Skip to content

Commit 71939dc

Browse files
sarahalsmillernathancoleman
sarahalsmiller
and
nathancoleman
authored
PSA Acceptance Tests (#4483)
* update tests and bases * change client image back * remove read only tag * remove root only file system * update test target address * fix kitchen sink gcc * fix target address * fix targetAddress * comment out flaky checks * Update acceptance/tests/api-gateway/api_gateway_test.go * update ports on jwt test * clean up names and enforce versions * Update acceptance/tests/fixtures/bases/api-gateway/gatewayclassconfig.yaml Co-authored-by: Nathan Coleman <[email protected]> * removing test case to reduce chances of flaking * update deployment sec context * skip psa in CNI for now * modify namespace directly not through the config * add test case back in * clean up print statement * gofmt * add namespace for cni * don't skip cni * don't skip cni when tproxy is on * add sec comp profile * fix unit test * update tests and bases * change client image back * remove read only tag * remove root only file system * update test target address * fix kitchen sink gcc * fix target address * fix targetAddress * comment out flaky checks * Update acceptance/tests/api-gateway/api_gateway_test.go * update ports on jwt test * clean up names and enforce versions * Update acceptance/tests/fixtures/bases/api-gateway/gatewayclassconfig.yaml Co-authored-by: Nathan Coleman <[email protected]> * removing test case to reduce chances of flaking * update deployment sec context * skip psa in CNI for now * modify namespace directly not through the config * add test case back in * clean up print statement * gofmt * add namespace for cni * don't skip cni * don't skip cni when tproxy is on * add sec comp profile * fix unit test * clean up, add cni comment * clean up counter --------- Co-authored-by: Nathan Coleman <[email protected]>
1 parent e88455a commit 71939dc

File tree

15 files changed

+128
-20
lines changed

15 files changed

+128
-20
lines changed

Diff for: ‎acceptance/tests/api-gateway/api_gateway_external_servers_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ func TestAPIGateway_ExternalServers(t *testing.T) {
120120
})
121121

122122
k8sOptions := ctx.KubectlOptions(t)
123-
targetAddress := fmt.Sprintf("http://%s/", gatewayAddress)
123+
targetAddress := fmt.Sprintf("http://%s:8080/", gatewayAddress)
124124

125125
// check that intentions keep our connection from happening
126126
k8s.CheckStaticServerHTTPConnectionFailing(t, k8sOptions, StaticClientName, targetAddress)

Diff for: ‎acceptance/tests/api-gateway/api_gateway_kitchen_sink_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -187,7 +187,7 @@ func TestAPIGateway_KitchenSink(t *testing.T) {
187187

188188
// finally we check that we can actually route to the service(s) via the gateway
189189
k8sOptions := ctx.KubectlOptions(t)
190-
targetHTTPAddress := fmt.Sprintf("http://%s/v1", gatewayAddress)
190+
targetHTTPAddress := fmt.Sprintf("http://%s:8080/v1", gatewayAddress)
191191

192192
// Now we create the allow intention.
193193
_, _, err = consulClient.ConfigEntries().Set(&api.ServiceIntentionsConfigEntry{

Diff for: ‎acceptance/tests/api-gateway/api_gateway_test.go

+53-12
Original file line numberDiff line numberDiff line change
@@ -37,20 +37,35 @@ const (
3737
// Test that api gateway basic functionality works in a default installation and a secure installation.
3838
func TestAPIGateway_Basic(t *testing.T) {
3939
cases := []struct {
40-
secure bool
40+
secure bool
41+
restrictedPSAEnforcement bool
4142
}{
4243
{
4344
secure: false,
4445
},
4546
{
4647
secure: true,
4748
},
49+
// There is an argument that all tests should be run in a restricted PSA namespace
50+
// However we are on a time crunch and don't want to make sweeping changes to the test suite
51+
{
52+
secure: true,
53+
restrictedPSAEnforcement: true,
54+
},
55+
{
56+
secure: false,
57+
restrictedPSAEnforcement: true,
58+
},
4859
}
4960
for _, c := range cases {
50-
name := fmt.Sprintf("secure: %t", c.secure)
61+
name := fmt.Sprintf("secure: %t restrictedPSAEnforcement: %t", c.secure, c.restrictedPSAEnforcement)
5162
t.Run(name, func(t *testing.T) {
5263
ctx := suite.Environment().DefaultContext(t)
5364
cfg := suite.Config()
65+
if cfg.EnableTransparentProxy && c.restrictedPSAEnforcement && !cfg.EnableCNI {
66+
t.Skipf("skipping because -enable-transparent-proxy is set and -enable-cni is not and tproxy cannot run in restrictedPSA without CNI enabled")
67+
}
68+
5469
helmValues := map[string]string{
5570
"connectInject.enabled": "true",
5671
"global.acls.manageSystemACLs": strconv.FormatBool(c.secure),
@@ -63,6 +78,30 @@ func TestAPIGateway_Basic(t *testing.T) {
6378

6479
consulCluster.Create(t)
6580

81+
if c.restrictedPSAEnforcement {
82+
//enable PSA enforcment for some tests
83+
k8s.RunKubectl(t, ctx.KubectlOptions(t), "label", "--overwrite", "ns", ctx.KubectlOptions(t).Namespace,
84+
"pod-security.kubernetes.io/enforce=restricted",
85+
)
86+
87+
if cfg.EnableCNI {
88+
helmValues["connectInject.cni.namespace"] = "cni-namespace"
89+
//create namespace for CNI. CNI pods require NET_ADMIN so the need to run in a non PSA restricted namespace.
90+
k8s.RunKubectl(t, ctx.KubectlOptions(t), "create", "namespace", "cni-namespace")
91+
}
92+
}
93+
helpers.Cleanup(t, cfg.NoCleanupOnFailure, cfg.NoCleanup, func() {
94+
if c.restrictedPSAEnforcement {
95+
//reset namespace
96+
k8s.RunKubectl(t, ctx.KubectlOptions(t), "label", "--overwrite", "ns", ctx.KubectlOptions(t).Namespace,
97+
"pod-security.kubernetes.io/enforce=privileged",
98+
)
99+
if cfg.EnableCNI {
100+
k8s.RunKubectl(t, ctx.KubectlOptions(t), "delete", "namespace", "cni-namespace")
101+
}
102+
}
103+
})
104+
66105
// Override the default proxy config settings for this test
67106
consulClient, _ := consulCluster.SetupConsulClient(t, c.secure)
68107
_, _, err := consulClient.ConfigEntries().Set(&api.ProxyConfigEntry{
@@ -208,6 +247,7 @@ func TestAPIGateway_Basic(t *testing.T) {
208247
require.Len(t, tcpRoute.Status.Parents, 1)
209248
require.EqualValues(t, gatewayClassControllerName, tcpRoute.Status.Parents[0].ControllerName)
210249
require.EqualValues(t, "gateway", tcpRoute.Status.Parents[0].ParentRef.Name)
250+
211251
checkStatusCondition(t, tcpRoute.Status.Parents[0].Conditions, trueCondition("Accepted", "Accepted"))
212252
checkStatusCondition(t, tcpRoute.Status.Parents[0].Conditions, trueCondition("ResolvedRefs", "ResolvedRefs"))
213253
checkStatusCondition(t, tcpRoute.Status.Parents[0].Conditions, trueCondition("ConsulAccepted", "Accepted"))
@@ -239,9 +279,10 @@ func TestAPIGateway_Basic(t *testing.T) {
239279

240280
// finally we check that we can actually route to the service via the gateway
241281
k8sOptions := ctx.KubectlOptions(t)
242-
targetHTTPAddress := fmt.Sprintf("http://%s", gatewayAddress)
243-
targetHTTPSAddress := fmt.Sprintf("https://%s", gatewayAddress)
244-
targetTCPAddress := fmt.Sprintf("http://%s:81", gatewayAddress)
282+
//we have to account for port mapping inside the cluster.
283+
targetHTTPAddress := fmt.Sprintf("http://%s:8080", gatewayAddress)
284+
targetHTTPSAddress := fmt.Sprintf("https://%s:8443", gatewayAddress)
285+
targetTCPAddress := fmt.Sprintf("http://%s:8081", gatewayAddress)
245286

246287
if c.secure {
247288
// check that intentions keep our connection from happening
@@ -543,13 +584,13 @@ func TestAPIGateway_JWTAuth_Basic(t *testing.T) {
543584

544585
// finally we check that we can actually route to the service(s) via the gateway
545586
k8sOptions := ctx.KubectlOptions(t)
546-
targetHTTPAddress := fmt.Sprintf("http://%s/v1", gatewayAddress)
547-
targetHTTPAddressAdmin := fmt.Sprintf("http://%s:8081/admin", gatewayAddress)
548-
targetHTTPAddressPet := fmt.Sprintf("http://%s:8081/pet", gatewayAddress)
549-
targetHTTPAddressAdmin2 := fmt.Sprintf("http://%s:8081/admin-2", gatewayAddress)
550-
targetHTTPAddressPet2 := fmt.Sprintf("http://%s:8081/pet-2", gatewayAddress)
551-
targetHTTPAddressAdminNoAuthOnRoute := fmt.Sprintf("http://%s:8081/admin-no-auth", gatewayAddress)
552-
targetHTTPAddressPetNotAuthOnRoute := fmt.Sprintf("http://%s:8081/pet-no-auth", gatewayAddress)
587+
targetHTTPAddress := fmt.Sprintf("http://%s:8080/v1", gatewayAddress)
588+
targetHTTPAddressAdmin := fmt.Sprintf("http://%s:8083/admin", gatewayAddress)
589+
targetHTTPAddressPet := fmt.Sprintf("http://%s:8083/pet", gatewayAddress)
590+
targetHTTPAddressAdmin2 := fmt.Sprintf("http://%s:8083/admin-2", gatewayAddress)
591+
targetHTTPAddressPet2 := fmt.Sprintf("http://%s:8083/pet-2", gatewayAddress)
592+
targetHTTPAddressAdminNoAuthOnRoute := fmt.Sprintf("http://%s:8083/admin-no-auth", gatewayAddress)
593+
targetHTTPAddressPetNotAuthOnRoute := fmt.Sprintf("http://%s:8083/pet-no-auth", gatewayAddress)
553594

554595
// Now we create the allow intention.
555596
_, _, err = consulClient.ConfigEntries().Set(&api.ServiceIntentionsConfigEntry{

Diff for: ‎acceptance/tests/fixtures/bases/api-gateway/gatewayclassconfig.yaml

+4-1
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,7 @@
44
apiVersion: consul.hashicorp.com/v1alpha1
55
kind: GatewayClassConfig
66
metadata:
7-
name: gateway-class-config
7+
name: gateway-class-config
8+
spec:
9+
# In order for Gateways to work whether or not we're enforcing the "restricted" pod security policy, they must not used privileged ports
10+
mapPrivilegedContainerPorts: 8000

Diff for: ‎acceptance/tests/fixtures/bases/static-client/deployment.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,17 @@ spec:
1818
spec:
1919
containers:
2020
- name: static-client
21+
securityContext:
22+
allowPrivilegeEscalation: false
23+
runAsNonRoot: true
24+
runAsUser: 1000
25+
seccompProfile:
26+
type: RuntimeDefault
27+
capabilities:
28+
add:
29+
- "NET_BIND_SERVICE"
30+
drop:
31+
- ALL
2132
image: docker.mirror.hashicorp.services/buildpack-deps:jammy-curl
2233
command: [ "/bin/sh", "-c", "--" ]
2334
args: [ "while true; do sleep 30; done;" ]

Diff for: ‎acceptance/tests/fixtures/bases/static-server-https/deployment.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,17 @@ spec:
1818
containers:
1919
- name: caddy
2020
image: caddy:latest
21+
securityContext:
22+
allowPrivilegeEscalation: false
23+
runAsNonRoot: true
24+
runAsUser: 1000
25+
seccompProfile:
26+
type: RuntimeDefault
27+
capabilities:
28+
add:
29+
- "NET_BIND_SERVICE"
30+
drop:
31+
- ALL
2132
ports:
2233
- name: https-port
2334
containerPort: 443

Diff for: ‎acceptance/tests/fixtures/bases/static-server-tcp/deployment.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,17 @@ spec:
2222
containers:
2323
- name: static-server
2424
image: docker.mirror.hashicorp.services/kschoche/http-echo:latest
25+
securityContext:
26+
allowPrivilegeEscalation: false
27+
runAsNonRoot: true
28+
runAsUser: 1000
29+
seccompProfile:
30+
type: RuntimeDefault
31+
capabilities:
32+
add:
33+
- "NET_BIND_SERVICE"
34+
drop:
35+
- ALL
2536
args:
2637
- -text="hello world"
2738
- -listen=:8080

Diff for: ‎acceptance/tests/fixtures/bases/static-server/deployment.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,17 @@ spec:
2121
# Using alpine vs latest as there is a build issue with M1s. Also other tests in multiport-app reference
2222
# alpine so standardizing this.
2323
image: docker.mirror.hashicorp.services/hashicorp/http-echo:alpine
24+
securityContext:
25+
allowPrivilegeEscalation: false
26+
runAsNonRoot: true
27+
runAsUser: 1000
28+
seccompProfile:
29+
type: RuntimeDefault
30+
capabilities:
31+
add:
32+
- "NET_BIND_SERVICE"
33+
drop:
34+
- ALL
2435
args:
2536
- -text="hello world"
2637
- -listen=:8080

Diff for: ‎acceptance/tests/fixtures/cases/api-gateways/jwt-auth/api-gateway.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,13 @@ spec:
99
gatewayClassName: gateway-class
1010
listeners:
1111
- protocol: HTTP
12-
port: 8081
12+
port: 83
1313
name: http-auth
1414
allowedRoutes:
1515
namespaces:
1616
from: "All"
1717
- protocol: HTTP
18-
port: 8082
18+
port: 84
1919
name: http-invalid-attach
2020
allowedRoutes:
2121
namespaces:

Diff for: ‎acceptance/tests/fixtures/cases/static-server-inject/patch.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,17 @@ spec:
1414
containers:
1515
- name: static-server
1616
image: docker.mirror.hashicorp.services/kschoche/http-echo:latest
17+
securityContext:
18+
allowPrivilegeEscalation: false
19+
runAsNonRoot: true
20+
runAsUser: 1000
21+
seccompProfile:
22+
type: RuntimeDefault
23+
capabilities:
24+
add:
25+
- "NET_BIND_SERVICE"
26+
drop:
27+
- ALL
1728
args:
1829
- -text="hello world"
1930
- -listen=:8080

Diff for: ‎acceptance/tests/partitions/partitions_gateway_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -259,7 +259,7 @@ func TestPartitions_Gateway(t *testing.T) {
259259
gatewayAddress = gateway.Status.Addresses[0].Value
260260
})
261261

262-
targetAddress := fmt.Sprintf("http://%s/", gatewayAddress)
262+
targetAddress := fmt.Sprintf("http://%s:8080/", gatewayAddress)
263263

264264
// This section of the tests runs the in-partition networking tests.
265265
t.Run("in-partition", func(t *testing.T) {

Diff for: ‎acceptance/tests/peering/peering_gateway_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -276,7 +276,7 @@ func TestPeering_Gateway(t *testing.T) {
276276
gatewayAddress = gateway.Status.Addresses[0].Value
277277
})
278278

279-
targetAddress := fmt.Sprintf("http://%s/", gatewayAddress)
279+
targetAddress := fmt.Sprintf("http://%s:8080/", gatewayAddress)
280280

281281
logger.Log(t, "creating local service resolver")
282282
k8s.KubectlApplyK(t, staticClientOpts, "../fixtures/cases/api-gateways/peer-resolver")

Diff for: ‎acceptance/tests/wan-federation/wan_federation_gateway_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -208,7 +208,7 @@ func checkConnectivity(t *testing.T, ctx environment.TestContext, client *api.Cl
208208
gatewayAddress = gateway.Status.Addresses[0].Value
209209
})
210210

211-
targetAddress := fmt.Sprintf("http://%s/", gatewayAddress)
211+
targetAddress := fmt.Sprintf("http://%s:8080/", gatewayAddress)
212212

213213
logger.Log(t, "checking that the connection is not successful because there's no intention")
214214
k8s.CheckStaticServerHTTPConnectionFailing(t, ctx.KubectlOptions(t), connhelper.StaticClientName, targetAddress)

Diff for: ‎control-plane/connect-inject/webhook/container_init.go

+3
Original file line numberDiff line numberDiff line change
@@ -254,6 +254,9 @@ func (w *MeshWebhook) containerInit(namespace corev1.Namespace, pod corev1.Pod,
254254
}
255255

256256
container.SecurityContext = &corev1.SecurityContext{
257+
SeccompProfile: &corev1.SeccompProfile{
258+
Type: corev1.SeccompProfileTypeRuntimeDefault,
259+
},
257260
RunAsUser: ptr.To(uid),
258261
RunAsGroup: ptr.To(group),
259262
RunAsNonRoot: ptr.To(true),

Diff for: ‎control-plane/connect-inject/webhook/container_init_test.go

+6
Original file line numberDiff line numberDiff line change
@@ -296,6 +296,9 @@ func TestHandlerContainerInit_transparentProxy(t *testing.T) {
296296
var expectedSecurityContext *corev1.SecurityContext
297297
if c.cniEnabled && !c.openShiftEnabled {
298298
expectedSecurityContext = &corev1.SecurityContext{
299+
SeccompProfile: &corev1.SeccompProfile{
300+
Type: corev1.SeccompProfileTypeRuntimeDefault,
301+
},
299302
RunAsUser: ptr.To(int64(initContainersUserAndGroupID)),
300303
RunAsGroup: ptr.To(int64(initContainersUserAndGroupID)),
301304
RunAsNonRoot: ptr.To(true),
@@ -319,6 +322,9 @@ func TestHandlerContainerInit_transparentProxy(t *testing.T) {
319322
} else if c.cniEnabled && c.openShiftEnabled {
320323
// When cni + openShift
321324
expectedSecurityContext = &corev1.SecurityContext{
325+
SeccompProfile: &corev1.SeccompProfile{
326+
Type: corev1.SeccompProfileTypeRuntimeDefault,
327+
},
322328
RunAsUser: ptr.To(int64(1000799999)),
323329
RunAsGroup: ptr.To(int64(1000799999)),
324330
RunAsNonRoot: ptr.To(true),

0 commit comments

Comments
 (0)