Add traffic permissions integration tests.#19008
Conversation
erichaberkorn
added
pr/no-changelog
erichaberkorn
force-pushed
the
tp-tests
branch
8 times, most recently
from
5f591b7 to
eb17a1e
Compare
There was a problem hiding this comment.
I don't particularly like this, but it's hard to do much better without making a breaking change that impacts tons and tons of tests.
There was a problem hiding this comment.
@ishustava It feels weird to me that configuring a traffic permission with default allow only swaps to default deny for a single port rather than all port. Should we change this behavior to swap all ports to default deny?
erichaberkorn
force-pushed
the
tp-tests
branch
from
eb17a1e to
f72aead
Compare
erichaberkorn
force-pushed
the
tp-tests
branch
from
f72aead to
5719346
Compare
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎ 2 Ignored Deployments
|
| // Copyright (c) HashiCorp, Inc. | ||
| // SPDX-License-Identifier: BUSL-1.1 | ||
|
|
||
| package tproxy |
There was a problem hiding this comment.
Should this be trafficpermissions?
erichaberkorn
force-pushed
the
tp-tests
branch
from
5719346 to
0a4366b
Compare
jmurret
left a comment
jmurret
left a comment
There was a problem hiding this comment.
👍 LGTM. Can you add the comment in code that I mentioned? Once it is merged, I will reference it in the ticket that I create.
There was a problem hiding this comment.
Can we add a note for something like:
On Mac M1s when TProxy is enabled, consul-dataplane that are spawned from this image (only used in consul-container integration tests) will terminate with the below error. It is related to tproxy-startup.sh calling iptables SDK which then calls the underly iptables. We are investigating how this works on M1s with consul-envoy images which do not have this problem. For the time being tproxy tests on Mac M1s will fail locally but pass in CI.
Error setting up traffic redirection rules: failed to run command: /sbin/iptables -t nat -N CONSUL_PROXY_INBOUND, err: exit status 1, output: iptables: Failed to initialize nft: Protocol not supported
erichaberkorn
force-pushed
the
tp-tests
branch
from
0a4366b to
033594f
Compare
erichaberkorn
force-pushed
the
tp-tests
branch
2 times, most recently
from
acaa084 to
53cf850
Compare
erichaberkorn
force-pushed
the
tp-tests
branch
from
53cf850 to
6af4fe2
Compare
2 participants
Description
Add integration tests for TCP traffic permissions.
PR Checklist