[wip] test net-certmanager changes#13621

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dprotaso wants to merge 11 commits into from
Closed

[wip] test net-certmanager changes #13621

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
2d87bf7
test net-certmanager changes
dprotaso Jan 19, 2023
956c996
use a long domain name
dprotaso Jan 20, 2023
9fe2163
make service name < 63
dprotaso Jan 20, 2023
b8fef20
skip cleanup on failure autotls
dprotaso Jan 20, 2023
4abdcfd
fix domain name length
dprotaso Jan 20, 2023
a5a888d
run HTTP01 tests
dprotaso Jan 20, 2023
f4bf85a
run only http01 tests
dprotaso Jan 20, 2023
6176fbf
don't delete the cluster issuer + debugging
dprotaso Jan 20, 2023
08a72af
ensure DNS record is *.{domain}
dprotaso Jan 21, 2023
8f7799c
allow challenges for hosts that don't match the route's host
dprotaso Jan 22, 2023
fafaf0d
fix domain mapping
dprotaso Jan 22, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions pkg/reconciler/domainmapping/resources/ingress.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -19,6 +19,7 @@ package resources
import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/util/intstr"
"k8s.io/apimachinery/pkg/util/sets"

netapi "knative.dev/networking/pkg/apis/networking"
netv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
Expand All@@ -35,6 +36,7 @@ import (
// KIngress). The created ingress will contain a RewriteHost rule to cause the
// given hostName to be used as the host.
func MakeIngress(dm *servingv1alpha1.DomainMapping, backendServiceName, hostName, ingressClass string, httpOption netv1alpha1.HTTPOption, tls []netv1alpha1.IngressTLS, acmeChallenges ...netv1alpha1.HTTP01Challenge) *netv1alpha1.Ingress {
paths, hosts := routeresources.MakeACMEIngressPaths(acmeChallenges, sets.NewString(dm.GetName()))
return &netv1alpha1.Ingress{
ObjectMeta: metav1.ObjectMeta{
Name: kmeta.ChildName(dm.GetName(), ""),
Expand All@@ -52,11 +54,11 @@ func MakeIngress(dm *servingv1alpha1.DomainMapping, backendServiceName, hostName
HTTPOption: httpOption,
TLS: tls,
Rules: []netv1alpha1.IngressRule{{
Hosts: []string{dm.Name},
Hosts: append(hosts, dm.Name),
Visibility: netv1alpha1.IngressVisibilityExternalIP,
HTTP: &netv1alpha1.HTTPIngressRuleValue{
// The order of the paths is sensitive, always put tls challenge first
Paths: append(routeresources.MakeACMEIngressPaths(acmeChallenges, dm.GetName()),
Paths: append(paths,
[]netv1alpha1.HTTPIngressPath{{
RewriteHost: hostName,
Splits: []netv1alpha1.IngressBackendSplit{{
Expand Down
27 changes: 15 additions & 12 deletions pkg/reconciler/route/resources/ingress.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -185,8 +185,9 @@ func makeIngressSpec(
}
// If this is a public rule, we need to configure ACME challenge paths.
if visibility == netv1alpha1.IngressVisibilityExternalIP {
rule.HTTP.Paths = append(
MakeACMEIngressPaths(acmeChallenges, domains...), rule.HTTP.Paths...)
paths, hosts := MakeACMEIngressPaths(acmeChallenges, domains)
rule.Hosts = append(hosts, rule.Hosts...)
rule.HTTP.Paths = append(paths, rule.HTTP.Paths...)
}
rules = append(rules, rule)
}
Expand DownExpand Up@@ -214,7 +215,7 @@ func getChallengeHosts(challenges []netv1alpha1.HTTP01Challenge) map[string]netv
return c
}

func routeDomain(ctx context.Context, targetName string, r *servingv1.Route, visibility netv1alpha1.IngressVisibility) ([]string, error) {
func routeDomain(ctx context.Context, targetName string, r *servingv1.Route, visibility netv1alpha1.IngressVisibility) (sets.String, error) {
hostname, err := domains.HostnameFromTemplate(ctx, r.Name, targetName)
if err != nil {
return nil, err
Expand All@@ -232,18 +233,20 @@ func routeDomain(ctx context.Context, targetName string, r *servingv1.Route, vis
if isClusterLocal {
domains = ingress.ExpandedHosts(sets.NewString(domains...)).List()
}
return domains, err
return sets.NewString(domains...), err
}

// MakeACMEIngressPaths returns a set of netv1alpha1.HTTPIngressPath
// that can be used to perform ACME challenges.
func MakeACMEIngressPaths(acmeChallenges []netv1alpha1.HTTP01Challenge, domains ...string) []netv1alpha1.HTTPIngressPath {
func MakeACMEIngressPaths(acmeChallenges []netv1alpha1.HTTP01Challenge, domains sets.String) ([]netv1alpha1.HTTPIngressPath, []string) {
challenges := getChallengeHosts(acmeChallenges)

paths := make([]netv1alpha1.HTTPIngressPath, 0, len(challenges))
for _, domain := range domains {
challenge, ok := challenges[domain]
if !ok {
continue
var extraHosts []string

for _, challenge := range challenges {
if !domains.Has(challenge.URL.Host) {
extraHosts = append(extraHosts, challenge.URL.Host)
}

paths = append(paths, netv1alpha1.HTTPIngressPath{
Expand All@@ -258,16 +261,16 @@ func MakeACMEIngressPaths(acmeChallenges []netv1alpha1.HTTP01Challenge, domains
Path: challenge.URL.Path,
})
}
return paths
return paths, extraHosts
}

func makeIngressRule(domains []string, ns string,
func makeIngressRule(domains sets.String, ns string,
visibility netv1alpha1.IngressVisibility,
targets traffic.RevisionTargets,
roCfgs []*traffic.ConfigurationRollout,
encryption bool) netv1alpha1.IngressRule {
return netv1alpha1.IngressRule{
Hosts: domains,
Hosts: domains.List(),
Visibility: visibility,
HTTP: &netv1alpha1.HTTPIngressRuleValue{
Paths: []netv1alpha1.HTTPIngressPath{
Expand Down
7 changes: 4 additions & 3 deletions pkg/reconciler/route/resources/ingress_test.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -26,6 +26,7 @@ import (
corev1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/util/intstr"
"k8s.io/apimachinery/pkg/util/sets"

"knative.dev/networking/pkg/apis/networking"
netv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
Expand DownExpand Up@@ -853,7 +854,7 @@ func TestMakeIngressSpecCorrectRulesWithTagBasedRouting(t *testing.T) {

// One active target.
func TestMakeIngressRuleVanilla(t *testing.T) {
domains := []string{"a.com", "b.org"}
domains := sets.NewString("a.com", "b.org")
targets := traffic.RevisionTargets{{
TrafficTarget: v1.TrafficTarget{
ConfigurationName: "config",
Expand DownExpand Up@@ -913,7 +914,7 @@ func TestMakeIngressRuleZeroPercentTarget(t *testing.T) {
Percent: ptr.Int64(0),
},
}}
domains := []string{"test.org"}
domains := sets.NewString("test.org")
tc := &traffic.Config{
Targets: map[string]traffic.RevisionTargets{
traffic.DefaultTarget: targets,
Expand DownExpand Up@@ -969,7 +970,7 @@ func TestMakeIngressRuleTwoTargets(t *testing.T) {
},
}
ro := tc.BuildRollout()
domains := []string{"test.org"}
domains := sets.NewString("test.org")
rule := makeIngressRule(domains, ns, netv1alpha1.IngressVisibilityExternalIP,
targets, ro.RolloutsByTag("a-tag"), false /* internal encryption */)
expected := netv1alpha1.IngressRule{
Expand Down
18 changes: 18 additions & 0 deletions pkg/reconciler/route/table_test.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -2758,6 +2758,15 @@ func TestReconcileEnableAutoTLS(t *testing.T) {
ServiceName: "cm-solver",
ServicePort: intstr.FromInt(8090),
ServiceNamespace: "default",
}, {
URL: &apis.URL{
Scheme: "http",
Host: "k.example.com",
Path: "/.well-known/acme-challenge/challengeToken2",
},
ServiceName: "cm-solver",
ServicePort: intstr.FromInt(8090),
ServiceNamespace: "default",
}},
},
},
Expand DownExpand Up@@ -2788,6 +2797,15 @@ func TestReconcileEnableAutoTLS(t *testing.T) {
ServiceName: "cm-solver",
ServicePort: intstr.FromInt(8090),
ServiceNamespace: "default",
}, {
URL: &apis.URL{
Scheme: "http",
Host: "k.example.com",
Path: "/.well-known/acme-challenge/challengeToken2",
},
ServiceName: "cm-solver",
ServicePort: intstr.FromInt(8090),
ServiceNamespace: "default",
}},
),
simpleK8sService(
Expand Down
41 changes: 22 additions & 19 deletions test/e2e-auto-tls-tests.sh
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -72,12 +72,13 @@ function setup_auto_tls_common() {
}

function cleanup_auto_tls_common() {
cleanup_custom_domain
true
# cleanup_custom_domain

toggle_feature autoTLS Disabled config-network
toggle_feature autocreateClusterDomainClaims false config-network
toggle_feature namespace-wildcard-cert-selector "" config-network
kubectl delete kcert --all -n "${TLS_TEST_NAMESPACE}"
# toggle_feature autoTLS Disabled config-network
# toggle_feature autocreateClusterDomainClaims false config-network
# toggle_feature namespace-wildcard-cert-selector "" config-network
# kubectl delete kcert --all -n "${TLS_TEST_NAMESPACE}"
}

function setup_http01_auto_tls() {
Expand All@@ -86,7 +87,7 @@ function setup_http01_auto_tls() {
# Rely on the built-in naming (for logstream)
unset TLS_SERVICE_NAME
# The full host name of the Knative Service. This is used to configure the DNS record.
export AUTO_TLS_TEST_FULL_HOST_NAME="*.${TLS_TEST_NAMESPACE}.${CUSTOM_DOMAIN_SUFFIX}"
export AUTO_TLS_TEST_FULL_HOST_NAME="*.${CUSTOM_DOMAIN_SUFFIX}"

kubectl delete kcert --all -n "${TLS_TEST_NAMESPACE}"

Expand DownExpand Up@@ -158,6 +159,9 @@ function delete_dns_record() {
fi
}


export ENABLE_GKE_TELEMETRY=true

# Script entry point.
initialize "$@" --skip-istio-addon --min-nodes=4 --max-nodes=4 --enable-ha --cluster-version=1.24

Expand All@@ -175,33 +179,32 @@ if [[ -z "${INGRESS_CLASS}" \
alpha="--enable-alpha"
fi

AUTO_TLS_TEST_OPTIONS="${AUTO_TLS_TEST_OPTIONS:-${alpha} --enable-beta}"
AUTO_TLS_TEST_OPTIONS="${AUTO_TLS_TEST_OPTIONS:-${alpha} --enable-beta -skip-cleanup-on-fail}"

# Auto TLS E2E tests mutate the cluster and must be ran separately
# because they need auto-tls and cert-manager specific configurations
subheader "Setup auto tls"
setup_auto_tls_common
add_trap "cleanup_auto_tls_common" EXIT SIGKILL SIGTERM SIGQUIT

subheader "Auto TLS test for per-ksvc certificate provision using self-signed CA"
setup_selfsigned_per_ksvc_auto_tls
go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
kubectl delete -f ${E2E_YAML_DIR}/test/config/autotls/certmanager/selfsigned/
# subheader "Auto TLS test for per-ksvc certificate provision using self-signed CA"
# setup_selfsigned_per_ksvc_auto_tls
# go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
# kubectl delete -f ${E2E_YAML_DIR}/test/config/autotls/certmanager/selfsigned/

subheader "Auto TLS test for per-namespace certificate provision using self-signed CA"
setup_selfsigned_per_namespace_auto_tls
add_trap "cleanup_per_selfsigned_namespace_auto_tls" SIGKILL SIGTERM SIGQUIT
go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
cleanup_per_selfsigned_namespace_auto_tls
# subheader "Auto TLS test for per-namespace certificate provision using self-signed CA"
# setup_selfsigned_per_namespace_auto_tls
# add_trap "cleanup_per_selfsigned_namespace_auto_tls" SIGKILL SIGTERM SIGQUIT
# go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
# cleanup_per_selfsigned_namespace_auto_tls

if [[ ${RUN_HTTP01_AUTO_TLS_TESTS} -eq 1 ]]; then
# if [[ ${RUN_HTTP01_AUTO_TLS_TESTS} -eq 1 ]]; then
subheader "Auto TLS test for per-ksvc certificate provision using HTTP01 challenge"
setup_http01_auto_tls
add_trap "delete_dns_record" SIGKILL SIGTERM SIGQUIT
go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
kubectl delete -f ${E2E_YAML_DIR}/test/config/autotls/certmanager/http01/
delete_dns_record
fi
# fi

(( failed )) && fail_test

Expand Down
2 changes: 2 additions & 0 deletions test/e2e/autotls/auto_tls_test.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -94,6 +94,8 @@ func testAutoTLS(t *testing.T) {
if len(env.TLSServiceName) != 0 {
names.Service = env.TLSServiceName
}
names.Service = names.Service + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
names.Service = names.Service[:60]
test.EnsureTearDown(t, clients, &names)

objects, err := v1test.CreateServiceReady(t, clients, &names)
Expand Down
24 changes: 12 additions & 12 deletions third_party/cert-manager-latest/net-certmanager.yaml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -19,7 +19,7 @@ metadata:
name: knative-serving-certmanager
labels:
app.kubernetes.io/component: net-certmanager
app.kubernetes.io/version: "20230123-cce02568"
app.kubernetes.io/version: devel
app.kubernetes.io/name: knative-serving
serving.knative.dev/controller: "true"
networking.knative.dev/certificate-provider: cert-manager
Expand DownExpand Up@@ -52,7 +52,7 @@ metadata:
name: config.webhook.net-certmanager.networking.internal.knative.dev
labels:
app.kubernetes.io/component: net-certmanager
app.kubernetes.io/version: "20230123-cce02568"
app.kubernetes.io/version: devel
app.kubernetes.io/name: knative-serving
networking.knative.dev/certificate-provider: cert-manager
webhooks:
Expand DownExpand Up@@ -93,7 +93,7 @@ metadata:
namespace: knative-serving
labels:
app.kubernetes.io/component: net-certmanager
app.kubernetes.io/version: "20230123-cce02568"
app.kubernetes.io/version: devel
app.kubernetes.io/name: knative-serving
networking.knative.dev/certificate-provider: cert-manager

Expand All@@ -119,7 +119,7 @@ metadata:
namespace: knative-serving
labels:
app.kubernetes.io/component: net-certmanager
app.kubernetes.io/version: "20230123-cce02568"
app.kubernetes.io/version: devel
app.kubernetes.io/name: knative-serving
networking.knative.dev/certificate-provider: cert-manager
data:
Expand DownExpand Up@@ -168,7 +168,7 @@ metadata:
namespace: knative-serving
labels:
app.kubernetes.io/component: net-certmanager
app.kubernetes.io/version: "20230123-cce02568"
app.kubernetes.io/version: devel
app.kubernetes.io/name: knative-serving
networking.knative.dev/certificate-provider: cert-manager
spec:
Expand All@@ -182,15 +182,15 @@ spec:
labels:
app: net-certmanager-controller
app.kubernetes.io/component: net-certmanager
app.kubernetes.io/version: "20230123-cce02568"
app.kubernetes.io/version: devel
app.kubernetes.io/name: knative-serving
spec:
serviceAccountName: controller
containers:
- name: controller
# This is the Go import path for the binary that is containerized
# and substituted here.
image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:61651eca0cbf2ab83ccdb2d64f98bee041b2869008b9e86c41714311ecdadda5
image: gcr.io/pivotal-knative/dave/controller-b5455ad1ba7b683d126966c08026cd15@sha256:5a786db6b17acc5c3e2037bda2442d85544522768deae3677d9732af4aef9572
resources:
requests:
cpu: 30m
Expand DownExpand Up@@ -229,7 +229,7 @@ metadata:
labels:
app: net-certmanager-controller
app.kubernetes.io/component: net-certmanager
app.kubernetes.io/version: "20230123-cce02568"
app.kubernetes.io/version: devel
app.kubernetes.io/name: knative-serving
networking.knative.dev/certificate-provider: cert-manager
name: net-certmanager-controller
Expand DownExpand Up@@ -268,7 +268,7 @@ metadata:
namespace: knative-serving
labels:
app.kubernetes.io/component: net-certmanager
app.kubernetes.io/version: "20230123-cce02568"
app.kubernetes.io/version: devel
app.kubernetes.io/name: knative-serving
networking.knative.dev/certificate-provider: cert-manager
spec:
Expand All@@ -283,7 +283,7 @@ spec:
labels:
app: net-certmanager-webhook
app.kubernetes.io/component: net-certmanager
app.kubernetes.io/version: "20230123-cce02568"
app.kubernetes.io/version: devel
app.kubernetes.io/name: knative-serving
role: net-certmanager-webhook
spec:
Expand All@@ -292,7 +292,7 @@ spec:
- name: webhook
# This is the Go import path for the binary that is containerized
# and substituted here.
image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:2f65e85b9cf2d8a10507c1fc02333ca00350864235d4bfab1dc28c7a8d2e61a2
image: gcr.io/pivotal-knative/dave/webhook-29139c5ce1fe7007906a2b725aaa018b@sha256:dca6101881eec45ce0fc293efccec3dbe17c9a1e621073cd92bab9fdf366c84a
resources:
requests:
cpu: 20m
Expand DownExpand Up@@ -356,7 +356,7 @@ metadata:
labels:
role: net-certmanager-webhook
app.kubernetes.io/component: net-certmanager
app.kubernetes.io/version: "20230123-cce02568"
app.kubernetes.io/version: devel
app.kubernetes.io/name: knative-serving
networking.knative.dev/certificate-provider: cert-manager
spec:
Expand Down
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
[wip] test net-certmanager changes#13621

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

dprotaso
wants to merge
11
commits into

from

 Closed


[wip] test net-certmanager changes
#13621
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


11 commits


Select commit
Hold shift + click to select a range
2d87bf7

test net-certmanager changes


dprotaso Jan 19, 2023
956c996

use a long domain name


dprotaso Jan 20, 2023
9fe2163

make service name < 63


dprotaso Jan 20, 2023
b8fef20

skip cleanup on failure autotls


dprotaso Jan 20, 2023
4abdcfd

fix domain name length


dprotaso Jan 20, 2023
a5a888d

run HTTP01 tests


dprotaso Jan 20, 2023
f4bf85a

run only http01 tests


dprotaso Jan 20, 2023
6176fbf

don't delete the cluster issuer + debugging


dprotaso Jan 20, 2023
08a72af

ensure DNS record is *.{domain}


dprotaso Jan 21, 2023
8f7799c

allow challenges for hosts that don't match the route's host


dprotaso Jan 22, 2023
fafaf0d

fix domain mapping


dprotaso Jan 22, 2023

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 4 additions & 2 deletions
pkg/reconciler/domainmapping/resources/ingress.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,6 +19,7 @@ package resources
import (
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/util/intstr"
	"k8s.io/apimachinery/pkg/util/sets"

	netapi "knative.dev/networking/pkg/apis/networking"
	netv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
Expand All@@ -35,6 +36,7 @@ import (
// KIngress). The created ingress will contain a RewriteHost rule to cause the
// given hostName to be used as the host.
func MakeIngress(dm *servingv1alpha1.DomainMapping, backendServiceName, hostName, ingressClass string, httpOption netv1alpha1.HTTPOption, tls []netv1alpha1.IngressTLS, acmeChallenges ...netv1alpha1.HTTP01Challenge) *netv1alpha1.Ingress {
	paths, hosts := routeresources.MakeACMEIngressPaths(acmeChallenges, sets.NewString(dm.GetName()))
	return &netv1alpha1.Ingress{
 ObjectMeta: metav1.ObjectMeta{
 Name: kmeta.ChildName(dm.GetName(), ""),
Expand All@@ -52,11 +54,11 @@ func MakeIngress(dm *servingv1alpha1.DomainMapping, backendServiceName, hostName
 HTTPOption: httpOption,
 TLS: tls,
 Rules: []netv1alpha1.IngressRule{{
 Hosts: []string{dm.Name},
 Hosts: append(hosts, dm.Name),
 Visibility: netv1alpha1.IngressVisibilityExternalIP,
 HTTP: &netv1alpha1.HTTPIngressRuleValue{
 // The order of the paths is sensitive, always put tls challenge first
 Paths: append(routeresources.MakeACMEIngressPaths(acmeChallenges, dm.GetName()),
 Paths: append(paths,
 []netv1alpha1.HTTPIngressPath{{
 RewriteHost: hostName,
 Splits: []netv1alpha1.IngressBackendSplit{{
Expand Down

27 changes: 15 additions & 12 deletions
pkg/reconciler/route/resources/ingress.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -185,8 +185,9 @@ func makeIngressSpec(
 }
 // If this is a public rule, we need to configure ACME challenge paths.
 if visibility == netv1alpha1.IngressVisibilityExternalIP {
 rule.HTTP.Paths = append(
 MakeACMEIngressPaths(acmeChallenges, domains...), rule.HTTP.Paths...)
 paths, hosts := MakeACMEIngressPaths(acmeChallenges, domains)
 rule.Hosts = append(hosts, rule.Hosts...)
 rule.HTTP.Paths = append(paths, rule.HTTP.Paths...)
 }
 rules = append(rules, rule)
 }
Expand DownExpand Up@@ -214,7 +215,7 @@ func getChallengeHosts(challenges []netv1alpha1.HTTP01Challenge) map[string]netv
	return c
}

func routeDomain(ctx context.Context, targetName string, r *servingv1.Route, visibility netv1alpha1.IngressVisibility) ([]string, error) {
func routeDomain(ctx context.Context, targetName string, r *servingv1.Route, visibility netv1alpha1.IngressVisibility) (sets.String, error) {
	hostname, err := domains.HostnameFromTemplate(ctx, r.Name, targetName)
	if err != nil {
 return nil, err
Expand All@@ -232,18 +233,20 @@ func routeDomain(ctx context.Context, targetName string, r *servingv1.Route, vis
	if isClusterLocal {
 domains = ingress.ExpandedHosts(sets.NewString(domains...)).List()
	}
	return domains, err
	return sets.NewString(domains...), err
}

// MakeACMEIngressPaths returns a set of netv1alpha1.HTTPIngressPath
// that can be used to perform ACME challenges.
func MakeACMEIngressPaths(acmeChallenges []netv1alpha1.HTTP01Challenge, domains ...string) []netv1alpha1.HTTPIngressPath {
func MakeACMEIngressPaths(acmeChallenges []netv1alpha1.HTTP01Challenge, domains sets.String) ([]netv1alpha1.HTTPIngressPath, []string) {
	challenges := getChallengeHosts(acmeChallenges)

	paths := make([]netv1alpha1.HTTPIngressPath, 0, len(challenges))
	for _, domain := range domains {
 challenge, ok := challenges[domain]
 if !ok {
 continue
	var extraHosts []string

	for _, challenge := range challenges {
 if !domains.Has(challenge.URL.Host) {
 extraHosts = append(extraHosts, challenge.URL.Host)
 }

 paths = append(paths, netv1alpha1.HTTPIngressPath{
Expand All@@ -258,16 +261,16 @@ func MakeACMEIngressPaths(acmeChallenges []netv1alpha1.HTTP01Challenge, domains
 Path: challenge.URL.Path,
 })
	}
	return paths
	return paths, extraHosts
}

func makeIngressRule(domains []string, ns string,
func makeIngressRule(domains sets.String, ns string,
	visibility netv1alpha1.IngressVisibility,
	targets traffic.RevisionTargets,
	roCfgs []*traffic.ConfigurationRollout,
	encryption bool) netv1alpha1.IngressRule {
	return netv1alpha1.IngressRule{
 Hosts: domains,
 Hosts: domains.List(),
 Visibility: visibility,
 HTTP: &netv1alpha1.HTTPIngressRuleValue{
 Paths: []netv1alpha1.HTTPIngressPath{
Expand Down

7 changes: 4 additions & 3 deletions
pkg/reconciler/route/resources/ingress_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -26,6 +26,7 @@ import (
	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/util/intstr"
	"k8s.io/apimachinery/pkg/util/sets"

	"knative.dev/networking/pkg/apis/networking"
	netv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
Expand DownExpand Up@@ -853,7 +854,7 @@ func TestMakeIngressSpecCorrectRulesWithTagBasedRouting(t *testing.T) {

// One active target.
func TestMakeIngressRuleVanilla(t *testing.T) {
	domains := []string{"a.com", "b.org"}
	domains := sets.NewString("a.com", "b.org")
	targets := traffic.RevisionTargets{{
 TrafficTarget: v1.TrafficTarget{
 ConfigurationName: "config",
Expand DownExpand Up@@ -913,7 +914,7 @@ func TestMakeIngressRuleZeroPercentTarget(t *testing.T) {
 Percent: ptr.Int64(0),
 },
	}}
	domains := []string{"test.org"}
	domains := sets.NewString("test.org")
	tc := &traffic.Config{
 Targets: map[string]traffic.RevisionTargets{
 traffic.DefaultTarget: targets,
Expand DownExpand Up@@ -969,7 +970,7 @@ func TestMakeIngressRuleTwoTargets(t *testing.T) {
 },
	}
	ro := tc.BuildRollout()
	domains := []string{"test.org"}
	domains := sets.NewString("test.org")
	rule := makeIngressRule(domains, ns, netv1alpha1.IngressVisibilityExternalIP,
 targets, ro.RolloutsByTag("a-tag"), false /* internal encryption */)
	expected := netv1alpha1.IngressRule{
Expand Down

18 changes: 18 additions & 0 deletions
pkg/reconciler/route/table_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2758,6 +2758,15 @@ func TestReconcileEnableAutoTLS(t *testing.T) {
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }, {
 URL: &apis.URL{
 Scheme: "http",
 Host: "k.example.com",
 Path: "/.well-known/acme-challenge/challengeToken2",
 },
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }},
 },
 },
Expand DownExpand Up@@ -2788,6 +2797,15 @@ func TestReconcileEnableAutoTLS(t *testing.T) {
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }, {
 URL: &apis.URL{
 Scheme: "http",
 Host: "k.example.com",
 Path: "/.well-known/acme-challenge/challengeToken2",
 },
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }},
 ),
 simpleK8sService(
Expand Down

41 changes: 22 additions & 19 deletions
test/e2e-auto-tls-tests.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -72,12 +72,13 @@ function setup_auto_tls_common() {
}

function cleanup_auto_tls_common() {
 cleanup_custom_domain
 true
 # cleanup_custom_domain

 toggle_feature autoTLS Disabled config-network
 toggle_feature autocreateClusterDomainClaims false config-network
 toggle_feature namespace-wildcard-cert-selector "" config-network
 kubectl delete kcert --all -n "${TLS_TEST_NAMESPACE}"
# toggle_feature autoTLS Disabled config-network
# toggle_feature autocreateClusterDomainClaims false config-network
# toggle_feature namespace-wildcard-cert-selector "" config-network
# kubectl delete kcert --all -n "${TLS_TEST_NAMESPACE}"
}

function setup_http01_auto_tls() {
Expand All@@ -86,7 +87,7 @@ function setup_http01_auto_tls() {
 # Rely on the built-in naming (for logstream)
 unset TLS_SERVICE_NAME
 # The full host name of the Knative Service. This is used to configure the DNS record.
 export AUTO_TLS_TEST_FULL_HOST_NAME="*.${TLS_TEST_NAMESPACE}.${CUSTOM_DOMAIN_SUFFIX}"
 export AUTO_TLS_TEST_FULL_HOST_NAME="*.${CUSTOM_DOMAIN_SUFFIX}"

 kubectl delete kcert --all -n "${TLS_TEST_NAMESPACE}"

Expand DownExpand Up@@ -158,6 +159,9 @@ function delete_dns_record() {
 fi
}


export ENABLE_GKE_TELEMETRY=true

# Script entry point.
initialize "$@" --skip-istio-addon --min-nodes=4 --max-nodes=4 --enable-ha --cluster-version=1.24

Expand All@@ -175,33 +179,32 @@ if [[ -z "${INGRESS_CLASS}" \
 alpha="--enable-alpha"
fi

AUTO_TLS_TEST_OPTIONS="${AUTO_TLS_TEST_OPTIONS:-${alpha} --enable-beta}"
AUTO_TLS_TEST_OPTIONS="${AUTO_TLS_TEST_OPTIONS:-${alpha} --enable-beta -skip-cleanup-on-fail}"

# Auto TLS E2E tests mutate the cluster and must be ran separately
# because they need auto-tls and cert-manager specific configurations
subheader "Setup auto tls"
setup_auto_tls_common
add_trap "cleanup_auto_tls_common" EXIT SIGKILL SIGTERM SIGQUIT

subheader "Auto TLS test for per-ksvc certificate provision using self-signed CA"
setup_selfsigned_per_ksvc_auto_tls
go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
kubectl delete -f ${E2E_YAML_DIR}/test/config/autotls/certmanager/selfsigned/
# subheader "Auto TLS test for per-ksvc certificate provision using self-signed CA"
# setup_selfsigned_per_ksvc_auto_tls
# go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
# kubectl delete -f ${E2E_YAML_DIR}/test/config/autotls/certmanager/selfsigned/

subheader "Auto TLS test for per-namespace certificate provision using self-signed CA"
setup_selfsigned_per_namespace_auto_tls
add_trap "cleanup_per_selfsigned_namespace_auto_tls" SIGKILL SIGTERM SIGQUIT
go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
cleanup_per_selfsigned_namespace_auto_tls
# subheader "Auto TLS test for per-namespace certificate provision using self-signed CA"
# setup_selfsigned_per_namespace_auto_tls
# add_trap "cleanup_per_selfsigned_namespace_auto_tls" SIGKILL SIGTERM SIGQUIT
# go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
# cleanup_per_selfsigned_namespace_auto_tls

if [[ ${RUN_HTTP01_AUTO_TLS_TESTS} -eq 1 ]]; then
# if [[ ${RUN_HTTP01_AUTO_TLS_TESTS} -eq 1 ]]; then
 subheader "Auto TLS test for per-ksvc certificate provision using HTTP01 challenge"
 setup_http01_auto_tls
 add_trap "delete_dns_record" SIGKILL SIGTERM SIGQUIT
 go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
 kubectl delete -f ${E2E_YAML_DIR}/test/config/autotls/certmanager/http01/
 delete_dns_record
fi
# fi

(( failed )) && fail_test

Expand Down

2 changes: 2 additions & 0 deletions
test/e2e/autotls/auto_tls_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -94,6 +94,8 @@ func testAutoTLS(t *testing.T) {
	if len(env.TLSServiceName) != 0 {
 names.Service = env.TLSServiceName
	}
	names.Service = names.Service + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
	names.Service = names.Service[:60]
	test.EnsureTearDown(t, clients, &names)

	objects, err := v1test.CreateServiceReady(t, clients, &names)
Expand Down

24 changes: 12 additions & 12 deletions
third_party/cert-manager-latest/net-certmanager.yaml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,7 +19,7 @@ metadata:
 name: knative-serving-certmanager
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 serving.knative.dev/controller: "true"
 networking.knative.dev/certificate-provider: cert-manager
Expand DownExpand Up@@ -52,7 +52,7 @@ metadata:
 name: config.webhook.net-certmanager.networking.internal.knative.dev
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
webhooks:
Expand DownExpand Up@@ -93,7 +93,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager

Expand All@@ -119,7 +119,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
data:
Expand DownExpand Up@@ -168,7 +168,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
spec:
Expand All@@ -182,15 +182,15 @@ spec:
 labels:
 app: net-certmanager-controller
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 spec:
 serviceAccountName: controller
 containers:
 - name: controller
 # This is the Go import path for the binary that is containerized
 # and substituted here.
 image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:61651eca0cbf2ab83ccdb2d64f98bee041b2869008b9e86c41714311ecdadda5
 image: gcr.io/pivotal-knative/dave/controller-b5455ad1ba7b683d126966c08026cd15@sha256:5a786db6b17acc5c3e2037bda2442d85544522768deae3677d9732af4aef9572
 resources:
 requests:
 cpu: 30m
Expand DownExpand Up@@ -229,7 +229,7 @@ metadata:
 labels:
 app: net-certmanager-controller
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
 name: net-certmanager-controller
Expand DownExpand Up@@ -268,7 +268,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
spec:
Expand All@@ -283,7 +283,7 @@ spec:
 labels:
 app: net-certmanager-webhook
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 role: net-certmanager-webhook
 spec:
Expand All@@ -292,7 +292,7 @@ spec:
 - name: webhook
 # This is the Go import path for the binary that is containerized
 # and substituted here.
 image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:2f65e85b9cf2d8a10507c1fc02333ca00350864235d4bfab1dc28c7a8d2e61a2
 image: gcr.io/pivotal-knative/dave/webhook-29139c5ce1fe7007906a2b725aaa018b@sha256:dca6101881eec45ce0fc293efccec3dbe17c9a1e621073cd92bab9fdf366c84a
 resources:
 requests:
 cpu: 20m
Expand DownExpand Up@@ -356,7 +356,7 @@ metadata:
 labels:
 role: net-certmanager-webhook
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
spec:
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
[wip] test net-certmanager changes#13621

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

dprotaso
wants to merge
11
commits into

from

 Closed


[wip] test net-certmanager changes
#13621
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


11 commits


Select commit
Hold shift + click to select a range
2d87bf7

test net-certmanager changes


dprotaso Jan 19, 2023
956c996

use a long domain name


dprotaso Jan 20, 2023
9fe2163

make service name < 63


dprotaso Jan 20, 2023
b8fef20

skip cleanup on failure autotls


dprotaso Jan 20, 2023
4abdcfd

fix domain name length


dprotaso Jan 20, 2023
a5a888d

run HTTP01 tests


dprotaso Jan 20, 2023
f4bf85a

run only http01 tests


dprotaso Jan 20, 2023
6176fbf

don't delete the cluster issuer + debugging


dprotaso Jan 20, 2023
08a72af

ensure DNS record is *.{domain}


dprotaso Jan 21, 2023
8f7799c

allow challenges for hosts that don't match the route's host


dprotaso Jan 22, 2023
fafaf0d

fix domain mapping


dprotaso Jan 22, 2023

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 4 additions & 2 deletions
pkg/reconciler/domainmapping/resources/ingress.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,6 +19,7 @@ package resources
import (
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/util/intstr"
	"k8s.io/apimachinery/pkg/util/sets"

	netapi "knative.dev/networking/pkg/apis/networking"
	netv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
Expand All@@ -35,6 +36,7 @@ import (
// KIngress). The created ingress will contain a RewriteHost rule to cause the
// given hostName to be used as the host.
func MakeIngress(dm *servingv1alpha1.DomainMapping, backendServiceName, hostName, ingressClass string, httpOption netv1alpha1.HTTPOption, tls []netv1alpha1.IngressTLS, acmeChallenges ...netv1alpha1.HTTP01Challenge) *netv1alpha1.Ingress {
	paths, hosts := routeresources.MakeACMEIngressPaths(acmeChallenges, sets.NewString(dm.GetName()))
	return &netv1alpha1.Ingress{
 ObjectMeta: metav1.ObjectMeta{
 Name: kmeta.ChildName(dm.GetName(), ""),
Expand All@@ -52,11 +54,11 @@ func MakeIngress(dm *servingv1alpha1.DomainMapping, backendServiceName, hostName
 HTTPOption: httpOption,
 TLS: tls,
 Rules: []netv1alpha1.IngressRule{{
 Hosts: []string{dm.Name},
 Hosts: append(hosts, dm.Name),
 Visibility: netv1alpha1.IngressVisibilityExternalIP,
 HTTP: &netv1alpha1.HTTPIngressRuleValue{
 // The order of the paths is sensitive, always put tls challenge first
 Paths: append(routeresources.MakeACMEIngressPaths(acmeChallenges, dm.GetName()),
 Paths: append(paths,
 []netv1alpha1.HTTPIngressPath{{
 RewriteHost: hostName,
 Splits: []netv1alpha1.IngressBackendSplit{{
Expand Down

27 changes: 15 additions & 12 deletions
pkg/reconciler/route/resources/ingress.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -185,8 +185,9 @@ func makeIngressSpec(
 }
 // If this is a public rule, we need to configure ACME challenge paths.
 if visibility == netv1alpha1.IngressVisibilityExternalIP {
 rule.HTTP.Paths = append(
 MakeACMEIngressPaths(acmeChallenges, domains...), rule.HTTP.Paths...)
 paths, hosts := MakeACMEIngressPaths(acmeChallenges, domains)
 rule.Hosts = append(hosts, rule.Hosts...)
 rule.HTTP.Paths = append(paths, rule.HTTP.Paths...)
 }
 rules = append(rules, rule)
 }
Expand DownExpand Up@@ -214,7 +215,7 @@ func getChallengeHosts(challenges []netv1alpha1.HTTP01Challenge) map[string]netv
	return c
}

func routeDomain(ctx context.Context, targetName string, r *servingv1.Route, visibility netv1alpha1.IngressVisibility) ([]string, error) {
func routeDomain(ctx context.Context, targetName string, r *servingv1.Route, visibility netv1alpha1.IngressVisibility) (sets.String, error) {
	hostname, err := domains.HostnameFromTemplate(ctx, r.Name, targetName)
	if err != nil {
 return nil, err
Expand All@@ -232,18 +233,20 @@ func routeDomain(ctx context.Context, targetName string, r *servingv1.Route, vis
	if isClusterLocal {
 domains = ingress.ExpandedHosts(sets.NewString(domains...)).List()
	}
	return domains, err
	return sets.NewString(domains...), err
}

// MakeACMEIngressPaths returns a set of netv1alpha1.HTTPIngressPath
// that can be used to perform ACME challenges.
func MakeACMEIngressPaths(acmeChallenges []netv1alpha1.HTTP01Challenge, domains ...string) []netv1alpha1.HTTPIngressPath {
func MakeACMEIngressPaths(acmeChallenges []netv1alpha1.HTTP01Challenge, domains sets.String) ([]netv1alpha1.HTTPIngressPath, []string) {
	challenges := getChallengeHosts(acmeChallenges)

	paths := make([]netv1alpha1.HTTPIngressPath, 0, len(challenges))
	for _, domain := range domains {
 challenge, ok := challenges[domain]
 if !ok {
 continue
	var extraHosts []string

	for _, challenge := range challenges {
 if !domains.Has(challenge.URL.Host) {
 extraHosts = append(extraHosts, challenge.URL.Host)
 }

 paths = append(paths, netv1alpha1.HTTPIngressPath{
Expand All@@ -258,16 +261,16 @@ func MakeACMEIngressPaths(acmeChallenges []netv1alpha1.HTTP01Challenge, domains
 Path: challenge.URL.Path,
 })
	}
	return paths
	return paths, extraHosts
}

func makeIngressRule(domains []string, ns string,
func makeIngressRule(domains sets.String, ns string,
	visibility netv1alpha1.IngressVisibility,
	targets traffic.RevisionTargets,
	roCfgs []*traffic.ConfigurationRollout,
	encryption bool) netv1alpha1.IngressRule {
	return netv1alpha1.IngressRule{
 Hosts: domains,
 Hosts: domains.List(),
 Visibility: visibility,
 HTTP: &netv1alpha1.HTTPIngressRuleValue{
 Paths: []netv1alpha1.HTTPIngressPath{
Expand Down

7 changes: 4 additions & 3 deletions
pkg/reconciler/route/resources/ingress_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -26,6 +26,7 @@ import (
	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/util/intstr"
	"k8s.io/apimachinery/pkg/util/sets"

	"knative.dev/networking/pkg/apis/networking"
	netv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
Expand DownExpand Up@@ -853,7 +854,7 @@ func TestMakeIngressSpecCorrectRulesWithTagBasedRouting(t *testing.T) {

// One active target.
func TestMakeIngressRuleVanilla(t *testing.T) {
	domains := []string{"a.com", "b.org"}
	domains := sets.NewString("a.com", "b.org")
	targets := traffic.RevisionTargets{{
 TrafficTarget: v1.TrafficTarget{
 ConfigurationName: "config",
Expand DownExpand Up@@ -913,7 +914,7 @@ func TestMakeIngressRuleZeroPercentTarget(t *testing.T) {
 Percent: ptr.Int64(0),
 },
	}}
	domains := []string{"test.org"}
	domains := sets.NewString("test.org")
	tc := &traffic.Config{
 Targets: map[string]traffic.RevisionTargets{
 traffic.DefaultTarget: targets,
Expand DownExpand Up@@ -969,7 +970,7 @@ func TestMakeIngressRuleTwoTargets(t *testing.T) {
 },
	}
	ro := tc.BuildRollout()
	domains := []string{"test.org"}
	domains := sets.NewString("test.org")
	rule := makeIngressRule(domains, ns, netv1alpha1.IngressVisibilityExternalIP,
 targets, ro.RolloutsByTag("a-tag"), false /* internal encryption */)
	expected := netv1alpha1.IngressRule{
Expand Down

18 changes: 18 additions & 0 deletions
pkg/reconciler/route/table_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2758,6 +2758,15 @@ func TestReconcileEnableAutoTLS(t *testing.T) {
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }, {
 URL: &apis.URL{
 Scheme: "http",
 Host: "k.example.com",
 Path: "/.well-known/acme-challenge/challengeToken2",
 },
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }},
 },
 },
Expand DownExpand Up@@ -2788,6 +2797,15 @@ func TestReconcileEnableAutoTLS(t *testing.T) {
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }, {
 URL: &apis.URL{
 Scheme: "http",
 Host: "k.example.com",
 Path: "/.well-known/acme-challenge/challengeToken2",
 },
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }},
 ),
 simpleK8sService(
Expand Down

41 changes: 22 additions & 19 deletions
test/e2e-auto-tls-tests.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -72,12 +72,13 @@ function setup_auto_tls_common() {
}

function cleanup_auto_tls_common() {
 cleanup_custom_domain
 true
 # cleanup_custom_domain

 toggle_feature autoTLS Disabled config-network
 toggle_feature autocreateClusterDomainClaims false config-network
 toggle_feature namespace-wildcard-cert-selector "" config-network
 kubectl delete kcert --all -n "${TLS_TEST_NAMESPACE}"
# toggle_feature autoTLS Disabled config-network
# toggle_feature autocreateClusterDomainClaims false config-network
# toggle_feature namespace-wildcard-cert-selector "" config-network
# kubectl delete kcert --all -n "${TLS_TEST_NAMESPACE}"
}

function setup_http01_auto_tls() {
Expand All@@ -86,7 +87,7 @@ function setup_http01_auto_tls() {
 # Rely on the built-in naming (for logstream)
 unset TLS_SERVICE_NAME
 # The full host name of the Knative Service. This is used to configure the DNS record.
 export AUTO_TLS_TEST_FULL_HOST_NAME="*.${TLS_TEST_NAMESPACE}.${CUSTOM_DOMAIN_SUFFIX}"
 export AUTO_TLS_TEST_FULL_HOST_NAME="*.${CUSTOM_DOMAIN_SUFFIX}"

 kubectl delete kcert --all -n "${TLS_TEST_NAMESPACE}"

Expand DownExpand Up@@ -158,6 +159,9 @@ function delete_dns_record() {
 fi
}


export ENABLE_GKE_TELEMETRY=true

# Script entry point.
initialize "$@" --skip-istio-addon --min-nodes=4 --max-nodes=4 --enable-ha --cluster-version=1.24

Expand All@@ -175,33 +179,32 @@ if [[ -z "${INGRESS_CLASS}" \
 alpha="--enable-alpha"
fi

AUTO_TLS_TEST_OPTIONS="${AUTO_TLS_TEST_OPTIONS:-${alpha} --enable-beta}"
AUTO_TLS_TEST_OPTIONS="${AUTO_TLS_TEST_OPTIONS:-${alpha} --enable-beta -skip-cleanup-on-fail}"

# Auto TLS E2E tests mutate the cluster and must be ran separately
# because they need auto-tls and cert-manager specific configurations
subheader "Setup auto tls"
setup_auto_tls_common
add_trap "cleanup_auto_tls_common" EXIT SIGKILL SIGTERM SIGQUIT

subheader "Auto TLS test for per-ksvc certificate provision using self-signed CA"
setup_selfsigned_per_ksvc_auto_tls
go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
kubectl delete -f ${E2E_YAML_DIR}/test/config/autotls/certmanager/selfsigned/
# subheader "Auto TLS test for per-ksvc certificate provision using self-signed CA"
# setup_selfsigned_per_ksvc_auto_tls
# go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
# kubectl delete -f ${E2E_YAML_DIR}/test/config/autotls/certmanager/selfsigned/

subheader "Auto TLS test for per-namespace certificate provision using self-signed CA"
setup_selfsigned_per_namespace_auto_tls
add_trap "cleanup_per_selfsigned_namespace_auto_tls" SIGKILL SIGTERM SIGQUIT
go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
cleanup_per_selfsigned_namespace_auto_tls
# subheader "Auto TLS test for per-namespace certificate provision using self-signed CA"
# setup_selfsigned_per_namespace_auto_tls
# add_trap "cleanup_per_selfsigned_namespace_auto_tls" SIGKILL SIGTERM SIGQUIT
# go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
# cleanup_per_selfsigned_namespace_auto_tls

if [[ ${RUN_HTTP01_AUTO_TLS_TESTS} -eq 1 ]]; then
# if [[ ${RUN_HTTP01_AUTO_TLS_TESTS} -eq 1 ]]; then
 subheader "Auto TLS test for per-ksvc certificate provision using HTTP01 challenge"
 setup_http01_auto_tls
 add_trap "delete_dns_record" SIGKILL SIGTERM SIGQUIT
 go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
 kubectl delete -f ${E2E_YAML_DIR}/test/config/autotls/certmanager/http01/
 delete_dns_record
fi
# fi

(( failed )) && fail_test

Expand Down

2 changes: 2 additions & 0 deletions
test/e2e/autotls/auto_tls_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -94,6 +94,8 @@ func testAutoTLS(t *testing.T) {
	if len(env.TLSServiceName) != 0 {
 names.Service = env.TLSServiceName
	}
	names.Service = names.Service + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
	names.Service = names.Service[:60]
	test.EnsureTearDown(t, clients, &names)

	objects, err := v1test.CreateServiceReady(t, clients, &names)
Expand Down

24 changes: 12 additions & 12 deletions
third_party/cert-manager-latest/net-certmanager.yaml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,7 +19,7 @@ metadata:
 name: knative-serving-certmanager
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 serving.knative.dev/controller: "true"
 networking.knative.dev/certificate-provider: cert-manager
Expand DownExpand Up@@ -52,7 +52,7 @@ metadata:
 name: config.webhook.net-certmanager.networking.internal.knative.dev
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
webhooks:
Expand DownExpand Up@@ -93,7 +93,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager

Expand All@@ -119,7 +119,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
data:
Expand DownExpand Up@@ -168,7 +168,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
spec:
Expand All@@ -182,15 +182,15 @@ spec:
 labels:
 app: net-certmanager-controller
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 spec:
 serviceAccountName: controller
 containers:
 - name: controller
 # This is the Go import path for the binary that is containerized
 # and substituted here.
 image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:61651eca0cbf2ab83ccdb2d64f98bee041b2869008b9e86c41714311ecdadda5
 image: gcr.io/pivotal-knative/dave/controller-b5455ad1ba7b683d126966c08026cd15@sha256:5a786db6b17acc5c3e2037bda2442d85544522768deae3677d9732af4aef9572
 resources:
 requests:
 cpu: 30m
Expand DownExpand Up@@ -229,7 +229,7 @@ metadata:
 labels:
 app: net-certmanager-controller
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
 name: net-certmanager-controller
Expand DownExpand Up@@ -268,7 +268,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
spec:
Expand All@@ -283,7 +283,7 @@ spec:
 labels:
 app: net-certmanager-webhook
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 role: net-certmanager-webhook
 spec:
Expand All@@ -292,7 +292,7 @@ spec:
 - name: webhook
 # This is the Go import path for the binary that is containerized
 # and substituted here.
 image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:2f65e85b9cf2d8a10507c1fc02333ca00350864235d4bfab1dc28c7a8d2e61a2
 image: gcr.io/pivotal-knative/dave/webhook-29139c5ce1fe7007906a2b725aaa018b@sha256:dca6101881eec45ce0fc293efccec3dbe17c9a1e621073cd92bab9fdf366c84a
 resources:
 requests:
 cpu: 20m
Expand DownExpand Up@@ -356,7 +356,7 @@ metadata:
 labels:
 role: net-certmanager-webhook
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
spec:
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
[wip] test net-certmanager changes#13621

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

dprotaso
wants to merge
11
commits into

from

 Closed


[wip] test net-certmanager changes
#13621
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


11 commits


Select commit
Hold shift + click to select a range
2d87bf7

test net-certmanager changes


dprotaso Jan 19, 2023
956c996

use a long domain name


dprotaso Jan 20, 2023
9fe2163

make service name < 63


dprotaso Jan 20, 2023
b8fef20

skip cleanup on failure autotls


dprotaso Jan 20, 2023
4abdcfd

fix domain name length


dprotaso Jan 20, 2023
a5a888d

run HTTP01 tests


dprotaso Jan 20, 2023
f4bf85a

run only http01 tests


dprotaso Jan 20, 2023
6176fbf

don't delete the cluster issuer + debugging


dprotaso Jan 20, 2023
08a72af

ensure DNS record is *.{domain}


dprotaso Jan 21, 2023
8f7799c

allow challenges for hosts that don't match the route's host


dprotaso Jan 22, 2023
fafaf0d

fix domain mapping


dprotaso Jan 22, 2023

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 4 additions & 2 deletions
pkg/reconciler/domainmapping/resources/ingress.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,6 +19,7 @@ package resources
import (
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/util/intstr"
	"k8s.io/apimachinery/pkg/util/sets"

	netapi "knative.dev/networking/pkg/apis/networking"
	netv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
Expand All@@ -35,6 +36,7 @@ import (
// KIngress). The created ingress will contain a RewriteHost rule to cause the
// given hostName to be used as the host.
func MakeIngress(dm *servingv1alpha1.DomainMapping, backendServiceName, hostName, ingressClass string, httpOption netv1alpha1.HTTPOption, tls []netv1alpha1.IngressTLS, acmeChallenges ...netv1alpha1.HTTP01Challenge) *netv1alpha1.Ingress {
	paths, hosts := routeresources.MakeACMEIngressPaths(acmeChallenges, sets.NewString(dm.GetName()))
	return &netv1alpha1.Ingress{
 ObjectMeta: metav1.ObjectMeta{
 Name: kmeta.ChildName(dm.GetName(), ""),
Expand All@@ -52,11 +54,11 @@ func MakeIngress(dm *servingv1alpha1.DomainMapping, backendServiceName, hostName
 HTTPOption: httpOption,
 TLS: tls,
 Rules: []netv1alpha1.IngressRule{{
 Hosts: []string{dm.Name},
 Hosts: append(hosts, dm.Name),
 Visibility: netv1alpha1.IngressVisibilityExternalIP,
 HTTP: &netv1alpha1.HTTPIngressRuleValue{
 // The order of the paths is sensitive, always put tls challenge first
 Paths: append(routeresources.MakeACMEIngressPaths(acmeChallenges, dm.GetName()),
 Paths: append(paths,
 []netv1alpha1.HTTPIngressPath{{
 RewriteHost: hostName,
 Splits: []netv1alpha1.IngressBackendSplit{{
Expand Down

27 changes: 15 additions & 12 deletions
pkg/reconciler/route/resources/ingress.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -185,8 +185,9 @@ func makeIngressSpec(
 }
 // If this is a public rule, we need to configure ACME challenge paths.
 if visibility == netv1alpha1.IngressVisibilityExternalIP {
 rule.HTTP.Paths = append(
 MakeACMEIngressPaths(acmeChallenges, domains...), rule.HTTP.Paths...)
 paths, hosts := MakeACMEIngressPaths(acmeChallenges, domains)
 rule.Hosts = append(hosts, rule.Hosts...)
 rule.HTTP.Paths = append(paths, rule.HTTP.Paths...)
 }
 rules = append(rules, rule)
 }
Expand DownExpand Up@@ -214,7 +215,7 @@ func getChallengeHosts(challenges []netv1alpha1.HTTP01Challenge) map[string]netv
	return c
}

func routeDomain(ctx context.Context, targetName string, r *servingv1.Route, visibility netv1alpha1.IngressVisibility) ([]string, error) {
func routeDomain(ctx context.Context, targetName string, r *servingv1.Route, visibility netv1alpha1.IngressVisibility) (sets.String, error) {
	hostname, err := domains.HostnameFromTemplate(ctx, r.Name, targetName)
	if err != nil {
 return nil, err
Expand All@@ -232,18 +233,20 @@ func routeDomain(ctx context.Context, targetName string, r *servingv1.Route, vis
	if isClusterLocal {
 domains = ingress.ExpandedHosts(sets.NewString(domains...)).List()
	}
	return domains, err
	return sets.NewString(domains...), err
}

// MakeACMEIngressPaths returns a set of netv1alpha1.HTTPIngressPath
// that can be used to perform ACME challenges.
func MakeACMEIngressPaths(acmeChallenges []netv1alpha1.HTTP01Challenge, domains ...string) []netv1alpha1.HTTPIngressPath {
func MakeACMEIngressPaths(acmeChallenges []netv1alpha1.HTTP01Challenge, domains sets.String) ([]netv1alpha1.HTTPIngressPath, []string) {
	challenges := getChallengeHosts(acmeChallenges)

	paths := make([]netv1alpha1.HTTPIngressPath, 0, len(challenges))
	for _, domain := range domains {
 challenge, ok := challenges[domain]
 if !ok {
 continue
	var extraHosts []string

	for _, challenge := range challenges {
 if !domains.Has(challenge.URL.Host) {
 extraHosts = append(extraHosts, challenge.URL.Host)
 }

 paths = append(paths, netv1alpha1.HTTPIngressPath{
Expand All@@ -258,16 +261,16 @@ func MakeACMEIngressPaths(acmeChallenges []netv1alpha1.HTTP01Challenge, domains
 Path: challenge.URL.Path,
 })
	}
	return paths
	return paths, extraHosts
}

func makeIngressRule(domains []string, ns string,
func makeIngressRule(domains sets.String, ns string,
	visibility netv1alpha1.IngressVisibility,
	targets traffic.RevisionTargets,
	roCfgs []*traffic.ConfigurationRollout,
	encryption bool) netv1alpha1.IngressRule {
	return netv1alpha1.IngressRule{
 Hosts: domains,
 Hosts: domains.List(),
 Visibility: visibility,
 HTTP: &netv1alpha1.HTTPIngressRuleValue{
 Paths: []netv1alpha1.HTTPIngressPath{
Expand Down

7 changes: 4 additions & 3 deletions
pkg/reconciler/route/resources/ingress_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -26,6 +26,7 @@ import (
	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/util/intstr"
	"k8s.io/apimachinery/pkg/util/sets"

	"knative.dev/networking/pkg/apis/networking"
	netv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
Expand DownExpand Up@@ -853,7 +854,7 @@ func TestMakeIngressSpecCorrectRulesWithTagBasedRouting(t *testing.T) {

// One active target.
func TestMakeIngressRuleVanilla(t *testing.T) {
	domains := []string{"a.com", "b.org"}
	domains := sets.NewString("a.com", "b.org")
	targets := traffic.RevisionTargets{{
 TrafficTarget: v1.TrafficTarget{
 ConfigurationName: "config",
Expand DownExpand Up@@ -913,7 +914,7 @@ func TestMakeIngressRuleZeroPercentTarget(t *testing.T) {
 Percent: ptr.Int64(0),
 },
	}}
	domains := []string{"test.org"}
	domains := sets.NewString("test.org")
	tc := &traffic.Config{
 Targets: map[string]traffic.RevisionTargets{
 traffic.DefaultTarget: targets,
Expand DownExpand Up@@ -969,7 +970,7 @@ func TestMakeIngressRuleTwoTargets(t *testing.T) {
 },
	}
	ro := tc.BuildRollout()
	domains := []string{"test.org"}
	domains := sets.NewString("test.org")
	rule := makeIngressRule(domains, ns, netv1alpha1.IngressVisibilityExternalIP,
 targets, ro.RolloutsByTag("a-tag"), false /* internal encryption */)
	expected := netv1alpha1.IngressRule{
Expand Down

18 changes: 18 additions & 0 deletions
pkg/reconciler/route/table_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2758,6 +2758,15 @@ func TestReconcileEnableAutoTLS(t *testing.T) {
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }, {
 URL: &apis.URL{
 Scheme: "http",
 Host: "k.example.com",
 Path: "/.well-known/acme-challenge/challengeToken2",
 },
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }},
 },
 },
Expand DownExpand Up@@ -2788,6 +2797,15 @@ func TestReconcileEnableAutoTLS(t *testing.T) {
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }, {
 URL: &apis.URL{
 Scheme: "http",
 Host: "k.example.com",
 Path: "/.well-known/acme-challenge/challengeToken2",
 },
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }},
 ),
 simpleK8sService(
Expand Down

41 changes: 22 additions & 19 deletions
test/e2e-auto-tls-tests.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -72,12 +72,13 @@ function setup_auto_tls_common() {
}

function cleanup_auto_tls_common() {
 cleanup_custom_domain
 true
 # cleanup_custom_domain

 toggle_feature autoTLS Disabled config-network
 toggle_feature autocreateClusterDomainClaims false config-network
 toggle_feature namespace-wildcard-cert-selector "" config-network
 kubectl delete kcert --all -n "${TLS_TEST_NAMESPACE}"
# toggle_feature autoTLS Disabled config-network
# toggle_feature autocreateClusterDomainClaims false config-network
# toggle_feature namespace-wildcard-cert-selector "" config-network
# kubectl delete kcert --all -n "${TLS_TEST_NAMESPACE}"
}

function setup_http01_auto_tls() {
Expand All@@ -86,7 +87,7 @@ function setup_http01_auto_tls() {
 # Rely on the built-in naming (for logstream)
 unset TLS_SERVICE_NAME
 # The full host name of the Knative Service. This is used to configure the DNS record.
 export AUTO_TLS_TEST_FULL_HOST_NAME="*.${TLS_TEST_NAMESPACE}.${CUSTOM_DOMAIN_SUFFIX}"
 export AUTO_TLS_TEST_FULL_HOST_NAME="*.${CUSTOM_DOMAIN_SUFFIX}"

 kubectl delete kcert --all -n "${TLS_TEST_NAMESPACE}"

Expand DownExpand Up@@ -158,6 +159,9 @@ function delete_dns_record() {
 fi
}


export ENABLE_GKE_TELEMETRY=true

# Script entry point.
initialize "$@" --skip-istio-addon --min-nodes=4 --max-nodes=4 --enable-ha --cluster-version=1.24

Expand All@@ -175,33 +179,32 @@ if [[ -z "${INGRESS_CLASS}" \
 alpha="--enable-alpha"
fi

AUTO_TLS_TEST_OPTIONS="${AUTO_TLS_TEST_OPTIONS:-${alpha} --enable-beta}"
AUTO_TLS_TEST_OPTIONS="${AUTO_TLS_TEST_OPTIONS:-${alpha} --enable-beta -skip-cleanup-on-fail}"

# Auto TLS E2E tests mutate the cluster and must be ran separately
# because they need auto-tls and cert-manager specific configurations
subheader "Setup auto tls"
setup_auto_tls_common
add_trap "cleanup_auto_tls_common" EXIT SIGKILL SIGTERM SIGQUIT

subheader "Auto TLS test for per-ksvc certificate provision using self-signed CA"
setup_selfsigned_per_ksvc_auto_tls
go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
kubectl delete -f ${E2E_YAML_DIR}/test/config/autotls/certmanager/selfsigned/
# subheader "Auto TLS test for per-ksvc certificate provision using self-signed CA"
# setup_selfsigned_per_ksvc_auto_tls
# go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
# kubectl delete -f ${E2E_YAML_DIR}/test/config/autotls/certmanager/selfsigned/

subheader "Auto TLS test for per-namespace certificate provision using self-signed CA"
setup_selfsigned_per_namespace_auto_tls
add_trap "cleanup_per_selfsigned_namespace_auto_tls" SIGKILL SIGTERM SIGQUIT
go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
cleanup_per_selfsigned_namespace_auto_tls
# subheader "Auto TLS test for per-namespace certificate provision using self-signed CA"
# setup_selfsigned_per_namespace_auto_tls
# add_trap "cleanup_per_selfsigned_namespace_auto_tls" SIGKILL SIGTERM SIGQUIT
# go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
# cleanup_per_selfsigned_namespace_auto_tls

if [[ ${RUN_HTTP01_AUTO_TLS_TESTS} -eq 1 ]]; then
# if [[ ${RUN_HTTP01_AUTO_TLS_TESTS} -eq 1 ]]; then
 subheader "Auto TLS test for per-ksvc certificate provision using HTTP01 challenge"
 setup_http01_auto_tls
 add_trap "delete_dns_record" SIGKILL SIGTERM SIGQUIT
 go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
 kubectl delete -f ${E2E_YAML_DIR}/test/config/autotls/certmanager/http01/
 delete_dns_record
fi
# fi

(( failed )) && fail_test

Expand Down

2 changes: 2 additions & 0 deletions
test/e2e/autotls/auto_tls_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -94,6 +94,8 @@ func testAutoTLS(t *testing.T) {
	if len(env.TLSServiceName) != 0 {
 names.Service = env.TLSServiceName
	}
	names.Service = names.Service + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
	names.Service = names.Service[:60]
	test.EnsureTearDown(t, clients, &names)

	objects, err := v1test.CreateServiceReady(t, clients, &names)
Expand Down

24 changes: 12 additions & 12 deletions
third_party/cert-manager-latest/net-certmanager.yaml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,7 +19,7 @@ metadata:
 name: knative-serving-certmanager
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 serving.knative.dev/controller: "true"
 networking.knative.dev/certificate-provider: cert-manager
Expand DownExpand Up@@ -52,7 +52,7 @@ metadata:
 name: config.webhook.net-certmanager.networking.internal.knative.dev
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
webhooks:
Expand DownExpand Up@@ -93,7 +93,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager

Expand All@@ -119,7 +119,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
data:
Expand DownExpand Up@@ -168,7 +168,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
spec:
Expand All@@ -182,15 +182,15 @@ spec:
 labels:
 app: net-certmanager-controller
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 spec:
 serviceAccountName: controller
 containers:
 - name: controller
 # This is the Go import path for the binary that is containerized
 # and substituted here.
 image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:61651eca0cbf2ab83ccdb2d64f98bee041b2869008b9e86c41714311ecdadda5
 image: gcr.io/pivotal-knative/dave/controller-b5455ad1ba7b683d126966c08026cd15@sha256:5a786db6b17acc5c3e2037bda2442d85544522768deae3677d9732af4aef9572
 resources:
 requests:
 cpu: 30m
Expand DownExpand Up@@ -229,7 +229,7 @@ metadata:
 labels:
 app: net-certmanager-controller
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
 name: net-certmanager-controller
Expand DownExpand Up@@ -268,7 +268,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
spec:
Expand All@@ -283,7 +283,7 @@ spec:
 labels:
 app: net-certmanager-webhook
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 role: net-certmanager-webhook
 spec:
Expand All@@ -292,7 +292,7 @@ spec:
 - name: webhook
 # This is the Go import path for the binary that is containerized
 # and substituted here.
 image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:2f65e85b9cf2d8a10507c1fc02333ca00350864235d4bfab1dc28c7a8d2e61a2
 image: gcr.io/pivotal-knative/dave/webhook-29139c5ce1fe7007906a2b725aaa018b@sha256:dca6101881eec45ce0fc293efccec3dbe17c9a1e621073cd92bab9fdf366c84a
 resources:
 requests:
 cpu: 20m
Expand DownExpand Up@@ -356,7 +356,7 @@ metadata:
 labels:
 role: net-certmanager-webhook
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
spec:
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
[wip] test net-certmanager changes#13621

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

dprotaso
wants to merge
11
commits into

from

 Closed


[wip] test net-certmanager changes
#13621
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


11 commits


Select commit
Hold shift + click to select a range
2d87bf7

test net-certmanager changes


dprotaso Jan 19, 2023
956c996

use a long domain name


dprotaso Jan 20, 2023
9fe2163

make service name < 63


dprotaso Jan 20, 2023
b8fef20

skip cleanup on failure autotls


dprotaso Jan 20, 2023
4abdcfd

fix domain name length


dprotaso Jan 20, 2023
a5a888d

run HTTP01 tests


dprotaso Jan 20, 2023
f4bf85a

run only http01 tests


dprotaso Jan 20, 2023
6176fbf

don't delete the cluster issuer + debugging


dprotaso Jan 20, 2023
08a72af

ensure DNS record is *.{domain}


dprotaso Jan 21, 2023
8f7799c

allow challenges for hosts that don't match the route's host


dprotaso Jan 22, 2023
fafaf0d

fix domain mapping


dprotaso Jan 22, 2023

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 4 additions & 2 deletions
pkg/reconciler/domainmapping/resources/ingress.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,6 +19,7 @@ package resources
import (
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/util/intstr"
	"k8s.io/apimachinery/pkg/util/sets"

	netapi "knative.dev/networking/pkg/apis/networking"
	netv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
Expand All@@ -35,6 +36,7 @@ import (
// KIngress). The created ingress will contain a RewriteHost rule to cause the
// given hostName to be used as the host.
func MakeIngress(dm *servingv1alpha1.DomainMapping, backendServiceName, hostName, ingressClass string, httpOption netv1alpha1.HTTPOption, tls []netv1alpha1.IngressTLS, acmeChallenges ...netv1alpha1.HTTP01Challenge) *netv1alpha1.Ingress {
	paths, hosts := routeresources.MakeACMEIngressPaths(acmeChallenges, sets.NewString(dm.GetName()))
	return &netv1alpha1.Ingress{
 ObjectMeta: metav1.ObjectMeta{
 Name: kmeta.ChildName(dm.GetName(), ""),
Expand All@@ -52,11 +54,11 @@ func MakeIngress(dm *servingv1alpha1.DomainMapping, backendServiceName, hostName
 HTTPOption: httpOption,
 TLS: tls,
 Rules: []netv1alpha1.IngressRule{{
 Hosts: []string{dm.Name},
 Hosts: append(hosts, dm.Name),
 Visibility: netv1alpha1.IngressVisibilityExternalIP,
 HTTP: &netv1alpha1.HTTPIngressRuleValue{
 // The order of the paths is sensitive, always put tls challenge first
 Paths: append(routeresources.MakeACMEIngressPaths(acmeChallenges, dm.GetName()),
 Paths: append(paths,
 []netv1alpha1.HTTPIngressPath{{
 RewriteHost: hostName,
 Splits: []netv1alpha1.IngressBackendSplit{{
Expand Down

27 changes: 15 additions & 12 deletions
pkg/reconciler/route/resources/ingress.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -185,8 +185,9 @@ func makeIngressSpec(
 }
 // If this is a public rule, we need to configure ACME challenge paths.
 if visibility == netv1alpha1.IngressVisibilityExternalIP {
 rule.HTTP.Paths = append(
 MakeACMEIngressPaths(acmeChallenges, domains...), rule.HTTP.Paths...)
 paths, hosts := MakeACMEIngressPaths(acmeChallenges, domains)
 rule.Hosts = append(hosts, rule.Hosts...)
 rule.HTTP.Paths = append(paths, rule.HTTP.Paths...)
 }
 rules = append(rules, rule)
 }
Expand DownExpand Up@@ -214,7 +215,7 @@ func getChallengeHosts(challenges []netv1alpha1.HTTP01Challenge) map[string]netv
	return c
}

func routeDomain(ctx context.Context, targetName string, r *servingv1.Route, visibility netv1alpha1.IngressVisibility) ([]string, error) {
func routeDomain(ctx context.Context, targetName string, r *servingv1.Route, visibility netv1alpha1.IngressVisibility) (sets.String, error) {
	hostname, err := domains.HostnameFromTemplate(ctx, r.Name, targetName)
	if err != nil {
 return nil, err
Expand All@@ -232,18 +233,20 @@ func routeDomain(ctx context.Context, targetName string, r *servingv1.Route, vis
	if isClusterLocal {
 domains = ingress.ExpandedHosts(sets.NewString(domains...)).List()
	}
	return domains, err
	return sets.NewString(domains...), err
}

// MakeACMEIngressPaths returns a set of netv1alpha1.HTTPIngressPath
// that can be used to perform ACME challenges.
func MakeACMEIngressPaths(acmeChallenges []netv1alpha1.HTTP01Challenge, domains ...string) []netv1alpha1.HTTPIngressPath {
func MakeACMEIngressPaths(acmeChallenges []netv1alpha1.HTTP01Challenge, domains sets.String) ([]netv1alpha1.HTTPIngressPath, []string) {
	challenges := getChallengeHosts(acmeChallenges)

	paths := make([]netv1alpha1.HTTPIngressPath, 0, len(challenges))
	for _, domain := range domains {
 challenge, ok := challenges[domain]
 if !ok {
 continue
	var extraHosts []string

	for _, challenge := range challenges {
 if !domains.Has(challenge.URL.Host) {
 extraHosts = append(extraHosts, challenge.URL.Host)
 }

 paths = append(paths, netv1alpha1.HTTPIngressPath{
Expand All@@ -258,16 +261,16 @@ func MakeACMEIngressPaths(acmeChallenges []netv1alpha1.HTTP01Challenge, domains
 Path: challenge.URL.Path,
 })
	}
	return paths
	return paths, extraHosts
}

func makeIngressRule(domains []string, ns string,
func makeIngressRule(domains sets.String, ns string,
	visibility netv1alpha1.IngressVisibility,
	targets traffic.RevisionTargets,
	roCfgs []*traffic.ConfigurationRollout,
	encryption bool) netv1alpha1.IngressRule {
	return netv1alpha1.IngressRule{
 Hosts: domains,
 Hosts: domains.List(),
 Visibility: visibility,
 HTTP: &netv1alpha1.HTTPIngressRuleValue{
 Paths: []netv1alpha1.HTTPIngressPath{
Expand Down

7 changes: 4 additions & 3 deletions
pkg/reconciler/route/resources/ingress_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -26,6 +26,7 @@ import (
	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/util/intstr"
	"k8s.io/apimachinery/pkg/util/sets"

	"knative.dev/networking/pkg/apis/networking"
	netv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
Expand DownExpand Up@@ -853,7 +854,7 @@ func TestMakeIngressSpecCorrectRulesWithTagBasedRouting(t *testing.T) {

// One active target.
func TestMakeIngressRuleVanilla(t *testing.T) {
	domains := []string{"a.com", "b.org"}
	domains := sets.NewString("a.com", "b.org")
	targets := traffic.RevisionTargets{{
 TrafficTarget: v1.TrafficTarget{
 ConfigurationName: "config",
Expand DownExpand Up@@ -913,7 +914,7 @@ func TestMakeIngressRuleZeroPercentTarget(t *testing.T) {
 Percent: ptr.Int64(0),
 },
	}}
	domains := []string{"test.org"}
	domains := sets.NewString("test.org")
	tc := &traffic.Config{
 Targets: map[string]traffic.RevisionTargets{
 traffic.DefaultTarget: targets,
Expand DownExpand Up@@ -969,7 +970,7 @@ func TestMakeIngressRuleTwoTargets(t *testing.T) {
 },
	}
	ro := tc.BuildRollout()
	domains := []string{"test.org"}
	domains := sets.NewString("test.org")
	rule := makeIngressRule(domains, ns, netv1alpha1.IngressVisibilityExternalIP,
 targets, ro.RolloutsByTag("a-tag"), false /* internal encryption */)
	expected := netv1alpha1.IngressRule{
Expand Down

18 changes: 18 additions & 0 deletions
pkg/reconciler/route/table_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2758,6 +2758,15 @@ func TestReconcileEnableAutoTLS(t *testing.T) {
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }, {
 URL: &apis.URL{
 Scheme: "http",
 Host: "k.example.com",
 Path: "/.well-known/acme-challenge/challengeToken2",
 },
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }},
 },
 },
Expand DownExpand Up@@ -2788,6 +2797,15 @@ func TestReconcileEnableAutoTLS(t *testing.T) {
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }, {
 URL: &apis.URL{
 Scheme: "http",
 Host: "k.example.com",
 Path: "/.well-known/acme-challenge/challengeToken2",
 },
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }},
 ),
 simpleK8sService(
Expand Down

41 changes: 22 additions & 19 deletions
test/e2e-auto-tls-tests.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -72,12 +72,13 @@ function setup_auto_tls_common() {
}

function cleanup_auto_tls_common() {
 cleanup_custom_domain
 true
 # cleanup_custom_domain

 toggle_feature autoTLS Disabled config-network
 toggle_feature autocreateClusterDomainClaims false config-network
 toggle_feature namespace-wildcard-cert-selector "" config-network
 kubectl delete kcert --all -n "${TLS_TEST_NAMESPACE}"
# toggle_feature autoTLS Disabled config-network
# toggle_feature autocreateClusterDomainClaims false config-network
# toggle_feature namespace-wildcard-cert-selector "" config-network
# kubectl delete kcert --all -n "${TLS_TEST_NAMESPACE}"
}

function setup_http01_auto_tls() {
Expand All@@ -86,7 +87,7 @@ function setup_http01_auto_tls() {
 # Rely on the built-in naming (for logstream)
 unset TLS_SERVICE_NAME
 # The full host name of the Knative Service. This is used to configure the DNS record.
 export AUTO_TLS_TEST_FULL_HOST_NAME="*.${TLS_TEST_NAMESPACE}.${CUSTOM_DOMAIN_SUFFIX}"
 export AUTO_TLS_TEST_FULL_HOST_NAME="*.${CUSTOM_DOMAIN_SUFFIX}"

 kubectl delete kcert --all -n "${TLS_TEST_NAMESPACE}"

Expand DownExpand Up@@ -158,6 +159,9 @@ function delete_dns_record() {
 fi
}


export ENABLE_GKE_TELEMETRY=true

# Script entry point.
initialize "$@" --skip-istio-addon --min-nodes=4 --max-nodes=4 --enable-ha --cluster-version=1.24

Expand All@@ -175,33 +179,32 @@ if [[ -z "${INGRESS_CLASS}" \
 alpha="--enable-alpha"
fi

AUTO_TLS_TEST_OPTIONS="${AUTO_TLS_TEST_OPTIONS:-${alpha} --enable-beta}"
AUTO_TLS_TEST_OPTIONS="${AUTO_TLS_TEST_OPTIONS:-${alpha} --enable-beta -skip-cleanup-on-fail}"

# Auto TLS E2E tests mutate the cluster and must be ran separately
# because they need auto-tls and cert-manager specific configurations
subheader "Setup auto tls"
setup_auto_tls_common
add_trap "cleanup_auto_tls_common" EXIT SIGKILL SIGTERM SIGQUIT

subheader "Auto TLS test for per-ksvc certificate provision using self-signed CA"
setup_selfsigned_per_ksvc_auto_tls
go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
kubectl delete -f ${E2E_YAML_DIR}/test/config/autotls/certmanager/selfsigned/
# subheader "Auto TLS test for per-ksvc certificate provision using self-signed CA"
# setup_selfsigned_per_ksvc_auto_tls
# go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
# kubectl delete -f ${E2E_YAML_DIR}/test/config/autotls/certmanager/selfsigned/

subheader "Auto TLS test for per-namespace certificate provision using self-signed CA"
setup_selfsigned_per_namespace_auto_tls
add_trap "cleanup_per_selfsigned_namespace_auto_tls" SIGKILL SIGTERM SIGQUIT
go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
cleanup_per_selfsigned_namespace_auto_tls
# subheader "Auto TLS test for per-namespace certificate provision using self-signed CA"
# setup_selfsigned_per_namespace_auto_tls
# add_trap "cleanup_per_selfsigned_namespace_auto_tls" SIGKILL SIGTERM SIGQUIT
# go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
# cleanup_per_selfsigned_namespace_auto_tls

if [[ ${RUN_HTTP01_AUTO_TLS_TESTS} -eq 1 ]]; then
# if [[ ${RUN_HTTP01_AUTO_TLS_TESTS} -eq 1 ]]; then
 subheader "Auto TLS test for per-ksvc certificate provision using HTTP01 challenge"
 setup_http01_auto_tls
 add_trap "delete_dns_record" SIGKILL SIGTERM SIGQUIT
 go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
 kubectl delete -f ${E2E_YAML_DIR}/test/config/autotls/certmanager/http01/
 delete_dns_record
fi
# fi

(( failed )) && fail_test

Expand Down

2 changes: 2 additions & 0 deletions
test/e2e/autotls/auto_tls_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -94,6 +94,8 @@ func testAutoTLS(t *testing.T) {
	if len(env.TLSServiceName) != 0 {
 names.Service = env.TLSServiceName
	}
	names.Service = names.Service + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
	names.Service = names.Service[:60]
	test.EnsureTearDown(t, clients, &names)

	objects, err := v1test.CreateServiceReady(t, clients, &names)
Expand Down

24 changes: 12 additions & 12 deletions
third_party/cert-manager-latest/net-certmanager.yaml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,7 +19,7 @@ metadata:
 name: knative-serving-certmanager
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 serving.knative.dev/controller: "true"
 networking.knative.dev/certificate-provider: cert-manager
Expand DownExpand Up@@ -52,7 +52,7 @@ metadata:
 name: config.webhook.net-certmanager.networking.internal.knative.dev
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
webhooks:
Expand DownExpand Up@@ -93,7 +93,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager

Expand All@@ -119,7 +119,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
data:
Expand DownExpand Up@@ -168,7 +168,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
spec:
Expand All@@ -182,15 +182,15 @@ spec:
 labels:
 app: net-certmanager-controller
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 spec:
 serviceAccountName: controller
 containers:
 - name: controller
 # This is the Go import path for the binary that is containerized
 # and substituted here.
 image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:61651eca0cbf2ab83ccdb2d64f98bee041b2869008b9e86c41714311ecdadda5
 image: gcr.io/pivotal-knative/dave/controller-b5455ad1ba7b683d126966c08026cd15@sha256:5a786db6b17acc5c3e2037bda2442d85544522768deae3677d9732af4aef9572
 resources:
 requests:
 cpu: 30m
Expand DownExpand Up@@ -229,7 +229,7 @@ metadata:
 labels:
 app: net-certmanager-controller
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
 name: net-certmanager-controller
Expand DownExpand Up@@ -268,7 +268,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
spec:
Expand All@@ -283,7 +283,7 @@ spec:
 labels:
 app: net-certmanager-webhook
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 role: net-certmanager-webhook
 spec:
Expand All@@ -292,7 +292,7 @@ spec:
 - name: webhook
 # This is the Go import path for the binary that is containerized
 # and substituted here.
 image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:2f65e85b9cf2d8a10507c1fc02333ca00350864235d4bfab1dc28c7a8d2e61a2
 image: gcr.io/pivotal-knative/dave/webhook-29139c5ce1fe7007906a2b725aaa018b@sha256:dca6101881eec45ce0fc293efccec3dbe17c9a1e621073cd92bab9fdf366c84a
 resources:
 requests:
 cpu: 20m
Expand DownExpand Up@@ -356,7 +356,7 @@ metadata:
 labels:
 role: net-certmanager-webhook
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
spec:
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
[wip] test net-certmanager changes#13621

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

dprotaso
wants to merge
11
commits into

from

 Closed


[wip] test net-certmanager changes
#13621
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


11 commits


Select commit
Hold shift + click to select a range
2d87bf7

test net-certmanager changes


dprotaso Jan 19, 2023
956c996

use a long domain name


dprotaso Jan 20, 2023
9fe2163

make service name < 63


dprotaso Jan 20, 2023
b8fef20

skip cleanup on failure autotls


dprotaso Jan 20, 2023
4abdcfd

fix domain name length


dprotaso Jan 20, 2023
a5a888d

run HTTP01 tests


dprotaso Jan 20, 2023
f4bf85a

run only http01 tests


dprotaso Jan 20, 2023
6176fbf

don't delete the cluster issuer + debugging


dprotaso Jan 20, 2023
08a72af

ensure DNS record is *.{domain}


dprotaso Jan 21, 2023
8f7799c

allow challenges for hosts that don't match the route's host


dprotaso Jan 22, 2023
fafaf0d

fix domain mapping


dprotaso Jan 22, 2023

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 4 additions & 2 deletions
pkg/reconciler/domainmapping/resources/ingress.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,6 +19,7 @@ package resources
import (
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/util/intstr"
	"k8s.io/apimachinery/pkg/util/sets"

	netapi "knative.dev/networking/pkg/apis/networking"
	netv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
Expand All@@ -35,6 +36,7 @@ import (
// KIngress). The created ingress will contain a RewriteHost rule to cause the
// given hostName to be used as the host.
func MakeIngress(dm *servingv1alpha1.DomainMapping, backendServiceName, hostName, ingressClass string, httpOption netv1alpha1.HTTPOption, tls []netv1alpha1.IngressTLS, acmeChallenges ...netv1alpha1.HTTP01Challenge) *netv1alpha1.Ingress {
	paths, hosts := routeresources.MakeACMEIngressPaths(acmeChallenges, sets.NewString(dm.GetName()))
	return &netv1alpha1.Ingress{
 ObjectMeta: metav1.ObjectMeta{
 Name: kmeta.ChildName(dm.GetName(), ""),
Expand All@@ -52,11 +54,11 @@ func MakeIngress(dm *servingv1alpha1.DomainMapping, backendServiceName, hostName
 HTTPOption: httpOption,
 TLS: tls,
 Rules: []netv1alpha1.IngressRule{{
 Hosts: []string{dm.Name},
 Hosts: append(hosts, dm.Name),
 Visibility: netv1alpha1.IngressVisibilityExternalIP,
 HTTP: &netv1alpha1.HTTPIngressRuleValue{
 // The order of the paths is sensitive, always put tls challenge first
 Paths: append(routeresources.MakeACMEIngressPaths(acmeChallenges, dm.GetName()),
 Paths: append(paths,
 []netv1alpha1.HTTPIngressPath{{
 RewriteHost: hostName,
 Splits: []netv1alpha1.IngressBackendSplit{{
Expand Down

27 changes: 15 additions & 12 deletions
pkg/reconciler/route/resources/ingress.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -185,8 +185,9 @@ func makeIngressSpec(
 }
 // If this is a public rule, we need to configure ACME challenge paths.
 if visibility == netv1alpha1.IngressVisibilityExternalIP {
 rule.HTTP.Paths = append(
 MakeACMEIngressPaths(acmeChallenges, domains...), rule.HTTP.Paths...)
 paths, hosts := MakeACMEIngressPaths(acmeChallenges, domains)
 rule.Hosts = append(hosts, rule.Hosts...)
 rule.HTTP.Paths = append(paths, rule.HTTP.Paths...)
 }
 rules = append(rules, rule)
 }
Expand DownExpand Up@@ -214,7 +215,7 @@ func getChallengeHosts(challenges []netv1alpha1.HTTP01Challenge) map[string]netv
	return c
}

func routeDomain(ctx context.Context, targetName string, r *servingv1.Route, visibility netv1alpha1.IngressVisibility) ([]string, error) {
func routeDomain(ctx context.Context, targetName string, r *servingv1.Route, visibility netv1alpha1.IngressVisibility) (sets.String, error) {
	hostname, err := domains.HostnameFromTemplate(ctx, r.Name, targetName)
	if err != nil {
 return nil, err
Expand All@@ -232,18 +233,20 @@ func routeDomain(ctx context.Context, targetName string, r *servingv1.Route, vis
	if isClusterLocal {
 domains = ingress.ExpandedHosts(sets.NewString(domains...)).List()
	}
	return domains, err
	return sets.NewString(domains...), err
}

// MakeACMEIngressPaths returns a set of netv1alpha1.HTTPIngressPath
// that can be used to perform ACME challenges.
func MakeACMEIngressPaths(acmeChallenges []netv1alpha1.HTTP01Challenge, domains ...string) []netv1alpha1.HTTPIngressPath {
func MakeACMEIngressPaths(acmeChallenges []netv1alpha1.HTTP01Challenge, domains sets.String) ([]netv1alpha1.HTTPIngressPath, []string) {
	challenges := getChallengeHosts(acmeChallenges)

	paths := make([]netv1alpha1.HTTPIngressPath, 0, len(challenges))
	for _, domain := range domains {
 challenge, ok := challenges[domain]
 if !ok {
 continue
	var extraHosts []string

	for _, challenge := range challenges {
 if !domains.Has(challenge.URL.Host) {
 extraHosts = append(extraHosts, challenge.URL.Host)
 }

 paths = append(paths, netv1alpha1.HTTPIngressPath{
Expand All@@ -258,16 +261,16 @@ func MakeACMEIngressPaths(acmeChallenges []netv1alpha1.HTTP01Challenge, domains
 Path: challenge.URL.Path,
 })
	}
	return paths
	return paths, extraHosts
}

func makeIngressRule(domains []string, ns string,
func makeIngressRule(domains sets.String, ns string,
	visibility netv1alpha1.IngressVisibility,
	targets traffic.RevisionTargets,
	roCfgs []*traffic.ConfigurationRollout,
	encryption bool) netv1alpha1.IngressRule {
	return netv1alpha1.IngressRule{
 Hosts: domains,
 Hosts: domains.List(),
 Visibility: visibility,
 HTTP: &netv1alpha1.HTTPIngressRuleValue{
 Paths: []netv1alpha1.HTTPIngressPath{
Expand Down

7 changes: 4 additions & 3 deletions
pkg/reconciler/route/resources/ingress_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -26,6 +26,7 @@ import (
	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/util/intstr"
	"k8s.io/apimachinery/pkg/util/sets"

	"knative.dev/networking/pkg/apis/networking"
	netv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
Expand DownExpand Up@@ -853,7 +854,7 @@ func TestMakeIngressSpecCorrectRulesWithTagBasedRouting(t *testing.T) {

// One active target.
func TestMakeIngressRuleVanilla(t *testing.T) {
	domains := []string{"a.com", "b.org"}
	domains := sets.NewString("a.com", "b.org")
	targets := traffic.RevisionTargets{{
 TrafficTarget: v1.TrafficTarget{
 ConfigurationName: "config",
Expand DownExpand Up@@ -913,7 +914,7 @@ func TestMakeIngressRuleZeroPercentTarget(t *testing.T) {
 Percent: ptr.Int64(0),
 },
	}}
	domains := []string{"test.org"}
	domains := sets.NewString("test.org")
	tc := &traffic.Config{
 Targets: map[string]traffic.RevisionTargets{
 traffic.DefaultTarget: targets,
Expand DownExpand Up@@ -969,7 +970,7 @@ func TestMakeIngressRuleTwoTargets(t *testing.T) {
 },
	}
	ro := tc.BuildRollout()
	domains := []string{"test.org"}
	domains := sets.NewString("test.org")
	rule := makeIngressRule(domains, ns, netv1alpha1.IngressVisibilityExternalIP,
 targets, ro.RolloutsByTag("a-tag"), false /* internal encryption */)
	expected := netv1alpha1.IngressRule{
Expand Down

18 changes: 18 additions & 0 deletions
pkg/reconciler/route/table_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2758,6 +2758,15 @@ func TestReconcileEnableAutoTLS(t *testing.T) {
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }, {
 URL: &apis.URL{
 Scheme: "http",
 Host: "k.example.com",
 Path: "/.well-known/acme-challenge/challengeToken2",
 },
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }},
 },
 },
Expand DownExpand Up@@ -2788,6 +2797,15 @@ func TestReconcileEnableAutoTLS(t *testing.T) {
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }, {
 URL: &apis.URL{
 Scheme: "http",
 Host: "k.example.com",
 Path: "/.well-known/acme-challenge/challengeToken2",
 },
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }},
 ),
 simpleK8sService(
Expand Down

41 changes: 22 additions & 19 deletions
test/e2e-auto-tls-tests.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -72,12 +72,13 @@ function setup_auto_tls_common() {
}

function cleanup_auto_tls_common() {
 cleanup_custom_domain
 true
 # cleanup_custom_domain

 toggle_feature autoTLS Disabled config-network
 toggle_feature autocreateClusterDomainClaims false config-network
 toggle_feature namespace-wildcard-cert-selector "" config-network
 kubectl delete kcert --all -n "${TLS_TEST_NAMESPACE}"
# toggle_feature autoTLS Disabled config-network
# toggle_feature autocreateClusterDomainClaims false config-network
# toggle_feature namespace-wildcard-cert-selector "" config-network
# kubectl delete kcert --all -n "${TLS_TEST_NAMESPACE}"
}

function setup_http01_auto_tls() {
Expand All@@ -86,7 +87,7 @@ function setup_http01_auto_tls() {
 # Rely on the built-in naming (for logstream)
 unset TLS_SERVICE_NAME
 # The full host name of the Knative Service. This is used to configure the DNS record.
 export AUTO_TLS_TEST_FULL_HOST_NAME="*.${TLS_TEST_NAMESPACE}.${CUSTOM_DOMAIN_SUFFIX}"
 export AUTO_TLS_TEST_FULL_HOST_NAME="*.${CUSTOM_DOMAIN_SUFFIX}"

 kubectl delete kcert --all -n "${TLS_TEST_NAMESPACE}"

Expand DownExpand Up@@ -158,6 +159,9 @@ function delete_dns_record() {
 fi
}


export ENABLE_GKE_TELEMETRY=true

# Script entry point.
initialize "$@" --skip-istio-addon --min-nodes=4 --max-nodes=4 --enable-ha --cluster-version=1.24

Expand All@@ -175,33 +179,32 @@ if [[ -z "${INGRESS_CLASS}" \
 alpha="--enable-alpha"
fi

AUTO_TLS_TEST_OPTIONS="${AUTO_TLS_TEST_OPTIONS:-${alpha} --enable-beta}"
AUTO_TLS_TEST_OPTIONS="${AUTO_TLS_TEST_OPTIONS:-${alpha} --enable-beta -skip-cleanup-on-fail}"

# Auto TLS E2E tests mutate the cluster and must be ran separately
# because they need auto-tls and cert-manager specific configurations
subheader "Setup auto tls"
setup_auto_tls_common
add_trap "cleanup_auto_tls_common" EXIT SIGKILL SIGTERM SIGQUIT

subheader "Auto TLS test for per-ksvc certificate provision using self-signed CA"
setup_selfsigned_per_ksvc_auto_tls
go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
kubectl delete -f ${E2E_YAML_DIR}/test/config/autotls/certmanager/selfsigned/
# subheader "Auto TLS test for per-ksvc certificate provision using self-signed CA"
# setup_selfsigned_per_ksvc_auto_tls
# go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
# kubectl delete -f ${E2E_YAML_DIR}/test/config/autotls/certmanager/selfsigned/

subheader "Auto TLS test for per-namespace certificate provision using self-signed CA"
setup_selfsigned_per_namespace_auto_tls
add_trap "cleanup_per_selfsigned_namespace_auto_tls" SIGKILL SIGTERM SIGQUIT
go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
cleanup_per_selfsigned_namespace_auto_tls
# subheader "Auto TLS test for per-namespace certificate provision using self-signed CA"
# setup_selfsigned_per_namespace_auto_tls
# add_trap "cleanup_per_selfsigned_namespace_auto_tls" SIGKILL SIGTERM SIGQUIT
# go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
# cleanup_per_selfsigned_namespace_auto_tls

if [[ ${RUN_HTTP01_AUTO_TLS_TESTS} -eq 1 ]]; then
# if [[ ${RUN_HTTP01_AUTO_TLS_TESTS} -eq 1 ]]; then
 subheader "Auto TLS test for per-ksvc certificate provision using HTTP01 challenge"
 setup_http01_auto_tls
 add_trap "delete_dns_record" SIGKILL SIGTERM SIGQUIT
 go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
 kubectl delete -f ${E2E_YAML_DIR}/test/config/autotls/certmanager/http01/
 delete_dns_record
fi
# fi

(( failed )) && fail_test

Expand Down

2 changes: 2 additions & 0 deletions
test/e2e/autotls/auto_tls_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -94,6 +94,8 @@ func testAutoTLS(t *testing.T) {
	if len(env.TLSServiceName) != 0 {
 names.Service = env.TLSServiceName
	}
	names.Service = names.Service + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
	names.Service = names.Service[:60]
	test.EnsureTearDown(t, clients, &names)

	objects, err := v1test.CreateServiceReady(t, clients, &names)
Expand Down

24 changes: 12 additions & 12 deletions
third_party/cert-manager-latest/net-certmanager.yaml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,7 +19,7 @@ metadata:
 name: knative-serving-certmanager
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 serving.knative.dev/controller: "true"
 networking.knative.dev/certificate-provider: cert-manager
Expand DownExpand Up@@ -52,7 +52,7 @@ metadata:
 name: config.webhook.net-certmanager.networking.internal.knative.dev
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
webhooks:
Expand DownExpand Up@@ -93,7 +93,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager

Expand All@@ -119,7 +119,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
data:
Expand DownExpand Up@@ -168,7 +168,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
spec:
Expand All@@ -182,15 +182,15 @@ spec:
 labels:
 app: net-certmanager-controller
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 spec:
 serviceAccountName: controller
 containers:
 - name: controller
 # This is the Go import path for the binary that is containerized
 # and substituted here.
 image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:61651eca0cbf2ab83ccdb2d64f98bee041b2869008b9e86c41714311ecdadda5
 image: gcr.io/pivotal-knative/dave/controller-b5455ad1ba7b683d126966c08026cd15@sha256:5a786db6b17acc5c3e2037bda2442d85544522768deae3677d9732af4aef9572
 resources:
 requests:
 cpu: 30m
Expand DownExpand Up@@ -229,7 +229,7 @@ metadata:
 labels:
 app: net-certmanager-controller
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
 name: net-certmanager-controller
Expand DownExpand Up@@ -268,7 +268,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
spec:
Expand All@@ -283,7 +283,7 @@ spec:
 labels:
 app: net-certmanager-webhook
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 role: net-certmanager-webhook
 spec:
Expand All@@ -292,7 +292,7 @@ spec:
 - name: webhook
 # This is the Go import path for the binary that is containerized
 # and substituted here.
 image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:2f65e85b9cf2d8a10507c1fc02333ca00350864235d4bfab1dc28c7a8d2e61a2
 image: gcr.io/pivotal-knative/dave/webhook-29139c5ce1fe7007906a2b725aaa018b@sha256:dca6101881eec45ce0fc293efccec3dbe17c9a1e621073cd92bab9fdf366c84a
 resources:
 requests:
 cpu: 20m
Expand DownExpand Up@@ -356,7 +356,7 @@ metadata:
 labels:
 role: net-certmanager-webhook
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
spec:
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
[wip] test net-certmanager changes#13621

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

dprotaso
wants to merge
11
commits into

from

 Closed


[wip] test net-certmanager changes
#13621
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


11 commits


Select commit
Hold shift + click to select a range
2d87bf7

test net-certmanager changes


dprotaso Jan 19, 2023
956c996

use a long domain name


dprotaso Jan 20, 2023
9fe2163

make service name < 63


dprotaso Jan 20, 2023
b8fef20

skip cleanup on failure autotls


dprotaso Jan 20, 2023
4abdcfd

fix domain name length


dprotaso Jan 20, 2023
a5a888d

run HTTP01 tests


dprotaso Jan 20, 2023
f4bf85a

run only http01 tests


dprotaso Jan 20, 2023
6176fbf

don't delete the cluster issuer + debugging


dprotaso Jan 20, 2023
08a72af

ensure DNS record is *.{domain}


dprotaso Jan 21, 2023
8f7799c

allow challenges for hosts that don't match the route's host


dprotaso Jan 22, 2023
fafaf0d

fix domain mapping


dprotaso Jan 22, 2023

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 4 additions & 2 deletions
pkg/reconciler/domainmapping/resources/ingress.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,6 +19,7 @@ package resources
import (
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/util/intstr"
	"k8s.io/apimachinery/pkg/util/sets"

	netapi "knative.dev/networking/pkg/apis/networking"
	netv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
Expand All@@ -35,6 +36,7 @@ import (
// KIngress). The created ingress will contain a RewriteHost rule to cause the
// given hostName to be used as the host.
func MakeIngress(dm *servingv1alpha1.DomainMapping, backendServiceName, hostName, ingressClass string, httpOption netv1alpha1.HTTPOption, tls []netv1alpha1.IngressTLS, acmeChallenges ...netv1alpha1.HTTP01Challenge) *netv1alpha1.Ingress {
	paths, hosts := routeresources.MakeACMEIngressPaths(acmeChallenges, sets.NewString(dm.GetName()))
	return &netv1alpha1.Ingress{
 ObjectMeta: metav1.ObjectMeta{
 Name: kmeta.ChildName(dm.GetName(), ""),
Expand All@@ -52,11 +54,11 @@ func MakeIngress(dm *servingv1alpha1.DomainMapping, backendServiceName, hostName
 HTTPOption: httpOption,
 TLS: tls,
 Rules: []netv1alpha1.IngressRule{{
 Hosts: []string{dm.Name},
 Hosts: append(hosts, dm.Name),
 Visibility: netv1alpha1.IngressVisibilityExternalIP,
 HTTP: &netv1alpha1.HTTPIngressRuleValue{
 // The order of the paths is sensitive, always put tls challenge first
 Paths: append(routeresources.MakeACMEIngressPaths(acmeChallenges, dm.GetName()),
 Paths: append(paths,
 []netv1alpha1.HTTPIngressPath{{
 RewriteHost: hostName,
 Splits: []netv1alpha1.IngressBackendSplit{{
Expand Down

27 changes: 15 additions & 12 deletions
pkg/reconciler/route/resources/ingress.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -185,8 +185,9 @@ func makeIngressSpec(
 }
 // If this is a public rule, we need to configure ACME challenge paths.
 if visibility == netv1alpha1.IngressVisibilityExternalIP {
 rule.HTTP.Paths = append(
 MakeACMEIngressPaths(acmeChallenges, domains...), rule.HTTP.Paths...)
 paths, hosts := MakeACMEIngressPaths(acmeChallenges, domains)
 rule.Hosts = append(hosts, rule.Hosts...)
 rule.HTTP.Paths = append(paths, rule.HTTP.Paths...)
 }
 rules = append(rules, rule)
 }
Expand DownExpand Up@@ -214,7 +215,7 @@ func getChallengeHosts(challenges []netv1alpha1.HTTP01Challenge) map[string]netv
	return c
}

func routeDomain(ctx context.Context, targetName string, r *servingv1.Route, visibility netv1alpha1.IngressVisibility) ([]string, error) {
func routeDomain(ctx context.Context, targetName string, r *servingv1.Route, visibility netv1alpha1.IngressVisibility) (sets.String, error) {
	hostname, err := domains.HostnameFromTemplate(ctx, r.Name, targetName)
	if err != nil {
 return nil, err
Expand All@@ -232,18 +233,20 @@ func routeDomain(ctx context.Context, targetName string, r *servingv1.Route, vis
	if isClusterLocal {
 domains = ingress.ExpandedHosts(sets.NewString(domains...)).List()
	}
	return domains, err
	return sets.NewString(domains...), err
}

// MakeACMEIngressPaths returns a set of netv1alpha1.HTTPIngressPath
// that can be used to perform ACME challenges.
func MakeACMEIngressPaths(acmeChallenges []netv1alpha1.HTTP01Challenge, domains ...string) []netv1alpha1.HTTPIngressPath {
func MakeACMEIngressPaths(acmeChallenges []netv1alpha1.HTTP01Challenge, domains sets.String) ([]netv1alpha1.HTTPIngressPath, []string) {
	challenges := getChallengeHosts(acmeChallenges)

	paths := make([]netv1alpha1.HTTPIngressPath, 0, len(challenges))
	for _, domain := range domains {
 challenge, ok := challenges[domain]
 if !ok {
 continue
	var extraHosts []string

	for _, challenge := range challenges {
 if !domains.Has(challenge.URL.Host) {
 extraHosts = append(extraHosts, challenge.URL.Host)
 }

 paths = append(paths, netv1alpha1.HTTPIngressPath{
Expand All@@ -258,16 +261,16 @@ func MakeACMEIngressPaths(acmeChallenges []netv1alpha1.HTTP01Challenge, domains
 Path: challenge.URL.Path,
 })
	}
	return paths
	return paths, extraHosts
}

func makeIngressRule(domains []string, ns string,
func makeIngressRule(domains sets.String, ns string,
	visibility netv1alpha1.IngressVisibility,
	targets traffic.RevisionTargets,
	roCfgs []*traffic.ConfigurationRollout,
	encryption bool) netv1alpha1.IngressRule {
	return netv1alpha1.IngressRule{
 Hosts: domains,
 Hosts: domains.List(),
 Visibility: visibility,
 HTTP: &netv1alpha1.HTTPIngressRuleValue{
 Paths: []netv1alpha1.HTTPIngressPath{
Expand Down

7 changes: 4 additions & 3 deletions
pkg/reconciler/route/resources/ingress_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -26,6 +26,7 @@ import (
	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/util/intstr"
	"k8s.io/apimachinery/pkg/util/sets"

	"knative.dev/networking/pkg/apis/networking"
	netv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
Expand DownExpand Up@@ -853,7 +854,7 @@ func TestMakeIngressSpecCorrectRulesWithTagBasedRouting(t *testing.T) {

// One active target.
func TestMakeIngressRuleVanilla(t *testing.T) {
	domains := []string{"a.com", "b.org"}
	domains := sets.NewString("a.com", "b.org")
	targets := traffic.RevisionTargets{{
 TrafficTarget: v1.TrafficTarget{
 ConfigurationName: "config",
Expand DownExpand Up@@ -913,7 +914,7 @@ func TestMakeIngressRuleZeroPercentTarget(t *testing.T) {
 Percent: ptr.Int64(0),
 },
	}}
	domains := []string{"test.org"}
	domains := sets.NewString("test.org")
	tc := &traffic.Config{
 Targets: map[string]traffic.RevisionTargets{
 traffic.DefaultTarget: targets,
Expand DownExpand Up@@ -969,7 +970,7 @@ func TestMakeIngressRuleTwoTargets(t *testing.T) {
 },
	}
	ro := tc.BuildRollout()
	domains := []string{"test.org"}
	domains := sets.NewString("test.org")
	rule := makeIngressRule(domains, ns, netv1alpha1.IngressVisibilityExternalIP,
 targets, ro.RolloutsByTag("a-tag"), false /* internal encryption */)
	expected := netv1alpha1.IngressRule{
Expand Down

18 changes: 18 additions & 0 deletions
pkg/reconciler/route/table_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2758,6 +2758,15 @@ func TestReconcileEnableAutoTLS(t *testing.T) {
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }, {
 URL: &apis.URL{
 Scheme: "http",
 Host: "k.example.com",
 Path: "/.well-known/acme-challenge/challengeToken2",
 },
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }},
 },
 },
Expand DownExpand Up@@ -2788,6 +2797,15 @@ func TestReconcileEnableAutoTLS(t *testing.T) {
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }, {
 URL: &apis.URL{
 Scheme: "http",
 Host: "k.example.com",
 Path: "/.well-known/acme-challenge/challengeToken2",
 },
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }},
 ),
 simpleK8sService(
Expand Down

41 changes: 22 additions & 19 deletions
test/e2e-auto-tls-tests.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -72,12 +72,13 @@ function setup_auto_tls_common() {
}

function cleanup_auto_tls_common() {
 cleanup_custom_domain
 true
 # cleanup_custom_domain

 toggle_feature autoTLS Disabled config-network
 toggle_feature autocreateClusterDomainClaims false config-network
 toggle_feature namespace-wildcard-cert-selector "" config-network
 kubectl delete kcert --all -n "${TLS_TEST_NAMESPACE}"
# toggle_feature autoTLS Disabled config-network
# toggle_feature autocreateClusterDomainClaims false config-network
# toggle_feature namespace-wildcard-cert-selector "" config-network
# kubectl delete kcert --all -n "${TLS_TEST_NAMESPACE}"
}

function setup_http01_auto_tls() {
Expand All@@ -86,7 +87,7 @@ function setup_http01_auto_tls() {
 # Rely on the built-in naming (for logstream)
 unset TLS_SERVICE_NAME
 # The full host name of the Knative Service. This is used to configure the DNS record.
 export AUTO_TLS_TEST_FULL_HOST_NAME="*.${TLS_TEST_NAMESPACE}.${CUSTOM_DOMAIN_SUFFIX}"
 export AUTO_TLS_TEST_FULL_HOST_NAME="*.${CUSTOM_DOMAIN_SUFFIX}"

 kubectl delete kcert --all -n "${TLS_TEST_NAMESPACE}"

Expand DownExpand Up@@ -158,6 +159,9 @@ function delete_dns_record() {
 fi
}


export ENABLE_GKE_TELEMETRY=true

# Script entry point.
initialize "$@" --skip-istio-addon --min-nodes=4 --max-nodes=4 --enable-ha --cluster-version=1.24

Expand All@@ -175,33 +179,32 @@ if [[ -z "${INGRESS_CLASS}" \
 alpha="--enable-alpha"
fi

AUTO_TLS_TEST_OPTIONS="${AUTO_TLS_TEST_OPTIONS:-${alpha} --enable-beta}"
AUTO_TLS_TEST_OPTIONS="${AUTO_TLS_TEST_OPTIONS:-${alpha} --enable-beta -skip-cleanup-on-fail}"

# Auto TLS E2E tests mutate the cluster and must be ran separately
# because they need auto-tls and cert-manager specific configurations
subheader "Setup auto tls"
setup_auto_tls_common
add_trap "cleanup_auto_tls_common" EXIT SIGKILL SIGTERM SIGQUIT

subheader "Auto TLS test for per-ksvc certificate provision using self-signed CA"
setup_selfsigned_per_ksvc_auto_tls
go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
kubectl delete -f ${E2E_YAML_DIR}/test/config/autotls/certmanager/selfsigned/
# subheader "Auto TLS test for per-ksvc certificate provision using self-signed CA"
# setup_selfsigned_per_ksvc_auto_tls
# go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
# kubectl delete -f ${E2E_YAML_DIR}/test/config/autotls/certmanager/selfsigned/

subheader "Auto TLS test for per-namespace certificate provision using self-signed CA"
setup_selfsigned_per_namespace_auto_tls
add_trap "cleanup_per_selfsigned_namespace_auto_tls" SIGKILL SIGTERM SIGQUIT
go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
cleanup_per_selfsigned_namespace_auto_tls
# subheader "Auto TLS test for per-namespace certificate provision using self-signed CA"
# setup_selfsigned_per_namespace_auto_tls
# add_trap "cleanup_per_selfsigned_namespace_auto_tls" SIGKILL SIGTERM SIGQUIT
# go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
# cleanup_per_selfsigned_namespace_auto_tls

if [[ ${RUN_HTTP01_AUTO_TLS_TESTS} -eq 1 ]]; then
# if [[ ${RUN_HTTP01_AUTO_TLS_TESTS} -eq 1 ]]; then
 subheader "Auto TLS test for per-ksvc certificate provision using HTTP01 challenge"
 setup_http01_auto_tls
 add_trap "delete_dns_record" SIGKILL SIGTERM SIGQUIT
 go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
 kubectl delete -f ${E2E_YAML_DIR}/test/config/autotls/certmanager/http01/
 delete_dns_record
fi
# fi

(( failed )) && fail_test

Expand Down

2 changes: 2 additions & 0 deletions
test/e2e/autotls/auto_tls_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -94,6 +94,8 @@ func testAutoTLS(t *testing.T) {
	if len(env.TLSServiceName) != 0 {
 names.Service = env.TLSServiceName
	}
	names.Service = names.Service + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
	names.Service = names.Service[:60]
	test.EnsureTearDown(t, clients, &names)

	objects, err := v1test.CreateServiceReady(t, clients, &names)
Expand Down

24 changes: 12 additions & 12 deletions
third_party/cert-manager-latest/net-certmanager.yaml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,7 +19,7 @@ metadata:
 name: knative-serving-certmanager
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 serving.knative.dev/controller: "true"
 networking.knative.dev/certificate-provider: cert-manager
Expand DownExpand Up@@ -52,7 +52,7 @@ metadata:
 name: config.webhook.net-certmanager.networking.internal.knative.dev
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
webhooks:
Expand DownExpand Up@@ -93,7 +93,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager

Expand All@@ -119,7 +119,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
data:
Expand DownExpand Up@@ -168,7 +168,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
spec:
Expand All@@ -182,15 +182,15 @@ spec:
 labels:
 app: net-certmanager-controller
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 spec:
 serviceAccountName: controller
 containers:
 - name: controller
 # This is the Go import path for the binary that is containerized
 # and substituted here.
 image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:61651eca0cbf2ab83ccdb2d64f98bee041b2869008b9e86c41714311ecdadda5
 image: gcr.io/pivotal-knative/dave/controller-b5455ad1ba7b683d126966c08026cd15@sha256:5a786db6b17acc5c3e2037bda2442d85544522768deae3677d9732af4aef9572
 resources:
 requests:
 cpu: 30m
Expand DownExpand Up@@ -229,7 +229,7 @@ metadata:
 labels:
 app: net-certmanager-controller
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
 name: net-certmanager-controller
Expand DownExpand Up@@ -268,7 +268,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
spec:
Expand All@@ -283,7 +283,7 @@ spec:
 labels:
 app: net-certmanager-webhook
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 role: net-certmanager-webhook
 spec:
Expand All@@ -292,7 +292,7 @@ spec:
 - name: webhook
 # This is the Go import path for the binary that is containerized
 # and substituted here.
 image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:2f65e85b9cf2d8a10507c1fc02333ca00350864235d4bfab1dc28c7a8d2e61a2
 image: gcr.io/pivotal-knative/dave/webhook-29139c5ce1fe7007906a2b725aaa018b@sha256:dca6101881eec45ce0fc293efccec3dbe17c9a1e621073cd92bab9fdf366c84a
 resources:
 requests:
 cpu: 20m
Expand DownExpand Up@@ -356,7 +356,7 @@ metadata:
 labels:
 role: net-certmanager-webhook
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
spec:
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
[wip] test net-certmanager changes#13621

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

dprotaso
wants to merge
11
commits into

from

 Closed


[wip] test net-certmanager changes
#13621
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


11 commits


Select commit
Hold shift + click to select a range
2d87bf7

test net-certmanager changes


dprotaso Jan 19, 2023
956c996

use a long domain name


dprotaso Jan 20, 2023
9fe2163

make service name < 63


dprotaso Jan 20, 2023
b8fef20

skip cleanup on failure autotls


dprotaso Jan 20, 2023
4abdcfd

fix domain name length


dprotaso Jan 20, 2023
a5a888d

run HTTP01 tests


dprotaso Jan 20, 2023
f4bf85a

run only http01 tests


dprotaso Jan 20, 2023
6176fbf

don't delete the cluster issuer + debugging


dprotaso Jan 20, 2023
08a72af

ensure DNS record is *.{domain}


dprotaso Jan 21, 2023
8f7799c

allow challenges for hosts that don't match the route's host


dprotaso Jan 22, 2023
fafaf0d

fix domain mapping


dprotaso Jan 22, 2023

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 4 additions & 2 deletions
pkg/reconciler/domainmapping/resources/ingress.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,6 +19,7 @@ package resources
import (
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/util/intstr"
	"k8s.io/apimachinery/pkg/util/sets"

	netapi "knative.dev/networking/pkg/apis/networking"
	netv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
Expand All@@ -35,6 +36,7 @@ import (
// KIngress). The created ingress will contain a RewriteHost rule to cause the
// given hostName to be used as the host.
func MakeIngress(dm *servingv1alpha1.DomainMapping, backendServiceName, hostName, ingressClass string, httpOption netv1alpha1.HTTPOption, tls []netv1alpha1.IngressTLS, acmeChallenges ...netv1alpha1.HTTP01Challenge) *netv1alpha1.Ingress {
	paths, hosts := routeresources.MakeACMEIngressPaths(acmeChallenges, sets.NewString(dm.GetName()))
	return &netv1alpha1.Ingress{
 ObjectMeta: metav1.ObjectMeta{
 Name: kmeta.ChildName(dm.GetName(), ""),
Expand All@@ -52,11 +54,11 @@ func MakeIngress(dm *servingv1alpha1.DomainMapping, backendServiceName, hostName
 HTTPOption: httpOption,
 TLS: tls,
 Rules: []netv1alpha1.IngressRule{{
 Hosts: []string{dm.Name},
 Hosts: append(hosts, dm.Name),
 Visibility: netv1alpha1.IngressVisibilityExternalIP,
 HTTP: &netv1alpha1.HTTPIngressRuleValue{
 // The order of the paths is sensitive, always put tls challenge first
 Paths: append(routeresources.MakeACMEIngressPaths(acmeChallenges, dm.GetName()),
 Paths: append(paths,
 []netv1alpha1.HTTPIngressPath{{
 RewriteHost: hostName,
 Splits: []netv1alpha1.IngressBackendSplit{{
Expand Down

27 changes: 15 additions & 12 deletions
pkg/reconciler/route/resources/ingress.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -185,8 +185,9 @@ func makeIngressSpec(
 }
 // If this is a public rule, we need to configure ACME challenge paths.
 if visibility == netv1alpha1.IngressVisibilityExternalIP {
 rule.HTTP.Paths = append(
 MakeACMEIngressPaths(acmeChallenges, domains...), rule.HTTP.Paths...)
 paths, hosts := MakeACMEIngressPaths(acmeChallenges, domains)
 rule.Hosts = append(hosts, rule.Hosts...)
 rule.HTTP.Paths = append(paths, rule.HTTP.Paths...)
 }
 rules = append(rules, rule)
 }
Expand DownExpand Up@@ -214,7 +215,7 @@ func getChallengeHosts(challenges []netv1alpha1.HTTP01Challenge) map[string]netv
	return c
}

func routeDomain(ctx context.Context, targetName string, r *servingv1.Route, visibility netv1alpha1.IngressVisibility) ([]string, error) {
func routeDomain(ctx context.Context, targetName string, r *servingv1.Route, visibility netv1alpha1.IngressVisibility) (sets.String, error) {
	hostname, err := domains.HostnameFromTemplate(ctx, r.Name, targetName)
	if err != nil {
 return nil, err
Expand All@@ -232,18 +233,20 @@ func routeDomain(ctx context.Context, targetName string, r *servingv1.Route, vis
	if isClusterLocal {
 domains = ingress.ExpandedHosts(sets.NewString(domains...)).List()
	}
	return domains, err
	return sets.NewString(domains...), err
}

// MakeACMEIngressPaths returns a set of netv1alpha1.HTTPIngressPath
// that can be used to perform ACME challenges.
func MakeACMEIngressPaths(acmeChallenges []netv1alpha1.HTTP01Challenge, domains ...string) []netv1alpha1.HTTPIngressPath {
func MakeACMEIngressPaths(acmeChallenges []netv1alpha1.HTTP01Challenge, domains sets.String) ([]netv1alpha1.HTTPIngressPath, []string) {
	challenges := getChallengeHosts(acmeChallenges)

	paths := make([]netv1alpha1.HTTPIngressPath, 0, len(challenges))
	for _, domain := range domains {
 challenge, ok := challenges[domain]
 if !ok {
 continue
	var extraHosts []string

	for _, challenge := range challenges {
 if !domains.Has(challenge.URL.Host) {
 extraHosts = append(extraHosts, challenge.URL.Host)
 }

 paths = append(paths, netv1alpha1.HTTPIngressPath{
Expand All@@ -258,16 +261,16 @@ func MakeACMEIngressPaths(acmeChallenges []netv1alpha1.HTTP01Challenge, domains
 Path: challenge.URL.Path,
 })
	}
	return paths
	return paths, extraHosts
}

func makeIngressRule(domains []string, ns string,
func makeIngressRule(domains sets.String, ns string,
	visibility netv1alpha1.IngressVisibility,
	targets traffic.RevisionTargets,
	roCfgs []*traffic.ConfigurationRollout,
	encryption bool) netv1alpha1.IngressRule {
	return netv1alpha1.IngressRule{
 Hosts: domains,
 Hosts: domains.List(),
 Visibility: visibility,
 HTTP: &netv1alpha1.HTTPIngressRuleValue{
 Paths: []netv1alpha1.HTTPIngressPath{
Expand Down

7 changes: 4 additions & 3 deletions
pkg/reconciler/route/resources/ingress_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -26,6 +26,7 @@ import (
	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/util/intstr"
	"k8s.io/apimachinery/pkg/util/sets"

	"knative.dev/networking/pkg/apis/networking"
	netv1alpha1 "knative.dev/networking/pkg/apis/networking/v1alpha1"
Expand DownExpand Up@@ -853,7 +854,7 @@ func TestMakeIngressSpecCorrectRulesWithTagBasedRouting(t *testing.T) {

// One active target.
func TestMakeIngressRuleVanilla(t *testing.T) {
	domains := []string{"a.com", "b.org"}
	domains := sets.NewString("a.com", "b.org")
	targets := traffic.RevisionTargets{{
 TrafficTarget: v1.TrafficTarget{
 ConfigurationName: "config",
Expand DownExpand Up@@ -913,7 +914,7 @@ func TestMakeIngressRuleZeroPercentTarget(t *testing.T) {
 Percent: ptr.Int64(0),
 },
	}}
	domains := []string{"test.org"}
	domains := sets.NewString("test.org")
	tc := &traffic.Config{
 Targets: map[string]traffic.RevisionTargets{
 traffic.DefaultTarget: targets,
Expand DownExpand Up@@ -969,7 +970,7 @@ func TestMakeIngressRuleTwoTargets(t *testing.T) {
 },
	}
	ro := tc.BuildRollout()
	domains := []string{"test.org"}
	domains := sets.NewString("test.org")
	rule := makeIngressRule(domains, ns, netv1alpha1.IngressVisibilityExternalIP,
 targets, ro.RolloutsByTag("a-tag"), false /* internal encryption */)
	expected := netv1alpha1.IngressRule{
Expand Down

18 changes: 18 additions & 0 deletions
pkg/reconciler/route/table_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2758,6 +2758,15 @@ func TestReconcileEnableAutoTLS(t *testing.T) {
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }, {
 URL: &apis.URL{
 Scheme: "http",
 Host: "k.example.com",
 Path: "/.well-known/acme-challenge/challengeToken2",
 },
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }},
 },
 },
Expand DownExpand Up@@ -2788,6 +2797,15 @@ func TestReconcileEnableAutoTLS(t *testing.T) {
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }, {
 URL: &apis.URL{
 Scheme: "http",
 Host: "k.example.com",
 Path: "/.well-known/acme-challenge/challengeToken2",
 },
 ServiceName: "cm-solver",
 ServicePort: intstr.FromInt(8090),
 ServiceNamespace: "default",
 }},
 ),
 simpleK8sService(
Expand Down

41 changes: 22 additions & 19 deletions
test/e2e-auto-tls-tests.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -72,12 +72,13 @@ function setup_auto_tls_common() {
}

function cleanup_auto_tls_common() {
 cleanup_custom_domain
 true
 # cleanup_custom_domain

 toggle_feature autoTLS Disabled config-network
 toggle_feature autocreateClusterDomainClaims false config-network
 toggle_feature namespace-wildcard-cert-selector "" config-network
 kubectl delete kcert --all -n "${TLS_TEST_NAMESPACE}"
# toggle_feature autoTLS Disabled config-network
# toggle_feature autocreateClusterDomainClaims false config-network
# toggle_feature namespace-wildcard-cert-selector "" config-network
# kubectl delete kcert --all -n "${TLS_TEST_NAMESPACE}"
}

function setup_http01_auto_tls() {
Expand All@@ -86,7 +87,7 @@ function setup_http01_auto_tls() {
 # Rely on the built-in naming (for logstream)
 unset TLS_SERVICE_NAME
 # The full host name of the Knative Service. This is used to configure the DNS record.
 export AUTO_TLS_TEST_FULL_HOST_NAME="*.${TLS_TEST_NAMESPACE}.${CUSTOM_DOMAIN_SUFFIX}"
 export AUTO_TLS_TEST_FULL_HOST_NAME="*.${CUSTOM_DOMAIN_SUFFIX}"

 kubectl delete kcert --all -n "${TLS_TEST_NAMESPACE}"

Expand DownExpand Up@@ -158,6 +159,9 @@ function delete_dns_record() {
 fi
}


export ENABLE_GKE_TELEMETRY=true

# Script entry point.
initialize "$@" --skip-istio-addon --min-nodes=4 --max-nodes=4 --enable-ha --cluster-version=1.24

Expand All@@ -175,33 +179,32 @@ if [[ -z "${INGRESS_CLASS}" \
 alpha="--enable-alpha"
fi

AUTO_TLS_TEST_OPTIONS="${AUTO_TLS_TEST_OPTIONS:-${alpha} --enable-beta}"
AUTO_TLS_TEST_OPTIONS="${AUTO_TLS_TEST_OPTIONS:-${alpha} --enable-beta -skip-cleanup-on-fail}"

# Auto TLS E2E tests mutate the cluster and must be ran separately
# because they need auto-tls and cert-manager specific configurations
subheader "Setup auto tls"
setup_auto_tls_common
add_trap "cleanup_auto_tls_common" EXIT SIGKILL SIGTERM SIGQUIT

subheader "Auto TLS test for per-ksvc certificate provision using self-signed CA"
setup_selfsigned_per_ksvc_auto_tls
go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
kubectl delete -f ${E2E_YAML_DIR}/test/config/autotls/certmanager/selfsigned/
# subheader "Auto TLS test for per-ksvc certificate provision using self-signed CA"
# setup_selfsigned_per_ksvc_auto_tls
# go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
# kubectl delete -f ${E2E_YAML_DIR}/test/config/autotls/certmanager/selfsigned/

subheader "Auto TLS test for per-namespace certificate provision using self-signed CA"
setup_selfsigned_per_namespace_auto_tls
add_trap "cleanup_per_selfsigned_namespace_auto_tls" SIGKILL SIGTERM SIGQUIT
go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
cleanup_per_selfsigned_namespace_auto_tls
# subheader "Auto TLS test for per-namespace certificate provision using self-signed CA"
# setup_selfsigned_per_namespace_auto_tls
# add_trap "cleanup_per_selfsigned_namespace_auto_tls" SIGKILL SIGTERM SIGQUIT
# go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
# cleanup_per_selfsigned_namespace_auto_tls

if [[ ${RUN_HTTP01_AUTO_TLS_TESTS} -eq 1 ]]; then
# if [[ ${RUN_HTTP01_AUTO_TLS_TESTS} -eq 1 ]]; then
 subheader "Auto TLS test for per-ksvc certificate provision using HTTP01 challenge"
 setup_http01_auto_tls
 add_trap "delete_dns_record" SIGKILL SIGTERM SIGQUIT
 go_test_e2e -timeout=10m ./test/e2e/autotls/ ${AUTO_TLS_TEST_OPTIONS} || failed=1
 kubectl delete -f ${E2E_YAML_DIR}/test/config/autotls/certmanager/http01/
 delete_dns_record
fi
# fi

(( failed )) && fail_test

Expand Down

2 changes: 2 additions & 0 deletions
test/e2e/autotls/auto_tls_test.go

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -94,6 +94,8 @@ func testAutoTLS(t *testing.T) {
	if len(env.TLSServiceName) != 0 {
 names.Service = env.TLSServiceName
	}
	names.Service = names.Service + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
	names.Service = names.Service[:60]
	test.EnsureTearDown(t, clients, &names)

	objects, err := v1test.CreateServiceReady(t, clients, &names)
Expand Down

24 changes: 12 additions & 12 deletions
third_party/cert-manager-latest/net-certmanager.yaml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,7 +19,7 @@ metadata:
 name: knative-serving-certmanager
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 serving.knative.dev/controller: "true"
 networking.knative.dev/certificate-provider: cert-manager
Expand DownExpand Up@@ -52,7 +52,7 @@ metadata:
 name: config.webhook.net-certmanager.networking.internal.knative.dev
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
webhooks:
Expand DownExpand Up@@ -93,7 +93,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager

Expand All@@ -119,7 +119,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
data:
Expand DownExpand Up@@ -168,7 +168,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
spec:
Expand All@@ -182,15 +182,15 @@ spec:
 labels:
 app: net-certmanager-controller
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 spec:
 serviceAccountName: controller
 containers:
 - name: controller
 # This is the Go import path for the binary that is containerized
 # and substituted here.
 image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:61651eca0cbf2ab83ccdb2d64f98bee041b2869008b9e86c41714311ecdadda5
 image: gcr.io/pivotal-knative/dave/controller-b5455ad1ba7b683d126966c08026cd15@sha256:5a786db6b17acc5c3e2037bda2442d85544522768deae3677d9732af4aef9572
 resources:
 requests:
 cpu: 30m
Expand DownExpand Up@@ -229,7 +229,7 @@ metadata:
 labels:
 app: net-certmanager-controller
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
 name: net-certmanager-controller
Expand DownExpand Up@@ -268,7 +268,7 @@ metadata:
 namespace: knative-serving
 labels:
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
spec:
Expand All@@ -283,7 +283,7 @@ spec:
 labels:
 app: net-certmanager-webhook
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 role: net-certmanager-webhook
 spec:
Expand All@@ -292,7 +292,7 @@ spec:
 - name: webhook
 # This is the Go import path for the binary that is containerized
 # and substituted here.
 image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:2f65e85b9cf2d8a10507c1fc02333ca00350864235d4bfab1dc28c7a8d2e61a2
 image: gcr.io/pivotal-knative/dave/webhook-29139c5ce1fe7007906a2b725aaa018b@sha256:dca6101881eec45ce0fc293efccec3dbe17c9a1e621073cd92bab9fdf366c84a
 resources:
 requests:
 cpu: 20m
Expand DownExpand Up@@ -356,7 +356,7 @@ metadata:
 labels:
 role: net-certmanager-webhook
 app.kubernetes.io/component: net-certmanager
 app.kubernetes.io/version: "20230123-cce02568"
 app.kubernetes.io/version: devel
 app.kubernetes.io/name: knative-serving
 networking.knative.dev/certificate-provider: cert-manager
spec:
Expand Down