istio

1
// Copyright Istio Authors
2
//
3
// Licensed under the Apache License, Version 2.0 (the "License");
4
// you may not use this file except in compliance with the License.
5
// You may obtain a copy of the License at
6
//
7
//     http://www.apache.org/licenses/LICENSE-2.0
8
//
9
// Unless required by applicable law or agreed to in writing, software
10
// distributed under the License is distributed on an "AS IS" BASIS,
11
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
// See the License for the specific language governing permissions and
13
// limitations under the License.
14

15
package controller
16

17
import (
18
	"context"
19
	"testing"
20
	"time"
21

22
	v1 "k8s.io/api/core/v1"
23
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
24
	"k8s.io/client-go/rest"
25

26
	meshconfig "istio.io/api/mesh/v1alpha1"
27
	"istio.io/istio/pilot/pkg/features"
28
	"istio.io/istio/pilot/pkg/keycertbundle"
29
	"istio.io/istio/pilot/pkg/server"
30
	"istio.io/istio/pilot/pkg/serviceregistry/aggregate"
31
	"istio.io/istio/pkg/cluster"
32
	"istio.io/istio/pkg/config/mesh"
33
	"istio.io/istio/pkg/kube"
34
	"istio.io/istio/pkg/kube/multicluster"
35
	"istio.io/istio/pkg/test"
36
	"istio.io/istio/pkg/test/util/assert"
37
	"istio.io/istio/pkg/test/util/retry"
38
)
39

40
const (
41
	testSecretNameSpace = "istio-system"
42
	DomainSuffix        = "fake_domain"
43
)
44

45
var mockserviceController = aggregate.NewController(aggregate.Options{})
46

47
func createMultiClusterSecret(k8s kube.Client, sname, cname string) error {
48
	data := map[string][]byte{}
49
	secret := v1.Secret{
50
		ObjectMeta: metav1.ObjectMeta{
51
			Name:      sname,
52
			Namespace: testSecretNameSpace,
53
			Labels: map[string]string{
54
				multicluster.MultiClusterSecretLabel: "true",
55
			},
56
		},
57
		Data: map[string][]byte{},
58
	}
59

60
	data[cname] = []byte("Test")
61
	secret.Data = data
62
	_, err := k8s.Kube().CoreV1().Secrets(testSecretNameSpace).Create(context.TODO(), &secret, metav1.CreateOptions{})
63
	return err
64
}
65

66
func deleteMultiClusterSecret(k8s kube.Client, sname string) error {
67
	var immediate int64
68

69
	return k8s.Kube().CoreV1().Secrets(testSecretNameSpace).Delete(
70
		context.TODO(),
71
		sname, metav1.DeleteOptions{GracePeriodSeconds: &immediate})
72
}
73

74
func verifyControllers(t *testing.T, m *Multicluster, expectedControllerCount int, timeoutName string) {
75
	t.Helper()
76
	assert.EventuallyEqual(t, func() int {
77
		return len(m.component.All())
78
	}, expectedControllerCount, retry.Message(timeoutName), retry.Delay(time.Millisecond*10), retry.Timeout(time.Second*5))
79
}
80

81
func initController(client kube.CLIClient, ns string, stop <-chan struct{}) *multicluster.Controller {
82
	sc := multicluster.NewController(client, ns, "cluster-1", mesh.NewFixedWatcher(nil))
83
	sc.ClientBuilder = func(kubeConfig []byte, c cluster.ID, configOverrides ...func(*rest.Config)) (kube.Client, error) {
84
		return kube.NewFakeClient(), nil
85
	}
86
	client.RunAndWait(stop)
87
	return sc
88
}
89

90
func Test_KubeSecretController(t *testing.T) {
91
	clientset := kube.NewFakeClient()
92
	stop := test.NewStop(t)
93
	s := server.New()
94
	mcc := initController(clientset, testSecretNameSpace, stop)
95
	mc := NewMulticluster("pilot-abc-123", clientset.Kube(), testSecretNameSpace, Options{
96
		ClusterID:             "cluster-1",
97
		DomainSuffix:          DomainSuffix,
98
		MeshWatcher:           mesh.NewFixedWatcher(&meshconfig.MeshConfig{}),
99
		MeshServiceController: mockserviceController,
100
	}, nil, nil, nil, "default", false, nil, s, mcc)
101
	assert.NoError(t, mcc.Run(stop))
102
	go mockserviceController.Run(stop)
103
	clientset.RunAndWait(stop)
104
	kube.WaitForCacheSync("test", stop, mcc.HasSynced)
105
	_ = s.Start(stop)
106

107
	verifyControllers(t, mc, 1, "create local controller")
108

109
	// Create the multicluster secret. Sleep to allow created remote
110
	// controller to start and callback add function to be called.
111
	err := createMultiClusterSecret(clientset, "test-secret-1", "test-remote-cluster-1")
112
	if err != nil {
113
		t.Fatalf("Unexpected error on secret create: %v", err)
114
	}
115

116
	// Test - Verify that the remote controller has been added.
117
	verifyControllers(t, mc, 2, "create remote controller")
118

119
	// Delete the mulicluster secret.
120
	err = deleteMultiClusterSecret(clientset, "test-secret-1")
121
	if err != nil {
122
		t.Fatalf("Unexpected error on secret delete: %v", err)
123
	}
124

125
	// Test - Verify that the remote controller has been removed.
126
	verifyControllers(t, mc, 1, "delete remote controller")
127
}
128

129
func Test_KubeSecretController_ExternalIstiod_MultipleClusters(t *testing.T) {
130
	test.SetForTest(t, &features.ExternalIstiod, true)
131
	test.SetForTest(t, &features.InjectionWebhookConfigName, "")
132
	clientset := kube.NewFakeClient()
133
	stop := test.NewStop(t)
134
	s := server.New()
135
	certWatcher := keycertbundle.NewWatcher()
136
	mcc := initController(clientset, testSecretNameSpace, stop)
137
	mc := NewMulticluster("pilot-abc-123", clientset.Kube(), testSecretNameSpace, Options{
138
		ClusterID:             "cluster-1",
139
		DomainSuffix:          DomainSuffix,
140
		MeshWatcher:           mesh.NewFixedWatcher(&meshconfig.MeshConfig{}),
141
		MeshServiceController: mockserviceController,
142
	}, nil, nil, certWatcher, "default", false, nil, s, mcc)
143
	assert.NoError(t, mcc.Run(stop))
144
	go mockserviceController.Run(stop)
145
	clientset.RunAndWait(stop)
146
	kube.WaitForCacheSync("test", stop, mcc.HasSynced)
147
	_ = s.Start(stop)
148

149
	// the multicluster controller will register the local cluster
150
	verifyControllers(t, mc, 1, "registered local cluster controller")
151

152
	// Create the multicluster secret. Sleep to allow created remote
153
	// controller to start and callback add function to be called.
154
	err := createMultiClusterSecret(clientset, "test-secret-1", "test-remote-cluster-1")
155
	if err != nil {
156
		t.Fatalf("Unexpected error on secret create: %v", err)
157
	}
158

159
	// Test - Verify that the remote controller has been added.
160
	verifyControllers(t, mc, 2, "create remote controller 1")
161

162
	// Create second multicluster secret. Sleep to allow created remote
163
	// controller to start and callback add function to be called.
164
	err = createMultiClusterSecret(clientset, "test-secret-2", "test-remote-cluster-2")
165
	if err != nil {
166
		t.Fatalf("Unexpected error on secret create: %v", err)
167
	}
168

169
	// Test - Verify that the remote controller has been added.
170
	verifyControllers(t, mc, 3, "create remote controller 2")
171

172
	// Delete the first mulicluster secret.
173
	err = deleteMultiClusterSecret(clientset, "test-secret-1")
174
	if err != nil {
175
		t.Fatalf("Unexpected error on secret delete: %v", err)
176
	}
177

178
	// Test - Verify that the remote controller has been removed.
179
	verifyControllers(t, mc, 2, "delete remote controller 1")
180

181
	// Delete the second mulicluster secret.
182
	err = deleteMultiClusterSecret(clientset, "test-secret-2")
183
	if err != nil {
184
		t.Fatalf("Unexpected error on secret delete: %v", err)
185
	}
186

187
	// Test - Verify that the remote controller has been removed.
188
	verifyControllers(t, mc, 1, "delete remote controller 2")
189
}
190