-
Notifications
You must be signed in to change notification settings - Fork 80
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #379 from jacobweinstock/auto-discover-trusted-pro…
…xies Add auto discovery of trusted proxies in Kubernetes, relays and giaddr fix: ## Description <!--- Please describe what this PR is going to change --> They will eliminate issues from users having to determine the trusted proxies. We've seen issues where the command we provided in the Helm chart doesn't accurately get the pod CIDRs from a cluster. Incorporating this into the Helm chart was tried, but ultimately not possible without extra ordinary effort and a lot of unneeded code to maintain. This functionality can be disabled if desired. By default we run auto discovery. This will help simplify the deployment of Smee in the Helm Chart. Also, move go.mod to Go 1.21. This is because when developing with Go 1.21 and `go mod tidy` will update the `go.mod` file. Dependency updates for tinkerbell/dhcp provide a fix for dhcp relays and the `giaddr`. ## Why is this needed <!--- Link to issue you have raised --> Fixes: #382 ## How Has This Been Tested? <!--- Please describe in detail how you tested your changes. --> <!--- Include details of your testing environment, and the tests you ran to --> <!--- see how your change affects other areas of the code, etc. --> ## How are existing users impacted? What migration steps/scripts do we need? <!--- Fixes a bug, unblocks installation, removes a component of the stack etc --> <!--- Requires a DB migration script, etc. --> ## Checklist: I have: - [ ] updated the documentation and/or roadmap (if required) - [ ] added unit or e2e tests - [ ] provided instructions on how to upgrade
- Loading branch information
Showing
8 changed files
with
401 additions
and
28 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,251 @@ | ||
| package main | ||
|
|
||
| import ( | ||
| "context" | ||
| "testing" | ||
|
|
||
| "github.com/go-logr/logr" | ||
| "github.com/google/go-cmp/cmp" | ||
| v1 "k8s.io/api/core/v1" | ||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| "k8s.io/apimachinery/pkg/runtime" | ||
| "k8s.io/client-go/kubernetes/fake" | ||
| ) | ||
|
|
||
| func TestClusterPodCIDR(t *testing.T) { | ||
| tests := map[string]struct { | ||
| spec []runtime.Object | ||
| want []string | ||
| }{ | ||
| "no podCIDR": {}, | ||
| "podCIDR": { | ||
| spec: []runtime.Object{ | ||
| &v1.PodList{ | ||
| Items: []v1.Pod{ | ||
| { | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Labels: map[string]string{ | ||
| "component": "kube-controller-manager", | ||
| }, | ||
| Namespace: "kube-system", | ||
| }, | ||
| Spec: v1.PodSpec{ | ||
| Containers: []v1.Container{ | ||
| { | ||
| Command: []string{ | ||
| "kube-controller-manager", | ||
| "--allocate-node-cidrs=true", | ||
| "--authentication-kubeconfig=/etc/kubernetes/controller-manager.conf", | ||
| "--authorization-kubeconfig=/etc/kubernetes/controller-manager.conf", | ||
| "--bind-address=127.0.0.1", | ||
| "--client-ca-file=/etc/kubernetes/pki/ca.crt", | ||
| "--cluster-cidr=10.244.0.0/16", | ||
| "--cluster-name=kubernetes", | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| want: []string{"10.244.0.0/16"}, | ||
| }, | ||
| } | ||
| for name, test := range tests { | ||
| t.Run(name, func(t *testing.T) { | ||
| c := fake.NewSimpleClientset(test.spec...) | ||
| got, err := clusterPodCIDR(context.Background(), c.CoreV1()) | ||
| if err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| if diff := cmp.Diff(got, test.want); diff != "" { | ||
| t.Fatalf("unexpected result (+want -got):\n%s", diff) | ||
| } | ||
| }) | ||
| } | ||
| } | ||
|
|
||
| func TestPerNodePodCIDRs(t *testing.T) { | ||
| tests := map[string]struct { | ||
| spec []runtime.Object | ||
| want []string | ||
| }{ | ||
| "no podCIDR": {}, | ||
| "podCIDR": { | ||
| spec: []runtime.Object{ | ||
| &v1.NodeList{ | ||
| Items: []v1.Node{ | ||
| { | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: "node1", | ||
| }, | ||
| Spec: v1.NodeSpec{ | ||
| PodCIDRs: []string{"10.42.0.0/24"}, | ||
| }, | ||
| }, | ||
| { | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: "node2", | ||
| }, | ||
| Spec: v1.NodeSpec{ | ||
| PodCIDRs: []string{"10.42.1.0/24"}, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| want: []string{"10.42.0.0/24", "10.42.1.0/24"}, | ||
| }, | ||
| } | ||
| for name, test := range tests { | ||
| t.Run(name, func(t *testing.T) { | ||
| c := fake.NewSimpleClientset(test.spec...) | ||
| got, err := perNodePodCIDRs(context.Background(), c.CoreV1()) | ||
| if err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| if diff := cmp.Diff(got, test.want); diff != "" { | ||
| t.Fatalf("unexpected result (+want -got):\n%s", diff) | ||
| } | ||
| }) | ||
| } | ||
| } | ||
|
|
||
| func TestCombinedCIDRs(t *testing.T) { | ||
| tests := map[string]struct { | ||
| spec []runtime.Object | ||
| want []string | ||
| }{ | ||
| "no podCIDR": {}, | ||
| "podCIDR": { | ||
| spec: []runtime.Object{ | ||
| &v1.NodeList{ | ||
| Items: []v1.Node{ | ||
| { | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: "node1", | ||
| }, | ||
| Spec: v1.NodeSpec{ | ||
| PodCIDRs: []string{"10.42.0.0/24"}, | ||
| }, | ||
| }, | ||
| { | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: "node2", | ||
| }, | ||
| Spec: v1.NodeSpec{ | ||
| PodCIDRs: []string{"10.42.1.0/24"}, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| &v1.PodList{ | ||
| Items: []v1.Pod{ | ||
| { | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Labels: map[string]string{ | ||
| "component": "kube-controller-manager", | ||
| }, | ||
| Namespace: "kube-system", | ||
| }, | ||
| Spec: v1.PodSpec{ | ||
| Containers: []v1.Container{ | ||
| { | ||
| Command: []string{ | ||
| "kube-controller-manager", | ||
| "--allocate-node-cidrs=true", | ||
| "--authentication-kubeconfig=/etc/kubernetes/controller-manager.conf", | ||
| "--authorization-kubeconfig=/etc/kubernetes/controller-manager.conf", | ||
| "--bind-address=127.0.0.1", | ||
| "--client-ca-file=/etc/kubernetes/pki/ca.crt", | ||
| "--cluster-cidr=10.244.0.0/16", | ||
| "--cluster-name=kubernetes", | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| want: []string{"10.42.0.0/24", "10.42.1.0/24", "10.244.0.0/16"}, | ||
| }, | ||
| } | ||
| for name, test := range tests { | ||
| t.Run(name, func(t *testing.T) { | ||
| c := fake.NewSimpleClientset(test.spec...) | ||
| got := combinedCIDRs(context.Background(), logr.Discard(), c.CoreV1(), nil) | ||
| if diff := cmp.Diff(got, test.want); diff != "" { | ||
| t.Fatalf("unexpected result (+want -got):\n%s", diff) | ||
| } | ||
| }) | ||
| } | ||
| } | ||
|
|
||
| func TestDiscoverTrustedProxies(t *testing.T) { | ||
| t.Skip("dont think i can mock this") | ||
| tests := map[string]struct { | ||
| spec []runtime.Object | ||
| want []string | ||
| }{ | ||
| "no podCIDR": {}, | ||
| "podCIDR": { | ||
| spec: []runtime.Object{ | ||
| &v1.NodeList{ | ||
| Items: []v1.Node{ | ||
| { | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: "node1", | ||
| }, | ||
| Spec: v1.NodeSpec{ | ||
| PodCIDRs: []string{"10.42.0.0/24"}, | ||
| }, | ||
| }, | ||
| { | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: "node2", | ||
| }, | ||
| Spec: v1.NodeSpec{ | ||
| PodCIDRs: []string{"10.42.1.0/24"}, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| &v1.PodList{ | ||
| Items: []v1.Pod{ | ||
| { | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Labels: map[string]string{ | ||
| "component": "kube-controller-manager", | ||
| }, | ||
| Namespace: "kube-system", | ||
| }, | ||
| Spec: v1.PodSpec{ | ||
| Containers: []v1.Container{ | ||
| { | ||
| Command: []string{ | ||
| "kube-controller-manager", | ||
| "--allocate-node-cidrs=true", | ||
| "--authentication-kubeconfig=/etc/kubernetes/controller-manager.conf", | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| want: []string{"10.42.1.0/24", "10.42.0.0/24"}, | ||
| }, | ||
| } | ||
| for name, test := range tests { | ||
| t.Run(name, func(t *testing.T) { | ||
| k := &Kube{} | ||
| got := k.discoverTrustedProxies(context.Background(), logr.Discard(), nil) | ||
| if diff := cmp.Diff(got, test.want); diff != "" { | ||
| t.Fatalf("unexpected result (+want -got):\n%s", diff) | ||
| } | ||
| }) | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.