This commit includes the following: loadgen unit testing with TLS for each component

Signed-off-by: Dean Amar <Dean.Amar@ibm.com>

Author: dean-amar

loadgen/client_test.go

@@ -30,8 +30,12 @@ import (
 	"github.com/hyperledger/fabric-x-committer/utils/test"
 )
 
-// We expect at least 3 blocks for a valid test run.
-const defaultExpectedTXs = defaultBlockSize * 3
+const (
+	// We expect at least 3 blocks for a valid test run.
+	defaultExpectedTXs = defaultBlockSize * 3
+	// Each server's SAN is localhost.
+	defaultServerSAN = "localhost"
+)
 
 // We can enforce exact limits only for the sidecar and the coordinator.
 // The other adapters runs concurrent workers that might overshoot.
@@ -42,64 +46,93 @@ var defaultLimits = []*adapters.GenerateLimit{
 
 func TestLoadGenForLoadGen(t *testing.T) {
 	t.Parallel()
-
-	for _, limit := range defaultLimits {
-		clientConf := DefaultClientConf()
-		clientConf.Limit = limit
-		// Ensure the client doesn't generate load, but only receives it from the sub client.
-		clientConf.LoadProfile.Workers = 0
-		t.Run(limitToString(limit), func(t *testing.T) {
+	for _, mode := range test.ServerModes {
+		mode := mode
+		t.Run(fmt.Sprintf("tls-mode:%s", mode), func(t *testing.T) {
 			t.Parallel()
-			clientConf.Adapter.VerifierClient = startVerifiers(t)
-			_, err := clientConf.Server.PreAllocateListener()
-			require.NoError(t, err)
-
-			subClientConf := DefaultClientConf()
-			subClientConf.Adapter.LoadGenClient = test.NewInsecureClientConfig(&clientConf.Server.Endpoint)
-			subClient, err := NewLoadGenClient(subClientConf)
-			require.NoError(t, err)
-
-			t.Log("Start distributed loadgen")
-			test.RunServiceAndGrpcForTest(t.Context(), t, subClient, subClientConf.Server)
-			testLoadGenerator(t, clientConf)
+			serverCreds, clientCreds := createServerAndClientTLSCerts(t, mode)
+			for _, limit := range defaultLimits {
+				limit := limit
+				t.Run(limitToString(limit), func(t *testing.T) {
+					t.Parallel()
+					clientConf := DefaultClientConf()
+					clientConf.Server.TLS = serverCreds
+					clientConf.Limit = limit
+					// Ensure the client doesn't generate load, but only receives it from the sub client.
+					clientConf.LoadProfile.Workers = 0
+
+					clientConf.Adapter.VerifierClient = startVerifiers(t,
+						test.InsecureTLSConfig, test.InsecureTLSConfig,
+					)
+					_, err := clientConf.Server.PreAllocateListener()
+					require.NoError(t, err)
+
+					subClientConf := DefaultClientConf()
+					subClientConf.Adapter.LoadGenClient = test.NewTLSClientConfig(
+						clientCreds, &clientConf.Server.Endpoint,
+					)
+					subClient, err := NewLoadGenClient(subClientConf)
+					require.NoError(t, err)
+
+					t.Log("Start distributed loadgen")
+					test.RunServiceAndGrpcForTest(t.Context(), t, subClient, subClientConf.Server)
+					testLoadGenerator(t, clientConf)
+				})
+			}
 		})
 	}
 }
 
 func TestLoadGenForVCService(t *testing.T) {
 	t.Parallel()
-	for _, limit := range defaultLimits {
-		clientConf := DefaultClientConf()
-		clientConf.Limit = limit
-		t.Run(limitToString(limit), func(t *testing.T) {
+	for _, mode := range test.ServerModes {
+		mode := mode
+		t.Run(fmt.Sprintf("tls-mode:%s", mode), func(t *testing.T) {
 			t.Parallel()
-			env := vc.NewValidatorAndCommitServiceTestEnvWithTLS(t, 2, test.InsecureTLSConfig)
-			clientConf.Adapter.VCClient = test.NewInsecureMultiClientConfig(env.Endpoints...)
-			testLoadGenerator(t, clientConf)
+			serverCreds, clientCreds := createServerAndClientTLSCerts(t, mode)
+			for _, limit := range defaultLimits {
+				limit := limit
+				t.Run(limitToString(limit), func(t *testing.T) {
+					t.Parallel()
+					clientConf := DefaultClientConf()
+					clientConf.Limit = limit
+					env := vc.NewValidatorAndCommitServiceTestEnvWithTLS(t, 2, serverCreds)
+					clientConf.Adapter.VCClient = test.NewTLSMultiClientConfig(clientCreds, env.Endpoints...)
+					testLoadGenerator(t, clientConf)
+				})
+			}
 		})
 	}
 }
 
 func TestLoadGenForSigVerifier(t *testing.T) {
 	t.Parallel()
-	for _, limit := range defaultLimits {
-		clientConf := DefaultClientConf()
-		clientConf.Limit = limit
-		t.Run(limitToString(limit), func(t *testing.T) {
+	for _, mode := range test.ServerModes {
+		mode := mode
+		t.Run(fmt.Sprintf("tls-mode:%s", mode), func(t *testing.T) {
 			t.Parallel()
-			clientConf.Adapter.VerifierClient = startVerifiers(t)
-			// Start client
-			testLoadGenerator(t, clientConf)
+			serverCreds, clientCreds := createServerAndClientTLSCerts(t, mode)
+			for _, limit := range defaultLimits {
+				limit := limit
+				t.Run(limitToString(limit), func(t *testing.T) {
+					t.Parallel()
+					clientConf := DefaultClientConf()
+					clientConf.Limit = limit
+					clientConf.Adapter.VerifierClient = startVerifiers(t, serverCreds, clientCreds)
+					// Start client
+					testLoadGenerator(t, clientConf)
+				})
+			}
 		})
 	}
 }
 
-func startVerifiers(t *testing.T) *connection.MultiClientConfig {
+func startVerifiers(t *testing.T, serverCreds, clientCreds connection.TLSConfig) *connection.MultiClientConfig {
 	t.Helper()
 	endpoints := make([]*connection.Endpoint, 2)
 	for i := range endpoints {
 		sConf := &verifier.Config{
-			Server: connection.NewLocalHostServerWithTLS(test.InsecureTLSConfig),
+			Server: connection.NewLocalHostServerWithTLS(serverCreds),
 			ParallelExecutor: verifier.ExecutorConfig{
 				BatchSizeCutoff:   50,
 				BatchTimeCutoff:   10 * time.Millisecond,
@@ -112,111 +145,130 @@ func startVerifiers(t *testing.T) *connection.MultiClientConfig {
 		test.RunGrpcServerForTest(t.Context(), t, sConf.Server, service.RegisterService)
 		endpoints[i] = &sConf.Server.Endpoint
 	}
-	return test.NewInsecureMultiClientConfig(endpoints...)
+	return test.NewTLSMultiClientConfig(clientCreds, endpoints...)
 }
 
 func TestLoadGenForCoordinator(t *testing.T) {
 	t.Parallel()
-	for _, limit := range append(
-		defaultLimits,
-		&adapters.GenerateLimit{Blocks: 5},
-		&adapters.GenerateLimit{Transactions: 5*defaultBlockSize + 2}, // +2 for the config and meta namespace TXs.
-	) {
-		clientConf := DefaultClientConf()
-		clientConf.Limit = limit
-		t.Run(limitToString(limit), func(t *testing.T) {
+	for _, mode := range test.ServerModes {
+		mode := mode
+		t.Run(fmt.Sprintf("tls-mode:%s", mode), func(t *testing.T) {
 			t.Parallel()
-			_, sigVerServer := mock.StartMockSVService(t, 1)
-			_, vcServer := mock.StartMockVCService(t, 1)
-
-			cConf := &coordinator.Config{
-				Server:             connection.NewLocalHostServerWithTLS(test.InsecureTLSConfig),
-				Monitoring:         defaultMonitoring(),
-				Verifier:           *test.ServerToMultiClientConfig(sigVerServer.Configs...),
-				ValidatorCommitter: *test.ServerToMultiClientConfig(vcServer.Configs...),
-				DependencyGraph: &coordinator.DependencyGraphConfig{
-					NumOfLocalDepConstructors: 1,
-					WaitingTxsLimit:           100_000,
+			serverCreds, clientCreds := createServerAndClientTLSCerts(t, mode)
+			for _, limit := range append(
+				defaultLimits,
+				&adapters.GenerateLimit{Blocks: 5},
+				&adapters.GenerateLimit{
+					Transactions: 5*defaultBlockSize + 2, // +2 for the config and meta namespace TXs.
 				},
-				ChannelBufferSizePerGoroutine: 10,
+			) {
+				limit := limit
+				t.Run(limitToString(limit), func(t *testing.T) {
+					t.Parallel()
+					clientConf := DefaultClientConf()
+					clientConf.Limit = limit
+					_, sigVerServer := mock.StartMockSVService(t, 1)
+					_, vcServer := mock.StartMockVCService(t, 1)
+
+					cConf := &coordinator.Config{
+						Server:             connection.NewLocalHostServerWithTLS(serverCreds),
+						Monitoring:         defaultMonitoring(),
+						Verifier:           *test.ServerToMultiClientConfig(sigVerServer.Configs...),
+						ValidatorCommitter: *test.ServerToMultiClientConfig(vcServer.Configs...),
+						DependencyGraph: &coordinator.DependencyGraphConfig{
+							NumOfLocalDepConstructors: 1,
+							WaitingTxsLimit:           100_000,
+						},
+						ChannelBufferSizePerGoroutine: 10,
+					}
+
+					service := coordinator.NewCoordinatorService(cConf)
+					test.RunServiceAndGrpcForTest(t.Context(), t, service, cConf.Server)
+
+					// Start client
+					clientConf.Adapter.CoordinatorClient = test.NewTLSClientConfig(clientCreds, &cConf.Server.Endpoint)
+					testLoadGenerator(t, clientConf)
+				})
 			}
-
-			service := coordinator.NewCoordinatorService(cConf)
-			test.RunServiceAndGrpcForTest(t.Context(), t, service, cConf.Server)
-
-			// Start client
-			clientConf.Adapter.CoordinatorClient = test.NewInsecureClientConfig(&cConf.Server.Endpoint)
-			testLoadGenerator(t, clientConf)
 		})
 	}
 }
 
 func TestLoadGenForSidecar(t *testing.T) {
 	t.Parallel()
-
-	for _, limit := range append(
-		defaultLimits,
-		&adapters.GenerateLimit{Blocks: 5},
-		&adapters.GenerateLimit{Transactions: 5*defaultBlockSize + 1}, // +1 for the meta namespace TX.
-	) {
-		clientConf := DefaultClientConf()
-		clientConf.Limit = limit
-		t.Run(limitToString(limit), func(t *testing.T) {
+	for _, mode := range test.ServerModes {
+		mode := mode
+		t.Run(fmt.Sprintf("tls-mode:%s", mode), func(t *testing.T) {
 			t.Parallel()
-			_, coordinatorServer := mock.StartMockCoordinatorService(t)
-
-			// When using the sidecar adapter, the load generator and the sidecar
-			// should have each other's endpoints.
-			// To avoid manually pre-choosing ports that might conflict with other tests,
-			// we pre allocate them by starting a listener that picks a port automatically and bind to it.
-			// In real evaluation scenario, the ports will be selected by the deployment infrastructure.
-			sidecarServerConf := preAllocatePorts(t)
-			ordererServers := make([]*connection.ServerConfig, 3)
-			for i := range ordererServers {
-				ordererServers[i] = preAllocatePorts(t)
-			}
-
-			// Start server under test
-			sidecarConf := &sidecar.Config{
-				Server: sidecarServerConf,
-				Orderer: ordererconn.Config{
-					Connection: ordererconn.ConnectionConfig{
-						Endpoints: ordererconn.NewEndpoints(0, "org", ordererServers...),
-					},
-					ChannelID:     clientConf.LoadProfile.Transaction.Policy.ChannelID,
-					Identity:      clientConf.LoadProfile.Transaction.Policy.Identity,
-					ConsensusType: ordererconn.Bft,
-				},
-				LastCommittedBlockSetInterval: 100 * time.Millisecond,
-				WaitingTxsLimit:               5000,
-				Committer:                     test.NewInsecureClientConfig(&coordinatorServer.Configs[0].Endpoint),
-				Monitoring:                    defaultMonitoring(),
-				Ledger: sidecar.LedgerConfig{
-					Path: t.TempDir(),
-				},
+			serverCreds, clientCreds := createServerAndClientTLSCerts(t, mode)
+			for _, limit := range append(
+				defaultLimits,
+				&adapters.GenerateLimit{Blocks: 5},
+				&adapters.GenerateLimit{Transactions: 5*defaultBlockSize + 1}, // +1 for the meta namespace TX.
+			) {
+				limit := limit
+				t.Run(limitToString(limit), func(t *testing.T) {
+					t.Parallel()
+					clientConf := DefaultClientConf()
+					clientConf.Limit = limit
+					_, coordinatorServer := mock.StartMockCoordinatorService(t)
+
+					// When using the sidecar adapter, the load generator and the sidecar
+					// should have each other's endpoints.
+					// To avoid manually pre-choosing ports that might conflict with other tests,
+					// we pre allocate them by starting a listener that picks a port automatically and bind to it.
+					// In real evaluation scenario, the ports will be selected by the deployment infrastructure.
+					sidecarServerConf := preAllocatePorts(t)
+					ordererServers := make([]*connection.ServerConfig, 3)
+					for i := range ordererServers {
+						ordererServers[i] = preAllocatePorts(t)
+					}
+					sidecarServerConf.TLS = serverCreds
+					// Start server under test
+					sidecarConf := &sidecar.Config{
+						Server: sidecarServerConf,
+						Orderer: ordererconn.Config{
+							Connection: ordererconn.ConnectionConfig{
+								Endpoints: ordererconn.NewEndpoints(0, "org", ordererServers...),
+							},
+							ChannelID:     clientConf.LoadProfile.Transaction.Policy.ChannelID,
+							Identity:      clientConf.LoadProfile.Transaction.Policy.Identity,
+							ConsensusType: ordererconn.Bft,
+						},
+						LastCommittedBlockSetInterval: 100 * time.Millisecond,
+						WaitingTxsLimit:               5000,
+						Committer: test.NewInsecureClientConfig(
+							&coordinatorServer.Configs[0].Endpoint,
+						),
+						Monitoring: defaultMonitoring(),
+						Ledger: sidecar.LedgerConfig{
+							Path: t.TempDir(),
+						},
+					}
+					service, err := sidecar.New(sidecarConf)
+					require.NoError(t, err)
+					t.Cleanup(service.Close)
+					test.RunServiceAndGrpcForTest(t.Context(), t, service, sidecarConf.Server)
+					// Start client
+					clientConf.Adapter.SidecarClient = &adapters.SidecarClientConfig{
+						OrdererServers: ordererServers,
+						SidecarClient:  test.NewTLSClientConfig(clientCreds, &sidecarServerConf.Endpoint),
+					}
+					testLoadGenerator(t, clientConf)
+				})
 			}
-			service, err := sidecar.New(sidecarConf)
-			require.NoError(t, err)
-			t.Cleanup(service.Close)
-			test.RunServiceAndGrpcForTest(t.Context(), t, service, sidecarConf.Server)
-
-			// Start client
-			clientConf.Adapter.SidecarClient = &adapters.SidecarClientConfig{
-				OrdererServers: ordererServers,
-				SidecarClient:  test.NewInsecureClientConfig(&sidecarServerConf.Endpoint),
-			}
-			testLoadGenerator(t, clientConf)
 		})
 	}
 }
 
 func TestLoadGenForOrderer(t *testing.T) {
 	t.Parallel()
 	for _, limit := range defaultLimits {
-		clientConf := DefaultClientConf()
-		clientConf.Limit = limit
+		limit := limit
 		t.Run(limitToString(limit), func(t *testing.T) {
 			t.Parallel()
+			clientConf := DefaultClientConf()
+			clientConf.Limit = limit
 			// Start dependencies
 			orderer, ordererServer := mock.StartMockOrderingServices(
 				t, &mock.OrdererConfig{NumService: 3, BlockSize: 100},
@@ -404,3 +456,13 @@ func limitToString(m *adapters.GenerateLimit) string {
 	}
 	return strings.Join(out, ",")
 }
+
+// createServerAndClientTLSCerts creates a tls configuration using the credential factory.
+func createServerAndClientTLSCerts(t *testing.T, tlsMode string) (
+	serverCreds, clientCreds connection.TLSConfig,
+) {
+	t.Helper()
+	credsFactory := test.NewCredentialsFactory(t)
+	return credsFactory.CreateServerCredentials(t, tlsMode, defaultServerSAN),
+		credsFactory.CreateClientCredentials(t, tlsMode)
+}

service/coordinator/coordinator_test.go

@@ -955,8 +955,8 @@ func fakeConfigForTest(t *testing.T) *Config {
 	require.NoError(t, err)
 	return &Config{
 		Server:             connection.NewLocalHostServerWithTLS(test.InsecureTLSConfig),
-		Verifier:           *test.NewInsecureMultiClientConfig(randomEndpoint),
-		ValidatorCommitter: *test.NewInsecureMultiClientConfig(randomEndpoint),
+		Verifier:           *test.NewTLSMultiClientConfig(test.InsecureTLSConfig, randomEndpoint),
+		ValidatorCommitter: *test.NewTLSMultiClientConfig(test.InsecureTLSConfig, randomEndpoint),
 		DependencyGraph:    &DependencyGraphConfig{},
 		Monitoring: monitoring.Config{
 			Server: connection.NewLocalHostServerWithTLS(test.InsecureTLSConfig),

service/query/query_service_test.go

@@ -358,7 +358,7 @@ func generateNamespacesUnderTest(t *testing.T, namespaces []string) *vc.Database
 	env.SetupSystemTablesAndNamespaces(t.Context(), t)
 
 	clientConf := loadgen.DefaultClientConf()
-	clientConf.Adapter.VCClient = test.NewInsecureMultiClientConfig(env.Endpoints...)
+	clientConf.Adapter.VCClient = test.NewTLSMultiClientConfig(test.InsecureTLSConfig, env.Endpoints...)
 	policies := &workload.PolicyProfile{
 		NamespacePolicies: make(map[string]*workload.Policy, len(namespaces)),
 	}