Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

xds: don't fail channel/server startup when xds creds is specified, but bootstrap is missing certificate providers #6848

Merged
merged 7 commits into from Dec 20, 2023
Merged

xds: don't fail channel/server startup when xds creds is specified, but bootstrap is missing certificate providers #6848

Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
b7dc2dc
xds: don't fail channel/server startup when xds creds is specified, b…
easwars Dec 11, 2023
a1143b6
make vet happy
easwars Dec 11, 2023
6d26f6f
e2e style tests for client side
easwars Dec 12, 2023
99c6171
e2e style tests for server side
easwars Dec 13, 2023
55f51d4
make vet happy
easwars Dec 15, 2023
e76c29e
review comments pass 1
easwars Dec 19, 2023
25050b6
review comments pass 2
easwars Dec 20, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
38 changes: 27 additions & 11 deletions test/xds/xds_server_certificate_providers_test.go
View file
Open in desktop
Expand Up @@ -98,7 +98,7 @@ func (s) TestServerSideXDS_WithNoCertificateProvidersInBootstrap_Success(t *test
t.Fatal(err)
}

// Create a client that uses insecure creds and verifiy RPCs.
// Create a client that uses insecure creds and verify RPCs.
cc, err := grpc.Dial(lis.Addr().String(), grpc.WithTransportCredentials(insecure.NewCredentials()))
if err != nil {
t.Fatalf("Failed to dial local test server: %v", err)
Expand All @@ -115,8 +115,10 @@ func (s) TestServerSideXDS_WithNoCertificateProvidersInBootstrap_Success(t *test
// providers, and xDS credentials with an insecure fallback is specified at
// server creation time. The management server is configured to return a
// server-side xDS Listener resource with mTLS security configuration. The xDS
// client is expected to NACK this resource and therefore he xDS-enabled gRPC
// server is expected to not enter "serving" mode.
// client is expected to NACK this resource because the certificate provider
// instance name specified in the Listener resource will not be present in the
// bootstrap file. The test verifies that server creation does not fail and that
// the xDS-enabled gRPC server does not enter "serving" mode.
func (s) TestServerSideXDS_WithNoCertificateProvidersInBootstrap_Failure(t *testing.T) {
ctx, cancel := context.WithTimeout(context.Background(), defaultTestTimeout)
defer cancel()
Expand Down Expand Up @@ -156,7 +158,8 @@ func (s) TestServerSideXDS_WithNoCertificateProvidersInBootstrap_Failure(t *test
t.Fatalf("Failed to create bootstrap configuration: %v", err)
}

// Configure xDS credentials to be used on the server-side.
// Configure xDS credentials with an insecure fallback to be used on the
// server-side.
creds, err := xdscreds.NewServerCredentials(xdscreds.ServerOptions{FallbackCreds: insecure.NewCredentials()})
if err != nil {
t.Fatal(err)
Expand Down Expand Up @@ -214,14 +217,15 @@ func (s) TestServerSideXDS_WithNoCertificateProvidersInBootstrap_Failure(t *test
t.Fatal("Timeout when waiting for an NACK from the xDS client for the LDS response")
}

// Wait a short duration and ensure that the server does not enter ""
// Wait a short duration and ensure that the server does not enter "serving"
// mode.
select {
case <-time.After(2 * defaultTestShortTimeout):
case <-modeCh:
t.Fatal("Server changed to serving mode when not expected to")
}

// Create a client that uses insecure creds and verifiy that RPCs don't
// Create a client that uses insecure creds and verify that RPCs don't
// succeed.
cc, err := grpc.Dial(lis.Addr().String(), grpc.WithTransportCredentials(insecure.NewCredentials()))
if err != nil {
Expand All @@ -233,10 +237,21 @@ func (s) TestServerSideXDS_WithNoCertificateProvidersInBootstrap_Failure(t *test
sCtx, sCancel := context.WithTimeout(ctx, defaultTestShortTimeout)
defer sCancel()
if _, err := client.EmptyCall(sCtx, &testpb.Empty{}); status.Code(err) != codes.DeadlineExceeded {
t.Fatalf("EmptyCall() failed: %v", err)
t.Fatalf("EmptyCall() failed: %v, wantCode: %s", err, codes.DeadlineExceeded)
}
}

// Tests the case where the bootstrap configuration contains one certificate
// provider, and xDS credentials with an insecure fallback is specified at
// server creation time. Two listeners are configured on the xDS-enabled gRPC
// server. The management server responds with two listener resources:
// 1. contains valid security configuration pointing to the certificate provider
// instance specified in the bootstrap
// 3. contains invalid security configuration pointing to a non-existent
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

DOne.

// certificate provider instance
//
// The test verifies that an RPC to the first listener succeeds, while the
// second listener never moves to "serving" mode and RPCs to it fail.
func (s) TestServerSideXDS_WithValidAndInvalidSecurityConfiguration(t *testing.T) {
zasweq marked this conversation as resolved.
Show resolved Hide resolved
ctx, cancel := context.WithTimeout(context.Background(), defaultTestTimeout)
defer cancel()
Expand Down Expand Up @@ -433,7 +448,7 @@ func (s) TestServerSideXDS_WithValidAndInvalidSecurityConfiguration(t *testing.T
t.Fatal(err)
}

// Create a client that uses TLS creds and verifiy RPCs to listener1.
// Create a client that uses TLS creds and verify RPCs to listener1.
clientCreds := e2e.CreateClientTLSCredentials(t)
cc1, err := grpc.Dial(lis1.Addr().String(), grpc.WithTransportCredentials(clientCreds))
if err != nil {
Expand All @@ -453,14 +468,15 @@ func (s) TestServerSideXDS_WithValidAndInvalidSecurityConfiguration(t *testing.T
t.Fatal("Timeout when waiting for an NACK from the xDS client for the LDS response")
}

// Wait a short duration and ensure that the server does not enter ""
// Wait a short duration and ensure that the server does not enter "serving"
// mode.
select {
case <-time.After(2 * defaultTestShortTimeout):
case <-modeCh:
t.Fatal("Server changed to serving mode when not expected to")
}

// Create a client that uses insecure creds and verifiy that RPCs don't
// Create a client that uses insecure creds and verify that RPCs don't
// succeed to listener2.
cc2, err := grpc.Dial(lis2.Addr().String(), grpc.WithTransportCredentials(insecure.NewCredentials()))
if err != nil {
Expand All @@ -472,6 +488,6 @@ func (s) TestServerSideXDS_WithValidAndInvalidSecurityConfiguration(t *testing.T
sCtx, sCancel := context.WithTimeout(ctx, defaultTestShortTimeout)
defer sCancel()
if _, err := client2.EmptyCall(sCtx, &testpb.Empty{}); status.Code(err) != codes.DeadlineExceeded {
t.Fatalf("EmptyCall() failed: %v", err)
t.Fatalf("EmptyCall() failed: %v, wantCode: %s", err, codes.DeadlineExceeded)
}
}