kuma

1
package gateway
2

3
import (
4
	"encoding/base64"
5
	"fmt"
6
	"strings"
7

8
	"github.com/gruntwork-io/terratest/modules/k8s"
9
	. "github.com/onsi/ginkgo/v2"
10
	. "github.com/onsi/gomega"
11

12
	. "github.com/kumahq/kuma/test/framework"
13
	"github.com/kumahq/kuma/test/framework/client"
14
	"github.com/kumahq/kuma/test/framework/deployments/testserver"
15
	"github.com/kumahq/kuma/test/framework/envs/kubernetes"
16
)
17

18
func Gateway() {
19
	meshName := "simple-gateway"
20
	namespace := "simple-gateway"
21
	clientNamespace := "client-simple-gateway"
22
	meshGateway := `
23
apiVersion: kuma.io/v1alpha1
24
kind: MeshGateway
25
metadata:
26
  name: simple-gateway
27
mesh: simple-gateway
28
spec:
29
  selectors:
30
  - match:
31
      kuma.io/service: simple-gateway
32
  conf:
33
    listeners:
34
    - port: 8080
35
      protocol: HTTP
36
      hostname: example.kuma.io
37
      tags:
38
        hostname: example.kuma.io
39
    - port: 8081
40
      protocol: HTTPS
41
      tls:
42
        mode: TERMINATE
43
        certificates:
44
        - secret: kuma-io-certificate-k8s` +
45
		// secret names have to be unique because
46
		// we're removing secrets using owner reference, and we're relying on async namespace deletion,
47
		// so we could have a situation where the secrets are not yet deleted,
48
		// and we're trying to create a new mesh with the same secret name which k8s treats as changing the mesh of the secret
49
		// and results in "cannot change mesh of the Secret. Delete the Secret first and apply it again."
50
		// https://app.circleci.com/pipelines/github/kumahq/kuma/24848/workflows/f33edb5a-74cb-45ae-b0c2-4b14bf289585/jobs/497239
51
		`
52
      hostname: example.kuma.io
53
      tags:
54
        hostname: example.kuma.io
55
    - port: 8081
56
      protocol: HTTPS
57
      tls:
58
        mode: TERMINATE
59
        certificates:
60
        - secret: kuma-io-certificate-k8s` +
61
		// secret names have to be unique because
62
		// we're removing secrets using owner reference, and we're relying on async namespace deletion,
63
		// so we could have a situation where the secrets are not yet deleted,
64
		// and we're trying to create a new mesh with the same secret name which k8s treats as changing the mesh of the secret
65
		// and results in "cannot change mesh of the Secret. Delete the Secret first and apply it again."
66
		// https://app.circleci.com/pipelines/github/kumahq/kuma/24848/workflows/f33edb5a-74cb-45ae-b0c2-4b14bf289585/jobs/497239
67
		`
68
      hostname: otherexample.kuma.io
69
      tags:
70
        hostname: otherexample.kuma.io
71
    - port: 8082
72
      protocol: HTTP
73
      hostname: '*'
74
    - port: 8083
75
      protocol: TCP
76
`
77
	httpsSecret := func() string {
78
		cert, key, err := CreateCertsFor("example.kuma.io")
79
		Expect(err).To(Succeed())
80
		secretData := base64.StdEncoding.EncodeToString([]byte(strings.Join([]string{key, cert}, "\n")))
81
		return fmt.Sprintf(`
82
apiVersion: v1
83
kind: Secret
84
metadata:
85
  name: kuma-io-certificate-k8s
86
  namespace: %s
87
  labels:
88
    kuma.io/mesh: simple-gateway
89
data:
90
  value: %s
91
type: system.kuma.io/secret
92
`, Config.KumaNamespace, secretData)
93
	}
94
	var clusterIP string
95

96
	BeforeAll(func() {
97
		err := NewClusterSetup().
98
			Install(MTLSMeshKubernetes(meshName)).
99
			Install(Namespace(clientNamespace)).
100
			Install(NamespaceWithSidecarInjection(namespace)).
101
			Install(testserver.Install(
102
				testserver.WithName("demo-client"),
103
				testserver.WithNamespace(clientNamespace),
104
			)).
105
			Install(testserver.Install(
106
				testserver.WithName("echo-server"),
107
				testserver.WithMesh(meshName),
108
				testserver.WithNamespace(namespace),
109
				testserver.WithEchoArgs("echo", "--instance", "echo-server"),
110
			)).
111
			Install(YamlK8s(httpsSecret())).
112
			Install(YamlK8s(meshGateway)).
113
			Install(YamlK8s(MkGatewayInstance("simple-gateway", namespace, meshName))).
114
			Install(MeshTrafficPermissionAllowAllKubernetes(meshName)).
115
			Setup(kubernetes.Cluster)
116
		Expect(err).ToNot(HaveOccurred())
117

118
		Eventually(func(g Gomega) {
119
			var err error
120
			clusterIP, err = k8s.RunKubectlAndGetOutputE(
121
				kubernetes.Cluster.GetTesting(),
122
				kubernetes.Cluster.GetKubectlOptions(namespace),
123
				"get", "service", "simple-gateway", "-ojsonpath={.spec.clusterIP}",
124
			)
125
			g.Expect(err).ToNot(HaveOccurred())
126
			g.Expect(clusterIP).ToNot(BeEmpty())
127
		}, "30s", "1s").Should(Succeed())
128
	})
129

130
	E2EAfterAll(func() {
131
		Expect(kubernetes.Cluster.TriggerDeleteNamespace(namespace)).To(Succeed())
132
		Expect(kubernetes.Cluster.TriggerDeleteNamespace(clientNamespace)).To(Succeed())
133
		Expect(kubernetes.Cluster.DeleteMesh(meshName)).To(Succeed())
134
	})
135

136
	meshGatewayRoutes := func(name, path, destination string) []string {
137
		return []string{
138
			fmt.Sprintf(`
139
apiVersion: kuma.io/v1alpha1
140
kind: MeshGatewayRoute
141
metadata:
142
  name: %s
143
mesh: simple-gateway
144
spec:
145
  selectors:
146
  - match:
147
      kuma.io/service: simple-gateway
148
  conf:
149
    http:
150
      rules:
151
      - matches:
152
        - path:
153
            match: PREFIX
154
            value: %s
155
        backends:
156
        - destination:
157
            kuma.io/service: %s
158
      - matches:
159
        - path:
160
            match: PREFIX
161
            value: /rewrite-host%s
162
        filters:
163
        - rewrite:
164
            hostToBackendHostname: true
165
        backends:
166
        - destination:
167
            kuma.io/service: %s
168
`, name, path, destination, path, destination),
169
			fmt.Sprintf(`
170
apiVersion: kuma.io/v1alpha1
171
kind: MeshGatewayRoute
172
metadata:
173
  name: %s-specific
174
mesh: simple-gateway
175
spec:
176
  selectors:
177
  - match:
178
      kuma.io/service: simple-gateway
179
  conf:
180
    http:
181
      hostnames:
182
      - specific.kuma.io
183
      rules:
184
      - matches:
185
        - path:
186
            match: PREFIX
187
            value: %s
188
        filters:
189
        - requestHeader:
190
            add:
191
            - name: x-specific-hostname-header
192
              value: "true"
193
        backends:
194
        - destination:
195
            kuma.io/service: %s
196
      - matches:
197
        - path:
198
            match: PREFIX
199
            value: /rewrite-host%s
200
        filters:
201
        - rewrite:
202
            hostToBackendHostname: true
203
        backends:
204
        - destination:
205
            kuma.io/service: %s
206
`, name, path, destination, path, destination),
207
			fmt.Sprintf(`
208
apiVersion: kuma.io/v1alpha1
209
kind: MeshGatewayRoute
210
metadata:
211
  name: %s-specific-listener
212
mesh: simple-gateway
213
spec:
214
  selectors:
215
  - match:
216
      kuma.io/service: simple-gateway
217
      hostname: otherexample.kuma.io
218
  conf:
219
    http:
220
      rules:
221
      - matches:
222
        - path:
223
            match: PREFIX
224
            value: "%s-specific-listener"
225
        filters:
226
        - requestHeader:
227
            add:
228
            - name: x-listener-by-hostname-header
229
              value: "true"
230
        backends:
231
        - destination:
232
            kuma.io/service: %s
233
`, name, path, destination),
234
		}
235
	}
236

237
	httpRoute := func(name, path, destination string) []string {
238
		return []string{
239
			fmt.Sprintf(`
240
apiVersion: kuma.io/v1alpha1
241
kind: MeshHTTPRoute
242
metadata:
243
  name: %s
244
  namespace: %s
245
  labels:
246
    kuma.io/mesh: simple-gateway
247
spec:
248
  targetRef:
249
    kind: MeshGateway
250
    name: simple-gateway
251
  to:
252
  - targetRef:
253
      kind: Mesh
254
    rules:
255
    - matches:
256
      - path:
257
          type: PathPrefix
258
          value: "%s"
259
      default:
260
        backendRefs:
261
        - kind: MeshService
262
          name: "%s"
263
  - targetRef:
264
      kind: Mesh
265
    hostnames:
266
    - specific.kuma.io
267
    rules:
268
    - matches:
269
      - path:
270
          type: PathPrefix
271
          value: "%s"
272
      default:
273
        filters:
274
        - type: RequestHeaderModifier
275
          requestHeaderModifier:
276
            add:
277
            - name: x-specific-hostname-header
278
              value: "true"
279
        backendRefs:
280
        - kind: MeshService
281
          name: "%s"
282
`, name, Config.KumaNamespace, path, destination, path, destination),
283
			fmt.Sprintf(`
284
apiVersion: kuma.io/v1alpha1
285
kind: MeshHTTPRoute
286
metadata:
287
  name: %s
288
  namespace: %s
289
  labels:
290
    kuma.io/mesh: simple-gateway
291
spec:
292
  targetRef:
293
    kind: MeshGateway
294
    name: simple-gateway
295
    tags:
296
      hostname: otherexample.kuma.io 
297
  to:
298
  - targetRef:
299
      kind: Mesh
300
    rules:
301
    - matches:
302
      - path:
303
          type: PathPrefix
304
          value: "%s-specific-listener"
305
      default:
306
        filters:
307
        - type: RequestHeaderModifier
308
          requestHeaderModifier:
309
            add:
310
            - name: x-listener-by-hostname-header
311
              value: "true"
312
        backendRefs:
313
        - kind: MeshService
314
          name: "%s"
315
`, name+"-hostname-specific", Config.KumaNamespace, path, destination),
316
		}
317
	}
318

319
	basicRouting := func(name string, routeYAMLs []string) {
320
		Context(fmt.Sprintf("Mesh service - %s", name), func() {
321
			BeforeAll(func() {
322
				Expect(NewClusterSetup().
323
					Install(YamlK8s(routeYAMLs...)).
324
					Setup(kubernetes.Cluster),
325
				).To(Succeed())
326
			})
327

328
			E2EAfterAll(func() {
329
				Expect(NewClusterSetup().
330
					Install(DeleteYamlK8s(routeYAMLs...)).
331
					Setup(kubernetes.Cluster),
332
				).To(Succeed())
333
			})
334

335
			It("should proxy to service via HTTP without port in host", func() {
336
				Eventually(func(g Gomega) {
337
					response, err := client.CollectEchoResponse(
338
						kubernetes.Cluster, "demo-client",
339
						"http://simple-gateway.simple-gateway:8080/",
340
						client.WithHeader("host", "example.kuma.io"),
341
						client.FromKubernetesPod(clientNamespace, "demo-client"),
342
					)
343

344
					g.Expect(err).ToNot(HaveOccurred())
345
					g.Expect(response.Instance).To(Equal("echo-server"))
346
					g.Expect(response.Received.Headers).ToNot(HaveKey("X-Specific-Hostname-Header"))
347
				}, "1m", "1s").Should(Succeed())
348
			})
349
			It("should proxy to service via HTTP with port in host", func() {
350
				Eventually(func(g Gomega) {
351
					response, err := client.CollectEchoResponse(
352
						kubernetes.Cluster, "demo-client",
353
						"http://simple-gateway.simple-gateway:8080/",
354
						client.WithHeader("host", "example.kuma.io:8080"),
355
						client.FromKubernetesPod(clientNamespace, "demo-client"),
356
					)
357

358
					g.Expect(err).ToNot(HaveOccurred())
359
					g.Expect(response.Instance).To(Equal("echo-server"))
360
					g.Expect(response.Received.Headers).ToNot(HaveKey("X-Specific-Hostname-Header"))
361
				}, "30s", "1s").Should(Succeed())
362
			})
363

364
			It("should proxy to service via HTTPS", func() {
365
				Eventually(func(g Gomega) {
366
					response, err := client.CollectEchoResponse(
367
						kubernetes.Cluster, "demo-client",
368
						"https://example.kuma.io:8081/",
369
						client.Resolve("example.kuma.io:8081", clusterIP),
370
						client.FromKubernetesPod(clientNamespace, "demo-client"),
371
						client.Insecure(),
372
					)
373

374
					g.Expect(err).ToNot(HaveOccurred())
375
					g.Expect(response.Instance).To(Equal("echo-server"))
376
					g.Expect(response.Received.Headers).ToNot(HaveKey("X-Specific-Hostname-Header"))
377
				}, "30s", "1s").Should(Succeed())
378
			})
379

380
			It("should automatically set host header from service address", func() {
381
				Eventually(func(g Gomega) {
382
					response, err := client.CollectEchoResponse(
383
						kubernetes.Cluster, "demo-client",
384
						"http://simple-gateway.simple-gateway:8082/",
385
						client.WithHeader("host", "example.kuma.io"),
386
						client.FromKubernetesPod(clientNamespace, "demo-client"),
387
					)
388

389
					g.Expect(err).ToNot(HaveOccurred())
390
					g.Expect(response.Received.Headers["Host"]).To(HaveLen(1))
391
					g.Expect(response.Received.Headers["Host"]).To(ContainElements("example.kuma.io"))
392
					g.Expect(response.Received.Headers).ToNot(HaveKey("X-Specific-Hostname-Header"))
393
				}, "30s", "1s").Should(Succeed())
394
			})
395

396
			It("should route based on host name", func() {
397
				Eventually(func(g Gomega) {
398
					response, err := client.CollectEchoResponse(
399
						kubernetes.Cluster, "demo-client",
400
						"http://simple-gateway.simple-gateway:8082/",
401
						client.WithHeader("host", "specific.kuma.io"),
402
						client.FromKubernetesPod(clientNamespace, "demo-client"),
403
					)
404

405
					g.Expect(err).ToNot(HaveOccurred())
406
					g.Expect(response.Received.Headers["Host"]).To(HaveLen(1))
407
					g.Expect(response.Received.Headers["Host"]).To(ContainElements("specific.kuma.io"))
408
					g.Expect(response.Received.Headers["X-Specific-Hostname-Header"]).To(ContainElements("true"))
409
				}, "30s", "1s").Should(Succeed())
410
			})
411

412
			It("should match routes by SNI", func() {
413
				Eventually(func(g Gomega) {
414
					response, err := client.CollectEchoResponse(
415
						kubernetes.Cluster, "demo-client",
416
						"https://otherexample.kuma.io:8081/-specific-listener",
417
						client.Resolve("otherexample.kuma.io:8081", clusterIP),
418
						client.FromKubernetesPod(clientNamespace, "demo-client"),
419
						client.Insecure(),
420
					)
421

422
					g.Expect(err).ToNot(HaveOccurred())
423
					g.Expect(response.Received.Headers["Host"]).To(HaveLen(1))
424
					g.Expect(response.Received.Headers["Host"]).To(ContainElements("otherexample.kuma.io:8081"))
425
					g.Expect(response.Received.Headers["X-Listener-By-Hostname-Header"]).To(ContainElements("true"))
426
				}, "30s", "1s").Should(Succeed())
427
			})
428

429
			It("should isolate routes by SNI", func() {
430
				Eventually(func(g Gomega) {
431
					response, err := client.CollectEchoResponse(
432
						kubernetes.Cluster, "demo-client",
433
						"https://example.kuma.io:8081/-specific-listener",
434
						client.Resolve("example.kuma.io:8081", clusterIP),
435
						client.FromKubernetesPod(clientNamespace, "demo-client"),
436
						client.Insecure(),
437
					)
438

439
					g.Expect(err).ToNot(HaveOccurred())
440
					g.Expect(response.Received.Headers["Host"]).To(HaveLen(1))
441
					g.Expect(response.Received.Headers["Host"]).To(ContainElements("example.kuma.io:8081"))
442
					g.Expect(response.Received.Headers["X-Listener-By-Hostname-Header"]).NotTo(ContainElements("true"))
443
				}, "30s", "1s").Should(Succeed())
444
			})
445

446
			It("should check both SNI and Host", func() {
447
				Consistently(func(g Gomega) {
448
					status, err := client.CollectFailure(
449
						kubernetes.Cluster, "demo-client",
450
						"https://otherexample.kuma.io:8081/-specific-listener",
451
						client.Resolve("otherexample.kuma.io:8081", clusterIP),
452
						// Note the header differs from the SNI
453
						client.WithHeader("host", "example.kuma.io"),
454
						client.FromKubernetesPod(clientNamespace, "demo-client"),
455
						client.Insecure(),
456
					)
457

458
					g.Expect(err).ToNot(HaveOccurred())
459
					g.Expect(status.ResponseCode).To(Equal(404))
460
				}, "30s", "1s").Should(Succeed())
461
			})
462
		})
463
	}
464

465
	basicRouting("MeshGatewayRoute", meshGatewayRoutes("internal-service", "/", "echo-server_simple-gateway_svc_80"))
466
	basicRouting("MeshHTTPRoute", httpRoute("internal-service", "/", "echo-server_simple-gateway_svc_80"))
467

468
	Context("Rate Limit", func() {
469
		rt := `apiVersion: kuma.io/v1alpha1
470
kind: RateLimit
471
metadata:
472
  name: gateway-rate-limit
473
mesh: simple-gateway
474
spec:
475
  sources:
476
  - match:
477
      kuma.io/service: simple-gateway
478
  destinations:
479
  - match:
480
      kuma.io/service: rt-echo-server_simple-gateway_svc_80
481
  conf:
482
    http:
483
      requests: 5
484
      interval: 10s`
485
		routes := meshGatewayRoutes("rt-echo-server", "/rt", "rt-echo-server_simple-gateway_svc_80")
486

487
		BeforeAll(func() {
488
			err := NewClusterSetup().
489
				Install(testserver.Install(
490
					testserver.WithName("rt-echo-server"),
491
					testserver.WithMesh(meshName),
492
					testserver.WithNamespace(namespace),
493
					testserver.WithEchoArgs("echo", "--instance", "rt-echo-server"),
494
				)).
495
				Install(YamlK8s(rt)).
496
				Install(YamlK8s(routes...)).
497
				Setup(kubernetes.Cluster)
498
			Expect(err).ToNot(HaveOccurred())
499
		})
500

501
		AfterAll(func() {
502
			err := NewClusterSetup().
503
				Install(DeleteYamlK8s(routes...)).
504
				Setup(kubernetes.Cluster)
505
			Expect(err).ToNot(HaveOccurred())
506
		})
507

508
		It("should rate limit", func() {
509
			Eventually(func(g Gomega) {
510
				response, err := client.CollectFailure(
511
					kubernetes.Cluster, "demo-client",
512
					"http://simple-gateway.simple-gateway:8080/rt",
513
					client.WithHeader("host", "example.kuma.io"),
514
					client.FromKubernetesPod(clientNamespace, "demo-client"),
515
					client.NoFail(),
516
					client.OutputFormat(`{ "received": { "status": %{response_code} } }`),
517
				)
518

519
				g.Expect(err).ToNot(HaveOccurred())
520
				g.Expect(response.ResponseCode).To(Equal(429))
521
			}, "30s", "1s").Should(Succeed())
522
		})
523
	})
524

525
	Context("TCPRoute", func() {
526
		routes := []string{
527
			fmt.Sprintf(`
528
apiVersion: kuma.io/v1alpha1
529
kind: MeshTCPRoute
530
metadata:
531
  name: simple-gateway-tcp-route
532
  namespace: %s
533
  labels:
534
    kuma.io/mesh: simple-gateway
535
spec:
536
  targetRef:
537
    kind: MeshGateway
538
    name: simple-gateway
539
  to:
540
    - targetRef:
541
        kind: Mesh
542
      rules:
543
        - default:
544
            backendRefs:
545
              - kind: MeshService
546
                name: test-tcp-server_simple-gateway_svc_80 
547
`, Config.KumaNamespace),
548
		}
549
		BeforeAll(func() {
550
			err := NewClusterSetup().
551
				Install(testserver.Install(
552
					testserver.WithName("test-tcp-server"),
553
					testserver.WithServicePortAppProtocol("tcp"),
554
					testserver.WithMesh(meshName),
555
					testserver.WithNamespace(namespace),
556
				)).
557
				Install(YamlK8s(routes...)).
558
				Setup(kubernetes.Cluster)
559
			Expect(err).ToNot(HaveOccurred())
560
		})
561
		AfterAll(func() {
562
			err := NewClusterSetup().
563
				Install(DeleteYamlK8s(routes...)).
564
				Setup(kubernetes.Cluster)
565
			Expect(err).ToNot(HaveOccurred())
566
		})
567

568
		It("should work on TCP service", func() {
569
			Eventually(func(g Gomega) {
570
				response, err := client.CollectEchoResponse(
571
					kubernetes.Cluster, "demo-client",
572
					"http://simple-gateway.simple-gateway:8083/",
573
					client.FromKubernetesPod(clientNamespace, "demo-client"),
574
				)
575
				g.Expect(err).ToNot(HaveOccurred())
576
				g.Expect(response.Instance).To(HavePrefix("test-tcp-server"))
577
			}, "30s", "1s").Should(Succeed())
578
		})
579
	})
580

581
	Context("External Service", func() {
582
		externalService := `
583
apiVersion: kuma.io/v1alpha1
584
kind: ExternalService
585
mesh: simple-gateway
586
metadata:
587
  name: simple-gateway-external-service
588
spec:
589
  tags:
590
    kuma.io/service: external-service
591
    kuma.io/protocol: http
592
  networking:
593
    address: es-echo-server.client-simple-gateway.svc.cluster.local:80`
594

595
		BeforeAll(func() {
596
			err := NewClusterSetup().
597
				Install(testserver.Install(
598
					testserver.WithName("es-echo-server"),
599
					testserver.WithNamespace(clientNamespace),
600
					testserver.WithEchoArgs("echo", "--instance", "es-echo-server"),
601
				)).
602
				Install(YamlK8s(externalService)).
603
				Setup(kubernetes.Cluster)
604
			Expect(err).ToNot(HaveOccurred())
605
		})
606

607
		It("should proxy to service via HTTP", func() {
608
			route := meshGatewayRoutes("es-echo-server", "/external-service", "external-service")
609
			setup := NewClusterSetup().Install(YamlK8s(route...))
610
			Expect(setup.Setup(kubernetes.Cluster)).To(Succeed())
611

612
			Eventually(func(g Gomega) {
613
				response, err := client.CollectEchoResponse(
614
					kubernetes.Cluster, "demo-client",
615
					"http://simple-gateway.simple-gateway:8080/external-service",
616
					client.WithHeader("host", "example.kuma.io"),
617
					client.FromKubernetesPod(clientNamespace, "demo-client"),
618
				)
619

620
				g.Expect(err).ToNot(HaveOccurred())
621
				g.Expect(response.Instance).To(Equal("es-echo-server"))
622
			}, "30s", "1s").Should(Succeed())
623

624
			Expect(NewClusterSetup().Install(DeleteYamlK8s(route...)).Setup(kubernetes.Cluster)).To(Succeed())
625
		})
626

627
		It("should automatically set host header from external service address when rewrite.hostToBackendHostname is set to true", func() {
628
			route := meshGatewayRoutes("es-echo-server", "/external-service", "external-service")
629
			setup := NewClusterSetup().Install(YamlK8s(route...))
630
			Expect(setup.Setup(kubernetes.Cluster)).To(Succeed())
631

632
			// don't rewrite host to backend hostname
633
			Eventually(func(g Gomega) {
634
				response, err := client.CollectEchoResponse(
635
					kubernetes.Cluster, "demo-client",
636
					"http://simple-gateway.simple-gateway:8080/external-service",
637
					client.WithHeader("host", "example.kuma.io"),
638
					client.FromKubernetesPod(clientNamespace, "demo-client"),
639
				)
640

641
				g.Expect(err).ToNot(HaveOccurred())
642
				g.Expect(response.Received.Headers["Host"]).To(HaveLen(1))
643
				g.Expect(response.Received.Headers["Host"]).To(ContainElements("example.kuma.io"))
644
			}, "30s", "1s").Should(Succeed())
645

646
			// rewrite host to backend hostname
647
			Eventually(func(g Gomega) {
648
				response, err := client.CollectEchoResponse(
649
					kubernetes.Cluster, "demo-client",
650
					"http://simple-gateway.simple-gateway:8080/rewrite-host/external-service",
651
					client.WithHeader("host", "example.kuma.io"),
652
					client.FromKubernetesPod(clientNamespace, "demo-client"),
653
				)
654

655
				g.Expect(err).ToNot(HaveOccurred())
656
				g.Expect(response.Received.Headers["Host"]).To(HaveLen(1))
657
				g.Expect(response.Received.Headers["Host"]).To(ContainElements("es-echo-server.client-simple-gateway.svc.cluster.local"))
658
			}, "30s", "1s").Should(Succeed())
659

660
			Expect(NewClusterSetup().Install(DeleteYamlK8s(route...)).Setup(kubernetes.Cluster)).To(Succeed())
661
		})
662

663
		It("should handle external-service excluded by tags", func() {
664
			route := fmt.Sprintf(`
665
apiVersion: kuma.io/v1alpha1
666
kind: MeshGatewayRoute
667
metadata:
668
  name: %s
669
mesh: simple-gateway
670
spec:
671
  selectors:
672
  - match:
673
      kuma.io/service: simple-gateway
674
  conf:
675
    http:
676
      rules:
677
      - matches:
678
        - path:
679
            match: PREFIX
680
            value: %s
681
        backends:
682
        - destination:
683
            kuma.io/service: %s
684
            nonexistent: tag
685
`, "es-echo-server-broken", "/external-service", "external-service")
686

687
			setup := NewClusterSetup().Install(YamlK8s(route))
688
			Expect(setup.Setup(kubernetes.Cluster)).To(Succeed())
689

690
			Eventually(func(g Gomega) {
691
				response, err := client.CollectFailure(
692
					kubernetes.Cluster, "demo-client",
693
					"http://simple-gateway.simple-gateway:8080/external-service",
694
					client.WithHeader("host", "example.kuma.io"),
695
					client.FromKubernetesPod(clientNamespace, "demo-client"),
696
				)
697

698
				g.Expect(err).ToNot(HaveOccurred())
699
				g.Expect(response.ResponseCode).To(Equal(503))
700
			}, "30s", "1s").Should(Succeed())
701

702
			Expect(NewClusterSetup().Install(DeleteYamlK8s(route)).Setup(kubernetes.Cluster)).To(Succeed())
703
		})
704
	})
705
}
706