul 1.0.0 (fixup)",
|
|
|
|
map[string]interface{}{
|
|
|
|
"Name": "test",
|
|
|
|
"Interval": "2s",
|
|
|
|
"script_args": []string{"true"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"> Consul 1.0.0",
|
|
|
|
map[string]interface{}{
|
|
|
|
"Name": "test",
|
|
|
|
"Interval": "2s",
|
|
|
|
"Args": []string{"true"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
|
|
t.Run(tt.name+" as node check", func(t *testing.T) {
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/check/register", jsonReader(tt.check))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
if _, err := a.srv.AgentRegisterCheck(resp, req); err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
if resp.Code != http.StatusOK {
|
|
|
|
t.Fatalf("bad: %d", resp.Code)
|
|
|
|
}
|
|
|
|
})
|
|
|
|
|
|
|
|
t.Run(tt.name+" as top-level service check", func(t *testing.T) {
|
|
|
|
args := map[string]interface{}{
|
|
|
|
"Name": "a",
|
|
|
|
"Port": 1234,
|
|
|
|
"Check": tt.check,
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
if _, err := a.srv.AgentRegisterService(resp, req); err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
if resp.Code != http.StatusOK {
|
|
|
|
t.Fatalf("bad: %d", resp.Code)
|
|
|
|
}
|
|
|
|
})
|
|
|
|
|
|
|
|
t.Run(tt.name+" as slice-based service check", func(t *testing.T) {
|
|
|
|
args := map[string]interface{}{
|
|
|
|
"Name": "a",
|
|
|
|
"Port": 1234,
|
|
|
|
"Checks": []map[string]interface{}{tt.check},
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
if _, err := a.srv.AgentRegisterService(resp, req); err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
if resp.Code != http.StatusOK {
|
|
|
|
t.Fatalf("bad: %d", resp.Code)
|
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-12-14 22:16:46 +00:00
|
|
|
func TestAgent_RegisterCheck_Passing(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a := NewTestAgent(t.Name(), "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2015-04-12 00:53:48 +00:00
|
|
|
|
2017-06-15 16:46:06 +00:00
|
|
|
args := &structs.CheckDefinition{
|
2017-05-15 19:49:13 +00:00
|
|
|
Name: "test",
|
|
|
|
TTL: 15 * time.Second,
|
2017-04-19 23:00:11 +00:00
|
|
|
Status: api.HealthPassing,
|
2015-04-12 00:53:48 +00:00
|
|
|
}
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/check/register", jsonReader(args))
|
2017-05-21 07:11:09 +00:00
|
|
|
obj, err := a.srv.AgentRegisterCheck(nil, req)
|
2015-04-12 00:53:48 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
if obj != nil {
|
|
|
|
t.Fatalf("bad: %v", obj)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Ensure we have a check mapping
|
2016-06-07 20:24:51 +00:00
|
|
|
checkID := types.CheckID("test")
|
2017-08-28 12:17:13 +00:00
|
|
|
if _, ok := a.State.Checks()[checkID]; !ok {
|
2015-04-12 00:53:48 +00:00
|
|
|
t.Fatalf("missing test check")
|
|
|
|
}
|
|
|
|
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, ok := a.checkTTLs[checkID]; !ok {
|
2015-04-12 00:53:48 +00:00
|
|
|
t.Fatalf("missing test check ttl")
|
|
|
|
}
|
|
|
|
|
2017-08-28 12:17:13 +00:00
|
|
|
state := a.State.Checks()[checkID]
|
2017-04-19 23:00:11 +00:00
|
|
|
if state.Status != api.HealthPassing {
|
2015-04-12 00:53:48 +00:00
|
|
|
t.Fatalf("bad: %v", state)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-12-14 22:16:46 +00:00
|
|
|
func TestAgent_RegisterCheck_BadStatus(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a := NewTestAgent(t.Name(), "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2015-04-12 00:53:48 +00:00
|
|
|
|
2017-06-15 16:46:06 +00:00
|
|
|
args := &structs.CheckDefinition{
|
2017-05-15 19:49:13 +00:00
|
|
|
Name: "test",
|
|
|
|
TTL: 15 * time.Second,
|
2015-04-12 00:53:48 +00:00
|
|
|
Status: "fluffy",
|
|
|
|
}
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/check/register", jsonReader(args))
|
2015-04-12 00:53:48 +00:00
|
|
|
resp := httptest.NewRecorder()
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentRegisterCheck(resp, req); err != nil {
|
2015-04-12 00:53:48 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
if resp.Code != 400 {
|
|
|
|
t.Fatalf("accepted bad status")
|
|
|
|
}
|
2014-01-30 23:51:15 +00:00
|
|
|
}
|
|
|
|
|
2016-12-14 22:16:46 +00:00
|
|
|
func TestAgent_RegisterCheck_ACLDeny(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-05-21 07:11:09 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig())
|
|
|
|
defer a.Shutdown()
|
2016-12-14 22:16:46 +00:00
|
|
|
|
2017-06-15 16:46:06 +00:00
|
|
|
args := &structs.CheckDefinition{
|
2016-12-14 22:16:46 +00:00
|
|
|
Name: "test",
|
2017-05-15 19:49:13 +00:00
|
|
|
TTL: 15 * time.Second,
|
2016-12-14 22:16:46 +00:00
|
|
|
}
|
2017-05-09 16:58:12 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("no token", func(t *testing.T) {
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/check/register", jsonReader(args))
|
2017-08-23 14:52:48 +00:00
|
|
|
if _, err := a.srv.AgentRegisterCheck(nil, req); !acl.IsErrPermissionDenied(err) {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2016-12-14 22:16:46 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("root token", func(t *testing.T) {
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/check/register?token=root", jsonReader(args))
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentRegisterCheck(nil, req); err != nil {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2016-12-14 22:16:46 +00:00
|
|
|
}
|
|
|
|
|
2016-12-14 17:33:57 +00:00
|
|
|
func TestAgent_DeregisterCheck(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a := NewTestAgent(t.Name(), "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2014-01-30 23:51:15 +00:00
|
|
|
|
|
|
|
chk := &structs.HealthCheck{Name: "test", CheckID: "test"}
|
2017-05-21 07:11:09 +00:00
|
|
|
if err := a.AddCheck(chk, nil, false, ""); err != nil {
|
2014-01-30 23:51:15 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/check/deregister/test", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
obj, err := a.srv.AgentDeregisterCheck(nil, req)
|
2014-01-30 23:51:15 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
if obj != nil {
|
|
|
|
t.Fatalf("bad: %v", obj)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Ensure we have a check mapping
|
2017-08-28 12:17:13 +00:00
|
|
|
if _, ok := a.State.Checks()["test"]; ok {
|
2014-01-30 23:51:15 +00:00
|
|
|
t.Fatalf("have test check")
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-12-14 22:16:46 +00:00
|
|
|
func TestAgent_DeregisterCheckACLDeny(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-05-21 07:11:09 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig())
|
|
|
|
defer a.Shutdown()
|
2016-12-14 22:16:46 +00:00
|
|
|
|
|
|
|
chk := &structs.HealthCheck{Name: "test", CheckID: "test"}
|
2017-05-21 07:11:09 +00:00
|
|
|
if err := a.AddCheck(chk, nil, false, ""); err != nil {
|
2016-12-14 22:16:46 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("no token", func(t *testing.T) {
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/check/deregister/test", nil)
|
2017-08-23 14:52:48 +00:00
|
|
|
if _, err := a.srv.AgentDeregisterCheck(nil, req); !acl.IsErrPermissionDenied(err) {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2016-12-14 22:16:46 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("root token", func(t *testing.T) {
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/check/deregister/test?token=root", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentDeregisterCheck(nil, req); err != nil {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2016-12-14 22:16:46 +00:00
|
|
|
}
|
|
|
|
|
2016-12-14 17:33:57 +00:00
|
|
|
func TestAgent_PassCheck(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a := NewTestAgent(t.Name(), "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2014-01-30 23:51:15 +00:00
|
|
|
|
|
|
|
chk := &structs.HealthCheck{Name: "test", CheckID: "test"}
|
2017-06-15 16:46:06 +00:00
|
|
|
chkType := &structs.CheckType{TTL: 15 * time.Second}
|
2017-05-21 07:11:09 +00:00
|
|
|
if err := a.AddCheck(chk, chkType, false, ""); err != nil {
|
2014-01-30 23:51:15 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/check/pass/test", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
obj, err := a.srv.AgentCheckPass(nil, req)
|
2014-01-30 23:51:15 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
if obj != nil {
|
|
|
|
t.Fatalf("bad: %v", obj)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Ensure we have a check mapping
|
2017-08-28 12:17:13 +00:00
|
|
|
state := a.State.Checks()["test"]
|
2017-04-19 23:00:11 +00:00
|
|
|
if state.Status != api.HealthPassing {
|
2014-01-30 23:51:15 +00:00
|
|
|
t.Fatalf("bad: %v", state)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-12-14 22:16:46 +00:00
|
|
|
func TestAgent_PassCheck_ACLDeny(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-05-21 07:11:09 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig())
|
|
|
|
defer a.Shutdown()
|
2016-12-14 22:16:46 +00:00
|
|
|
|
|
|
|
chk := &structs.HealthCheck{Name: "test", CheckID: "test"}
|
2017-06-15 16:46:06 +00:00
|
|
|
chkType := &structs.CheckType{TTL: 15 * time.Second}
|
2017-05-21 07:11:09 +00:00
|
|
|
if err := a.AddCheck(chk, chkType, false, ""); err != nil {
|
2016-12-14 22:16:46 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("no token", func(t *testing.T) {
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/check/pass/test", nil)
|
2017-08-23 14:52:48 +00:00
|
|
|
if _, err := a.srv.AgentCheckPass(nil, req); !acl.IsErrPermissionDenied(err) {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2016-12-14 22:16:46 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("root token", func(t *testing.T) {
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/check/pass/test?token=root", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentCheckPass(nil, req); err != nil {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2016-12-14 22:16:46 +00:00
|
|
|
}
|
|
|
|
|
2016-12-14 17:33:57 +00:00
|
|
|
func TestAgent_WarnCheck(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a := NewTestAgent(t.Name(), "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2014-01-30 23:51:15 +00:00
|
|
|
|
|
|
|
chk := &structs.HealthCheck{Name: "test", CheckID: "test"}
|
2017-06-15 16:46:06 +00:00
|
|
|
chkType := &structs.CheckType{TTL: 15 * time.Second}
|
2017-05-21 07:11:09 +00:00
|
|
|
if err := a.AddCheck(chk, chkType, false, ""); err != nil {
|
2014-01-30 23:51:15 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/check/warn/test", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
obj, err := a.srv.AgentCheckWarn(nil, req)
|
2014-01-30 23:51:15 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
if obj != nil {
|
|
|
|
t.Fatalf("bad: %v", obj)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Ensure we have a check mapping
|
2017-08-28 12:17:13 +00:00
|
|
|
state := a.State.Checks()["test"]
|
2017-04-19 23:00:11 +00:00
|
|
|
if state.Status != api.HealthWarning {
|
2014-01-30 23:51:15 +00:00
|
|
|
t.Fatalf("bad: %v", state)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-12-14 22:16:46 +00:00
|
|
|
func TestAgent_WarnCheck_ACLDeny(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-05-21 07:11:09 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig())
|
|
|
|
defer a.Shutdown()
|
2016-12-14 22:16:46 +00:00
|
|
|
|
|
|
|
chk := &structs.HealthCheck{Name: "test", CheckID: "test"}
|
2017-06-15 16:46:06 +00:00
|
|
|
chkType := &structs.CheckType{TTL: 15 * time.Second}
|
2017-05-21 07:11:09 +00:00
|
|
|
if err := a.AddCheck(chk, chkType, false, ""); err != nil {
|
2016-12-14 22:16:46 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("no token", func(t *testing.T) {
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/check/warn/test", nil)
|
2017-08-23 14:52:48 +00:00
|
|
|
if _, err := a.srv.AgentCheckWarn(nil, req); !acl.IsErrPermissionDenied(err) {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2016-12-14 22:16:46 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("root token", func(t *testing.T) {
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/check/warn/test?token=root", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentCheckWarn(nil, req); err != nil {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2016-12-14 22:16:46 +00:00
|
|
|
}
|
|
|
|
|
2016-12-14 17:33:57 +00:00
|
|
|
func TestAgent_FailCheck(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a := NewTestAgent(t.Name(), "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2014-01-30 23:51:15 +00:00
|
|
|
|
|
|
|
chk := &structs.HealthCheck{Name: "test", CheckID: "test"}
|
2017-06-15 16:46:06 +00:00
|
|
|
chkType := &structs.CheckType{TTL: 15 * time.Second}
|
2017-05-21 07:11:09 +00:00
|
|
|
if err := a.AddCheck(chk, chkType, false, ""); err != nil {
|
2014-01-30 23:51:15 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/check/fail/test", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
obj, err := a.srv.AgentCheckFail(nil, req)
|
2014-01-30 23:51:15 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
if obj != nil {
|
|
|
|
t.Fatalf("bad: %v", obj)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Ensure we have a check mapping
|
2017-08-28 12:17:13 +00:00
|
|
|
state := a.State.Checks()["test"]
|
2017-04-19 23:00:11 +00:00
|
|
|
if state.Status != api.HealthCritical {
|
2014-01-30 23:51:15 +00:00
|
|
|
t.Fatalf("bad: %v", state)
|
|
|
|
}
|
|
|
|
}
|
2014-01-30 23:56:03 +00:00
|
|
|
|
2016-12-14 22:16:46 +00:00
|
|
|
func TestAgent_FailCheck_ACLDeny(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-05-21 07:11:09 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig())
|
|
|
|
defer a.Shutdown()
|
2016-12-14 22:16:46 +00:00
|
|
|
|
|
|
|
chk := &structs.HealthCheck{Name: "test", CheckID: "test"}
|
2017-06-15 16:46:06 +00:00
|
|
|
chkType := &structs.CheckType{TTL: 15 * time.Second}
|
2017-05-21 07:11:09 +00:00
|
|
|
if err := a.AddCheck(chk, chkType, false, ""); err != nil {
|
2016-12-14 22:16:46 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("no token", func(t *testing.T) {
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/check/fail/test", nil)
|
2017-08-23 14:52:48 +00:00
|
|
|
if _, err := a.srv.AgentCheckFail(nil, req); !acl.IsErrPermissionDenied(err) {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2016-12-14 22:16:46 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("root token", func(t *testing.T) {
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/check/fail/test?token=root", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentCheckFail(nil, req); err != nil {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2016-12-14 22:16:46 +00:00
|
|
|
}
|
|
|
|
|
2016-12-14 17:33:57 +00:00
|
|
|
func TestAgent_UpdateCheck(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a := NewTestAgent(t.Name(), "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2016-03-03 01:08:06 +00:00
|
|
|
|
|
|
|
chk := &structs.HealthCheck{Name: "test", CheckID: "test"}
|
2017-06-15 16:46:06 +00:00
|
|
|
chkType := &structs.CheckType{TTL: 15 * time.Second}
|
2017-05-21 07:11:09 +00:00
|
|
|
if err := a.AddCheck(chk, chkType, false, ""); err != nil {
|
2016-03-03 01:08:06 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
cases := []checkUpdate{
|
2017-04-19 23:00:11 +00:00
|
|
|
checkUpdate{api.HealthPassing, "hello-passing"},
|
|
|
|
checkUpdate{api.HealthCritical, "hello-critical"},
|
|
|
|
checkUpdate{api.HealthWarning, "hello-warning"},
|
2016-03-03 01:08:06 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
for _, c := range cases {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run(c.Status, func(t *testing.T) {
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/check/update/test", jsonReader(c))
|
|
|
|
resp := httptest.NewRecorder()
|
2017-05-21 07:11:09 +00:00
|
|
|
obj, err := a.srv.AgentCheckUpdate(resp, req)
|
2017-05-09 17:46:11 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
if obj != nil {
|
|
|
|
t.Fatalf("bad: %v", obj)
|
|
|
|
}
|
|
|
|
if resp.Code != 200 {
|
|
|
|
t.Fatalf("expected 200, got %d", resp.Code)
|
|
|
|
}
|
2016-03-03 01:08:06 +00:00
|
|
|
|
2017-08-28 12:17:13 +00:00
|
|
|
state := a.State.Checks()["test"]
|
2017-05-09 17:46:11 +00:00
|
|
|
if state.Status != c.Status || state.Output != c.Output {
|
|
|
|
t.Fatalf("bad: %v", state)
|
|
|
|
}
|
|
|
|
})
|
2016-03-03 01:08:06 +00:00
|
|
|
}
|
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("log output limit", func(t *testing.T) {
|
2017-05-09 16:58:12 +00:00
|
|
|
args := checkUpdate{
|
2017-04-19 23:00:11 +00:00
|
|
|
Status: api.HealthPassing,
|
2017-10-25 09:18:07 +00:00
|
|
|
Output: strings.Repeat("-= bad -=", 5*checks.BufSize),
|
2016-03-03 01:08:06 +00:00
|
|
|
}
|
2017-05-09 16:58:12 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/check/update/test", jsonReader(args))
|
2016-03-03 01:08:06 +00:00
|
|
|
resp := httptest.NewRecorder()
|
2017-05-21 07:11:09 +00:00
|
|
|
obj, err := a.srv.AgentCheckUpdate(resp, req)
|
2016-03-03 01:08:06 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
if obj != nil {
|
|
|
|
t.Fatalf("bad: %v", obj)
|
|
|
|
}
|
|
|
|
if resp.Code != 200 {
|
|
|
|
t.Fatalf("expected 200, got %d", resp.Code)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Since we append some notes about truncating, we just do a
|
|
|
|
// rough check that the output buffer was cut down so this test
|
|
|
|
// isn't super brittle.
|
2017-08-28 12:17:13 +00:00
|
|
|
state := a.State.Checks()["test"]
|
2017-10-25 09:18:07 +00:00
|
|
|
if state.Status != api.HealthPassing || len(state.Output) > 2*checks.BufSize {
|
2016-03-03 01:08:06 +00:00
|
|
|
t.Fatalf("bad: %v", state)
|
|
|
|
}
|
2017-05-09 17:46:11 +00:00
|
|
|
})
|
2016-03-03 01:08:06 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("bogus status", func(t *testing.T) {
|
2017-05-09 16:58:12 +00:00
|
|
|
args := checkUpdate{Status: "itscomplicated"}
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/check/update/test", jsonReader(args))
|
2016-03-03 01:08:06 +00:00
|
|
|
resp := httptest.NewRecorder()
|
2017-05-21 07:11:09 +00:00
|
|
|
obj, err := a.srv.AgentCheckUpdate(resp, req)
|
2016-03-03 01:08:06 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
if obj != nil {
|
|
|
|
t.Fatalf("bad: %v", obj)
|
|
|
|
}
|
|
|
|
if resp.Code != 400 {
|
|
|
|
t.Fatalf("expected 400, got %d", resp.Code)
|
|
|
|
}
|
2017-05-09 17:46:11 +00:00
|
|
|
})
|
2016-03-03 01:08:06 +00:00
|
|
|
}
|
|
|
|
|
2016-12-14 22:16:46 +00:00
|
|
|
func TestAgent_UpdateCheck_ACLDeny(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-05-21 07:11:09 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig())
|
|
|
|
defer a.Shutdown()
|
2016-12-14 22:16:46 +00:00
|
|
|
|
|
|
|
chk := &structs.HealthCheck{Name: "test", CheckID: "test"}
|
2017-06-15 16:46:06 +00:00
|
|
|
chkType := &structs.CheckType{TTL: 15 * time.Second}
|
2017-05-21 07:11:09 +00:00
|
|
|
if err := a.AddCheck(chk, chkType, false, ""); err != nil {
|
2016-12-14 22:16:46 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("no token", func(t *testing.T) {
|
|
|
|
args := checkUpdate{api.HealthPassing, "hello-passing"}
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/check/update/test", jsonReader(args))
|
2017-08-23 14:52:48 +00:00
|
|
|
if _, err := a.srv.AgentCheckUpdate(nil, req); !acl.IsErrPermissionDenied(err) {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2016-12-14 22:16:46 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("root token", func(t *testing.T) {
|
|
|
|
args := checkUpdate{api.HealthPassing, "hello-passing"}
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/check/update/test?token=root", jsonReader(args))
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentCheckUpdate(nil, req); err != nil {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2016-12-14 22:16:46 +00:00
|
|
|
}
|
|
|
|
|
2016-12-14 17:33:57 +00:00
|
|
|
func TestAgent_RegisterService(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a := NewTestAgent(t.Name(), "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2014-01-30 23:56:03 +00:00
|
|
|
|
2017-06-15 16:46:06 +00:00
|
|
|
args := &structs.ServiceDefinition{
|
2014-01-30 23:56:03 +00:00
|
|
|
Name: "test",
|
2018-04-21 15:34:29 +00:00
|
|
|
Meta: map[string]string{"hello": "world"},
|
2014-04-03 19:12:23 +00:00
|
|
|
Tags: []string{"master"},
|
2014-01-30 23:56:03 +00:00
|
|
|
Port: 8000,
|
2017-06-15 16:46:06 +00:00
|
|
|
Check: structs.CheckType{
|
2014-01-30 23:56:03 +00:00
|
|
|
TTL: 15 * time.Second,
|
|
|
|
},
|
2017-06-15 16:46:06 +00:00
|
|
|
Checks: []*structs.CheckType{
|
|
|
|
&structs.CheckType{
|
2015-01-14 03:08:30 +00:00
|
|
|
TTL: 20 * time.Second,
|
|
|
|
},
|
2017-06-15 16:46:06 +00:00
|
|
|
&structs.CheckType{
|
2015-01-14 03:08:30 +00:00
|
|
|
TTL: 30 * time.Second,
|
|
|
|
},
|
|
|
|
},
|
2014-01-30 23:56:03 +00:00
|
|
|
}
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register?token=abc123", jsonReader(args))
|
2014-01-30 23:56:03 +00:00
|
|
|
|
2017-05-21 07:11:09 +00:00
|
|
|
obj, err := a.srv.AgentRegisterService(nil, req)
|
2014-01-30 23:56:03 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
if obj != nil {
|
|
|
|
t.Fatalf("bad: %v", obj)
|
|
|
|
}
|
|
|
|
|
2018-03-19 16:56:00 +00:00
|
|
|
// Ensure the service
|
2017-08-28 12:17:13 +00:00
|
|
|
if _, ok := a.State.Services()["test"]; !ok {
|
2014-01-30 23:56:03 +00:00
|
|
|
t.Fatalf("missing test service")
|
|
|
|
}
|
2018-04-21 15:34:29 +00:00
|
|
|
if val := a.State.Service("test").Meta["hello"]; val != "world" {
|
|
|
|
t.Fatalf("Missing meta: %v", a.State.Service("test").Meta)
|
|
|
|
}
|
2014-01-30 23:56:03 +00:00
|
|
|
|
|
|
|
// Ensure we have a check mapping
|
2017-08-28 12:17:13 +00:00
|
|
|
checks := a.State.Checks()
|
2015-01-14 03:08:30 +00:00
|
|
|
if len(checks) != 3 {
|
|
|
|
t.Fatalf("bad: %v", checks)
|
2014-01-30 23:56:03 +00:00
|
|
|
}
|
|
|
|
|
2017-05-21 07:11:09 +00:00
|
|
|
if len(a.checkTTLs) != 3 {
|
|
|
|
t.Fatalf("missing test check ttls: %v", a.checkTTLs)
|
2014-01-30 23:56:03 +00:00
|
|
|
}
|
2015-04-28 20:06:02 +00:00
|
|
|
|
|
|
|
// Ensure the token was configured
|
2017-08-28 12:17:13 +00:00
|
|
|
if token := a.State.ServiceToken("test"); token == "" {
|
2015-04-28 20:06:02 +00:00
|
|
|
t.Fatalf("missing token")
|
|
|
|
}
|
2014-01-30 23:56:03 +00:00
|
|
|
}
|
|
|
|
|
2017-10-10 23:40:59 +00:00
|
|
|
func TestAgent_RegisterService_TranslateKeys(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
a := NewTestAgent(t.Name(), "")
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
2018-04-21 15:34:29 +00:00
|
|
|
json := `{"name":"test", "port":8000, "enable_tag_override": true, "meta": {"some": "meta"}}`
|
2017-10-10 23:40:59 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register", strings.NewReader(json))
|
|
|
|
|
|
|
|
obj, err := a.srv.AgentRegisterService(nil, req)
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
if obj != nil {
|
|
|
|
t.Fatalf("bad: %v", obj)
|
|
|
|
}
|
|
|
|
svc := &structs.NodeService{
|
|
|
|
ID: "test",
|
|
|
|
Service: "test",
|
2018-04-21 15:34:29 +00:00
|
|
|
Meta: map[string]string{"some": "meta"},
|
2017-10-10 23:40:59 +00:00
|
|
|
Port: 8000,
|
|
|
|
EnableTagOverride: true,
|
|
|
|
}
|
|
|
|
|
2017-08-30 10:25:49 +00:00
|
|
|
if got, want := a.State.Service("test"), svc; !verify.Values(t, "", got, want) {
|
2017-10-10 23:40:59 +00:00
|
|
|
t.Fail()
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-12-14 22:16:46 +00:00
|
|
|
func TestAgent_RegisterService_ACLDeny(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-05-21 07:11:09 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig())
|
|
|
|
defer a.Shutdown()
|
2016-12-14 22:16:46 +00:00
|
|
|
|
2017-06-15 16:46:06 +00:00
|
|
|
args := &structs.ServiceDefinition{
|
2016-12-14 22:16:46 +00:00
|
|
|
Name: "test",
|
|
|
|
Tags: []string{"master"},
|
|
|
|
Port: 8000,
|
2017-06-15 16:46:06 +00:00
|
|
|
Check: structs.CheckType{
|
2016-12-14 22:16:46 +00:00
|
|
|
TTL: 15 * time.Second,
|
|
|
|
},
|
2017-06-15 16:46:06 +00:00
|
|
|
Checks: []*structs.CheckType{
|
|
|
|
&structs.CheckType{
|
2016-12-14 22:16:46 +00:00
|
|
|
TTL: 20 * time.Second,
|
|
|
|
},
|
2017-06-15 16:46:06 +00:00
|
|
|
&structs.CheckType{
|
2016-12-14 22:16:46 +00:00
|
|
|
TTL: 30 * time.Second,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("no token", func(t *testing.T) {
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register", jsonReader(args))
|
2017-08-23 14:52:48 +00:00
|
|
|
if _, err := a.srv.AgentRegisterService(nil, req); !acl.IsErrPermissionDenied(err) {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2016-12-14 22:16:46 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("root token", func(t *testing.T) {
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register?token=root", jsonReader(args))
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentRegisterService(nil, req); err != nil {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2016-12-14 22:16:46 +00:00
|
|
|
}
|
|
|
|
|
2017-05-08 16:34:45 +00:00
|
|
|
func TestAgent_RegisterService_InvalidAddress(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a := NewTestAgent(t.Name(), "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2017-05-08 16:34:45 +00:00
|
|
|
|
2017-05-09 07:29:13 +00:00
|
|
|
for _, addr := range []string{"0.0.0.0", "::", "[::]"} {
|
|
|
|
t.Run("addr "+addr, func(t *testing.T) {
|
2017-06-15 16:46:06 +00:00
|
|
|
args := &structs.ServiceDefinition{
|
2017-05-09 07:29:13 +00:00
|
|
|
Name: "test",
|
|
|
|
Address: addr,
|
|
|
|
Port: 8000,
|
|
|
|
}
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register?token=abc123", jsonReader(args))
|
2017-05-09 07:29:13 +00:00
|
|
|
resp := httptest.NewRecorder()
|
2017-05-21 07:11:09 +00:00
|
|
|
_, err := a.srv.AgentRegisterService(resp, req)
|
2017-05-09 16:58:12 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("got error %v want nil", err)
|
|
|
|
}
|
2017-05-09 07:29:13 +00:00
|
|
|
if got, want := resp.Code, 400; got != want {
|
|
|
|
t.Fatalf("got code %d want %d", got, want)
|
|
|
|
}
|
|
|
|
if got, want := resp.Body.String(), "Invalid service address"; got != want {
|
|
|
|
t.Fatalf("got body %q want %q", got, want)
|
|
|
|
}
|
|
|
|
})
|
2017-05-08 16:34:45 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-04-17 12:29:02 +00:00
|
|
|
// This tests local agent service registration with a managed proxy.
|
|
|
|
func TestAgent_RegisterService_ManagedConnectProxy(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
assert := assert.New(t)
|
|
|
|
require := require.New(t)
|
2018-06-12 15:35:59 +00:00
|
|
|
a := NewTestAgent(t.Name(), `
|
|
|
|
connect {
|
|
|
|
proxy {
|
|
|
|
allow_managed_api_registration = true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
`)
|
2018-04-17 12:29:02 +00:00
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
// Register a proxy. Note that the destination doesn't exist here on
|
|
|
|
// this agent or in the catalog at all. This is intended and part
|
|
|
|
// of the design.
|
2018-04-20 13:24:24 +00:00
|
|
|
args := &api.AgentServiceRegistration{
|
2018-04-17 12:29:02 +00:00
|
|
|
Name: "web",
|
|
|
|
Port: 8000,
|
2018-04-20 13:24:24 +00:00
|
|
|
Connect: &api.AgentServiceConnect{
|
|
|
|
Proxy: &api.AgentServiceConnectProxy{
|
2018-04-17 12:29:02 +00:00
|
|
|
ExecMode: "script",
|
2018-04-27 05:16:21 +00:00
|
|
|
Command: []string{"proxy.sh"},
|
2018-04-17 12:29:02 +00:00
|
|
|
Config: map[string]interface{}{
|
|
|
|
"foo": "bar",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register?token=abc123", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
obj, err := a.srv.AgentRegisterService(resp, req)
|
|
|
|
assert.NoError(err)
|
|
|
|
assert.Nil(obj)
|
|
|
|
require.Equal(200, resp.Code, "request failed with body: %s",
|
|
|
|
resp.Body.String())
|
|
|
|
|
|
|
|
// Ensure the target service
|
|
|
|
_, ok := a.State.Services()["web"]
|
|
|
|
assert.True(ok, "has service")
|
|
|
|
|
|
|
|
// Ensure the proxy service was registered
|
|
|
|
proxySvc, ok := a.State.Services()["web-proxy"]
|
|
|
|
require.True(ok, "has proxy service")
|
|
|
|
assert.Equal(structs.ServiceKindConnectProxy, proxySvc.Kind)
|
|
|
|
assert.Equal("web", proxySvc.ProxyDestination)
|
|
|
|
assert.NotEmpty(proxySvc.Port, "a port should have been assigned")
|
|
|
|
|
|
|
|
// Ensure proxy itself was registered
|
|
|
|
proxy := a.State.Proxy("web-proxy")
|
|
|
|
require.NotNil(proxy)
|
2018-04-18 20:05:30 +00:00
|
|
|
assert.Equal(structs.ProxyExecModeScript, proxy.Proxy.ExecMode)
|
2018-04-27 18:24:49 +00:00
|
|
|
assert.Equal([]string{"proxy.sh"}, proxy.Proxy.Command)
|
2018-04-18 20:05:30 +00:00
|
|
|
assert.Equal(args.Connect.Proxy.Config, proxy.Proxy.Config)
|
2018-04-17 12:29:02 +00:00
|
|
|
|
|
|
|
// Ensure the token was configured
|
|
|
|
assert.Equal("abc123", a.State.ServiceToken("web"))
|
|
|
|
assert.Equal("abc123", a.State.ServiceToken("web-proxy"))
|
|
|
|
}
|
|
|
|
|
2018-06-12 15:35:59 +00:00
|
|
|
// This tests local agent service registration with a managed proxy with
|
|
|
|
// API registration disabled (default).
|
|
|
|
func TestAgent_RegisterService_ManagedConnectProxy_Disabled(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
assert := assert.New(t)
|
|
|
|
a := NewTestAgent(t.Name(), ``)
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
// Register a proxy. Note that the destination doesn't exist here on
|
|
|
|
// this agent or in the catalog at all. This is intended and part
|
|
|
|
// of the design.
|
|
|
|
args := &api.AgentServiceRegistration{
|
|
|
|
Name: "web",
|
|
|
|
Port: 8000,
|
|
|
|
Connect: &api.AgentServiceConnect{
|
|
|
|
Proxy: &api.AgentServiceConnectProxy{
|
|
|
|
ExecMode: "script",
|
|
|
|
Command: []string{"proxy.sh"},
|
|
|
|
Config: map[string]interface{}{
|
|
|
|
"foo": "bar",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register?token=abc123", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err := a.srv.AgentRegisterService(resp, req)
|
|
|
|
assert.Error(err)
|
|
|
|
|
|
|
|
// Ensure the target service does not exist
|
|
|
|
_, ok := a.State.Services()["web"]
|
|
|
|
assert.False(ok, "does not has service")
|
|
|
|
}
|
|
|
|
|
2018-04-17 12:29:02 +00:00
|
|
|
// This tests local agent service registration of a unmanaged connect proxy.
|
|
|
|
// This verifies that it is put in the local state store properly for syncing
|
|
|
|
// later. Note that _managed_ connect proxies are registered as part of the
|
|
|
|
// target service's registration.
|
|
|
|
func TestAgent_RegisterService_UnmanagedConnectProxy(t *testing.T) {
|
2018-03-10 01:16:12 +00:00
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
assert := assert.New(t)
|
|
|
|
a := NewTestAgent(t.Name(), "")
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
2018-03-12 17:13:44 +00:00
|
|
|
// Register a proxy. Note that the destination doesn't exist here on
|
|
|
|
// this agent or in the catalog at all. This is intended and part
|
|
|
|
// of the design.
|
2018-03-10 01:16:12 +00:00
|
|
|
args := &structs.ServiceDefinition{
|
|
|
|
Kind: structs.ServiceKindConnectProxy,
|
|
|
|
Name: "connect-proxy",
|
|
|
|
Port: 8000,
|
|
|
|
ProxyDestination: "db",
|
|
|
|
Check: structs.CheckType{
|
|
|
|
TTL: 15 * time.Second,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register?token=abc123", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
obj, err := a.srv.AgentRegisterService(resp, req)
|
|
|
|
assert.Nil(err)
|
|
|
|
assert.Nil(obj)
|
|
|
|
|
2018-03-12 17:13:44 +00:00
|
|
|
// Ensure the service
|
2018-03-10 01:16:12 +00:00
|
|
|
svc, ok := a.State.Services()["connect-proxy"]
|
|
|
|
assert.True(ok, "has service")
|
|
|
|
assert.Equal(structs.ServiceKindConnectProxy, svc.Kind)
|
|
|
|
assert.Equal("db", svc.ProxyDestination)
|
|
|
|
|
|
|
|
// Ensure the token was configured
|
|
|
|
assert.Equal("abc123", a.State.ServiceToken("connect-proxy"))
|
|
|
|
}
|
|
|
|
|
2018-03-12 20:05:06 +00:00
|
|
|
// This tests that connect proxy validation is done for local agent
|
|
|
|
// registration. This doesn't need to test validation exhaustively since
|
|
|
|
// that is done via a table test in the structs package.
|
2018-04-17 12:29:02 +00:00
|
|
|
func TestAgent_RegisterService_UnmanagedConnectProxyInvalid(t *testing.T) {
|
2018-03-11 01:42:30 +00:00
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
assert := assert.New(t)
|
|
|
|
a := NewTestAgent(t.Name(), "")
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
args := &structs.ServiceDefinition{
|
|
|
|
Kind: structs.ServiceKindConnectProxy,
|
|
|
|
Name: "connect-proxy",
|
|
|
|
ProxyDestination: "db",
|
|
|
|
Check: structs.CheckType{
|
|
|
|
TTL: 15 * time.Second,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register?token=abc123", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
obj, err := a.srv.AgentRegisterService(resp, req)
|
|
|
|
assert.Nil(err)
|
|
|
|
assert.Nil(obj)
|
|
|
|
assert.Equal(http.StatusBadRequest, resp.Code)
|
|
|
|
assert.Contains(resp.Body.String(), "Port")
|
|
|
|
|
|
|
|
// Ensure the service doesn't exist
|
|
|
|
_, ok := a.State.Services()["connect-proxy"]
|
|
|
|
assert.False(ok)
|
|
|
|
}
|
|
|
|
|
2018-06-04 05:20:16 +00:00
|
|
|
// Tests agent registration of a service that is connect native.
|
|
|
|
func TestAgent_RegisterService_ConnectNative(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
assert := assert.New(t)
|
|
|
|
a := NewTestAgent(t.Name(), "")
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
// Register a proxy. Note that the destination doesn't exist here on
|
|
|
|
// this agent or in the catalog at all. This is intended and part
|
|
|
|
// of the design.
|
|
|
|
args := &structs.ServiceDefinition{
|
|
|
|
Name: "web",
|
|
|
|
Port: 8000,
|
|
|
|
Check: structs.CheckType{
|
|
|
|
TTL: 15 * time.Second,
|
|
|
|
},
|
2018-06-05 17:51:05 +00:00
|
|
|
Connect: &structs.ServiceConnect{
|
2018-06-04 05:20:16 +00:00
|
|
|
Native: true,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
obj, err := a.srv.AgentRegisterService(resp, req)
|
|
|
|
assert.Nil(err)
|
|
|
|
assert.Nil(obj)
|
|
|
|
|
|
|
|
// Ensure the service
|
|
|
|
svc, ok := a.State.Services()["web"]
|
|
|
|
assert.True(ok, "has service")
|
2018-06-05 17:51:05 +00:00
|
|
|
assert.True(svc.Connect.Native)
|
2018-06-04 05:20:16 +00:00
|
|
|
}
|
|
|
|
|
2016-12-14 17:33:57 +00:00
|
|
|
func TestAgent_DeregisterService(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a := NewTestAgent(t.Name(), "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2014-01-30 23:56:03 +00:00
|
|
|
|
|
|
|
service := &structs.NodeService{
|
|
|
|
ID: "test",
|
|
|
|
Service: "test",
|
|
|
|
}
|
2017-05-21 07:11:09 +00:00
|
|
|
if err := a.AddService(service, nil, false, ""); err != nil {
|
2014-01-30 23:56:03 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/deregister/test", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
obj, err := a.srv.AgentDeregisterService(nil, req)
|
2014-01-30 23:56:03 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
if obj != nil {
|
|
|
|
t.Fatalf("bad: %v", obj)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Ensure we have a check mapping
|
2017-08-28 12:17:13 +00:00
|
|
|
if _, ok := a.State.Services()["test"]; ok {
|
2014-01-30 23:56:03 +00:00
|
|
|
t.Fatalf("have test service")
|
|
|
|
}
|
|
|
|
|
2017-08-28 12:17:13 +00:00
|
|
|
if _, ok := a.State.Checks()["test"]; ok {
|
2014-01-30 23:56:03 +00:00
|
|
|
t.Fatalf("have test check")
|
|
|
|
}
|
|
|
|
}
|
2015-01-15 09:17:35 +00:00
|
|
|
|
2016-12-14 22:16:46 +00:00
|
|
|
func TestAgent_DeregisterService_ACLDeny(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-05-21 07:11:09 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig())
|
|
|
|
defer a.Shutdown()
|
2016-12-14 22:16:46 +00:00
|
|
|
|
|
|
|
service := &structs.NodeService{
|
|
|
|
ID: "test",
|
|
|
|
Service: "test",
|
|
|
|
}
|
2017-05-21 07:11:09 +00:00
|
|
|
if err := a.AddService(service, nil, false, ""); err != nil {
|
2016-12-14 22:16:46 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("no token", func(t *testing.T) {
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/deregister/test", nil)
|
2017-08-23 14:52:48 +00:00
|
|
|
if _, err := a.srv.AgentDeregisterService(nil, req); !acl.IsErrPermissionDenied(err) {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2016-12-14 22:16:46 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("root token", func(t *testing.T) {
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/deregister/test?token=root", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentDeregisterService(nil, req); err != nil {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2016-12-14 22:16:46 +00:00
|
|
|
}
|
|
|
|
|
2018-06-13 07:57:48 +00:00
|
|
|
func TestAgent_DeregisterService_withManagedProxy(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
require := require.New(t)
|
|
|
|
a := NewTestAgent(t.Name(), `
|
|
|
|
connect {
|
|
|
|
proxy {
|
|
|
|
allow_managed_api_registration = true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
`)
|
|
|
|
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
// Register a service with a managed proxy
|
|
|
|
{
|
|
|
|
reg := &structs.ServiceDefinition{
|
|
|
|
ID: "test-id",
|
|
|
|
Name: "test",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
Port: 8000,
|
|
|
|
Check: structs.CheckType{
|
|
|
|
TTL: 15 * time.Second,
|
|
|
|
},
|
|
|
|
Connect: &structs.ServiceConnect{
|
|
|
|
Proxy: &structs.ServiceDefinitionConnectProxy{},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register", jsonReader(reg))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err := a.srv.AgentRegisterService(resp, req)
|
|
|
|
require.NoError(err)
|
|
|
|
require.Equal(200, resp.Code, "body: %s", resp.Body.String())
|
|
|
|
}
|
|
|
|
|
|
|
|
// Get the proxy ID
|
2018-06-13 21:24:19 +00:00
|
|
|
require.Len(a.State.Proxies(), 1)
|
2018-06-13 07:57:48 +00:00
|
|
|
var proxyID string
|
|
|
|
for _, p := range a.State.Proxies() {
|
|
|
|
proxyID = p.Proxy.ProxyService.ID
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/deregister/test-id", nil)
|
|
|
|
obj, err := a.srv.AgentDeregisterService(nil, req)
|
|
|
|
require.NoError(err)
|
|
|
|
require.Nil(obj)
|
|
|
|
|
|
|
|
// Ensure we have no service, check, managed proxy, or proxy service
|
|
|
|
require.NotContains(a.State.Services(), "test-id")
|
|
|
|
require.NotContains(a.State.Checks(), "test-id")
|
|
|
|
require.NotContains(a.State.Services(), proxyID)
|
|
|
|
require.Len(a.State.Proxies(), 0)
|
|
|
|
}
|
|
|
|
|
2018-06-13 08:00:23 +00:00
|
|
|
// Test that we can't deregister a managed proxy service directly.
|
|
|
|
func TestAgent_DeregisterService_managedProxyDirect(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
require := require.New(t)
|
|
|
|
a := NewTestAgent(t.Name(), `
|
|
|
|
connect {
|
|
|
|
proxy {
|
|
|
|
allow_managed_api_registration = true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
`)
|
|
|
|
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
// Register a service with a managed proxy
|
|
|
|
{
|
|
|
|
reg := &structs.ServiceDefinition{
|
|
|
|
ID: "test-id",
|
|
|
|
Name: "test",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
Port: 8000,
|
|
|
|
Check: structs.CheckType{
|
|
|
|
TTL: 15 * time.Second,
|
|
|
|
},
|
|
|
|
Connect: &structs.ServiceConnect{
|
|
|
|
Proxy: &structs.ServiceDefinitionConnectProxy{},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register", jsonReader(reg))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err := a.srv.AgentRegisterService(resp, req)
|
|
|
|
require.NoError(err)
|
|
|
|
require.Equal(200, resp.Code, "body: %s", resp.Body.String())
|
|
|
|
}
|
|
|
|
|
|
|
|
// Get the proxy ID
|
|
|
|
var proxyID string
|
|
|
|
for _, p := range a.State.Proxies() {
|
|
|
|
proxyID = p.Proxy.ProxyService.ID
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/deregister/"+proxyID, nil)
|
|
|
|
obj, err := a.srv.AgentDeregisterService(nil, req)
|
|
|
|
require.Error(err)
|
|
|
|
require.Nil(obj)
|
|
|
|
}
|
|
|
|
|
2016-12-14 22:16:46 +00:00
|
|
|
func TestAgent_ServiceMaintenance_BadRequest(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a := NewTestAgent(t.Name(), "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2015-01-15 09:17:35 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("not enabled", func(t *testing.T) {
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/maintenance/test", nil)
|
|
|
|
resp := httptest.NewRecorder()
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentServiceMaintenance(resp, req); err != nil {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %s", err)
|
|
|
|
}
|
|
|
|
if resp.Code != 400 {
|
|
|
|
t.Fatalf("expected 400, got %d", resp.Code)
|
|
|
|
}
|
|
|
|
})
|
2015-01-15 09:17:35 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("no service id", func(t *testing.T) {
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/maintenance/?enable=true", nil)
|
|
|
|
resp := httptest.NewRecorder()
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentServiceMaintenance(resp, req); err != nil {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %s", err)
|
|
|
|
}
|
|
|
|
if resp.Code != 400 {
|
|
|
|
t.Fatalf("expected 400, got %d", resp.Code)
|
|
|
|
}
|
|
|
|
})
|
2015-01-15 18:51:00 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("bad service id", func(t *testing.T) {
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/maintenance/_nope_?enable=true", nil)
|
|
|
|
resp := httptest.NewRecorder()
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentServiceMaintenance(resp, req); err != nil {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %s", err)
|
|
|
|
}
|
|
|
|
if resp.Code != 404 {
|
|
|
|
t.Fatalf("expected 404, got %d", resp.Code)
|
|
|
|
}
|
|
|
|
})
|
2015-01-15 09:17:35 +00:00
|
|
|
}
|
|
|
|
|
2016-12-14 22:16:46 +00:00
|
|
|
func TestAgent_ServiceMaintenance_Enable(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a := NewTestAgent(t.Name(), "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2015-01-15 09:17:35 +00:00
|
|
|
|
|
|
|
// Register the service
|
|
|
|
service := &structs.NodeService{
|
|
|
|
ID: "test",
|
|
|
|
Service: "test",
|
|
|
|
}
|
2017-05-21 07:11:09 +00:00
|
|
|
if err := a.AddService(service, nil, false, ""); err != nil {
|
2015-01-15 09:17:35 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
|
2015-01-15 18:51:00 +00:00
|
|
|
// Force the service into maintenance mode
|
2015-09-10 19:08:08 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/maintenance/test?enable=true&reason=broken&token=mytoken", nil)
|
2015-01-15 09:17:35 +00:00
|
|
|
resp := httptest.NewRecorder()
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentServiceMaintenance(resp, req); err != nil {
|
2015-01-15 09:17:35 +00:00
|
|
|
t.Fatalf("err: %s", err)
|
|
|
|
}
|
|
|
|
if resp.Code != 200 {
|
|
|
|
t.Fatalf("expected 200, got %d", resp.Code)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Ensure the maintenance check was registered
|
2015-01-15 20:20:57 +00:00
|
|
|
checkID := serviceMaintCheckID("test")
|
2017-08-28 12:17:13 +00:00
|
|
|
check, ok := a.State.Checks()[checkID]
|
2015-01-21 20:21:57 +00:00
|
|
|
if !ok {
|
2015-01-15 09:17:35 +00:00
|
|
|
t.Fatalf("should have registered maintenance check")
|
|
|
|
}
|
2015-01-21 20:21:57 +00:00
|
|
|
|
2015-09-10 19:08:08 +00:00
|
|
|
// Ensure the token was added
|
2017-08-28 12:17:13 +00:00
|
|
|
if token := a.State.CheckToken(checkID); token != "mytoken" {
|
2015-09-10 19:08:08 +00:00
|
|
|
t.Fatalf("expected 'mytoken', got '%s'", token)
|
|
|
|
}
|
|
|
|
|
2015-01-21 20:21:57 +00:00
|
|
|
// Ensure the reason was set in notes
|
|
|
|
if check.Notes != "broken" {
|
|
|
|
t.Fatalf("bad: %#v", check)
|
|
|
|
}
|
2015-01-15 09:17:35 +00:00
|
|
|
}
|
|
|
|
|
2016-12-14 22:16:46 +00:00
|
|
|
func TestAgent_ServiceMaintenance_Disable(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a := NewTestAgent(t.Name(), "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2015-01-15 09:17:35 +00:00
|
|
|
|
|
|
|
// Register the service
|
|
|
|
service := &structs.NodeService{
|
|
|
|
ID: "test",
|
|
|
|
Service: "test",
|
|
|
|
}
|
2017-05-21 07:11:09 +00:00
|
|
|
if err := a.AddService(service, nil, false, ""); err != nil {
|
2015-01-15 09:17:35 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Force the service into maintenance mode
|
2017-05-21 07:11:09 +00:00
|
|
|
if err := a.EnableServiceMaintenance("test", "", ""); err != nil {
|
2015-01-15 09:17:35 +00:00
|
|
|
t.Fatalf("err: %s", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Leave maintenance mode
|
2015-01-15 18:51:00 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/maintenance/test?enable=false", nil)
|
|
|
|
resp := httptest.NewRecorder()
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentServiceMaintenance(resp, req); err != nil {
|
2015-01-15 09:17:35 +00:00
|
|
|
t.Fatalf("err: %s", err)
|
|
|
|
}
|
|
|
|
if resp.Code != 200 {
|
|
|
|
t.Fatalf("expected 200, got %d", resp.Code)
|
|
|
|
}
|
2015-01-15 18:51:00 +00:00
|
|
|
|
|
|
|
// Ensure the maintenance check was removed
|
2015-01-15 20:20:57 +00:00
|
|
|
checkID := serviceMaintCheckID("test")
|
2017-08-28 12:17:13 +00:00
|
|
|
if _, ok := a.State.Checks()[checkID]; ok {
|
2015-01-15 18:51:00 +00:00
|
|
|
t.Fatalf("should have removed maintenance check")
|
|
|
|
}
|
2015-01-15 09:17:35 +00:00
|
|
|
}
|
2015-01-15 19:26:14 +00:00
|
|
|
|
2016-12-14 22:16:46 +00:00
|
|
|
func TestAgent_ServiceMaintenance_ACLDeny(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-05-21 07:11:09 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig())
|
|
|
|
defer a.Shutdown()
|
2016-12-14 22:16:46 +00:00
|
|
|
|
|
|
|
// Register the service.
|
|
|
|
service := &structs.NodeService{
|
|
|
|
ID: "test",
|
|
|
|
Service: "test",
|
|
|
|
}
|
2017-05-21 07:11:09 +00:00
|
|
|
if err := a.AddService(service, nil, false, ""); err != nil {
|
2016-12-14 22:16:46 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("no token", func(t *testing.T) {
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/maintenance/test?enable=true&reason=broken", nil)
|
2017-08-23 14:52:48 +00:00
|
|
|
if _, err := a.srv.AgentServiceMaintenance(nil, req); !acl.IsErrPermissionDenied(err) {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2016-12-14 22:16:46 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("root token", func(t *testing.T) {
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/maintenance/test?enable=true&reason=broken&token=root", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentServiceMaintenance(nil, req); err != nil {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2016-12-14 22:16:46 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestAgent_NodeMaintenance_BadRequest(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a := NewTestAgent(t.Name(), "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2015-01-15 19:26:14 +00:00
|
|
|
|
|
|
|
// Fails when no enable flag provided
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/self/maintenance", nil)
|
|
|
|
resp := httptest.NewRecorder()
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentNodeMaintenance(resp, req); err != nil {
|
2015-01-15 19:26:14 +00:00
|
|
|
t.Fatalf("err: %s", err)
|
|
|
|
}
|
|
|
|
if resp.Code != 400 {
|
|
|
|
t.Fatalf("expected 400, got %d", resp.Code)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-12-14 22:16:46 +00:00
|
|
|
func TestAgent_NodeMaintenance_Enable(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a := NewTestAgent(t.Name(), "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2015-01-15 19:26:14 +00:00
|
|
|
|
|
|
|
// Force the node into maintenance mode
|
2017-05-09 11:38:05 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/self/maintenance?enable=true&reason=broken&token=mytoken", nil)
|
2015-01-15 19:26:14 +00:00
|
|
|
resp := httptest.NewRecorder()
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentNodeMaintenance(resp, req); err != nil {
|
2015-01-15 19:26:14 +00:00
|
|
|
t.Fatalf("err: %s", err)
|
|
|
|
}
|
|
|
|
if resp.Code != 200 {
|
|
|
|
t.Fatalf("expected 200, got %d", resp.Code)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Ensure the maintenance check was registered
|
2017-08-28 12:17:13 +00:00
|
|
|
check, ok := a.State.Checks()[structs.NodeMaint]
|
2015-01-21 20:21:57 +00:00
|
|
|
if !ok {
|
2015-01-15 19:26:14 +00:00
|
|
|
t.Fatalf("should have registered maintenance check")
|
|
|
|
}
|
2015-01-21 20:21:57 +00:00
|
|
|
|
2015-09-10 19:08:08 +00:00
|
|
|
// Check that the token was used
|
2017-08-28 12:17:13 +00:00
|
|
|
if token := a.State.CheckToken(structs.NodeMaint); token != "mytoken" {
|
2015-09-10 19:08:08 +00:00
|
|
|
t.Fatalf("expected 'mytoken', got '%s'", token)
|
|
|
|
}
|
|
|
|
|
2015-01-21 20:21:57 +00:00
|
|
|
// Ensure the reason was set in notes
|
|
|
|
if check.Notes != "broken" {
|
|
|
|
t.Fatalf("bad: %#v", check)
|
|
|
|
}
|
2015-01-15 19:26:14 +00:00
|
|
|
}
|
|
|
|
|
2016-12-14 22:16:46 +00:00
|
|
|
func TestAgent_NodeMaintenance_Disable(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a := NewTestAgent(t.Name(), "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2015-01-15 19:26:14 +00:00
|
|
|
|
|
|
|
// Force the node into maintenance mode
|
2017-05-21 07:11:09 +00:00
|
|
|
a.EnableNodeMaintenance("", "")
|
2015-01-15 19:26:14 +00:00
|
|
|
|
|
|
|
// Leave maintenance mode
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/self/maintenance?enable=false", nil)
|
|
|
|
resp := httptest.NewRecorder()
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentNodeMaintenance(resp, req); err != nil {
|
2015-01-15 19:26:14 +00:00
|
|
|
t.Fatalf("err: %s", err)
|
|
|
|
}
|
|
|
|
if resp.Code != 200 {
|
|
|
|
t.Fatalf("expected 200, got %d", resp.Code)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Ensure the maintenance check was removed
|
2017-08-28 12:17:13 +00:00
|
|
|
if _, ok := a.State.Checks()[structs.NodeMaint]; ok {
|
2015-01-15 19:26:14 +00:00
|
|
|
t.Fatalf("should have removed maintenance check")
|
|
|
|
}
|
|
|
|
}
|
2015-01-14 01:52:17 +00:00
|
|
|
|
2016-12-14 22:16:46 +00:00
|
|
|
func TestAgent_NodeMaintenance_ACLDeny(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-05-21 07:11:09 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig())
|
|
|
|
defer a.Shutdown()
|
2016-12-14 22:16:46 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("no token", func(t *testing.T) {
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/self/maintenance?enable=true&reason=broken", nil)
|
2017-08-23 14:52:48 +00:00
|
|
|
if _, err := a.srv.AgentNodeMaintenance(nil, req); !acl.IsErrPermissionDenied(err) {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2016-12-14 22:16:46 +00:00
|
|
|
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Run("root token", func(t *testing.T) {
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/self/maintenance?enable=true&reason=broken&token=root", nil)
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentNodeMaintenance(nil, req); err != nil {
|
2017-05-09 17:46:11 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2016-12-14 22:16:46 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestAgent_RegisterCheck_Service(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-09-25 18:40:42 +00:00
|
|
|
a := NewTestAgent(t.Name(), "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2015-01-14 01:52:17 +00:00
|
|
|
|
2017-06-15 16:46:06 +00:00
|
|
|
args := &structs.ServiceDefinition{
|
2015-01-14 01:52:17 +00:00
|
|
|
Name: "memcache",
|
|
|
|
Port: 8000,
|
2017-06-15 16:46:06 +00:00
|
|
|
Check: structs.CheckType{
|
2015-01-14 01:52:17 +00:00
|
|
|
TTL: 15 * time.Second,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
2017-05-09 16:58:12 +00:00
|
|
|
// First register the service
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register", jsonReader(args))
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentRegisterService(nil, req); err != nil {
|
2015-01-14 01:52:17 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Now register an additional check
|
2017-06-15 16:46:06 +00:00
|
|
|
checkArgs := &structs.CheckDefinition{
|
2015-01-14 01:52:17 +00:00
|
|
|
Name: "memcache_check2",
|
|
|
|
ServiceID: "memcache",
|
2017-05-15 19:49:13 +00:00
|
|
|
TTL: 15 * time.Second,
|
2015-01-14 01:52:17 +00:00
|
|
|
}
|
2017-09-26 06:11:19 +00:00
|
|
|
req, _ = http.NewRequest("PUT", "/v1/agent/check/register", jsonReader(checkArgs))
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentRegisterCheck(nil, req); err != nil {
|
2015-01-14 01:52:17 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Ensure we have a check mapping
|
2017-08-28 12:17:13 +00:00
|
|
|
result := a.State.Checks()
|
2015-01-14 01:52:17 +00:00
|
|
|
if _, ok := result["service:memcache"]; !ok {
|
|
|
|
t.Fatalf("missing memcached check")
|
|
|
|
}
|
|
|
|
if _, ok := result["memcache_check2"]; !ok {
|
|
|
|
t.Fatalf("missing memcache_check2 check")
|
|
|
|
}
|
|
|
|
|
|
|
|
// Make sure the new check is associated with the service
|
|
|
|
if result["memcache_check2"].ServiceID != "memcache" {
|
|
|
|
t.Fatalf("bad: %#v", result["memcached_check2"])
|
|
|
|
}
|
|
|
|
}
|
2016-11-16 21:45:26 +00:00
|
|
|
|
2016-12-14 17:33:57 +00:00
|
|
|
func TestAgent_Monitor(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2016-11-16 21:45:26 +00:00
|
|
|
logWriter := logger.NewLogWriter(512)
|
2017-05-21 07:11:09 +00:00
|
|
|
a := &TestAgent{
|
|
|
|
Name: t.Name(),
|
|
|
|
LogWriter: logWriter,
|
2017-05-22 23:43:34 +00:00
|
|
|
LogOutput: io.MultiWriter(os.Stderr, logWriter),
|
2017-05-21 07:11:09 +00:00
|
|
|
}
|
|
|
|
a.Start()
|
|
|
|
defer a.Shutdown()
|
2016-11-16 21:45:26 +00:00
|
|
|
|
2016-11-28 21:08:31 +00:00
|
|
|
// Try passing an invalid log level
|
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/monitor?loglevel=invalid", nil)
|
2016-11-16 21:45:26 +00:00
|
|
|
resp := newClosableRecorder()
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentMonitor(resp, req); err != nil {
|
2016-11-28 21:08:31 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
if resp.Code != 400 {
|
|
|
|
t.Fatalf("bad: %v", resp.Code)
|
|
|
|
}
|
|
|
|
body, _ := ioutil.ReadAll(resp.Body)
|
|
|
|
if !strings.Contains(string(body), "Unknown log level") {
|
|
|
|
t.Fatalf("bad: %s", body)
|
|
|
|
}
|
|
|
|
|
2016-12-15 02:13:30 +00:00
|
|
|
// Try to stream logs until we see the expected log line
|
2017-05-04 22:52:53 +00:00
|
|
|
retry.Run(t, func(r *retry.R) {
|
2016-12-15 02:13:30 +00:00
|
|
|
req, _ = http.NewRequest("GET", "/v1/agent/monitor?loglevel=debug", nil)
|
|
|
|
resp = newClosableRecorder()
|
|
|
|
done := make(chan struct{})
|
|
|
|
go func() {
|
2017-05-21 07:11:09 +00:00
|
|
|
if _, err := a.srv.AgentMonitor(resp, req); err != nil {
|
2016-12-15 02:13:30 +00:00
|
|
|
t.Fatalf("err: %s", err)
|
2016-11-16 21:45:26 +00:00
|
|
|
}
|
2016-12-15 02:13:30 +00:00
|
|
|
close(done)
|
|
|
|
}()
|
2016-11-16 21:45:26 +00:00
|
|
|
|
2016-12-15 02:13:30 +00:00
|
|
|
resp.Close()
|
|
|
|
<-done
|
|
|
|
|
2017-04-29 16:34:02 +00:00
|
|
|
got := resp.Body.Bytes()
|
|
|
|
want := []byte("raft: Initial configuration (index=1)")
|
|
|
|
if !bytes.Contains(got, want) {
|
|
|
|
r.Fatalf("got %q and did not find %q", got, want)
|
2016-11-16 21:45:26 +00:00
|
|
|
}
|
2017-04-29 16:34:02 +00:00
|
|
|
})
|
2016-11-16 21:45:26 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
type closableRecorder struct {
|
|
|
|
*httptest.ResponseRecorder
|
|
|
|
closer chan bool
|
|
|
|
}
|
|
|
|
|
|
|
|
func newClosableRecorder() *closableRecorder {
|
|
|
|
r := httptest.NewRecorder()
|
|
|
|
closer := make(chan bool)
|
|
|
|
return &closableRecorder{r, closer}
|
|
|
|
}
|
|
|
|
|
2016-12-15 02:13:30 +00:00
|
|
|
func (r *closableRecorder) Close() {
|
|
|
|
close(r.closer)
|
|
|
|
}
|
|
|
|
|
2016-11-16 21:45:26 +00:00
|
|
|
func (r *closableRecorder) CloseNotify() <-chan bool {
|
|
|
|
return r.closer
|
|
|
|
}
|
2016-12-14 17:33:57 +00:00
|
|
|
|
|
|
|
func TestAgent_Monitor_ACLDeny(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-05-21 07:11:09 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig())
|
|
|
|
defer a.Shutdown()
|
2016-12-14 17:33:57 +00:00
|
|
|
|
|
|
|
// Try without a token.
|
2017-05-09 11:38:05 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/monitor", nil)
|
2017-08-23 14:52:48 +00:00
|
|
|
if _, err := a.srv.AgentMonitor(nil, req); !acl.IsErrPermissionDenied(err) {
|
2016-12-14 17:33:57 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// This proves we call the ACL function, and we've got the other monitor
|
|
|
|
// test to prove monitor works, which should be sufficient. The monitor
|
|
|
|
// logic is a little complex to set up so isn't worth repeating again
|
|
|
|
// here.
|
|
|
|
}
|
2017-07-26 18:03:43 +00:00
|
|
|
|
|
|
|
func TestAgent_Token(t *testing.T) {
|
|
|
|
t.Parallel()
|
2017-11-28 21:47:30 +00:00
|
|
|
|
|
|
|
// The behavior of this handler when ACLs are disabled is vetted over
|
|
|
|
// in TestACL_Disabled_Response since there's already good infra set
|
|
|
|
// up over there to test this, and it calls the common function.
|
2017-09-25 18:40:42 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig()+`
|
|
|
|
acl_token = ""
|
|
|
|
acl_agent_token = ""
|
|
|
|
acl_agent_master_token = ""
|
|
|
|
`)
|
2017-07-26 18:03:43 +00:00
|
|
|
defer a.Shutdown()
|
|
|
|
|
2017-08-03 22:39:31 +00:00
|
|
|
type tokens struct {
|
|
|
|
user, agent, master, repl string
|
|
|
|
}
|
|
|
|
|
|
|
|
resetTokens := func(got tokens) {
|
|
|
|
a.tokens.UpdateUserToken(got.user)
|
|
|
|
a.tokens.UpdateAgentToken(got.agent)
|
|
|
|
a.tokens.UpdateAgentMasterToken(got.master)
|
|
|
|
a.tokens.UpdateACLReplicationToken(got.repl)
|
|
|
|
}
|
|
|
|
|
|
|
|
body := func(token string) io.Reader {
|
2017-07-26 18:03:43 +00:00
|
|
|
return jsonReader(&api.AgentToken{Token: token})
|
|
|
|
}
|
|
|
|
|
|
|
|
badJSON := func() io.Reader {
|
|
|
|
return jsonReader(false)
|
|
|
|
}
|
|
|
|
|
|
|
|
tests := []struct {
|
|
|
|
name string
|
|
|
|
method, url string
|
|
|
|
body io.Reader
|
|
|
|
code int
|
2017-08-03 22:39:31 +00:00
|
|
|
got, want tokens
|
2017-07-26 18:03:43 +00:00
|
|
|
}{
|
2017-08-03 22:39:31 +00:00
|
|
|
{
|
|
|
|
name: "bad token name",
|
|
|
|
method: "PUT",
|
|
|
|
url: "nope?token=root",
|
|
|
|
body: body("X"),
|
|
|
|
code: http.StatusNotFound,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "bad JSON",
|
|
|
|
method: "PUT",
|
|
|
|
url: "acl_token?token=root",
|
|
|
|
body: badJSON(),
|
|
|
|
code: http.StatusBadRequest,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "set user",
|
|
|
|
method: "PUT",
|
|
|
|
url: "acl_token?token=root",
|
|
|
|
body: body("U"),
|
|
|
|
code: http.StatusOK,
|
|
|
|
want: tokens{user: "U", agent: "U"},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "set agent",
|
|
|
|
method: "PUT",
|
|
|
|
url: "acl_agent_token?token=root",
|
|
|
|
body: body("A"),
|
|
|
|
code: http.StatusOK,
|
|
|
|
got: tokens{user: "U", agent: "U"},
|
|
|
|
want: tokens{user: "U", agent: "A"},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "set master",
|
|
|
|
method: "PUT",
|
|
|
|
url: "acl_agent_master_token?token=root",
|
|
|
|
body: body("M"),
|
|
|
|
code: http.StatusOK,
|
|
|
|
want: tokens{master: "M"},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "set repl",
|
|
|
|
method: "PUT",
|
|
|
|
url: "acl_replication_token?token=root",
|
|
|
|
body: body("R"),
|
|
|
|
code: http.StatusOK,
|
|
|
|
want: tokens{repl: "R"},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "clear user",
|
|
|
|
method: "PUT",
|
|
|
|
url: "acl_token?token=root",
|
|
|
|
body: body(""),
|
|
|
|
code: http.StatusOK,
|
|
|
|
got: tokens{user: "U"},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "clear agent",
|
|
|
|
method: "PUT",
|
|
|
|
url: "acl_agent_token?token=root",
|
|
|
|
body: body(""),
|
|
|
|
code: http.StatusOK,
|
|
|
|
got: tokens{agent: "A"},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "clear master",
|
|
|
|
method: "PUT",
|
|
|
|
url: "acl_agent_master_token?token=root",
|
|
|
|
body: body(""),
|
|
|
|
code: http.StatusOK,
|
|
|
|
got: tokens{master: "M"},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "clear repl",
|
|
|
|
method: "PUT",
|
|
|
|
url: "acl_replication_token?token=root",
|
|
|
|
body: body(""),
|
|
|
|
code: http.StatusOK,
|
|
|
|
got: tokens{repl: "R"},
|
|
|
|
},
|
2017-07-26 18:03:43 +00:00
|
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
|
|
t.Run(tt.name, func(t *testing.T) {
|
2017-08-03 22:39:31 +00:00
|
|
|
resetTokens(tt.got)
|
2017-07-26 18:03:43 +00:00
|
|
|
url := fmt.Sprintf("/v1/agent/token/%s", tt.url)
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
req, _ := http.NewRequest(tt.method, url, tt.body)
|
|
|
|
if _, err := a.srv.AgentToken(resp, req); err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
if got, want := resp.Code, tt.code; got != want {
|
|
|
|
t.Fatalf("got %d want %d", got, want)
|
|
|
|
}
|
2017-08-03 22:39:31 +00:00
|
|
|
if got, want := a.tokens.UserToken(), tt.want.user; got != want {
|
2017-07-26 18:03:43 +00:00
|
|
|
t.Fatalf("got %q want %q", got, want)
|
|
|
|
}
|
2017-08-03 22:39:31 +00:00
|
|
|
if got, want := a.tokens.AgentToken(), tt.want.agent; got != want {
|
2017-07-26 18:03:43 +00:00
|
|
|
t.Fatalf("got %q want %q", got, want)
|
|
|
|
}
|
2017-08-03 22:39:31 +00:00
|
|
|
if tt.want.master != "" && !a.tokens.IsAgentMasterToken(tt.want.master) {
|
|
|
|
t.Fatalf("%q should be the master token", tt.want.master)
|
|
|
|
}
|
|
|
|
if got, want := a.tokens.ACLReplicationToken(), tt.want.repl; got != want {
|
|
|
|
t.Fatalf("got %q want %q", got, want)
|
2017-07-26 18:03:43 +00:00
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
// This one returns an error that is interpreted by the HTTP wrapper, so
|
|
|
|
// doesn't fit into our table above.
|
|
|
|
t.Run("permission denied", func(t *testing.T) {
|
2017-08-03 22:39:31 +00:00
|
|
|
resetTokens(tokens{})
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/token/acl_token", body("X"))
|
2017-08-23 14:52:48 +00:00
|
|
|
if _, err := a.srv.AgentToken(nil, req); !acl.IsErrPermissionDenied(err) {
|
2017-07-26 18:03:43 +00:00
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
if got, want := a.tokens.UserToken(), ""; got != want {
|
|
|
|
t.Fatalf("got %q want %q", got, want)
|
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
2018-03-21 17:20:35 +00:00
|
|
|
|
|
|
|
func TestAgentConnectCARoots_empty(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
2018-05-09 16:15:29 +00:00
|
|
|
require := require.New(t)
|
2018-04-30 21:23:49 +00:00
|
|
|
a := NewTestAgent(t.Name(), "connect { enabled = false }")
|
2018-03-21 17:20:35 +00:00
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/connect/ca/roots", nil)
|
|
|
|
resp := httptest.NewRecorder()
|
2018-07-25 19:26:27 +00:00
|
|
|
_, err := a.srv.AgentConnectCARoots(resp, req)
|
|
|
|
require.Error(err)
|
|
|
|
require.Contains(err.Error(), "Connect must be enabled")
|
2018-03-21 17:20:35 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestAgentConnectCARoots_list(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
2018-05-09 16:15:29 +00:00
|
|
|
assert := assert.New(t)
|
2018-04-11 09:18:24 +00:00
|
|
|
require := require.New(t)
|
2018-03-21 17:20:35 +00:00
|
|
|
a := NewTestAgent(t.Name(), "")
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
2018-04-30 21:23:49 +00:00
|
|
|
// Set some CAs. Note that NewTestAgent already bootstraps one CA so this just
|
|
|
|
// adds a second and makes it active.
|
|
|
|
ca2 := connect.TestCAConfigSet(t, a, nil)
|
2018-03-21 17:20:35 +00:00
|
|
|
|
|
|
|
// List
|
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/connect/ca/roots", nil)
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
obj, err := a.srv.AgentConnectCARoots(resp, req)
|
2018-05-09 16:15:29 +00:00
|
|
|
require.NoError(err)
|
2018-03-21 17:20:35 +00:00
|
|
|
|
|
|
|
value := obj.(structs.IndexedCARoots)
|
2018-05-09 16:15:29 +00:00
|
|
|
assert.Equal(value.ActiveRootID, ca2.ID)
|
|
|
|
// Would like to assert that it's the same as the TestAgent domain but the
|
|
|
|
// only way to access that state via this package is by RPC to the server
|
|
|
|
// implementation running in TestAgent which is more or less a tautology.
|
|
|
|
assert.NotEmpty(value.TrustDomain)
|
|
|
|
assert.Len(value.Roots, 2)
|
2018-03-21 17:20:35 +00:00
|
|
|
|
|
|
|
// We should never have the secret information
|
|
|
|
for _, r := range value.Roots {
|
2018-05-09 16:15:29 +00:00
|
|
|
assert.Equal("", r.SigningCert)
|
|
|
|
assert.Equal("", r.SigningKey)
|
2018-04-11 09:18:24 +00:00
|
|
|
}
|
|
|
|
|
2018-06-15 12:13:54 +00:00
|
|
|
assert.Equal("MISS", resp.Header().Get("X-Cache"))
|
2018-04-11 09:18:24 +00:00
|
|
|
|
|
|
|
// Test caching
|
|
|
|
{
|
|
|
|
// List it again
|
2018-06-15 12:13:54 +00:00
|
|
|
resp2 := httptest.NewRecorder()
|
|
|
|
obj2, err := a.srv.AgentConnectCARoots(resp2, req)
|
2018-05-09 16:15:29 +00:00
|
|
|
require.NoError(err)
|
|
|
|
assert.Equal(obj, obj2)
|
2018-04-11 09:18:24 +00:00
|
|
|
|
|
|
|
// Should cache hit this time and not make request
|
2018-06-15 12:13:54 +00:00
|
|
|
assert.Equal("HIT", resp2.Header().Get("X-Cache"))
|
2018-04-11 09:18:24 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Test that caching is updated in the background
|
|
|
|
{
|
2018-04-30 21:23:49 +00:00
|
|
|
// Set a new CA
|
|
|
|
ca := connect.TestCAConfigSet(t, a, nil)
|
2018-04-11 09:18:24 +00:00
|
|
|
|
2018-04-22 21:00:32 +00:00
|
|
|
retry.Run(t, func(r *retry.R) {
|
|
|
|
// List it again
|
2018-06-15 12:13:54 +00:00
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
obj, err := a.srv.AgentConnectCARoots(resp, req)
|
2018-04-30 21:23:49 +00:00
|
|
|
r.Check(err)
|
2018-04-11 09:18:24 +00:00
|
|
|
|
2018-04-22 21:00:32 +00:00
|
|
|
value := obj.(structs.IndexedCARoots)
|
|
|
|
if ca.ID != value.ActiveRootID {
|
|
|
|
r.Fatalf("%s != %s", ca.ID, value.ActiveRootID)
|
|
|
|
}
|
2018-04-30 21:23:49 +00:00
|
|
|
// There are now 3 CAs because we didn't complete rotation on the original
|
|
|
|
// 2
|
|
|
|
if len(value.Roots) != 3 {
|
2018-04-22 21:00:32 +00:00
|
|
|
r.Fatalf("bad len: %d", len(value.Roots))
|
|
|
|
}
|
2018-04-11 09:18:24 +00:00
|
|
|
|
2018-06-15 12:13:54 +00:00
|
|
|
// Should be a cache hit! The data should've updated in the cache
|
|
|
|
// in the background so this should've been fetched directly from
|
|
|
|
// the cache.
|
|
|
|
if resp.Header().Get("X-Cache") != "HIT" {
|
|
|
|
r.Fatalf("should be a cache hit")
|
|
|
|
}
|
|
|
|
})
|
2018-03-21 17:20:35 +00:00
|
|
|
}
|
|
|
|
}
|
2018-03-21 17:55:39 +00:00
|
|
|
|
2018-05-07 04:46:22 +00:00
|
|
|
func TestAgentConnectCALeafCert_aclDefaultDeny(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
require := require.New(t)
|
2018-06-13 08:34:20 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig()+testAllowProxyConfig())
|
2018-05-07 04:46:22 +00:00
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
// Register a service with a managed proxy
|
|
|
|
{
|
|
|
|
reg := &structs.ServiceDefinition{
|
|
|
|
ID: "test-id",
|
|
|
|
Name: "test",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
Port: 8000,
|
|
|
|
Check: structs.CheckType{
|
|
|
|
TTL: 15 * time.Second,
|
|
|
|
},
|
2018-06-05 17:51:05 +00:00
|
|
|
Connect: &structs.ServiceConnect{
|
2018-05-07 04:46:22 +00:00
|
|
|
Proxy: &structs.ServiceDefinitionConnectProxy{},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register?token=root", jsonReader(reg))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err := a.srv.AgentRegisterService(resp, req)
|
|
|
|
require.NoError(err)
|
|
|
|
require.Equal(200, resp.Code, "body: %s", resp.Body.String())
|
|
|
|
}
|
|
|
|
|
2018-05-19 06:27:02 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/connect/ca/leaf/test", nil)
|
2018-05-07 04:46:22 +00:00
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err := a.srv.AgentConnectCALeafCert(resp, req)
|
|
|
|
require.Error(err)
|
|
|
|
require.True(acl.IsErrPermissionDenied(err))
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestAgentConnectCALeafCert_aclProxyToken(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
require := require.New(t)
|
2018-06-13 08:34:20 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig()+testAllowProxyConfig())
|
2018-05-07 04:46:22 +00:00
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
// Register a service with a managed proxy
|
|
|
|
{
|
|
|
|
reg := &structs.ServiceDefinition{
|
|
|
|
ID: "test-id",
|
|
|
|
Name: "test",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
Port: 8000,
|
|
|
|
Check: structs.CheckType{
|
|
|
|
TTL: 15 * time.Second,
|
|
|
|
},
|
2018-06-05 17:51:05 +00:00
|
|
|
Connect: &structs.ServiceConnect{
|
2018-05-07 04:46:22 +00:00
|
|
|
Proxy: &structs.ServiceDefinitionConnectProxy{},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register?token=root", jsonReader(reg))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err := a.srv.AgentRegisterService(resp, req)
|
|
|
|
require.NoError(err)
|
|
|
|
require.Equal(200, resp.Code, "body: %s", resp.Body.String())
|
|
|
|
}
|
|
|
|
|
|
|
|
// Get the proxy token from the agent directly, since there is no API.
|
|
|
|
proxy := a.State.Proxy("test-id-proxy")
|
|
|
|
require.NotNil(proxy)
|
|
|
|
token := proxy.ProxyToken
|
|
|
|
require.NotEmpty(token)
|
|
|
|
|
2018-05-19 06:27:02 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/connect/ca/leaf/test?token="+token, nil)
|
2018-05-07 04:46:22 +00:00
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
obj, err := a.srv.AgentConnectCALeafCert(resp, req)
|
|
|
|
require.NoError(err)
|
|
|
|
|
|
|
|
// Get the issued cert
|
|
|
|
_, ok := obj.(*structs.IssuedCert)
|
|
|
|
require.True(ok)
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestAgentConnectCALeafCert_aclProxyTokenOther(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
require := require.New(t)
|
2018-06-13 08:34:20 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig()+testAllowProxyConfig())
|
2018-05-07 04:46:22 +00:00
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
// Register a service with a managed proxy
|
|
|
|
{
|
|
|
|
reg := &structs.ServiceDefinition{
|
|
|
|
ID: "test-id",
|
|
|
|
Name: "test",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
Port: 8000,
|
|
|
|
Check: structs.CheckType{
|
|
|
|
TTL: 15 * time.Second,
|
|
|
|
},
|
2018-06-05 17:51:05 +00:00
|
|
|
Connect: &structs.ServiceConnect{
|
2018-05-07 04:46:22 +00:00
|
|
|
Proxy: &structs.ServiceDefinitionConnectProxy{},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register?token=root", jsonReader(reg))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err := a.srv.AgentRegisterService(resp, req)
|
|
|
|
require.NoError(err)
|
|
|
|
require.Equal(200, resp.Code, "body: %s", resp.Body.String())
|
|
|
|
}
|
|
|
|
|
|
|
|
// Register another service
|
|
|
|
{
|
|
|
|
reg := &structs.ServiceDefinition{
|
|
|
|
ID: "wrong-id",
|
|
|
|
Name: "wrong",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
Port: 8000,
|
|
|
|
Check: structs.CheckType{
|
|
|
|
TTL: 15 * time.Second,
|
|
|
|
},
|
2018-06-05 17:51:05 +00:00
|
|
|
Connect: &structs.ServiceConnect{
|
2018-05-07 04:46:22 +00:00
|
|
|
Proxy: &structs.ServiceDefinitionConnectProxy{},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register?token=root", jsonReader(reg))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err := a.srv.AgentRegisterService(resp, req)
|
|
|
|
require.NoError(err)
|
|
|
|
require.Equal(200, resp.Code, "body: %s", resp.Body.String())
|
|
|
|
}
|
|
|
|
|
|
|
|
// Get the proxy token from the agent directly, since there is no API.
|
|
|
|
proxy := a.State.Proxy("wrong-id-proxy")
|
|
|
|
require.NotNil(proxy)
|
|
|
|
token := proxy.ProxyToken
|
|
|
|
require.NotEmpty(token)
|
|
|
|
|
2018-05-19 06:27:02 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/connect/ca/leaf/test?token="+token, nil)
|
2018-05-07 04:46:22 +00:00
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err := a.srv.AgentConnectCALeafCert(resp, req)
|
|
|
|
require.Error(err)
|
|
|
|
require.True(acl.IsErrPermissionDenied(err))
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestAgentConnectCALeafCert_aclServiceWrite(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
require := require.New(t)
|
2018-06-13 08:34:20 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig()+testAllowProxyConfig())
|
2018-05-07 04:46:22 +00:00
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
// Register a service with a managed proxy
|
|
|
|
{
|
|
|
|
reg := &structs.ServiceDefinition{
|
|
|
|
ID: "test-id",
|
|
|
|
Name: "test",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
Port: 8000,
|
|
|
|
Check: structs.CheckType{
|
|
|
|
TTL: 15 * time.Second,
|
|
|
|
},
|
2018-06-05 17:51:05 +00:00
|
|
|
Connect: &structs.ServiceConnect{
|
2018-05-07 04:46:22 +00:00
|
|
|
Proxy: &structs.ServiceDefinitionConnectProxy{},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register?token=root", jsonReader(reg))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err := a.srv.AgentRegisterService(resp, req)
|
|
|
|
require.NoError(err)
|
|
|
|
require.Equal(200, resp.Code, "body: %s", resp.Body.String())
|
|
|
|
}
|
|
|
|
|
|
|
|
// Create an ACL with service:write for our service
|
|
|
|
var token string
|
|
|
|
{
|
|
|
|
args := map[string]interface{}{
|
|
|
|
"Name": "User Token",
|
|
|
|
"Type": "client",
|
|
|
|
"Rules": `service "test" { policy = "write" }`,
|
|
|
|
}
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/acl/create?token=root", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
obj, err := a.srv.ACLCreate(resp, req)
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
aclResp := obj.(aclCreateResponse)
|
|
|
|
token = aclResp.ID
|
|
|
|
}
|
|
|
|
|
2018-05-19 06:27:02 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/connect/ca/leaf/test?token="+token, nil)
|
2018-05-07 04:46:22 +00:00
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
obj, err := a.srv.AgentConnectCALeafCert(resp, req)
|
|
|
|
require.NoError(err)
|
|
|
|
|
|
|
|
// Get the issued cert
|
|
|
|
_, ok := obj.(*structs.IssuedCert)
|
|
|
|
require.True(ok)
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestAgentConnectCALeafCert_aclServiceReadDeny(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
require := require.New(t)
|
2018-06-13 08:34:20 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig()+testAllowProxyConfig())
|
2018-05-07 04:46:22 +00:00
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
// Register a service with a managed proxy
|
|
|
|
{
|
|
|
|
reg := &structs.ServiceDefinition{
|
|
|
|
ID: "test-id",
|
|
|
|
Name: "test",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
Port: 8000,
|
|
|
|
Check: structs.CheckType{
|
|
|
|
TTL: 15 * time.Second,
|
|
|
|
},
|
2018-06-05 17:51:05 +00:00
|
|
|
Connect: &structs.ServiceConnect{
|
2018-05-07 04:46:22 +00:00
|
|
|
Proxy: &structs.ServiceDefinitionConnectProxy{},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register?token=root", jsonReader(reg))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err := a.srv.AgentRegisterService(resp, req)
|
|
|
|
require.NoError(err)
|
|
|
|
require.Equal(200, resp.Code, "body: %s", resp.Body.String())
|
|
|
|
}
|
|
|
|
|
|
|
|
// Create an ACL with service:read for our service
|
|
|
|
var token string
|
|
|
|
{
|
|
|
|
args := map[string]interface{}{
|
|
|
|
"Name": "User Token",
|
|
|
|
"Type": "client",
|
|
|
|
"Rules": `service "test" { policy = "read" }`,
|
|
|
|
}
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/acl/create?token=root", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
obj, err := a.srv.ACLCreate(resp, req)
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
aclResp := obj.(aclCreateResponse)
|
|
|
|
token = aclResp.ID
|
|
|
|
}
|
|
|
|
|
2018-05-19 06:27:02 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/connect/ca/leaf/test?token="+token, nil)
|
2018-05-07 04:46:22 +00:00
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err := a.srv.AgentConnectCALeafCert(resp, req)
|
|
|
|
require.Error(err)
|
|
|
|
require.True(acl.IsErrPermissionDenied(err))
|
|
|
|
}
|
|
|
|
|
2018-03-21 17:55:39 +00:00
|
|
|
func TestAgentConnectCALeafCert_good(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
assert := assert.New(t)
|
2018-04-30 21:23:49 +00:00
|
|
|
require := require.New(t)
|
2018-03-21 17:55:39 +00:00
|
|
|
a := NewTestAgent(t.Name(), "")
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
2018-04-30 21:23:49 +00:00
|
|
|
// CA already setup by default by NewTestAgent but force a new one so we can
|
|
|
|
// verify it was signed easily.
|
|
|
|
ca1 := connect.TestCAConfigSet(t, a, nil)
|
|
|
|
|
2018-03-21 17:55:39 +00:00
|
|
|
{
|
|
|
|
// Register a local service
|
|
|
|
args := &structs.ServiceDefinition{
|
|
|
|
ID: "foo",
|
|
|
|
Name: "test",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
Port: 8000,
|
|
|
|
Check: structs.CheckType{
|
|
|
|
TTL: 15 * time.Second,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err := a.srv.AgentRegisterService(resp, req)
|
2018-04-30 21:23:49 +00:00
|
|
|
require.NoError(err)
|
2018-03-21 17:55:39 +00:00
|
|
|
if !assert.Equal(200, resp.Code) {
|
|
|
|
t.Log("Body: ", resp.Body.String())
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// List
|
2018-05-19 06:27:02 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/connect/ca/leaf/test", nil)
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
obj, err := a.srv.AgentConnectCALeafCert(resp, req)
|
|
|
|
require.NoError(err)
|
2018-06-15 12:13:54 +00:00
|
|
|
require.Equal("MISS", resp.Header().Get("X-Cache"))
|
2018-06-13 19:43:34 +00:00
|
|
|
|
2018-05-19 06:27:02 +00:00
|
|
|
// Get the issued cert
|
|
|
|
issued, ok := obj.(*structs.IssuedCert)
|
|
|
|
assert.True(ok)
|
|
|
|
|
|
|
|
// Verify that the cert is signed by the CA
|
|
|
|
requireLeafValidUnderCA(t, issued, ca1)
|
|
|
|
|
|
|
|
// Verify blocking index
|
|
|
|
assert.True(issued.ModifyIndex > 0)
|
|
|
|
assert.Equal(fmt.Sprintf("%d", issued.ModifyIndex),
|
|
|
|
resp.Header().Get("X-Consul-Index"))
|
|
|
|
|
|
|
|
// Test caching
|
|
|
|
{
|
|
|
|
// Fetch it again
|
2018-06-15 12:13:54 +00:00
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
obj2, err := a.srv.AgentConnectCALeafCert(resp, req)
|
2018-05-19 06:27:02 +00:00
|
|
|
require.NoError(err)
|
|
|
|
require.Equal(obj, obj2)
|
|
|
|
|
|
|
|
// Should cache hit this time and not make request
|
2018-06-15 12:13:54 +00:00
|
|
|
require.Equal("HIT", resp.Header().Get("X-Cache"))
|
2018-05-19 06:27:02 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Test that caching is updated in the background
|
|
|
|
{
|
|
|
|
// Set a new CA
|
|
|
|
ca := connect.TestCAConfigSet(t, a, nil)
|
|
|
|
|
|
|
|
retry.Run(t, func(r *retry.R) {
|
2018-06-15 12:13:54 +00:00
|
|
|
resp := httptest.NewRecorder()
|
2018-05-19 06:27:02 +00:00
|
|
|
// Try and sign again (note no index/wait arg since cache should update in
|
|
|
|
// background even if we aren't actively blocking)
|
2018-06-15 12:13:54 +00:00
|
|
|
obj, err := a.srv.AgentConnectCALeafCert(resp, req)
|
2018-05-19 06:27:02 +00:00
|
|
|
r.Check(err)
|
|
|
|
|
|
|
|
issued2 := obj.(*structs.IssuedCert)
|
|
|
|
if issued.CertPEM == issued2.CertPEM {
|
|
|
|
r.Fatalf("leaf has not updated")
|
|
|
|
}
|
|
|
|
|
|
|
|
// Got a new leaf. Sanity check it's a whole new key as well as differnt
|
|
|
|
// cert.
|
|
|
|
if issued.PrivateKeyPEM == issued2.PrivateKeyPEM {
|
|
|
|
r.Fatalf("new leaf has same private key as before")
|
|
|
|
}
|
|
|
|
|
|
|
|
// Verify that the cert is signed by the new CA
|
|
|
|
requireLeafValidUnderCA(t, issued2, ca)
|
|
|
|
|
2018-06-15 12:13:54 +00:00
|
|
|
// Should be a cache hit! The data should've updated in the cache
|
|
|
|
// in the background so this should've been fetched directly from
|
|
|
|
// the cache.
|
|
|
|
if resp.Header().Get("X-Cache") != "HIT" {
|
|
|
|
r.Fatalf("should be a cache hit")
|
|
|
|
}
|
|
|
|
})
|
2018-05-19 06:27:02 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Test we can request a leaf cert for a service we have permission for
|
|
|
|
// but is not local to this agent.
|
|
|
|
func TestAgentConnectCALeafCert_goodNotLocal(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
assert := assert.New(t)
|
|
|
|
require := require.New(t)
|
|
|
|
a := NewTestAgent(t.Name(), "")
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
// CA already setup by default by NewTestAgent but force a new one so we can
|
|
|
|
// verify it was signed easily.
|
|
|
|
ca1 := connect.TestCAConfigSet(t, a, nil)
|
|
|
|
|
|
|
|
{
|
|
|
|
// Register a non-local service (central catalog)
|
|
|
|
args := &structs.RegisterRequest{
|
|
|
|
Node: "foo",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
Service: &structs.NodeService{
|
|
|
|
Service: "test",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
Port: 8080,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/catalog/register", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err := a.srv.CatalogRegister(resp, req)
|
|
|
|
require.NoError(err)
|
|
|
|
if !assert.Equal(200, resp.Code) {
|
|
|
|
t.Log("Body: ", resp.Body.String())
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// List
|
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/connect/ca/leaf/test", nil)
|
2018-03-21 17:55:39 +00:00
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
obj, err := a.srv.AgentConnectCALeafCert(resp, req)
|
2018-04-30 21:23:49 +00:00
|
|
|
require.NoError(err)
|
2018-06-15 12:13:54 +00:00
|
|
|
require.Equal("MISS", resp.Header().Get("X-Cache"))
|
2018-03-21 17:55:39 +00:00
|
|
|
|
|
|
|
// Get the issued cert
|
|
|
|
issued, ok := obj.(*structs.IssuedCert)
|
|
|
|
assert.True(ok)
|
|
|
|
|
|
|
|
// Verify that the cert is signed by the CA
|
2018-04-30 21:23:49 +00:00
|
|
|
requireLeafValidUnderCA(t, issued, ca1)
|
|
|
|
|
|
|
|
// Verify blocking index
|
|
|
|
assert.True(issued.ModifyIndex > 0)
|
|
|
|
assert.Equal(fmt.Sprintf("%d", issued.ModifyIndex),
|
|
|
|
resp.Header().Get("X-Consul-Index"))
|
|
|
|
|
|
|
|
// Test caching
|
|
|
|
{
|
|
|
|
// Fetch it again
|
2018-06-15 12:13:54 +00:00
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
obj2, err := a.srv.AgentConnectCALeafCert(resp, req)
|
2018-04-30 21:23:49 +00:00
|
|
|
require.NoError(err)
|
|
|
|
require.Equal(obj, obj2)
|
|
|
|
|
|
|
|
// Should cache hit this time and not make request
|
2018-06-15 12:13:54 +00:00
|
|
|
require.Equal("HIT", resp.Header().Get("X-Cache"))
|
2018-04-30 21:23:49 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Test that caching is updated in the background
|
|
|
|
{
|
|
|
|
// Set a new CA
|
|
|
|
ca := connect.TestCAConfigSet(t, a, nil)
|
|
|
|
|
|
|
|
retry.Run(t, func(r *retry.R) {
|
2018-06-15 12:13:54 +00:00
|
|
|
resp := httptest.NewRecorder()
|
2018-04-30 21:23:49 +00:00
|
|
|
// Try and sign again (note no index/wait arg since cache should update in
|
|
|
|
// background even if we aren't actively blocking)
|
2018-06-15 12:13:54 +00:00
|
|
|
obj, err := a.srv.AgentConnectCALeafCert(resp, req)
|
2018-04-30 21:23:49 +00:00
|
|
|
r.Check(err)
|
|
|
|
|
|
|
|
issued2 := obj.(*structs.IssuedCert)
|
|
|
|
if issued.CertPEM == issued2.CertPEM {
|
|
|
|
r.Fatalf("leaf has not updated")
|
|
|
|
}
|
|
|
|
|
2018-06-08 15:18:58 +00:00
|
|
|
// Got a new leaf. Sanity check it's a whole new key as well as different
|
2018-04-30 21:23:49 +00:00
|
|
|
// cert.
|
|
|
|
if issued.PrivateKeyPEM == issued2.PrivateKeyPEM {
|
|
|
|
r.Fatalf("new leaf has same private key as before")
|
|
|
|
}
|
|
|
|
|
|
|
|
// Verify that the cert is signed by the new CA
|
|
|
|
requireLeafValidUnderCA(t, issued2, ca)
|
|
|
|
|
2018-06-15 12:13:54 +00:00
|
|
|
// Should be a cache hit! The data should've updated in the cache
|
|
|
|
// in the background so this should've been fetched directly from
|
|
|
|
// the cache.
|
|
|
|
if resp.Header().Get("X-Cache") != "HIT" {
|
|
|
|
r.Fatalf("should be a cache hit")
|
|
|
|
}
|
|
|
|
})
|
2018-04-30 21:23:49 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func requireLeafValidUnderCA(t *testing.T, issued *structs.IssuedCert,
|
|
|
|
ca *structs.CARoot) {
|
|
|
|
|
2018-03-21 17:55:39 +00:00
|
|
|
roots := x509.NewCertPool()
|
2018-04-30 21:23:49 +00:00
|
|
|
require.True(t, roots.AppendCertsFromPEM([]byte(ca.RootCert)))
|
2018-03-21 17:55:39 +00:00
|
|
|
leaf, err := connect.ParseCert(issued.CertPEM)
|
2018-04-30 21:23:49 +00:00
|
|
|
require.NoError(t, err)
|
2018-03-21 17:55:39 +00:00
|
|
|
_, err = leaf.Verify(x509.VerifyOptions{
|
|
|
|
Roots: roots,
|
|
|
|
})
|
2018-04-30 21:23:49 +00:00
|
|
|
require.NoError(t, err)
|
2018-03-21 17:55:39 +00:00
|
|
|
|
2018-04-30 21:23:49 +00:00
|
|
|
// Verify the private key matches. tls.LoadX509Keypair does this for us!
|
|
|
|
_, err = tls.X509KeyPair([]byte(issued.CertPEM), []byte(issued.PrivateKeyPEM))
|
|
|
|
require.NoError(t, err)
|
2018-03-21 17:55:39 +00:00
|
|
|
}
|
2018-03-26 00:52:26 +00:00
|
|
|
|
2018-04-26 13:01:20 +00:00
|
|
|
func TestAgentConnectProxyConfig_Blocking(t *testing.T) {
|
2018-04-18 20:05:30 +00:00
|
|
|
t.Parallel()
|
|
|
|
|
2018-06-13 08:34:20 +00:00
|
|
|
a := NewTestAgent(t.Name(), testAllowProxyConfig())
|
2018-04-18 20:05:30 +00:00
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
// Define a local service with a managed proxy. It's registered in the test
|
|
|
|
// loop to make sure agent state is predictable whatever order tests execute
|
|
|
|
// since some alter this service config.
|
|
|
|
reg := &structs.ServiceDefinition{
|
|
|
|
Name: "test",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
Port: 8000,
|
|
|
|
Check: structs.CheckType{
|
|
|
|
TTL: 15 * time.Second,
|
|
|
|
},
|
2018-06-05 17:51:05 +00:00
|
|
|
Connect: &structs.ServiceConnect{
|
2018-04-18 20:05:30 +00:00
|
|
|
Proxy: &structs.ServiceDefinitionConnectProxy{
|
2018-05-03 17:44:10 +00:00
|
|
|
Command: []string{"tubes.sh"},
|
2018-04-18 20:05:30 +00:00
|
|
|
Config: map[string]interface{}{
|
|
|
|
"bind_port": 1234,
|
|
|
|
"connect_timeout_ms": 500,
|
|
|
|
"upstreams": []map[string]interface{}{
|
|
|
|
{
|
|
|
|
"destination_name": "db",
|
|
|
|
"local_port": 3131,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
2018-04-20 13:24:24 +00:00
|
|
|
expectedResponse := &api.ConnectProxyConfig{
|
2018-04-18 20:05:30 +00:00
|
|
|
ProxyServiceID: "test-proxy",
|
|
|
|
TargetServiceID: "test",
|
|
|
|
TargetServiceName: "test",
|
2018-05-03 17:44:10 +00:00
|
|
|
ContentHash: "4662e51e78609569",
|
2018-04-18 20:05:30 +00:00
|
|
|
ExecMode: "daemon",
|
2018-05-03 17:44:10 +00:00
|
|
|
Command: []string{"tubes.sh"},
|
2018-04-18 20:05:30 +00:00
|
|
|
Config: map[string]interface{}{
|
|
|
|
"upstreams": []interface{}{
|
|
|
|
map[string]interface{}{
|
|
|
|
"destination_name": "db",
|
|
|
|
"local_port": float64(3131),
|
|
|
|
},
|
|
|
|
},
|
2018-04-26 13:01:20 +00:00
|
|
|
"bind_address": "127.0.0.1",
|
|
|
|
"local_service_address": "127.0.0.1:8000",
|
2018-06-30 13:18:13 +00:00
|
|
|
"bind_port": int(1234),
|
2018-04-26 13:01:20 +00:00
|
|
|
"connect_timeout_ms": float64(500),
|
2018-04-18 20:05:30 +00:00
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
ur, err := copystructure.Copy(expectedResponse)
|
|
|
|
require.NoError(t, err)
|
2018-04-20 13:24:24 +00:00
|
|
|
updatedResponse := ur.(*api.ConnectProxyConfig)
|
2018-06-20 11:58:08 +00:00
|
|
|
updatedResponse.ContentHash = "23b5b6b3767601e1"
|
2018-04-18 20:05:30 +00:00
|
|
|
upstreams := updatedResponse.Config["upstreams"].([]interface{})
|
|
|
|
upstreams = append(upstreams,
|
|
|
|
map[string]interface{}{
|
|
|
|
"destination_name": "cache",
|
|
|
|
"local_port": float64(4242),
|
|
|
|
})
|
|
|
|
updatedResponse.Config["upstreams"] = upstreams
|
|
|
|
|
|
|
|
tests := []struct {
|
|
|
|
name string
|
|
|
|
url string
|
|
|
|
updateFunc func()
|
|
|
|
wantWait time.Duration
|
|
|
|
wantCode int
|
|
|
|
wantErr bool
|
2018-04-20 13:24:24 +00:00
|
|
|
wantResp *api.ConnectProxyConfig
|
2018-04-18 20:05:30 +00:00
|
|
|
}{
|
|
|
|
{
|
|
|
|
name: "simple fetch",
|
|
|
|
url: "/v1/agent/connect/proxy/test-proxy",
|
|
|
|
wantCode: 200,
|
|
|
|
wantErr: false,
|
|
|
|
wantResp: expectedResponse,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "blocking fetch timeout, no change",
|
2018-04-05 16:15:43 +00:00
|
|
|
url: "/v1/agent/connect/proxy/test-proxy?hash=" + expectedResponse.ContentHash + "&wait=100ms",
|
2018-04-18 20:05:30 +00:00
|
|
|
wantWait: 100 * time.Millisecond,
|
|
|
|
wantCode: 200,
|
|
|
|
wantErr: false,
|
|
|
|
wantResp: expectedResponse,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "blocking fetch old hash should return immediately",
|
|
|
|
url: "/v1/agent/connect/proxy/test-proxy?hash=123456789abcd&wait=10m",
|
|
|
|
wantCode: 200,
|
|
|
|
wantErr: false,
|
|
|
|
wantResp: expectedResponse,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "blocking fetch returns change",
|
2018-04-05 16:15:43 +00:00
|
|
|
url: "/v1/agent/connect/proxy/test-proxy?hash=" + expectedResponse.ContentHash,
|
2018-04-18 20:05:30 +00:00
|
|
|
updateFunc: func() {
|
|
|
|
time.Sleep(100 * time.Millisecond)
|
|
|
|
// Re-register with new proxy config
|
|
|
|
r2, err := copystructure.Copy(reg)
|
|
|
|
require.NoError(t, err)
|
|
|
|
reg2 := r2.(*structs.ServiceDefinition)
|
|
|
|
reg2.Connect.Proxy.Config = updatedResponse.Config
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register", jsonReader(r2))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err = a.srv.AgentRegisterService(resp, req)
|
|
|
|
require.NoError(t, err)
|
|
|
|
require.Equal(t, 200, resp.Code, "body: %s", resp.Body.String())
|
|
|
|
},
|
|
|
|
wantWait: 100 * time.Millisecond,
|
|
|
|
wantCode: 200,
|
|
|
|
wantErr: false,
|
|
|
|
wantResp: updatedResponse,
|
|
|
|
},
|
2018-04-26 13:01:20 +00:00
|
|
|
{
|
|
|
|
// This test exercises a case that caused a busy loop to eat CPU for the
|
|
|
|
// entire duration of the blocking query. If a service gets re-registered
|
|
|
|
// wth same proxy config then the old proxy config chan is closed causing
|
|
|
|
// blocked watchset.Watch to return false indicating a change. But since
|
|
|
|
// the hash is the same when the blocking fn is re-called we should just
|
|
|
|
// keep blocking on the next iteration. The bug hit was that the WatchSet
|
|
|
|
// ws was not being reset in the loop and so when you try to `Watch` it
|
|
|
|
// the second time it just returns immediately making the blocking loop
|
|
|
|
// into a busy-poll!
|
|
|
|
//
|
|
|
|
// This test though doesn't catch that because busy poll still has the
|
|
|
|
// correct external behaviour. I don't want to instrument the loop to
|
|
|
|
// assert it's not executing too fast here as I can't think of a clean way
|
|
|
|
// and the issue is fixed now so this test doesn't actually catch the
|
|
|
|
// error, but does provide an easy way to verify the behaviour by hand:
|
|
|
|
// 1. Make this test fail e.g. change wantErr to true
|
|
|
|
// 2. Add a log.Println or similar into the blocking loop/function
|
|
|
|
// 3. See whether it's called just once or many times in a tight loop.
|
|
|
|
name: "blocking fetch interrupted with no change (same hash)",
|
|
|
|
url: "/v1/agent/connect/proxy/test-proxy?wait=200ms&hash=" + expectedResponse.ContentHash,
|
|
|
|
updateFunc: func() {
|
|
|
|
time.Sleep(100 * time.Millisecond)
|
|
|
|
// Re-register with _same_ proxy config
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register", jsonReader(reg))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err = a.srv.AgentRegisterService(resp, req)
|
|
|
|
require.NoError(t, err)
|
|
|
|
require.Equal(t, 200, resp.Code, "body: %s", resp.Body.String())
|
|
|
|
},
|
|
|
|
wantWait: 200 * time.Millisecond,
|
|
|
|
wantCode: 200,
|
|
|
|
wantErr: false,
|
|
|
|
wantResp: expectedResponse,
|
|
|
|
},
|
2018-04-18 20:05:30 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
for _, tt := range tests {
|
|
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
|
|
assert := assert.New(t)
|
|
|
|
require := require.New(t)
|
|
|
|
|
|
|
|
// Register the basic service to ensure it's in a known state to start.
|
|
|
|
{
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register", jsonReader(reg))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err := a.srv.AgentRegisterService(resp, req)
|
|
|
|
require.NoError(err)
|
|
|
|
require.Equal(200, resp.Code, "body: %s", resp.Body.String())
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("GET", tt.url, nil)
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
if tt.updateFunc != nil {
|
|
|
|
go tt.updateFunc()
|
|
|
|
}
|
|
|
|
start := time.Now()
|
2018-04-05 16:15:43 +00:00
|
|
|
obj, err := a.srv.AgentConnectProxyConfig(resp, req)
|
2018-04-18 20:05:30 +00:00
|
|
|
elapsed := time.Now().Sub(start)
|
|
|
|
|
|
|
|
if tt.wantErr {
|
|
|
|
require.Error(err)
|
|
|
|
} else {
|
|
|
|
require.NoError(err)
|
|
|
|
}
|
|
|
|
if tt.wantCode != 0 {
|
|
|
|
require.Equal(tt.wantCode, resp.Code, "body: %s", resp.Body.String())
|
|
|
|
}
|
|
|
|
if tt.wantWait != 0 {
|
|
|
|
assert.True(elapsed >= tt.wantWait, "should have waited at least %s, "+
|
|
|
|
"took %s", tt.wantWait, elapsed)
|
|
|
|
} else {
|
|
|
|
assert.True(elapsed < 10*time.Millisecond, "should not have waited, "+
|
|
|
|
"took %s", elapsed)
|
|
|
|
}
|
|
|
|
|
|
|
|
assert.Equal(tt.wantResp, obj)
|
2018-04-18 20:48:58 +00:00
|
|
|
|
|
|
|
assert.Equal(tt.wantResp.ContentHash, resp.Header().Get("X-Consul-ContentHash"))
|
2018-04-18 20:05:30 +00:00
|
|
|
})
|
|
|
|
}
|
2018-04-26 13:01:20 +00:00
|
|
|
}
|
|
|
|
|
2018-05-07 04:02:44 +00:00
|
|
|
func TestAgentConnectProxyConfig_aclDefaultDeny(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
require := require.New(t)
|
2018-06-13 08:34:20 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig()+testAllowProxyConfig())
|
2018-05-07 04:02:44 +00:00
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
// Register a service with a managed proxy
|
|
|
|
{
|
|
|
|
reg := &structs.ServiceDefinition{
|
|
|
|
ID: "test-id",
|
|
|
|
Name: "test",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
Port: 8000,
|
|
|
|
Check: structs.CheckType{
|
|
|
|
TTL: 15 * time.Second,
|
|
|
|
},
|
2018-06-05 17:51:05 +00:00
|
|
|
Connect: &structs.ServiceConnect{
|
2018-05-07 04:02:44 +00:00
|
|
|
Proxy: &structs.ServiceDefinitionConnectProxy{},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register?token=root", jsonReader(reg))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err := a.srv.AgentRegisterService(resp, req)
|
|
|
|
require.NoError(err)
|
|
|
|
require.Equal(200, resp.Code, "body: %s", resp.Body.String())
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/connect/proxy/test-id-proxy", nil)
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err := a.srv.AgentConnectProxyConfig(resp, req)
|
|
|
|
require.True(acl.IsErrPermissionDenied(err))
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestAgentConnectProxyConfig_aclProxyToken(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
require := require.New(t)
|
2018-06-13 08:34:20 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig()+testAllowProxyConfig())
|
2018-05-07 04:02:44 +00:00
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
// Register a service with a managed proxy
|
|
|
|
{
|
|
|
|
reg := &structs.ServiceDefinition{
|
|
|
|
ID: "test-id",
|
|
|
|
Name: "test",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
Port: 8000,
|
|
|
|
Check: structs.CheckType{
|
|
|
|
TTL: 15 * time.Second,
|
|
|
|
},
|
2018-06-05 17:51:05 +00:00
|
|
|
Connect: &structs.ServiceConnect{
|
2018-05-07 04:02:44 +00:00
|
|
|
Proxy: &structs.ServiceDefinitionConnectProxy{},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register?token=root", jsonReader(reg))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err := a.srv.AgentRegisterService(resp, req)
|
|
|
|
require.NoError(err)
|
|
|
|
require.Equal(200, resp.Code, "body: %s", resp.Body.String())
|
|
|
|
}
|
|
|
|
|
|
|
|
// Get the proxy token from the agent directly, since there is no API
|
|
|
|
// to expose this.
|
|
|
|
proxy := a.State.Proxy("test-id-proxy")
|
|
|
|
require.NotNil(proxy)
|
|
|
|
token := proxy.ProxyToken
|
|
|
|
require.NotEmpty(token)
|
|
|
|
|
|
|
|
req, _ := http.NewRequest(
|
|
|
|
"GET", "/v1/agent/connect/proxy/test-id-proxy?token="+token, nil)
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
obj, err := a.srv.AgentConnectProxyConfig(resp, req)
|
|
|
|
require.NoError(err)
|
|
|
|
proxyCfg := obj.(*api.ConnectProxyConfig)
|
|
|
|
require.Equal("test-id-proxy", proxyCfg.ProxyServiceID)
|
|
|
|
require.Equal("test-id", proxyCfg.TargetServiceID)
|
|
|
|
require.Equal("test", proxyCfg.TargetServiceName)
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestAgentConnectProxyConfig_aclServiceWrite(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
require := require.New(t)
|
2018-06-13 08:34:20 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig()+testAllowProxyConfig())
|
2018-05-07 04:02:44 +00:00
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
// Register a service with a managed proxy
|
|
|
|
{
|
|
|
|
reg := &structs.ServiceDefinition{
|
|
|
|
ID: "test-id",
|
|
|
|
Name: "test",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
Port: 8000,
|
|
|
|
Check: structs.CheckType{
|
|
|
|
TTL: 15 * time.Second,
|
|
|
|
},
|
2018-06-05 17:51:05 +00:00
|
|
|
Connect: &structs.ServiceConnect{
|
2018-05-07 04:02:44 +00:00
|
|
|
Proxy: &structs.ServiceDefinitionConnectProxy{},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register?token=root", jsonReader(reg))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err := a.srv.AgentRegisterService(resp, req)
|
|
|
|
require.NoError(err)
|
|
|
|
require.Equal(200, resp.Code, "body: %s", resp.Body.String())
|
|
|
|
}
|
|
|
|
|
|
|
|
// Create an ACL with service:write for our service
|
|
|
|
var token string
|
|
|
|
{
|
|
|
|
args := map[string]interface{}{
|
|
|
|
"Name": "User Token",
|
|
|
|
"Type": "client",
|
|
|
|
"Rules": `service "test" { policy = "write" }`,
|
|
|
|
}
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/acl/create?token=root", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
obj, err := a.srv.ACLCreate(resp, req)
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
aclResp := obj.(aclCreateResponse)
|
|
|
|
token = aclResp.ID
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest(
|
|
|
|
"GET", "/v1/agent/connect/proxy/test-id-proxy?token="+token, nil)
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
obj, err := a.srv.AgentConnectProxyConfig(resp, req)
|
|
|
|
require.NoError(err)
|
|
|
|
proxyCfg := obj.(*api.ConnectProxyConfig)
|
|
|
|
require.Equal("test-id-proxy", proxyCfg.ProxyServiceID)
|
|
|
|
require.Equal("test-id", proxyCfg.TargetServiceID)
|
|
|
|
require.Equal("test", proxyCfg.TargetServiceName)
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestAgentConnectProxyConfig_aclServiceReadDeny(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
require := require.New(t)
|
2018-06-13 08:34:20 +00:00
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig()+testAllowProxyConfig())
|
2018-05-07 04:02:44 +00:00
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
// Register a service with a managed proxy
|
|
|
|
{
|
|
|
|
reg := &structs.ServiceDefinition{
|
|
|
|
ID: "test-id",
|
|
|
|
Name: "test",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
Port: 8000,
|
|
|
|
Check: structs.CheckType{
|
|
|
|
TTL: 15 * time.Second,
|
|
|
|
},
|
2018-06-05 17:51:05 +00:00
|
|
|
Connect: &structs.ServiceConnect{
|
2018-05-07 04:02:44 +00:00
|
|
|
Proxy: &structs.ServiceDefinitionConnectProxy{},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register?token=root", jsonReader(reg))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err := a.srv.AgentRegisterService(resp, req)
|
|
|
|
require.NoError(err)
|
|
|
|
require.Equal(200, resp.Code, "body: %s", resp.Body.String())
|
|
|
|
}
|
|
|
|
|
|
|
|
// Create an ACL with service:read for our service
|
|
|
|
var token string
|
|
|
|
{
|
|
|
|
args := map[string]interface{}{
|
|
|
|
"Name": "User Token",
|
|
|
|
"Type": "client",
|
|
|
|
"Rules": `service "test" { policy = "read" }`,
|
|
|
|
}
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/acl/create?token=root", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
obj, err := a.srv.ACLCreate(resp, req)
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
aclResp := obj.(aclCreateResponse)
|
|
|
|
token = aclResp.ID
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest(
|
|
|
|
"GET", "/v1/agent/connect/proxy/test-id-proxy?token="+token, nil)
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err := a.srv.AgentConnectProxyConfig(resp, req)
|
|
|
|
require.True(acl.IsErrPermissionDenied(err))
|
|
|
|
}
|
|
|
|
|
2018-06-14 12:52:48 +00:00
|
|
|
func makeTelemetryDefaults(targetID string) lib.TelemetryConfig {
|
|
|
|
return lib.TelemetryConfig{
|
|
|
|
FilterDefault: true,
|
|
|
|
MetricsPrefix: "consul.proxy." + targetID,
|
2018-06-08 15:18:58 +00:00
|
|
|
}
|
2018-06-07 13:11:06 +00:00
|
|
|
}
|
|
|
|
|
2018-04-26 13:01:20 +00:00
|
|
|
func TestAgentConnectProxyConfig_ConfigHandling(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
2018-05-03 17:44:10 +00:00
|
|
|
// Get the default command to compare below
|
2018-06-15 20:04:04 +00:00
|
|
|
defaultCommand, err := defaultProxyCommand(nil)
|
2018-05-03 17:44:10 +00:00
|
|
|
require.NoError(t, err)
|
|
|
|
|
2018-04-26 13:01:20 +00:00
|
|
|
// Define a local service with a managed proxy. It's registered in the test
|
|
|
|
// loop to make sure agent state is predictable whatever order tests execute
|
|
|
|
// since some alter this service config.
|
|
|
|
reg := &structs.ServiceDefinition{
|
|
|
|
ID: "test-id",
|
|
|
|
Name: "test",
|
|
|
|
Address: "127.0.0.1",
|
|
|
|
Port: 8000,
|
|
|
|
Check: structs.CheckType{
|
|
|
|
TTL: 15 * time.Second,
|
|
|
|
},
|
2018-06-18 19:37:00 +00:00
|
|
|
Connect: &structs.ServiceConnect{
|
|
|
|
// Proxy is populated with the definition in the table below.
|
|
|
|
},
|
2018-04-26 13:01:20 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
tests := []struct {
|
|
|
|
name string
|
|
|
|
globalConfig string
|
|
|
|
proxy structs.ServiceDefinitionConnectProxy
|
2018-06-18 19:37:00 +00:00
|
|
|
useToken string
|
2018-04-26 13:01:20 +00:00
|
|
|
wantMode api.ProxyExecMode
|
2018-05-03 15:52:36 +00:00
|
|
|
wantCommand []string
|
2018-04-26 13:01:20 +00:00
|
|
|
wantConfig map[string]interface{}
|
|
|
|
}{
|
|
|
|
{
|
|
|
|
name: "defaults",
|
|
|
|
globalConfig: `
|
|
|
|
bind_addr = "0.0.0.0"
|
|
|
|
connect {
|
|
|
|
enabled = true
|
2018-06-13 08:34:20 +00:00
|
|
|
proxy {
|
|
|
|
allow_managed_api_registration = true
|
|
|
|
}
|
2018-06-06 20:35:44 +00:00
|
|
|
}
|
|
|
|
ports {
|
|
|
|
proxy_min_port = 10000
|
|
|
|
proxy_max_port = 10000
|
2018-04-26 13:01:20 +00:00
|
|
|
}
|
|
|
|
`,
|
|
|
|
proxy: structs.ServiceDefinitionConnectProxy{},
|
|
|
|
wantMode: api.ProxyExecModeDaemon,
|
2018-05-03 17:44:10 +00:00
|
|
|
wantCommand: defaultCommand,
|
2018-04-26 13:01:20 +00:00
|
|
|
wantConfig: map[string]interface{}{
|
|
|
|
"bind_address": "0.0.0.0",
|
|
|
|
"bind_port": 10000, // "randomly" chosen from our range of 1
|
|
|
|
"local_service_address": "127.0.0.1:8000", // port from service reg
|
2018-06-08 15:18:58 +00:00
|
|
|
"telemetry": makeTelemetryDefaults(reg.ID),
|
2018-04-26 13:01:20 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "global defaults - script",
|
|
|
|
globalConfig: `
|
|
|
|
bind_addr = "0.0.0.0"
|
|
|
|
connect {
|
|
|
|
enabled = true
|
2018-06-13 08:34:20 +00:00
|
|
|
proxy {
|
|
|
|
allow_managed_api_registration = true
|
|
|
|
}
|
2018-04-26 13:01:20 +00:00
|
|
|
proxy_defaults = {
|
|
|
|
exec_mode = "script"
|
2018-05-03 15:52:36 +00:00
|
|
|
script_command = ["script.sh"]
|
2018-04-26 13:01:20 +00:00
|
|
|
}
|
|
|
|
}
|
2018-06-06 20:35:44 +00:00
|
|
|
ports {
|
|
|
|
proxy_min_port = 10000
|
|
|
|
proxy_max_port = 10000
|
|
|
|
}
|
2018-04-26 13:01:20 +00:00
|
|
|
`,
|
|
|
|
proxy: structs.ServiceDefinitionConnectProxy{},
|
|
|
|
wantMode: api.ProxyExecModeScript,
|
2018-05-03 15:52:36 +00:00
|
|
|
wantCommand: []string{"script.sh"},
|
2018-04-26 13:01:20 +00:00
|
|
|
wantConfig: map[string]interface{}{
|
|
|
|
"bind_address": "0.0.0.0",
|
|
|
|
"bind_port": 10000, // "randomly" chosen from our range of 1
|
|
|
|
"local_service_address": "127.0.0.1:8000", // port from service reg
|
2018-06-08 15:18:58 +00:00
|
|
|
"telemetry": makeTelemetryDefaults(reg.ID),
|
2018-04-26 13:01:20 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "global defaults - daemon",
|
|
|
|
globalConfig: `
|
|
|
|
bind_addr = "0.0.0.0"
|
|
|
|
connect {
|
|
|
|
enabled = true
|
2018-06-13 08:34:20 +00:00
|
|
|
proxy {
|
|
|
|
allow_managed_api_registration = true
|
|
|
|
}
|
2018-04-26 13:01:20 +00:00
|
|
|
proxy_defaults = {
|
|
|
|
exec_mode = "daemon"
|
2018-05-03 15:52:36 +00:00
|
|
|
daemon_command = ["daemon.sh"]
|
2018-04-26 13:01:20 +00:00
|
|
|
}
|
|
|
|
}
|
2018-06-06 20:35:44 +00:00
|
|
|
ports {
|
|
|
|
proxy_min_port = 10000
|
|
|
|
proxy_max_port = 10000
|
|
|
|
}
|
2018-04-26 13:01:20 +00:00
|
|
|
`,
|
|
|
|
proxy: structs.ServiceDefinitionConnectProxy{},
|
|
|
|
wantMode: api.ProxyExecModeDaemon,
|
2018-05-03 15:52:36 +00:00
|
|
|
wantCommand: []string{"daemon.sh"},
|
2018-04-26 13:01:20 +00:00
|
|
|
wantConfig: map[string]interface{}{
|
|
|
|
"bind_address": "0.0.0.0",
|
|
|
|
"bind_port": 10000, // "randomly" chosen from our range of 1
|
|
|
|
"local_service_address": "127.0.0.1:8000", // port from service reg
|
2018-06-08 15:18:58 +00:00
|
|
|
"telemetry": makeTelemetryDefaults(reg.ID),
|
2018-04-26 13:01:20 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "global default config merge",
|
|
|
|
globalConfig: `
|
|
|
|
bind_addr = "0.0.0.0"
|
|
|
|
connect {
|
|
|
|
enabled = true
|
2018-06-13 08:34:20 +00:00
|
|
|
proxy {
|
|
|
|
allow_managed_api_registration = true
|
|
|
|
}
|
2018-04-26 13:01:20 +00:00
|
|
|
proxy_defaults = {
|
|
|
|
config = {
|
|
|
|
connect_timeout_ms = 1000
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2018-06-06 20:35:44 +00:00
|
|
|
ports {
|
|
|
|
proxy_min_port = 10000
|
|
|
|
proxy_max_port = 10000
|
|
|
|
}
|
2018-06-13 15:53:44 +00:00
|
|
|
telemetry {
|
|
|
|
statsite_address = "localhost:8989"
|
|
|
|
}
|
2018-04-26 13:01:20 +00:00
|
|
|
`,
|
|
|
|
proxy: structs.ServiceDefinitionConnectProxy{
|
|
|
|
Config: map[string]interface{}{
|
|
|
|
"foo": "bar",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
wantMode: api.ProxyExecModeDaemon,
|
2018-05-03 17:44:10 +00:00
|
|
|
wantCommand: defaultCommand,
|
2018-04-26 13:01:20 +00:00
|
|
|
wantConfig: map[string]interface{}{
|
|
|
|
"bind_address": "0.0.0.0",
|
|
|
|
"bind_port": 10000, // "randomly" chosen from our range of 1
|
|
|
|
"local_service_address": "127.0.0.1:8000", // port from service reg
|
|
|
|
"connect_timeout_ms": 1000,
|
|
|
|
"foo": "bar",
|
2018-06-14 12:52:48 +00:00
|
|
|
"telemetry": lib.TelemetryConfig{
|
|
|
|
FilterDefault: true,
|
|
|
|
MetricsPrefix: "consul.proxy." + reg.ID,
|
|
|
|
StatsiteAddr: "localhost:8989",
|
2018-06-13 15:53:44 +00:00
|
|
|
},
|
2018-04-26 13:01:20 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "overrides in reg",
|
|
|
|
globalConfig: `
|
|
|
|
bind_addr = "0.0.0.0"
|
|
|
|
connect {
|
|
|
|
enabled = true
|
2018-06-13 08:34:20 +00:00
|
|
|
proxy {
|
|
|
|
allow_managed_api_registration = true
|
|
|
|
}
|
2018-04-26 13:01:20 +00:00
|
|
|
proxy_defaults = {
|
|
|
|
exec_mode = "daemon"
|
2018-05-03 15:52:36 +00:00
|
|
|
daemon_command = ["daemon.sh"]
|
|
|
|
script_command = ["script.sh"]
|
2018-04-26 13:01:20 +00:00
|
|
|
config = {
|
|
|
|
connect_timeout_ms = 1000
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2018-06-06 20:35:44 +00:00
|
|
|
ports {
|
|
|
|
proxy_min_port = 10000
|
|
|
|
proxy_max_port = 10000
|
|
|
|
}
|
2018-06-13 15:53:44 +00:00
|
|
|
telemetry {
|
|
|
|
statsite_address = "localhost:8989"
|
|
|
|
}
|
2018-04-26 13:01:20 +00:00
|
|
|
`,
|
|
|
|
proxy: structs.ServiceDefinitionConnectProxy{
|
|
|
|
ExecMode: "script",
|
2018-05-03 15:52:36 +00:00
|
|
|
Command: []string{"foo.sh"},
|
2018-04-26 13:01:20 +00:00
|
|
|
Config: map[string]interface{}{
|
|
|
|
"connect_timeout_ms": 2000,
|
|
|
|
"bind_address": "127.0.0.1",
|
|
|
|
"bind_port": 1024,
|
|
|
|
"local_service_address": "127.0.0.1:9191",
|
2018-06-13 15:53:44 +00:00
|
|
|
"telemetry": map[string]interface{}{
|
2018-06-14 12:52:48 +00:00
|
|
|
"statsite_address": "stats.it:10101",
|
|
|
|
"metrics_prefix": "foo", // important! checks that our prefix logic respects user customization
|
2018-06-13 15:53:44 +00:00
|
|
|
},
|
2018-04-26 13:01:20 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
wantMode: api.ProxyExecModeScript,
|
2018-05-03 15:52:36 +00:00
|
|
|
wantCommand: []string{"foo.sh"},
|
2018-04-26 13:01:20 +00:00
|
|
|
wantConfig: map[string]interface{}{
|
|
|
|
"bind_address": "127.0.0.1",
|
2018-06-30 13:18:13 +00:00
|
|
|
"bind_port": int(1024),
|
2018-04-26 13:01:20 +00:00
|
|
|
"local_service_address": "127.0.0.1:9191",
|
|
|
|
"connect_timeout_ms": float64(2000),
|
2018-06-14 12:52:48 +00:00
|
|
|
"telemetry": lib.TelemetryConfig{
|
|
|
|
FilterDefault: true,
|
|
|
|
MetricsPrefix: "foo",
|
|
|
|
StatsiteAddr: "stats.it:10101",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "reg telemetry not compatible, preserved with no merge",
|
|
|
|
globalConfig: `
|
|
|
|
connect {
|
|
|
|
enabled = true
|
|
|
|
proxy {
|
|
|
|
allow_managed_api_registration = true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
ports {
|
|
|
|
proxy_min_port = 10000
|
|
|
|
proxy_max_port = 10000
|
|
|
|
}
|
|
|
|
telemetry {
|
|
|
|
statsite_address = "localhost:8989"
|
|
|
|
}
|
|
|
|
`,
|
|
|
|
proxy: structs.ServiceDefinitionConnectProxy{
|
|
|
|
ExecMode: "script",
|
|
|
|
Command: []string{"foo.sh"},
|
|
|
|
Config: map[string]interface{}{
|
|
|
|
"telemetry": map[string]interface{}{
|
|
|
|
"foo": "bar",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
wantMode: api.ProxyExecModeScript,
|
|
|
|
wantCommand: []string{"foo.sh"},
|
|
|
|
wantConfig: map[string]interface{}{
|
|
|
|
"bind_address": "127.0.0.1",
|
|
|
|
"bind_port": 10000, // "randomly" chosen from our range of 1
|
|
|
|
"local_service_address": "127.0.0.1:8000", // port from service reg
|
2018-06-13 15:53:44 +00:00
|
|
|
"telemetry": map[string]interface{}{
|
2018-06-14 12:52:48 +00:00
|
|
|
"foo": "bar",
|
2018-06-13 15:53:44 +00:00
|
|
|
},
|
2018-04-26 13:01:20 +00:00
|
|
|
},
|
|
|
|
},
|
2018-06-18 19:37:00 +00:00
|
|
|
{
|
|
|
|
name: "reg passed through with no agent config added if not proxy token auth",
|
|
|
|
useToken: "foo", // no actual ACLs set so this any token will work but has to be non-empty to be used below
|
|
|
|
globalConfig: `
|
|
|
|
bind_addr = "0.0.0.0"
|
|
|
|
connect {
|
|
|
|
enabled = true
|
|
|
|
proxy {
|
|
|
|
allow_managed_api_registration = true
|
|
|
|
}
|
|
|
|
proxy_defaults = {
|
|
|
|
exec_mode = "daemon"
|
|
|
|
daemon_command = ["daemon.sh"]
|
|
|
|
script_command = ["script.sh"]
|
|
|
|
config = {
|
|
|
|
connect_timeout_ms = 1000
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
ports {
|
|
|
|
proxy_min_port = 10000
|
|
|
|
proxy_max_port = 10000
|
|
|
|
}
|
|
|
|
telemetry {
|
|
|
|
statsite_address = "localhost:8989"
|
|
|
|
}
|
|
|
|
`,
|
|
|
|
proxy: structs.ServiceDefinitionConnectProxy{
|
|
|
|
ExecMode: "script",
|
|
|
|
Command: []string{"foo.sh"},
|
|
|
|
Config: map[string]interface{}{
|
|
|
|
"connect_timeout_ms": 2000,
|
|
|
|
"bind_address": "127.0.0.1",
|
|
|
|
"bind_port": 1024,
|
|
|
|
"local_service_address": "127.0.0.1:9191",
|
|
|
|
"telemetry": map[string]interface{}{
|
|
|
|
"metrics_prefix": "foo",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
wantMode: api.ProxyExecModeScript,
|
|
|
|
wantCommand: []string{"foo.sh"},
|
|
|
|
wantConfig: map[string]interface{}{
|
|
|
|
"bind_address": "127.0.0.1",
|
2018-06-30 13:18:13 +00:00
|
|
|
"bind_port": int(1024),
|
2018-06-18 19:37:00 +00:00
|
|
|
"local_service_address": "127.0.0.1:9191",
|
|
|
|
"connect_timeout_ms": float64(2000),
|
|
|
|
"telemetry": map[string]interface{}{ // No defaults merged
|
|
|
|
"metrics_prefix": "foo",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2018-04-26 13:01:20 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
for _, tt := range tests {
|
|
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
|
|
assert := assert.New(t)
|
|
|
|
require := require.New(t)
|
|
|
|
|
|
|
|
a := NewTestAgent(t.Name(), tt.globalConfig)
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
// Register the basic service with the required config
|
|
|
|
{
|
|
|
|
reg.Connect.Proxy = &tt.proxy
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/agent/service/register", jsonReader(reg))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err := a.srv.AgentRegisterService(resp, req)
|
|
|
|
require.NoError(err)
|
|
|
|
require.Equal(200, resp.Code, "body: %s", resp.Body.String())
|
|
|
|
}
|
|
|
|
|
2018-06-18 19:37:00 +00:00
|
|
|
proxy := a.State.Proxy("test-id-proxy")
|
|
|
|
require.NotNil(proxy)
|
|
|
|
require.NotEmpty(proxy.ProxyToken)
|
|
|
|
|
2018-04-26 13:01:20 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/connect/proxy/test-id-proxy", nil)
|
2018-06-18 19:37:00 +00:00
|
|
|
if tt.useToken != "" {
|
|
|
|
req.Header.Set("X-Consul-Token", tt.useToken)
|
|
|
|
} else {
|
|
|
|
req.Header.Set("X-Consul-Token", proxy.ProxyToken)
|
|
|
|
}
|
2018-04-26 13:01:20 +00:00
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
obj, err := a.srv.AgentConnectProxyConfig(resp, req)
|
|
|
|
require.NoError(err)
|
|
|
|
|
|
|
|
proxyCfg := obj.(*api.ConnectProxyConfig)
|
|
|
|
assert.Equal("test-id-proxy", proxyCfg.ProxyServiceID)
|
|
|
|
assert.Equal("test-id", proxyCfg.TargetServiceID)
|
|
|
|
assert.Equal("test", proxyCfg.TargetServiceName)
|
|
|
|
assert.Equal(tt.wantMode, proxyCfg.ExecMode)
|
|
|
|
assert.Equal(tt.wantCommand, proxyCfg.Command)
|
|
|
|
require.Equal(tt.wantConfig, proxyCfg.Config)
|
|
|
|
})
|
|
|
|
}
|
2018-04-18 20:05:30 +00:00
|
|
|
}
|
|
|
|
|
2018-03-26 00:52:26 +00:00
|
|
|
func TestAgentConnectAuthorize_badBody(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
assert := assert.New(t)
|
|
|
|
a := NewTestAgent(t.Name(), "")
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
args := []string{}
|
|
|
|
req, _ := http.NewRequest("POST", "/v1/agent/connect/authorize", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err := a.srv.AgentConnectAuthorize(resp, req)
|
|
|
|
assert.Nil(err)
|
|
|
|
assert.Equal(400, resp.Code)
|
|
|
|
assert.Contains(resp.Body.String(), "decode")
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestAgentConnectAuthorize_noTarget(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
assert := assert.New(t)
|
|
|
|
a := NewTestAgent(t.Name(), "")
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
args := &structs.ConnectAuthorizeRequest{}
|
|
|
|
req, _ := http.NewRequest("POST", "/v1/agent/connect/authorize", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err := a.srv.AgentConnectAuthorize(resp, req)
|
|
|
|
assert.Nil(err)
|
|
|
|
assert.Equal(400, resp.Code)
|
|
|
|
assert.Contains(resp.Body.String(), "Target service")
|
|
|
|
}
|
|
|
|
|
|
|
|
// Client ID is not in the valid URI format
|
|
|
|
func TestAgentConnectAuthorize_idInvalidFormat(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
assert := assert.New(t)
|
|
|
|
a := NewTestAgent(t.Name(), "")
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
args := &structs.ConnectAuthorizeRequest{
|
2018-03-28 21:29:35 +00:00
|
|
|
Target: "web",
|
|
|
|
ClientCertURI: "tubes",
|
2018-03-26 00:52:26 +00:00
|
|
|
}
|
|
|
|
req, _ := http.NewRequest("POST", "/v1/agent/connect/authorize", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
respRaw, err := a.srv.AgentConnectAuthorize(resp, req)
|
|
|
|
assert.Nil(err)
|
|
|
|
assert.Equal(200, resp.Code)
|
|
|
|
|
|
|
|
obj := respRaw.(*connectAuthorizeResp)
|
|
|
|
assert.False(obj.Authorized)
|
|
|
|
assert.Contains(obj.Reason, "Invalid client")
|
|
|
|
}
|
|
|
|
|
|
|
|
// Client ID is a valid URI but its not a service URI
|
|
|
|
func TestAgentConnectAuthorize_idNotService(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
assert := assert.New(t)
|
|
|
|
a := NewTestAgent(t.Name(), "")
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
args := &structs.ConnectAuthorizeRequest{
|
2018-03-28 21:29:35 +00:00
|
|
|
Target: "web",
|
|
|
|
ClientCertURI: "spiffe://1234.consul",
|
2018-03-26 00:52:26 +00:00
|
|
|
}
|
|
|
|
req, _ := http.NewRequest("POST", "/v1/agent/connect/authorize", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
respRaw, err := a.srv.AgentConnectAuthorize(resp, req)
|
|
|
|
assert.Nil(err)
|
|
|
|
assert.Equal(200, resp.Code)
|
|
|
|
|
|
|
|
obj := respRaw.(*connectAuthorizeResp)
|
|
|
|
assert.False(obj.Authorized)
|
|
|
|
assert.Contains(obj.Reason, "must be a valid")
|
|
|
|
}
|
|
|
|
|
|
|
|
// Test when there is an intention allowing the connection
|
|
|
|
func TestAgentConnectAuthorize_allow(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
2018-04-17 23:26:58 +00:00
|
|
|
require := require.New(t)
|
2018-03-26 00:52:26 +00:00
|
|
|
a := NewTestAgent(t.Name(), "")
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
target := "db"
|
|
|
|
|
|
|
|
// Create some intentions
|
2018-04-17 23:26:58 +00:00
|
|
|
var ixnId string
|
2018-03-26 00:52:26 +00:00
|
|
|
{
|
|
|
|
req := structs.IntentionRequest{
|
|
|
|
Datacenter: "dc1",
|
|
|
|
Op: structs.IntentionOpCreate,
|
|
|
|
Intention: structs.TestIntention(t),
|
|
|
|
}
|
|
|
|
req.Intention.SourceNS = structs.IntentionDefaultNamespace
|
|
|
|
req.Intention.SourceName = "web"
|
|
|
|
req.Intention.DestinationNS = structs.IntentionDefaultNamespace
|
|
|
|
req.Intention.DestinationName = target
|
|
|
|
req.Intention.Action = structs.IntentionActionAllow
|
|
|
|
|
2018-04-17 23:26:58 +00:00
|
|
|
require.Nil(a.RPC("Intention.Apply", &req, &ixnId))
|
2018-03-26 00:52:26 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
args := &structs.ConnectAuthorizeRequest{
|
2018-05-10 16:04:33 +00:00
|
|
|
Target: target,
|
|
|
|
ClientCertURI: connect.TestSpiffeIDService(t, "web").URI().String(),
|
2018-03-26 00:52:26 +00:00
|
|
|
}
|
|
|
|
req, _ := http.NewRequest("POST", "/v1/agent/connect/authorize", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
respRaw, err := a.srv.AgentConnectAuthorize(resp, req)
|
2018-04-17 23:26:58 +00:00
|
|
|
require.Nil(err)
|
|
|
|
require.Equal(200, resp.Code)
|
2018-06-15 12:13:54 +00:00
|
|
|
require.Equal("MISS", resp.Header().Get("X-Cache"))
|
2018-03-26 00:52:26 +00:00
|
|
|
|
|
|
|
obj := respRaw.(*connectAuthorizeResp)
|
2018-04-17 23:26:58 +00:00
|
|
|
require.True(obj.Authorized)
|
|
|
|
require.Contains(obj.Reason, "Matched")
|
|
|
|
|
|
|
|
// Make the request again
|
|
|
|
{
|
|
|
|
req, _ := http.NewRequest("POST", "/v1/agent/connect/authorize", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
respRaw, err := a.srv.AgentConnectAuthorize(resp, req)
|
|
|
|
require.Nil(err)
|
|
|
|
require.Equal(200, resp.Code)
|
|
|
|
|
|
|
|
obj := respRaw.(*connectAuthorizeResp)
|
|
|
|
require.True(obj.Authorized)
|
|
|
|
require.Contains(obj.Reason, "Matched")
|
|
|
|
|
2018-06-15 12:13:54 +00:00
|
|
|
// That should've been a cache hit.
|
|
|
|
require.Equal("HIT", resp.Header().Get("X-Cache"))
|
|
|
|
}
|
2018-04-17 23:26:58 +00:00
|
|
|
|
|
|
|
// Change the intention
|
|
|
|
{
|
|
|
|
req := structs.IntentionRequest{
|
|
|
|
Datacenter: "dc1",
|
|
|
|
Op: structs.IntentionOpUpdate,
|
|
|
|
Intention: structs.TestIntention(t),
|
|
|
|
}
|
|
|
|
req.Intention.ID = ixnId
|
|
|
|
req.Intention.SourceNS = structs.IntentionDefaultNamespace
|
|
|
|
req.Intention.SourceName = "web"
|
|
|
|
req.Intention.DestinationNS = structs.IntentionDefaultNamespace
|
|
|
|
req.Intention.DestinationName = target
|
|
|
|
req.Intention.Action = structs.IntentionActionDeny
|
|
|
|
|
|
|
|
require.Nil(a.RPC("Intention.Apply", &req, &ixnId))
|
|
|
|
}
|
|
|
|
|
|
|
|
// Short sleep lets the cache background refresh happen
|
|
|
|
time.Sleep(100 * time.Millisecond)
|
|
|
|
|
|
|
|
// Make the request again
|
|
|
|
{
|
|
|
|
req, _ := http.NewRequest("POST", "/v1/agent/connect/authorize", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
respRaw, err := a.srv.AgentConnectAuthorize(resp, req)
|
|
|
|
require.Nil(err)
|
|
|
|
require.Equal(200, resp.Code)
|
|
|
|
|
|
|
|
obj := respRaw.(*connectAuthorizeResp)
|
|
|
|
require.False(obj.Authorized)
|
|
|
|
require.Contains(obj.Reason, "Matched")
|
|
|
|
|
2018-06-15 12:13:54 +00:00
|
|
|
// That should've been a cache hit, too, since it updated in the
|
|
|
|
// background.
|
|
|
|
require.Equal("HIT", resp.Header().Get("X-Cache"))
|
|
|
|
}
|
2018-03-26 00:52:26 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Test when there is an intention denying the connection
|
|
|
|
func TestAgentConnectAuthorize_deny(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
assert := assert.New(t)
|
|
|
|
a := NewTestAgent(t.Name(), "")
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
target := "db"
|
|
|
|
|
|
|
|
// Create some intentions
|
|
|
|
{
|
|
|
|
req := structs.IntentionRequest{
|
|
|
|
Datacenter: "dc1",
|
|
|
|
Op: structs.IntentionOpCreate,
|
|
|
|
Intention: structs.TestIntention(t),
|
|
|
|
}
|
|
|
|
req.Intention.SourceNS = structs.IntentionDefaultNamespace
|
|
|
|
req.Intention.SourceName = "web"
|
|
|
|
req.Intention.DestinationNS = structs.IntentionDefaultNamespace
|
|
|
|
req.Intention.DestinationName = target
|
|
|
|
req.Intention.Action = structs.IntentionActionDeny
|
|
|
|
|
|
|
|
var reply string
|
|
|
|
assert.Nil(a.RPC("Intention.Apply", &req, &reply))
|
|
|
|
}
|
|
|
|
|
|
|
|
args := &structs.ConnectAuthorizeRequest{
|
2018-05-10 16:04:33 +00:00
|
|
|
Target: target,
|
|
|
|
ClientCertURI: connect.TestSpiffeIDService(t, "web").URI().String(),
|
2018-03-26 00:52:26 +00:00
|
|
|
}
|
|
|
|
req, _ := http.NewRequest("POST", "/v1/agent/connect/authorize", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
respRaw, err := a.srv.AgentConnectAuthorize(resp, req)
|
|
|
|
assert.Nil(err)
|
|
|
|
assert.Equal(200, resp.Code)
|
|
|
|
|
|
|
|
obj := respRaw.(*connectAuthorizeResp)
|
|
|
|
assert.False(obj.Authorized)
|
|
|
|
assert.Contains(obj.Reason, "Matched")
|
|
|
|
}
|
2018-03-26 01:50:05 +00:00
|
|
|
|
2018-05-09 19:30:43 +00:00
|
|
|
// Test when there is an intention allowing service but for a different trust
|
|
|
|
// domain.
|
|
|
|
func TestAgentConnectAuthorize_denyTrustDomain(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
assert := assert.New(t)
|
|
|
|
a := NewTestAgent(t.Name(), "")
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
target := "db"
|
|
|
|
|
|
|
|
// Create some intentions
|
|
|
|
{
|
|
|
|
req := structs.IntentionRequest{
|
|
|
|
Datacenter: "dc1",
|
|
|
|
Op: structs.IntentionOpCreate,
|
|
|
|
Intention: structs.TestIntention(t),
|
|
|
|
}
|
|
|
|
req.Intention.SourceNS = structs.IntentionDefaultNamespace
|
|
|
|
req.Intention.SourceName = "web"
|
|
|
|
req.Intention.DestinationNS = structs.IntentionDefaultNamespace
|
|
|
|
req.Intention.DestinationName = target
|
|
|
|
req.Intention.Action = structs.IntentionActionAllow
|
|
|
|
|
|
|
|
var reply string
|
|
|
|
assert.Nil(a.RPC("Intention.Apply", &req, &reply))
|
|
|
|
}
|
|
|
|
|
|
|
|
{
|
|
|
|
args := &structs.ConnectAuthorizeRequest{
|
2018-05-10 16:04:33 +00:00
|
|
|
Target: target,
|
|
|
|
ClientCertURI: "spiffe://fake-domain.consul/ns/default/dc/dc1/svc/web",
|
2018-05-09 19:30:43 +00:00
|
|
|
}
|
|
|
|
req, _ := http.NewRequest("POST", "/v1/agent/connect/authorize", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
respRaw, err := a.srv.AgentConnectAuthorize(resp, req)
|
|
|
|
assert.Nil(err)
|
|
|
|
assert.Equal(200, resp.Code)
|
|
|
|
|
|
|
|
obj := respRaw.(*connectAuthorizeResp)
|
|
|
|
assert.False(obj.Authorized)
|
|
|
|
assert.Contains(obj.Reason, "Identity from an external trust domain")
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-04-05 11:53:42 +00:00
|
|
|
func TestAgentConnectAuthorize_denyWildcard(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
assert := assert.New(t)
|
|
|
|
a := NewTestAgent(t.Name(), "")
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
target := "db"
|
|
|
|
|
|
|
|
// Create some intentions
|
|
|
|
{
|
|
|
|
// Deny wildcard to DB
|
|
|
|
req := structs.IntentionRequest{
|
|
|
|
Datacenter: "dc1",
|
|
|
|
Op: structs.IntentionOpCreate,
|
|
|
|
Intention: structs.TestIntention(t),
|
|
|
|
}
|
|
|
|
req.Intention.SourceNS = structs.IntentionDefaultNamespace
|
|
|
|
req.Intention.SourceName = "*"
|
|
|
|
req.Intention.DestinationNS = structs.IntentionDefaultNamespace
|
|
|
|
req.Intention.DestinationName = target
|
|
|
|
req.Intention.Action = structs.IntentionActionDeny
|
|
|
|
|
|
|
|
var reply string
|
|
|
|
assert.Nil(a.RPC("Intention.Apply", &req, &reply))
|
|
|
|
}
|
|
|
|
{
|
|
|
|
// Allow web to DB
|
|
|
|
req := structs.IntentionRequest{
|
|
|
|
Datacenter: "dc1",
|
|
|
|
Op: structs.IntentionOpCreate,
|
|
|
|
Intention: structs.TestIntention(t),
|
|
|
|
}
|
|
|
|
req.Intention.SourceNS = structs.IntentionDefaultNamespace
|
|
|
|
req.Intention.SourceName = "web"
|
|
|
|
req.Intention.DestinationNS = structs.IntentionDefaultNamespace
|
|
|
|
req.Intention.DestinationName = target
|
|
|
|
req.Intention.Action = structs.IntentionActionAllow
|
|
|
|
|
|
|
|
var reply string
|
|
|
|
assert.Nil(a.RPC("Intention.Apply", &req, &reply))
|
|
|
|
}
|
|
|
|
|
|
|
|
// Web should be allowed
|
|
|
|
{
|
|
|
|
args := &structs.ConnectAuthorizeRequest{
|
2018-05-10 16:04:33 +00:00
|
|
|
Target: target,
|
|
|
|
ClientCertURI: connect.TestSpiffeIDService(t, "web").URI().String(),
|
2018-04-05 11:53:42 +00:00
|
|
|
}
|
|
|
|
req, _ := http.NewRequest("POST", "/v1/agent/connect/authorize", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
respRaw, err := a.srv.AgentConnectAuthorize(resp, req)
|
|
|
|
assert.Nil(err)
|
|
|
|
assert.Equal(200, resp.Code)
|
|
|
|
|
|
|
|
obj := respRaw.(*connectAuthorizeResp)
|
|
|
|
assert.True(obj.Authorized)
|
|
|
|
assert.Contains(obj.Reason, "Matched")
|
|
|
|
}
|
|
|
|
|
|
|
|
// API should be denied
|
|
|
|
{
|
|
|
|
args := &structs.ConnectAuthorizeRequest{
|
2018-05-10 16:04:33 +00:00
|
|
|
Target: target,
|
|
|
|
ClientCertURI: connect.TestSpiffeIDService(t, "api").URI().String(),
|
2018-04-05 11:53:42 +00:00
|
|
|
}
|
|
|
|
req, _ := http.NewRequest("POST", "/v1/agent/connect/authorize", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
respRaw, err := a.srv.AgentConnectAuthorize(resp, req)
|
|
|
|
assert.Nil(err)
|
|
|
|
assert.Equal(200, resp.Code)
|
|
|
|
|
|
|
|
obj := respRaw.(*connectAuthorizeResp)
|
|
|
|
assert.False(obj.Authorized)
|
|
|
|
assert.Contains(obj.Reason, "Matched")
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-03-26 01:50:05 +00:00
|
|
|
// Test that authorize fails without service:write for the target service.
|
|
|
|
func TestAgentConnectAuthorize_serviceWrite(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
assert := assert.New(t)
|
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig())
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
// Create an ACL
|
|
|
|
var token string
|
|
|
|
{
|
|
|
|
args := map[string]interface{}{
|
|
|
|
"Name": "User Token",
|
|
|
|
"Type": "client",
|
|
|
|
"Rules": `service "foo" { policy = "read" }`,
|
|
|
|
}
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/acl/create?token=root", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
obj, err := a.srv.ACLCreate(resp, req)
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
aclResp := obj.(aclCreateResponse)
|
|
|
|
token = aclResp.ID
|
|
|
|
}
|
|
|
|
|
|
|
|
args := &structs.ConnectAuthorizeRequest{
|
2018-03-28 21:29:35 +00:00
|
|
|
Target: "foo",
|
|
|
|
ClientCertURI: connect.TestSpiffeIDService(t, "web").URI().String(),
|
2018-03-26 01:50:05 +00:00
|
|
|
}
|
|
|
|
req, _ := http.NewRequest("POST",
|
|
|
|
"/v1/agent/connect/authorize?token="+token, jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err := a.srv.AgentConnectAuthorize(resp, req)
|
|
|
|
assert.True(acl.IsErrPermissionDenied(err))
|
|
|
|
}
|
|
|
|
|
|
|
|
// Test when no intentions match w/ a default deny policy
|
|
|
|
func TestAgentConnectAuthorize_defaultDeny(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
assert := assert.New(t)
|
|
|
|
a := NewTestAgent(t.Name(), TestACLConfig())
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
args := &structs.ConnectAuthorizeRequest{
|
2018-03-28 21:29:35 +00:00
|
|
|
Target: "foo",
|
|
|
|
ClientCertURI: connect.TestSpiffeIDService(t, "web").URI().String(),
|
2018-03-26 01:50:05 +00:00
|
|
|
}
|
|
|
|
req, _ := http.NewRequest("POST", "/v1/agent/connect/authorize?token=root", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
respRaw, err := a.srv.AgentConnectAuthorize(resp, req)
|
|
|
|
assert.Nil(err)
|
|
|
|
assert.Equal(200, resp.Code)
|
|
|
|
|
|
|
|
obj := respRaw.(*connectAuthorizeResp)
|
|
|
|
assert.False(obj.Authorized)
|
|
|
|
assert.Contains(obj.Reason, "Default behavior")
|
|
|
|
}
|
|
|
|
|
|
|
|
// Test when no intentions match w/ a default allow policy
|
|
|
|
func TestAgentConnectAuthorize_defaultAllow(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
assert := assert.New(t)
|
|
|
|
a := NewTestAgent(t.Name(), `
|
|
|
|
acl_datacenter = "dc1"
|
|
|
|
acl_default_policy = "allow"
|
|
|
|
acl_master_token = "root"
|
|
|
|
acl_agent_token = "root"
|
|
|
|
acl_agent_master_token = "towel"
|
|
|
|
acl_enforce_version_8 = true
|
|
|
|
`)
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
args := &structs.ConnectAuthorizeRequest{
|
2018-03-28 21:29:35 +00:00
|
|
|
Target: "foo",
|
|
|
|
ClientCertURI: connect.TestSpiffeIDService(t, "web").URI().String(),
|
2018-03-26 01:50:05 +00:00
|
|
|
}
|
|
|
|
req, _ := http.NewRequest("POST", "/v1/agent/connect/authorize?token=root", jsonReader(args))
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
respRaw, err := a.srv.AgentConnectAuthorize(resp, req)
|
|
|
|
assert.Nil(err)
|
|
|
|
assert.Equal(200, resp.Code)
|
|
|
|
|
|
|
|
obj := respRaw.(*connectAuthorizeResp)
|
|
|
|
assert.True(obj.Authorized)
|
|
|
|
assert.Contains(obj.Reason, "Default behavior")
|
|
|
|
}
|
2018-06-13 08:34:20 +00:00
|
|
|
|
|
|
|
// testAllowProxyConfig returns agent config to allow managed proxy API
|
|
|
|
// registration.
|
|
|
|
func testAllowProxyConfig() string {
|
|
|
|
return `
|
|
|
|
connect {
|
|
|
|
enabled = true
|
|
|
|
|
|
|
|
proxy {
|
|
|
|
allow_managed_api_registration = true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
`
|
|
|
|
}
|