Skip to content

Commit 7adec2e

Browse files
MadalinaPatrichiMadalinaPatrichi
committed
Third round of comments
1 parent 0254b8a commit 7adec2e

File tree

4 files changed

+90
-37
lines changed

4 files changed

+90
-37
lines changed

‎pkg/oci/load_balancer.go

+4-4
Original file line numberDiff line numberDiff line change
@@ -203,14 +203,14 @@ func (cp *CloudProvider) readSSLSecret(ns, name string) (*certificateData, error
203203
}
204204
var ok bool
205205
var cacert, cert, key, pass []byte
206-
cacert, _ = secret.Data[SSLCAFileName]
206+
cacert = secret.Data[SSLCAFileName]
207207
if cert, ok = secret.Data[SSLCertificateFileName]; !ok {
208208
return nil, errors.Errorf("%s not found in secret %s/%s", SSLCertificateFileName, ns, name)
209209
}
210210
if key, ok = secret.Data[SSLPrivateKeyFileName]; !ok {
211211
return nil, errors.Errorf("%s not found in secret %s/%s", SSLPrivateKeyFileName, ns, name)
212212
}
213-
pass, _ = secret.Data[SSLPassphrase]
213+
pass = secret.Data[SSLPassphrase]
214214
return &certificateData{CACert: cacert, PublicCert: cert, PrivateKey: key, Passphrase: pass}, nil
215215
}
216216

@@ -323,8 +323,8 @@ func (cp *CloudProvider) EnsureLoadBalancer(ctx context.Context, clusterName str
323323
if err != nil {
324324
return nil, err
325325
}
326-
secretListenerString, _ := service.Annotations[ServiceAnnotationLoadBalancerTLSSecret]
327-
secretBackendSetString, _ := service.Annotations[ServiceAnnotationLoadBalancerBackendSetSecret]
326+
secretListenerString := service.Annotations[ServiceAnnotationLoadBalancerTLSSecret]
327+
secretBackendSetString := service.Annotations[ServiceAnnotationLoadBalancerBackendSetSecret]
328328
sslConfig = NewSSLConfig(secretListenerString, secretBackendSetString, ports, cp)
329329
}
330330
subnets := []string{cp.config.LoadBalancer.Subnet1, cp.config.LoadBalancer.Subnet2}

‎pkg/oci/load_balancer_spec.go

+5-20
Original file line numberDiff line numberDiff line change
@@ -178,9 +178,6 @@ func (s *LBSpec) Certificates() (map[string]loadbalancer.CertificateDetails, err
178178
if err != nil {
179179
return nil, errors.Wrap(err, "reading SSL Listener Secret")
180180
}
181-
if len(sslSecret.PublicCert) == 0 || len(sslSecret.PrivateKey) == 0 {
182-
return certs, nil
183-
}
184181

185182
certs[s.SSLConfig.ListenerSSLSecretName] = loadbalancer.CertificateDetails{
186183
CertificateName: &s.SSLConfig.ListenerSSLSecretName,
@@ -192,9 +189,6 @@ func (s *LBSpec) Certificates() (map[string]loadbalancer.CertificateDetails, err
192189
if err != nil {
193190
return nil, errors.Wrap(err, "reading SSL BackendSet Secret")
194191
}
195-
if len(sslSecret.PublicCert) == 0 || len(sslSecret.PrivateKey) == 0 {
196-
return certs, nil
197-
}
198192

199193
certs[s.SSLConfig.BackendSetSSLSecretName] = loadbalancer.CertificateDetails{
200194
CertificateName: &s.SSLConfig.BackendSetSSLSecretName,
@@ -280,20 +274,11 @@ func getBackendSets(svc *v1.Service, nodes []*v1.Node, sslCfg *SSLConfig) map[st
280274
if sslCfg != nil {
281275
secretName = sslCfg.BackendSetSSLSecretName
282276
}
283-
sslConfig := getSSLConfiguration(sslCfg, secretName, port)
284-
if sslConfig != nil {
285-
backendSets[name] = loadbalancer.BackendSetDetails{
286-
Policy: common.String(DefaultLoadBalancerPolicy),
287-
Backends: getBackends(nodes, servicePort.NodePort),
288-
HealthChecker: getHealthChecker(sslCfg, port, svc),
289-
SslConfiguration: sslConfig,
290-
}
291-
} else {
292-
backendSets[name] = loadbalancer.BackendSetDetails{
293-
Policy: common.String(DefaultLoadBalancerPolicy),
294-
Backends: getBackends(nodes, servicePort.NodePort),
295-
HealthChecker: getHealthChecker(sslCfg, port, svc),
296-
}
277+
backendSets[name] = loadbalancer.BackendSetDetails{
278+
Policy: common.String(DefaultLoadBalancerPolicy),
279+
Backends: getBackends(nodes, servicePort.NodePort),
280+
HealthChecker: getHealthChecker(sslCfg, port, svc),
281+
SslConfiguration: getSSLConfiguration(sslCfg, secretName, port),
297282
}
298283
}
299284
return backendSets

‎test/e2e/framework/networking_util.go

+1-2
Original file line numberDiff line numberDiff line change
@@ -104,8 +104,7 @@ func TestReachableHTTPWithContentTimeout(secure bool, ip string, port int, reque
104104
func TestReachableHTTPWithContentTimeoutWithRetriableErrorCodes(secure bool, ip string, port int, request string, expect string, content *bytes.Buffer, retriableErrCodes []int, timeout time.Duration) (bool, error) {
105105

106106
ipPort := net.JoinHostPort(ip, strconv.Itoa(port))
107-
var url string
108-
url = fmt.Sprintf("http://%s%s", ipPort, request)
107+
url := fmt.Sprintf("http://%s%s", ipPort, request)
109108
if secure {
110109
url = fmt.Sprintf("https://%s%s", ipPort, request)
111110
}

‎test/e2e/load_balancer.go

+80-11
Original file line numberDiff line numberDiff line change
@@ -311,7 +311,6 @@ var _ = Describe("End to end TLS", func() {
311311
ns := f.Namespace.Name
312312

313313
jig := framework.NewServiceTestJig(f.ClientSet, serviceName)
314-
//nodeIP := framework.PickNodeIP(jig.Client) // for later
315314

316315
sslSecretName := "ssl-certificate-secret"
317316
_, err := f.ClientSet.CoreV1().Secrets(ns).Create(&v1.Secret{
@@ -327,7 +326,6 @@ var _ = Describe("End to end TLS", func() {
327326
},
328327
})
329328
framework.ExpectNoError(err)
330-
//loadBalancerLagTimeout := framework.LoadBalancerLagTimeoutDefault
331329
loadBalancerCreateTimeout := framework.LoadBalancerCreateTimeoutDefault
332330
if nodes := framework.GetReadySchedulableNodesOrDie(f.ClientSet); len(nodes.Items) > framework.LargeClusterMinNodesNumber {
333331
loadBalancerCreateTimeout = framework.LoadBalancerCreateTimeoutLarge
@@ -370,11 +368,87 @@ var _ = Describe("End to end TLS", func() {
370368
tcpIngressIP := framework.GetIngressPoint(&tcpService.Status.LoadBalancer.Ingress[0])
371369
framework.Logf("TCP load balancer: %s", tcpIngressIP)
372370

373-
// By("hitting the TCP service's NodePort")
374-
// jig.TestReachableHTTP(true, nodeIP, tcpNodePort, framework.KubeProxyLagTimeout)
371+
By("changing TCP service back to type=ClusterIP")
372+
tcpService = jig.UpdateServiceOrFail(ns, tcpService.Name, func(s *v1.Service) {
373+
s.Spec.Type = v1.ServiceTypeClusterIP
374+
s.Spec.Ports[0].NodePort = 0
375+
s.Spec.Ports[1].NodePort = 0
376+
})
377+
378+
// Wait for the load balancer to be destroyed asynchronously
379+
tcpService = jig.WaitForLoadBalancerDestroyOrFail(ns, tcpService.Name, tcpIngressIP, svcPort, loadBalancerCreateTimeout)
380+
jig.SanityCheckService(tcpService, v1.ServiceTypeClusterIP)
381+
382+
err = f.ClientSet.CoreV1().Secrets(ns).Delete(sslSecretName, nil)
383+
framework.ExpectNoError(err)
384+
})
385+
})
386+
387+
var _ = Describe("End to end TLS", func() {
388+
f := framework.NewDefaultFramework("service")
389+
390+
It("should be possible to create and mutate a Service type:LoadBalancer [Canary]", func() {
391+
serviceName := "e2e-tls-lb-test"
392+
ns := f.Namespace.Name
375393

376-
// By("hitting the TCP service's LoadBalancer")
377-
// jig.TestReachableHTTP(true, tcpIngressIP, svcPort, loadBalancerLagTimeout)
394+
jig := framework.NewServiceTestJig(f.ClientSet, serviceName)
395+
//nodeIP := framework.PickNodeIP(jig.Client) // for later
396+
397+
sslSecretName := "ssl-certificate-secret"
398+
_, err := f.ClientSet.CoreV1().Secrets(ns).Create(&v1.Secret{
399+
ObjectMeta: metav1.ObjectMeta{
400+
Namespace: ns,
401+
Name: sslSecretName,
402+
},
403+
Data: map[string][]byte{
404+
cloudprovider.SSLCAFileName: []byte(framework.SSLCAData),
405+
cloudprovider.SSLCertificateFileName: []byte(framework.SSLCertificateData),
406+
cloudprovider.SSLPrivateKeyFileName: []byte(framework.SSLPrivateData),
407+
cloudprovider.SSLPassphrase: []byte(framework.SSLPassphrase),
408+
},
409+
})
410+
framework.ExpectNoError(err)
411+
//loadBalancerLagTimeout := framework.LoadBalancerLagTimeoutDefault
412+
loadBalancerCreateTimeout := framework.LoadBalancerCreateTimeoutDefault
413+
if nodes := framework.GetReadySchedulableNodesOrDie(f.ClientSet); len(nodes.Items) > framework.LargeClusterMinNodesNumber {
414+
loadBalancerCreateTimeout = framework.LoadBalancerCreateTimeoutLarge
415+
}
416+
417+
// TODO(apryde): Test that LoadBalancers can receive static IP addresses
418+
// (in a provider agnostic manner?). OCI does not currently
419+
// support this.
420+
requestedIP := ""
421+
422+
tcpService := jig.CreateTCPServiceOrFail(ns, func(s *v1.Service) {
423+
s.Spec.Type = v1.ServiceTypeLoadBalancer
424+
s.Spec.LoadBalancerIP = requestedIP
425+
s.Spec.Ports = []v1.ServicePort{v1.ServicePort{Name: "http", Port: 80, TargetPort: intstr.FromInt(80)},
426+
v1.ServicePort{Name: "https", Port: 443, TargetPort: intstr.FromInt(80)}}
427+
s.ObjectMeta.Annotations = map[string]string{cloudprovider.ServiceAnnotationLoadBalancerSSLPorts: "443",
428+
cloudprovider.ServiceAnnotationLoadBalancerBackendSetSecret: sslSecretName}
429+
430+
})
431+
432+
svcPort := int(tcpService.Spec.Ports[0].Port)
433+
434+
By("creating a pod to be part of the TCP service " + serviceName)
435+
jig.RunOrFail(ns, nil)
436+
437+
// TODO(apryde): Test UDP service. OCI does not currently support this.
438+
439+
By("waiting for the TCP service to have a load balancer")
440+
// Wait for the load balancer to be created asynchronously
441+
tcpService = jig.WaitForLoadBalancerOrFail(ns, tcpService.Name, loadBalancerCreateTimeout)
442+
jig.SanityCheckService(tcpService, v1.ServiceTypeLoadBalancer)
443+
444+
tcpNodePort := int(tcpService.Spec.Ports[0].NodePort)
445+
framework.Logf("TCP node port: %d", tcpNodePort)
446+
447+
if requestedIP != "" && framework.GetIngressPoint(&tcpService.Status.LoadBalancer.Ingress[0]) != requestedIP {
448+
framework.Failf("unexpected TCP Status.LoadBalancer.Ingress (expected %s, got %s)", requestedIP, framework.GetIngressPoint(&tcpService.Status.LoadBalancer.Ingress[0]))
449+
}
450+
tcpIngressIP := framework.GetIngressPoint(&tcpService.Status.LoadBalancer.Ingress[0])
451+
framework.Logf("TCP load balancer: %s", tcpIngressIP)
378452

379453
By("changing TCP service back to type=ClusterIP")
380454
tcpService = jig.UpdateServiceOrFail(ns, tcpService.Name, func(s *v1.Service) {
@@ -387,11 +461,6 @@ var _ = Describe("End to end TLS", func() {
387461
tcpService = jig.WaitForLoadBalancerDestroyOrFail(ns, tcpService.Name, tcpIngressIP, svcPort, loadBalancerCreateTimeout)
388462
jig.SanityCheckService(tcpService, v1.ServiceTypeClusterIP)
389463

390-
// By("checking the TCP NodePort is closed")
391-
// jig.TestNotReachableHTTP(nodeIP, tcpNodePort, framework.KubeProxyLagTimeout)
392-
393-
// By("checking the TCP LoadBalancer is closed")
394-
// jig.TestNotReachableHTTP(tcpIngressIP, svcPort, loadBalancerLagTimeout)
395464
err = f.ClientSet.CoreV1().Secrets(ns).Delete(sslSecretName, nil)
396465
framework.ExpectNoError(err)
397466
})

0 commit comments

Comments
 (0)