added tenancy to TestBuildL4TrafficPermissions (#19932)

agent/connect/uri_workload_identity.go

@@ -6,8 +6,6 @@ package connect
 import (
 	"fmt"
 	"net/url"
-
-	"github.com/hashicorp/consul/acl"
 )
 
 // SpiffeIDWorkloadIdentity is the structure to represent the SPIFFE ID for a workload.
@@ -18,10 +16,6 @@ type SpiffeIDWorkloadIdentity struct {
 	WorkloadIdentity string
 }
 
-func (id SpiffeIDWorkloadIdentity) NamespaceOrDefault() string {
-	return acl.NamespaceOrDefault(id.Namespace)
-}
-
 // URI returns the *url.URL for this SPIFFE ID.
 func (id SpiffeIDWorkloadIdentity) URI() *url.URL {
 	var result url.URL
@@ -37,8 +31,8 @@ func (id SpiffeIDWorkloadIdentity) uriPath() string {
 	// to generate the correct SpiffeID.
 	// We intentionally avoid using pbpartition.DefaultName here to be CE friendly.
 	path := fmt.Sprintf("/ap/%s/ns/%s/identity/%s",
-		id.PartitionOrDefault(),
+		id.Partition,
-		id.NamespaceOrDefault(),
+		id.Namespace,
 		id.WorkloadIdentity,
 	)
 

agent/connect/uri_workload_identity_ce.go

@@ -6,25 +6,13 @@
 package connect
 
 import (
-	"strings"
-
 	"github.com/hashicorp/consul/acl"
 )
 
+// TODO: this will need to somehow be updated to set namespace here when we include namespaces in CE
+
 // GetEnterpriseMeta will synthesize an EnterpriseMeta struct from the SpiffeIDWorkloadIdentity.
 // in CE this just returns an empty (but never nil) struct pointer
 func (id SpiffeIDWorkloadIdentity) GetEnterpriseMeta() *acl.EnterpriseMeta {
 	return &acl.EnterpriseMeta{}
 }
-
-// PartitionOrDefault breaks from CE's pattern of returning empty strings.
-// Although CE has no support for partitions, it still needs to be able to
-// handle exportedPartition from peered Consul Enterprise clusters in order
-// to generate the correct SpiffeID.
-func (id SpiffeIDWorkloadIdentity) PartitionOrDefault() string {
-	if id.Partition == "" {
-		return "default"
-	}
-
-	return strings.ToLower(id.Partition)
-}

agent/connect/uri_workload_identity_ce_test.go

@@ -1,40 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-//go:build !consulent
-
-package connect
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestSpiffeIDWorkloadURI(t *testing.T) {
-	t.Run("default partition; default namespace", func(t *testing.T) {
-		wl := &SpiffeIDWorkloadIdentity{
-			TrustDomain:      "1234.consul",
-			WorkloadIdentity: "web",
-		}
-		require.Equal(t, "spiffe://1234.consul/ap/default/ns/default/identity/web", wl.URI().String())
-	})
-
-	t.Run("namespaces are ignored", func(t *testing.T) {
-		wl := &SpiffeIDWorkloadIdentity{
-			TrustDomain:      "1234.consul",
-			WorkloadIdentity: "web",
-			Namespace:        "other",
-		}
-		require.Equal(t, "spiffe://1234.consul/ap/default/ns/default/identity/web", wl.URI().String())
-	})
-
-	t.Run("partitions are not ignored", func(t *testing.T) {
-		wl := &SpiffeIDWorkloadIdentity{
-			TrustDomain:      "1234.consul",
-			WorkloadIdentity: "web",
-			Partition:        "other",
-		}
-		require.Equal(t, "spiffe://1234.consul/ap/other/ns/default/identity/web", wl.URI().String())
-	})
-}

agent/connect/uri_workload_identity_test.go

@@ -0,0 +1,31 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package connect
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestSpiffeIDWorkloadURI(t *testing.T) {
+	t.Run("spiffe id workload uri default tenancy", func(t *testing.T) {
+		wl := &SpiffeIDWorkloadIdentity{
+			TrustDomain:      "1234.consul",
+			WorkloadIdentity: "web",
+			Partition:        "default",
+			Namespace:        "default",
+		}
+		require.Equal(t, "spiffe://1234.consul/ap/default/ns/default/identity/web", wl.URI().String())
+	})
+	t.Run("spiffe id workload uri non-default tenancy", func(t *testing.T) {
+		wl := &SpiffeIDWorkloadIdentity{
+			TrustDomain:      "1234.consul",
+			WorkloadIdentity: "web",
+			Partition:        "part1",
+			Namespace:        "dev",
+		}
+		require.Equal(t, "spiffe://1234.consul/ap/part1/ns/dev/identity/web", wl.URI().String())
+	})
+}

internal/mesh/internal/controllers/sidecarproxy/builder/local_app_test.go

@@ -4,6 +4,7 @@
 package builder
 
 import (
+	"fmt"
 	"sort"
 	"testing"
 	"time"
@@ -247,6 +248,7 @@ func TestBuildLocalApp_WithProxyConfiguration(t *testing.T) {
 }
 
 func TestBuildL4TrafficPermissions(t *testing.T) {
+	resourcetest.RunWithTenancies(func(tenancy *pbresource.Tenancy) {
 		testTrustDomain := "test.consul"
 
 		cases := map[string]struct {
@@ -326,8 +328,8 @@ func TestBuildL4TrafficPermissions(t *testing.T) {
 							Sources: []*pbauth.Source{
 								{
 									IdentityName: "foo",
-								Partition:    "default",
+									Partition:    tenancy.Partition,
-								Namespace:    "default",
+									Namespace:    tenancy.Namespace,
 								},
 							},
 							DestinationRules: []*pbauth.DestinationRule{
@@ -345,7 +347,110 @@ func TestBuildL4TrafficPermissions(t *testing.T) {
 							{
 								Principals: []*pbproxystate.Principal{
 									{
-									Spiffe: &pbproxystate.Spiffe{Regex: "^spiffe://test.consul/ap/default/ns/default/identity/foo$"},
+										Spiffe: &pbproxystate.Spiffe{Regex: fmt.Sprintf("^spiffe://test.consul/ap/%s/ns/%s/identity/foo$", tenancy.Partition, tenancy.Namespace)},
+									},
+								},
+							},
+						},
+					},
+					"p2": {
+						DefaultAllow: false,
+					},
+				},
+			},
+			"preserves default deny wildcard namespace": {
+				defaultAllow: false,
+				workloadPorts: map[string]*pbcatalog.WorkloadPort{
+					"p1": {
+						Protocol: pbcatalog.Protocol_PROTOCOL_TCP,
+					},
+					"p2": {
+						Protocol: pbcatalog.Protocol_PROTOCOL_HTTP,
+					},
+				},
+				ctp: &pbauth.ComputedTrafficPermissions{
+					AllowPermissions: []*pbauth.Permission{
+						{
+							Sources: []*pbauth.Source{
+								{
+									IdentityName: "",
+									Partition:    tenancy.Partition,
+									Namespace:    "",
+								},
+							},
+							DestinationRules: []*pbauth.DestinationRule{
+								{
+									PortNames: []string{"p1"},
+								},
+							},
+						},
+					},
+				},
+				expected: map[string]*pbproxystate.TrafficPermissions{
+					"p1": {
+						DefaultAllow: false,
+						AllowPermissions: []*pbproxystate.Permission{
+							{
+								Principals: []*pbproxystate.Principal{
+									{
+										Spiffe: &pbproxystate.Spiffe{Regex: fmt.Sprintf("^spiffe://test.consul/ap/%s/ns/%s/identity/[^/]+$", tenancy.Partition, anyPath)},
+									},
+								},
+							},
+						},
+					},
+					"p2": {
+						DefaultAllow: false,
+					},
+				},
+			},
+			"preserves default deny wildcard namespace exclude source": {
+				defaultAllow: false,
+				workloadPorts: map[string]*pbcatalog.WorkloadPort{
+					"p1": {
+						Protocol: pbcatalog.Protocol_PROTOCOL_TCP,
+					},
+					"p2": {
+						Protocol: pbcatalog.Protocol_PROTOCOL_HTTP,
+					},
+				},
+				ctp: &pbauth.ComputedTrafficPermissions{
+					AllowPermissions: []*pbauth.Permission{
+						{
+							Sources: []*pbauth.Source{
+								{
+									IdentityName: "",
+									Partition:    tenancy.Partition,
+									Namespace:    "",
+									Exclude: []*pbauth.ExcludeSource{
+										{
+											IdentityName: "bar",
+											Namespace:    tenancy.Namespace,
+											Partition:    tenancy.Partition,
+										},
+									},
+								},
+							},
+							DestinationRules: []*pbauth.DestinationRule{
+								{
+									PortNames: []string{"p1"},
+								},
+							},
+						},
+					},
+				},
+				expected: map[string]*pbproxystate.TrafficPermissions{
+					"p1": {
+						DefaultAllow: false,
+						AllowPermissions: []*pbproxystate.Permission{
+							{
+								Principals: []*pbproxystate.Principal{
+									{
+										Spiffe: &pbproxystate.Spiffe{Regex: fmt.Sprintf("^spiffe://test.consul/ap/%s/ns/%s/identity/[^/]+$", tenancy.Partition, anyPath)},
+
+										ExcludeSpiffes: []*pbproxystate.Spiffe{
+											{Regex: fmt.Sprintf("^spiffe://test.consul/ap/%s/ns/%s/identity/bar$", tenancy.Partition, tenancy.Namespace)},
+										},
 									},
 								},
 							},
@@ -372,8 +477,8 @@ func TestBuildL4TrafficPermissions(t *testing.T) {
 							Sources: []*pbauth.Source{
 								{
 									IdentityName: "baz",
-								Partition:    "default",
+									Partition:    tenancy.Partition,
-								Namespace:    "default",
+									Namespace:    tenancy.Namespace,
 								},
 							},
 							DestinationRules: []*pbauth.DestinationRule{
@@ -409,18 +514,18 @@ func TestBuildL4TrafficPermissions(t *testing.T) {
 							Sources: []*pbauth.Source{
 								{
 									IdentityName: "foo",
-								Partition:    "default",
+									Partition:    tenancy.Partition,
-								Namespace:    "default",
+									Namespace:    tenancy.Namespace,
 								},
 								{
 									IdentityName: "",
-								Partition:    "default",
+									Partition:    tenancy.Partition,
-								Namespace:    "default",
+									Namespace:    tenancy.Namespace,
 									Exclude: []*pbauth.ExcludeSource{
 										{
 											IdentityName: "bar",
-										Namespace:    "default",
+											Namespace:    tenancy.Namespace,
-										Partition:    "default",
+											Partition:    tenancy.Partition,
 										},
 									},
 								},
@@ -440,8 +545,8 @@ func TestBuildL4TrafficPermissions(t *testing.T) {
 							Sources: []*pbauth.Source{
 								{
 									IdentityName: "baz",
-								Partition:    "default",
+									Partition:    tenancy.Partition,
-								Namespace:    "default",
+									Namespace:    tenancy.Namespace,
 								},
 							},
 							DestinationRules: []*pbauth.DestinationRule{
@@ -456,8 +561,8 @@ func TestBuildL4TrafficPermissions(t *testing.T) {
 							Sources: []*pbauth.Source{
 								{
 									IdentityName: "qux",
-								Partition:    "default",
+									Partition:    tenancy.Partition,
-								Namespace:    "default",
+									Namespace:    tenancy.Namespace,
 								},
 							},
 						},
@@ -465,13 +570,13 @@ func TestBuildL4TrafficPermissions(t *testing.T) {
 							Sources: []*pbauth.Source{
 								{
 									IdentityName: "",
-								Namespace:    "default",
+									Namespace:    tenancy.Namespace,
-								Partition:    "default",
+									Partition:    tenancy.Partition,
 									Exclude: []*pbauth.ExcludeSource{
 										{
 											IdentityName: "quux",
-										Partition:    "default",
+											Partition:    tenancy.Partition,
-										Namespace:    "default",
+											Namespace:    tenancy.Namespace,
 										},
 									},
 								},
@@ -486,16 +591,16 @@ func TestBuildL4TrafficPermissions(t *testing.T) {
 							{
 								Principals: []*pbproxystate.Principal{
 									{
-									Spiffe: &pbproxystate.Spiffe{Regex: "^spiffe://test.consul/ap/default/ns/default/identity/qux$"},
+										Spiffe: &pbproxystate.Spiffe{Regex: fmt.Sprintf("^spiffe://test.consul/ap/%s/ns/%s/identity/qux$", tenancy.Partition, tenancy.Namespace)},
 									},
 								},
 							},
 							{
 								Principals: []*pbproxystate.Principal{
 									{
-									Spiffe: &pbproxystate.Spiffe{Regex: `^spiffe://test.consul/ap/default/ns/default/identity/[^/]+$`},
+										Spiffe: &pbproxystate.Spiffe{Regex: fmt.Sprintf(`^spiffe://test.consul/ap/%s/ns/%s/identity/[^/]+$`, tenancy.Partition, tenancy.Namespace)},
 										ExcludeSpiffes: []*pbproxystate.Spiffe{
-										{Regex: "^spiffe://test.consul/ap/default/ns/default/identity/quux$"},
+											{Regex: fmt.Sprintf("^spiffe://test.consul/ap/%s/ns/%s/identity/quux$", tenancy.Partition, tenancy.Namespace)},
 										},
 									},
 								},
@@ -505,7 +610,7 @@ func TestBuildL4TrafficPermissions(t *testing.T) {
 							{
 								Principals: []*pbproxystate.Principal{
 									{
-									Spiffe: &pbproxystate.Spiffe{Regex: "^spiffe://test.consul/ap/default/ns/default/identity/baz$"},
+										Spiffe: &pbproxystate.Spiffe{Regex: fmt.Sprintf("^spiffe://test.consul/ap/%s/ns/%s/identity/baz$", tenancy.Partition, tenancy.Namespace)},
 									},
 								},
 							},
@@ -517,16 +622,16 @@ func TestBuildL4TrafficPermissions(t *testing.T) {
 							{
 								Principals: []*pbproxystate.Principal{
 									{
-									Spiffe: &pbproxystate.Spiffe{Regex: "^spiffe://test.consul/ap/default/ns/default/identity/qux$"},
+										Spiffe: &pbproxystate.Spiffe{Regex: fmt.Sprintf("^spiffe://test.consul/ap/%s/ns/%s/identity/qux$", tenancy.Partition, tenancy.Namespace)},
 									},
 								},
 							},
 							{
 								Principals: []*pbproxystate.Principal{
 									{
-									Spiffe: &pbproxystate.Spiffe{Regex: `^spiffe://test.consul/ap/default/ns/default/identity/[^/]+$`},
+										Spiffe: &pbproxystate.Spiffe{Regex: fmt.Sprintf(`^spiffe://test.consul/ap/%s/ns/%s/identity/[^/]+$`, tenancy.Partition, tenancy.Namespace)},
 										ExcludeSpiffes: []*pbproxystate.Spiffe{
-										{Regex: "^spiffe://test.consul/ap/default/ns/default/identity/quux$"},
+											{Regex: fmt.Sprintf("^spiffe://test.consul/ap/%s/ns/%s/identity/quux$", tenancy.Partition, tenancy.Namespace)},
 										},
 									},
 								},
@@ -536,12 +641,12 @@ func TestBuildL4TrafficPermissions(t *testing.T) {
 							{
 								Principals: []*pbproxystate.Principal{
 									{
-									Spiffe: &pbproxystate.Spiffe{Regex: "^spiffe://test.consul/ap/default/ns/default/identity/foo$"},
+										Spiffe: &pbproxystate.Spiffe{Regex: fmt.Sprintf("^spiffe://test.consul/ap/%s/ns/%s/identity/foo$", tenancy.Partition, tenancy.Namespace)},
 									},
 									{
-									Spiffe: &pbproxystate.Spiffe{Regex: `^spiffe://test.consul/ap/default/ns/default/identity/[^/]+$`},
+										Spiffe: &pbproxystate.Spiffe{Regex: fmt.Sprintf(`^spiffe://test.consul/ap/%s/ns/%s/identity/[^/]+$`, tenancy.Partition, tenancy.Namespace)},
 										ExcludeSpiffes: []*pbproxystate.Spiffe{
-										{Regex: "^spiffe://test.consul/ap/default/ns/default/identity/bar$"},
+											{Regex: fmt.Sprintf("^spiffe://test.consul/ap/%s/ns/%s/identity/bar$", tenancy.Partition, tenancy.Namespace)},
 										},
 									},
 								},
@@ -553,7 +658,7 @@ func TestBuildL4TrafficPermissions(t *testing.T) {
 		}
 
 		for name, tc := range cases {
-		t.Run(name, func(t *testing.T) {
+			t.Run(resourcetest.AppendTenancyInfoSubtest(t.Name(), name, tenancy), func(t *testing.T) {
 				workload := &pbcatalog.Workload{
 					Ports: tc.workloadPorts,
 				}
@@ -564,6 +669,7 @@ func TestBuildL4TrafficPermissions(t *testing.T) {
 				}
 			})
 		}
+	}, t)
 }
 
 func testProxyStateTemplateID(tenancy *pbresource.Tenancy) *pbresource.ID {