Add tests for multitenancy with Service Mesh by ReToCode · Pull Request #2171 · openshift-knative/serverless-operator

ReToCode · 2023-07-18T06:13:59Z

Fixes

Incorporates changes from #2126

Changes

From Martins PR:

Rewrite tests from https://github.com/ReToCode/knative-multitenancy in Golang. They're under test/servinge2e/servicemesh/
Remove TestKnativeVersusKubeServicesInOneNamespace as it's redundant. Having Knative and k8s service in one namespace is tested with all Eventing tests which now include KSVC in the test scenarios.
Add authorization policies so that Eventing and Eventing Kafka Broker tests pass. But this PR doesn't include any tests for verifying cross-tenant traffic for Eventing. They depend on Send namespace header in MT components knative/eventing#7048 to be merged and backported.
Split the test webhook under serving/metadata-webhook into cluster-resources and namespaced-resources. The second one needs to be applied with -n <namespace>. This is to reduce duplication of code because the webhook is now used in two namespaces: serving-tests, serverless-tests.

Additional Changes

Automatically generate AuthorizationPolicies from helm chart
Use a specific label for the Knative Gateways to omit issues with conflicting gateways (SRVCOM-2356)
Set knative-local-gateway to tls.mode: ISTIO_MUTUAL to make DomainMapping work
Set security.dataPlane.mtls: true in SMCP to automatically force the whole mesh to mTLS
Drop TERMINATION_DRAIN_DURATION_SECONDS from metadata-webhook, as this no longer works
Add terminationDrainDuration: 35s to SMCP to make envoy wait longer with termination
Exclude port 8022 from istio-proxy to fix an issue with PreStopHook not working
Increase rekt test timeout to 4 minutes
Reduce parallelism of mesh tests to 8 because istio-proxies are to slow otherwise

/hold

ReToCode · 2023-07-18T06:14:25Z

/test 4.13-upstream-e2e-mesh-aws-ocp-413

openshift-ci · 2023-07-18T06:15:54Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ReToCode

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [ReToCode]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

ReToCode · 2023-07-18T07:07:03Z

/test 4.13-upstream-e2e-mesh-aws-ocp-413

ReToCode · 2023-07-18T08:27:28Z

/test 4.13-upstream-e2e-mesh-aws-ocp-413

ReToCode · 2023-07-18T11:23:33Z

/test 4.13-upstream-e2e-mesh-aws-ocp-413

ReToCode · 2023-07-18T14:20:09Z

/test 4.13-upstream-e2e-mesh-aws-ocp-413

ReToCode · 2023-07-18T14:21:46Z

/retest

ReToCode · 2023-07-19T06:06:51Z

/test 4.13-upstream-e2e-mesh-aws-ocp-413

ReToCode · 2023-07-19T11:04:04Z

/test 4.13-upstream-e2e-mesh-aws-ocp-413

ReToCode · 2023-07-19T14:05:44Z

Again, just eventing errors.

/test 4.13-upstream-e2e-mesh-aws-ocp-413

ReToCode · 2023-07-19T14:06:14Z

/test ?

openshift-ci · 2023-07-19T14:06:22Z

@ReToCode: The following commands are available to trigger required jobs:

/test 4.10-images
/test 4.10-operator-e2e-aws-ocp-410
/test 4.10-ui-tests
/test 4.13-aws-ovn-images
/test 4.13-azure-images
/test 4.13-gcp-images
/test 4.13-hypershift-images
/test 4.13-images
/test 4.13-operator-e2e-aws-ocp-413
/test 4.13-osd-images
/test 4.13-single-node-images
/test 4.13-ui-tests
/test 4.13-vsphere-images
/test ocp4.14-lp-interop-images
/test unit-test

The following commands are available to trigger optional jobs:

/test 4.10-e2e-kitchensink-ocp-410
/test 4.10-upgrade-kitchensink-ocp-410
/test 4.10-upgrade-tests-aws-ocp-410
/test 4.10-upstream-e2e-aws-ocp-410
/test 4.10-upstream-e2e-kafka-aws-ocp-410
/test 4.10-upstream-e2e-mesh-aws-ocp-410
/test 4.13-e2e-kitchensink-ocp-413
/test 4.13-upgrade-kitchensink-ocp-413
/test 4.13-upgrade-tests-aws-ocp-413
/test 4.13-upstream-e2e-aws-ocp-413
/test 4.13-upstream-e2e-kafka-aws-ocp-413
/test 4.13-upstream-e2e-mesh-aws-ocp-413

Use /test all to run the following jobs that were automatically triggered:

pull-ci-openshift-knative-serverless-operator-main-4.10-images
pull-ci-openshift-knative-serverless-operator-main-4.13-aws-ovn-images
pull-ci-openshift-knative-serverless-operator-main-4.13-azure-images
pull-ci-openshift-knative-serverless-operator-main-4.13-gcp-images
pull-ci-openshift-knative-serverless-operator-main-4.13-hypershift-images
pull-ci-openshift-knative-serverless-operator-main-4.13-images
pull-ci-openshift-knative-serverless-operator-main-4.13-operator-e2e-aws-ocp-413
pull-ci-openshift-knative-serverless-operator-main-4.13-osd-images
pull-ci-openshift-knative-serverless-operator-main-4.13-single-node-images
pull-ci-openshift-knative-serverless-operator-main-4.13-upgrade-tests-aws-ocp-413
pull-ci-openshift-knative-serverless-operator-main-4.13-upstream-e2e-aws-ocp-413
pull-ci-openshift-knative-serverless-operator-main-4.13-upstream-e2e-kafka-aws-ocp-413
pull-ci-openshift-knative-serverless-operator-main-4.13-vsphere-images
pull-ci-openshift-knative-serverless-operator-main-ocp4.14-lp-interop-images
pull-ci-openshift-knative-serverless-operator-main-unit-test

Details

In response to this:

/test ?

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

ReToCode · 2023-07-19T14:06:44Z

/test 4.10-operator-e2e-aws-ocp-410

ReToCode · 2023-07-20T04:32:47Z

Again, just eventing errors.

/test 4.13-upstream-e2e-mesh-aws-ocp-413

ReToCode · 2023-07-20T06:44:24Z

/test 4.13-upstream-e2e-mesh-aws-ocp-413

ReToCode · 2023-07-20T13:01:16Z

/test 4.13-upstream-e2e-mesh-aws-ocp-413

ReToCode · 2023-07-20T13:11:05Z

/retest

ReToCode · 2023-07-21T04:58:14Z

/test 4.13-upstream-e2e-mesh-aws-ocp-413

ReToCode · 2023-07-21T07:00:48Z

/retest

ReToCode · 2023-07-21T07:00:53Z

/test 4.13-upstream-e2e-mesh-aws-ocp-413

ReToCode · 2023-07-21T08:26:56Z

/test 4.13-upstream-e2e-mesh-aws-ocp-413

pierDipi · 2023-07-21T09:14:30Z

hack/lib/mesh_resources/authorization-policies/README.md

@@ -0,0 +1,12 @@
+The resources in this folder are based on https://github.com/openshift-knative/knative-istio-authz-chart.


The ideal would be that we generate those as part of make generated-files so that we pick up changes automatically as we do them on the chart (and we can test them here before releasing them)

Makes sense. I'll add this as we will now have a aligned version of the chart 👍

The webhook needs to be installed for both upstream Serving tests and downstream serverless-operator tests. Better to install it at the beginning.

For DomainMapping test

…ving

…nstead of env variable

ReToCode · 2023-07-25T06:43:37Z

/test 4.13-upstream-e2e-mesh-aws-ocp-413

ReToCode · 2023-07-25T07:05:44Z

/test 4.13-upstream-e2e-mesh-aws-ocp-413

openshift-ci · 2023-07-25T08:09:44Z

@ReToCode: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/4.12-aws-ovn-images	`9708629`	link	true	`/test 4.12-aws-ovn-images`
ci/prow/4.12-azure-images	`9708629`	link	true	`/test 4.12-azure-images`
ci/prow/4.12-gcp-images	`9708629`	link	true	`/test 4.12-gcp-images`
ci/prow/4.12-hypershift-images	`9708629`	link	true	`/test 4.12-hypershift-images`
ci/prow/4.12-osd-images	`9708629`	link	true	`/test 4.12-osd-images`
ci/prow/4.12-single-node-images	`9708629`	link	true	`/test 4.12-single-node-images`
ci/prow/4.12-vsphere-images	`9708629`	link	true	`/test 4.12-vsphere-images`
ci/prow/4.10-upgrade-kitchensink-ocp-410	`f6e1273`	link	false	`/test 4.10-upgrade-kitchensink-ocp-410`
ci/prow/4.13-upgrade-kitchensink-ocp-413	`f6e1273`	link	false	`/test 4.13-upgrade-kitchensink-ocp-413`
ci/prow/4.10-upstream-e2e-mesh-aws-ocp-410	`f6e1273`	link	false	`/test 4.10-upstream-e2e-mesh-aws-ocp-410`
ci/prow/4.13-upstream-e2e-mesh-aws-ocp-413	`bf83511`	link	false	`/test 4.13-upstream-e2e-mesh-aws-ocp-413`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

ReToCode · 2023-07-27T10:56:09Z

We are doing that partial PRs now.

openshift-ci bot added the do-not-merge/hold label Jul 18, 2023

openshift-ci bot requested review from dsimansk and nak3 July 18, 2023 06:14

openshift-ci bot added the approved label Jul 18, 2023

ReToCode mentioned this pull request Jul 19, 2023

[TEST-ONLY] #2138

Closed

ReToCode changed the title ~~[TEST-ONLY] with auto-mtls enabled~~ [TEST-ONLY] Tests for multitenancy with Service Mesh Jul 20, 2023

ReToCode mentioned this pull request Jul 20, 2023

Add serving resources to helm chart openshift-knative/knative-istio-authz-chart#1

Merged

ReToCode force-pushed the multitenant_tests_reto_automtls branch from 5c1ccfe to d15096b Compare July 21, 2023 04:57

pierDipi reviewed Jul 21, 2023

View reviewed changes

mgencur and others added 21 commits July 25, 2023 08:41

Workaround for OSSM-1397

6bddabd

Place webhook installation back after Serverless installation

8cdb6e4

The webhook needs to be installed for both upstream Serving tests and downstream serverless-operator tests. Better to install it at the beginning.

Workaround for OSSM-1397

bcd43cf

Fix readme for webhook

0d09462

Allow traffic from knative-serving to istio-system

5283201

For DomainMapping test

Add peerauthentication for knative-serving

ee5d5f6

TMP: Try removing deny-all-by-defautl for Serving

9ba1c03

Remove allow-traffic-to-istio-system as it breaks all traffic for Ser…

96e161f

…ving

Put back deny-all-by-default for serving

16eed4e

serving-tests-alt Workaround for OSSM-1397

a42ae9c

Update authorization policies for istio-system

451a9eb

Update mesh resources

b5abe20

Run tests with less parallel

8180777

Disable IOR to fix TestBYOCertificate

d23cf5a

Use techPreview.meshConfig.defaultConfig.terminationDrainDuration i…

3a6da52

…nstead of env variable

Reduce parallelism only on mesh tests

2fa28b9

Use annotation to omit IOR OCP route creation

42013b4

Use specific labels for Knative gateways to omit conflict (SRVCOM-2356)

5943d92

Use updated resources from openshift-knative/knative-istio-authz-chart

1aa6643

Cleanup

305f6ec

Create mesh AuthorizationPolicies from helm chart automatically

8fcc696

ReToCode force-pushed the multitenant_tests_reto_automtls branch from 3b4317f to 8fcc696 Compare July 25, 2023 06:41

Fix cleanup script

ca517fa

Fix dropped test deletion on rebase

bf83511

ReToCode mentioned this pull request Jul 26, 2023

Make Serving service mesh tests more stable #2196

Merged

ReToCode closed this Jul 27, 2023

		@@ -0,0 +1,12 @@
		The resources in this folder are based on https://github.com/openshift-knative/knative-istio-authz-chart.

Conversation

ReToCode commented Jul 18, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

ReToCode commented Jul 18, 2023

Uh oh!

openshift-ci bot commented Jul 18, 2023

Uh oh!

ReToCode commented Jul 18, 2023

Uh oh!

ReToCode commented Jul 18, 2023

Uh oh!

ReToCode commented Jul 18, 2023

Uh oh!

ReToCode commented Jul 18, 2023

Uh oh!

ReToCode commented Jul 18, 2023

Uh oh!

ReToCode commented Jul 19, 2023

Uh oh!

ReToCode commented Jul 19, 2023

Uh oh!

ReToCode commented Jul 19, 2023

Uh oh!

ReToCode commented Jul 19, 2023

Uh oh!

openshift-ci bot commented Jul 19, 2023

Uh oh!

ReToCode commented Jul 19, 2023

Uh oh!

ReToCode commented Jul 20, 2023

Uh oh!

ReToCode commented Jul 20, 2023

Uh oh!

ReToCode commented Jul 20, 2023

Uh oh!

ReToCode commented Jul 20, 2023

Uh oh!

ReToCode commented Jul 21, 2023

Uh oh!

ReToCode commented Jul 21, 2023

Uh oh!

ReToCode commented Jul 21, 2023

Uh oh!

ReToCode commented Jul 21, 2023

Uh oh!

pierDipi Jul 21, 2023

Choose a reason for hiding this comment

Uh oh!

ReToCode Jul 21, 2023

Choose a reason for hiding this comment

Uh oh!

ReToCode commented Jul 25, 2023

Uh oh!

ReToCode commented Jul 25, 2023

Uh oh!

openshift-ci bot commented Jul 25, 2023

Uh oh!

ReToCode commented Jul 27, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ReToCode commented Jul 18, 2023 •

edited

Loading