status-im
/
consul
mirror of https://github.com/status-im/consul.git
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

added tenancy to TestBuildL4TrafficPermissions (#19932)

This commit is contained in:
aahel 2023-12-14 10:41:24 +05:30 committed by GitHub
parent 33a90edfab
commit a6496898de
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
5 changed files with 419 additions and 340 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
agent/connect/uri_workload_identity.go
View File

@ -6,8 +6,6 @@ package connect
import (
"fmt"
"net/url"
"github.com/hashicorp/consul/acl"
)
// SpiffeIDWorkloadIdentity is the structure to represent the SPIFFE ID for a workload.
@ -18,10 +16,6 @@ type SpiffeIDWorkloadIdentity struct {
WorkloadIdentity string
}
func (id SpiffeIDWorkloadIdentity) NamespaceOrDefault() string {
return acl.NamespaceOrDefault(id.Namespace)
}
// URI returns the *url.URL for this SPIFFE ID.
func (id SpiffeIDWorkloadIdentity) URI() *url.URL {
var result url.URL
@ -37,8 +31,8 @@ func (id SpiffeIDWorkloadIdentity) uriPath() string {
// to generate the correct SpiffeID.
// We intentionally avoid using pbpartition.DefaultName here to be CE friendly.
path := fmt.Sprintf("/ap/%s/ns/%s/identity/%s",
id.PartitionOrDefault(),
id.NamespaceOrDefault(),
id.Partition,
id.Namespace,
id.WorkloadIdentity,
)

16
agent/connect/uri_workload_identity_ce.go
View File

@ -6,25 +6,13 @@
package connect
import (
"strings"
"github.com/hashicorp/consul/acl"
)
// TODO: this will need to somehow be updated to set namespace here when we include namespaces in CE
// GetEnterpriseMeta will synthesize an EnterpriseMeta struct from the SpiffeIDWorkloadIdentity.
// in CE this just returns an empty (but never nil) struct pointer
func (id SpiffeIDWorkloadIdentity) GetEnterpriseMeta() *acl.EnterpriseMeta {
return &acl.EnterpriseMeta{}
}
// PartitionOrDefault breaks from CE's pattern of returning empty strings.
// Although CE has no support for partitions, it still needs to be able to
// handle exportedPartition from peered Consul Enterprise clusters in order
// to generate the correct SpiffeID.
func (id SpiffeIDWorkloadIdentity) PartitionOrDefault() string {
if id.Partition == "" {
return "default"
}
return strings.ToLower(id.Partition)
}

40
agent/connect/uri_workload_identity_ce_test.go
View File

@ -1,40 +0,0 @@
// Copyright (c) HashiCorp, Inc.
// SPDX-License-Identifier: BUSL-1.1
//go:build !consulent
package connect
import (
"testing"
"github.com/stretchr/testify/require"
)
func TestSpiffeIDWorkloadURI(t *testing.T) {
t.Run("default partition; default namespace", func(t *testing.T) {
wl := &SpiffeIDWorkloadIdentity{
TrustDomain: "1234.consul",
WorkloadIdentity: "web",
}
require.Equal(t, "spiffe://1234.consul/ap/default/ns/default/identity/web", wl.URI().String())
})
t.Run("namespaces are ignored", func(t *testing.T) {
wl := &SpiffeIDWorkloadIdentity{
TrustDomain: "1234.consul",
WorkloadIdentity: "web",
Namespace: "other",
}
require.Equal(t, "spiffe://1234.consul/ap/default/ns/default/identity/web", wl.URI().String())
})
t.Run("partitions are not ignored", func(t *testing.T) {
wl := &SpiffeIDWorkloadIdentity{
TrustDomain: "1234.consul",
WorkloadIdentity: "web",
Partition: "other",
}
require.Equal(t, "spiffe://1234.consul/ap/other/ns/default/identity/web", wl.URI().String())
})
}

31
agent/connect/uri_workload_identity_test.go Normal file
View File

@ -0,0 +1,31 @@
// Copyright (c) HashiCorp, Inc.
// SPDX-License-Identifier: BUSL-1.1
package connect
import (
"testing"
"github.com/stretchr/testify/require"
)
func TestSpiffeIDWorkloadURI(t *testing.T) {
t.Run("spiffe id workload uri default tenancy", func(t *testing.T) {
wl := &SpiffeIDWorkloadIdentity{
TrustDomain: "1234.consul",
WorkloadIdentity: "web",
Partition: "default",
Namespace: "default",
}
require.Equal(t, "spiffe://1234.consul/ap/default/ns/default/identity/web", wl.URI().String())
})
t.Run("spiffe id workload uri non-default tenancy", func(t *testing.T) {
wl := &SpiffeIDWorkloadIdentity{
TrustDomain: "1234.consul",
WorkloadIdentity: "web",
Partition: "part1",
Namespace: "dev",
}
require.Equal(t, "spiffe://1234.consul/ap/part1/ns/dev/identity/web", wl.URI().String())
})
}

166
internal/mesh/internal/controllers/sidecarproxy/builder/local_app_test.go
View File

@ -4,6 +4,7 @@
package builder
import (
"fmt"
"sort"
"testing"
"time"
@ -247,6 +248,7 @@ func TestBuildLocalApp_WithProxyConfiguration(t *testing.T) {
}
func TestBuildL4TrafficPermissions(t *testing.T) {
resourcetest.RunWithTenancies(func(tenancy *pbresource.Tenancy) {
testTrustDomain := "test.consul"
cases := map[string]struct {
@ -326,8 +328,8 @@ func TestBuildL4TrafficPermissions(t *testing.T) {
Sources: []*pbauth.Source{
{
IdentityName: "foo",
Partition: "default",
Namespace: "default",
Partition: tenancy.Partition,
Namespace: tenancy.Namespace,
},
},
DestinationRules: []*pbauth.DestinationRule{
@ -345,7 +347,110 @@ func TestBuildL4TrafficPermissions(t *testing.T) {
{
Principals: []*pbproxystate.Principal{
{
Spiffe: &pbproxystate.Spiffe{Regex: "^spiffe://test.consul/ap/default/ns/default/identity/foo$"},
Spiffe: &pbproxystate.Spiffe{Regex: fmt.Sprintf("^spiffe://test.consul/ap/%s/ns/%s/identity/foo$", tenancy.Partition, tenancy.Namespace)},
},
},
},
},
},
"p2": {
DefaultAllow: false,
},
},
},
"preserves default deny wildcard namespace": {
defaultAllow: false,
workloadPorts: map[string]*pbcatalog.WorkloadPort{
"p1": {
Protocol: pbcatalog.Protocol_PROTOCOL_TCP,
},
"p2": {
Protocol: pbcatalog.Protocol_PROTOCOL_HTTP,
},
},
ctp: &pbauth.ComputedTrafficPermissions{
AllowPermissions: []*pbauth.Permission{
{
Sources: []*pbauth.Source{
{
IdentityName: "",
Partition: tenancy.Partition,
Namespace: "",
},
},
DestinationRules: []*pbauth.DestinationRule{
{
PortNames: []string{"p1"},
},
},
},
},
},
expected: map[string]*pbproxystate.TrafficPermissions{
"p1": {
DefaultAllow: false,
AllowPermissions: []*pbproxystate.Permission{
{
Principals: []*pbproxystate.Principal{
{
Spiffe: &pbproxystate.Spiffe{Regex: fmt.Sprintf("^spiffe://test.consul/ap/%s/ns/%s/identity/[^/]+$", tenancy.Partition, anyPath)},
},
},
},
},
},
"p2": {
DefaultAllow: false,
},
},
},
"preserves default deny wildcard namespace exclude source": {
defaultAllow: false,
workloadPorts: map[string]*pbcatalog.WorkloadPort{
"p1": {
Protocol: pbcatalog.Protocol_PROTOCOL_TCP,
},
"p2": {
Protocol: pbcatalog.Protocol_PROTOCOL_HTTP,
},
},
ctp: &pbauth.ComputedTrafficPermissions{
AllowPermissions: []*pbauth.Permission{
{
Sources: []*pbauth.Source{
{
IdentityName: "",
Partition: tenancy.Partition,
Namespace: "",
Exclude: []*pbauth.ExcludeSource{
{
IdentityName: "bar",
Namespace: tenancy.Namespace,
Partition: tenancy.Partition,
},
},
},
},
DestinationRules: []*pbauth.DestinationRule{
{
PortNames: []string{"p1"},
},
},
},
},
},
expected: map[string]*pbproxystate.TrafficPermissions{
"p1": {
DefaultAllow: false,
AllowPermissions: []*pbproxystate.Permission{
{
Principals: []*pbproxystate.Principal{
{
Spiffe: &pbproxystate.Spiffe{Regex: fmt.Sprintf("^spiffe://test.consul/ap/%s/ns/%s/identity/[^/]+$", tenancy.Partition, anyPath)},
ExcludeSpiffes: []*pbproxystate.Spiffe{
{Regex: fmt.Sprintf("^spiffe://test.consul/ap/%s/ns/%s/identity/bar$", tenancy.Partition, tenancy.Namespace)},
},
},
},
},
@ -372,8 +477,8 @@ func TestBuildL4TrafficPermissions(t *testing.T) {
Sources: []*pbauth.Source{
{
IdentityName: "baz",
Partition: "default",
Namespace: "default",
Partition: tenancy.Partition,
Namespace: tenancy.Namespace,
},
},
DestinationRules: []*pbauth.DestinationRule{
@ -409,18 +514,18 @@ func TestBuildL4TrafficPermissions(t *testing.T) {
Sources: []*pbauth.Source{
{
IdentityName: "foo",
Partition: "default",
Namespace: "default",
Partition: tenancy.Partition,
Namespace: tenancy.Namespace,
},
{
IdentityName: "",
Partition: "default",
Namespace: "default",
Partition: tenancy.Partition,
Namespace: tenancy.Namespace,
Exclude: []*pbauth.ExcludeSource{
{
IdentityName: "bar",
Namespace: "default",
Partition: "default",
Namespace: tenancy.Namespace,
Partition: tenancy.Partition,
},
},
},
@ -440,8 +545,8 @@ func TestBuildL4TrafficPermissions(t *testing.T) {
Sources: []*pbauth.Source{
{
IdentityName: "baz",
Partition: "default",
Namespace: "default",
Partition: tenancy.Partition,
Namespace: tenancy.Namespace,
},
},
DestinationRules: []*pbauth.DestinationRule{
@ -456,8 +561,8 @@ func TestBuildL4TrafficPermissions(t *testing.T) {
Sources: []*pbauth.Source{
{
IdentityName: "qux",
Partition: "default",
Namespace: "default",
Partition: tenancy.Partition,
Namespace: tenancy.Namespace,
},
},
},
@ -465,13 +570,13 @@ func TestBuildL4TrafficPermissions(t *testing.T) {
Sources: []*pbauth.Source{
{
IdentityName: "",
Namespace: "default",
Partition: "default",
Namespace: tenancy.Namespace,
Partition: tenancy.Partition,
Exclude: []*pbauth.ExcludeSource{
{
IdentityName: "quux",
Partition: "default",
Namespace: "default",
Partition: tenancy.Partition,
Namespace: tenancy.Namespace,
},
},
},
@ -486,16 +591,16 @@ func TestBuildL4TrafficPermissions(t *testing.T) {
{
Principals: []*pbproxystate.Principal{
{
Spiffe: &pbproxystate.Spiffe{Regex: "^spiffe://test.consul/ap/default/ns/default/identity/qux$"},
Spiffe: &pbproxystate.Spiffe{Regex: fmt.Sprintf("^spiffe://test.consul/ap/%s/ns/%s/identity/qux$", tenancy.Partition, tenancy.Namespace)},
},
},
},
{
Principals: []*pbproxystate.Principal{
{
Spiffe: &pbproxystate.Spiffe{Regex: `^spiffe://test.consul/ap/default/ns/default/identity/[^/]+$`},
Spiffe: &pbproxystate.Spiffe{Regex: fmt.Sprintf(`^spiffe://test.consul/ap/%s/ns/%s/identity/[^/]+$`, tenancy.Partition, tenancy.Namespace)},
ExcludeSpiffes: []*pbproxystate.Spiffe{
{Regex: "^spiffe://test.consul/ap/default/ns/default/identity/quux$"},
{Regex: fmt.Sprintf("^spiffe://test.consul/ap/%s/ns/%s/identity/quux$", tenancy.Partition, tenancy.Namespace)},
},
},
},
@ -505,7 +610,7 @@ func TestBuildL4TrafficPermissions(t *testing.T) {
{
Principals: []*pbproxystate.Principal{
{
Spiffe: &pbproxystate.Spiffe{Regex: "^spiffe://test.consul/ap/default/ns/default/identity/baz$"},
Spiffe: &pbproxystate.Spiffe{Regex: fmt.Sprintf("^spiffe://test.consul/ap/%s/ns/%s/identity/baz$", tenancy.Partition, tenancy.Namespace)},
},
},
},
@ -517,16 +622,16 @@ func TestBuildL4TrafficPermissions(t *testing.T) {
{
Principals: []*pbproxystate.Principal{
{
Spiffe: &pbproxystate.Spiffe{Regex: "^spiffe://test.consul/ap/default/ns/default/identity/qux$"},
Spiffe: &pbproxystate.Spiffe{Regex: fmt.Sprintf("^spiffe://test.consul/ap/%s/ns/%s/identity/qux$", tenancy.Partition, tenancy.Namespace)},
},
},
},
{
Principals: []*pbproxystate.Principal{
{
Spiffe: &pbproxystate.Spiffe{Regex: `^spiffe://test.consul/ap/default/ns/default/identity/[^/]+$`},
Spiffe: &pbproxystate.Spiffe{Regex: fmt.Sprintf(`^spiffe://test.consul/ap/%s/ns/%s/identity/[^/]+$`, tenancy.Partition, tenancy.Namespace)},
ExcludeSpiffes: []*pbproxystate.Spiffe{
{Regex: "^spiffe://test.consul/ap/default/ns/default/identity/quux$"},
{Regex: fmt.Sprintf("^spiffe://test.consul/ap/%s/ns/%s/identity/quux$", tenancy.Partition, tenancy.Namespace)},
},
},
},
@ -536,12 +641,12 @@ func TestBuildL4TrafficPermissions(t *testing.T) {
{
Principals: []*pbproxystate.Principal{
{
Spiffe: &pbproxystate.Spiffe{Regex: "^spiffe://test.consul/ap/default/ns/default/identity/foo$"},
Spiffe: &pbproxystate.Spiffe{Regex: fmt.Sprintf("^spiffe://test.consul/ap/%s/ns/%s/identity/foo$", tenancy.Partition, tenancy.Namespace)},
},
{
Spiffe: &pbproxystate.Spiffe{Regex: `^spiffe://test.consul/ap/default/ns/default/identity/[^/]+$`},
Spiffe: &pbproxystate.Spiffe{Regex: fmt.Sprintf(`^spiffe://test.consul/ap/%s/ns/%s/identity/[^/]+$`, tenancy.Partition, tenancy.Namespace)},
ExcludeSpiffes: []*pbproxystate.Spiffe{
{Regex: "^spiffe://test.consul/ap/default/ns/default/identity/bar$"},
{Regex: fmt.Sprintf("^spiffe://test.consul/ap/%s/ns/%s/identity/bar$", tenancy.Partition, tenancy.Namespace)},
},
},
},
@ -553,7 +658,7 @@ func TestBuildL4TrafficPermissions(t *testing.T) {
}
for name, tc := range cases {
t.Run(name, func(t *testing.T) {
t.Run(resourcetest.AppendTenancyInfoSubtest(t.Name(), name, tenancy), func(t *testing.T) {
workload := &pbcatalog.Workload{
Ports: tc.workloadPorts,
}
@ -564,6 +669,7 @@ func TestBuildL4TrafficPermissions(t *testing.T) {
}
})
}
}, t)
}
func testProxyStateTemplateID(tenancy *pbresource.Tenancy) *pbresource.ID {