e2e

Documentation

Overview

Package e2e wires the gateway end-to-end harness: a kind cluster, Crossplane core plus the GCP/Kubernetes providers, and the gateway chart provisioning a real GCP gateway. It runs only under GATEWAY_E2E and is not part of `go test ./...`.

Index

• Constants
• type Env
  • func RequireEnv() (Env, error)
• type FirewallAllowed
• type FirewallRule
• type Stack
• type StartOption
  • func WithLinkReplicas(n int32) StartOption
  • func WithWireguardListenPort(port int) StartOption
• type Suite
  • func Setup(ctx context.Context) (*Suite, error)
  • func (s *Suite) Client() *hk8s.Client
  • func (s *Suite) Env() Env
  • func (s *Suite) GatewayFirewallTargets(ctx context.Context, namePrefix string) ([]FirewallRule, error)
  • func (s *Suite) GatewayServiceAccountEmail(ctx context.Context, namespace, name string) (string, error)
  • func (s *Suite) SharedNetworkCount(ctx context.Context) (int, error)
  • func (s *Suite) Start(ctx context.Context, t *testing.T, opts ...StartOption) (*Stack, error)
  • func (s *Suite) StartE(ctx context.Context, t *testing.T, opts ...StartOption) (*Stack, error)
  • func (s *Suite) Teardown(ctx context.Context, code int)

Constants

const (

	// EnvUseExisting, when set, makes the suite deploy into the cluster named
	// by $KUBECONFIG / the current context instead of creating a kind cluster.
	EnvUseExisting = "GATEWAY_E2E_USE_EXISTING"

	// EnvKeep, when set, makes the suite skip all teardown so the cluster and the
	// GCP gateway VM survive for live debugging. See Env.Keep.
	EnvKeep = "GATEWAY_E2E_KEEP"
)

Environment variable names the suite reads.

const SharedNetworkName = "wgnet-" + operatorRelease

SharedNetworkName mirrors the chart's release-derived VPC name (wgnet-<release>) for the e2e operator install.

Types

type Env

type Env struct {
	// ProjectID is the GCP project that owns the gateway VM, its network, and its
	// Secret Manager secret.
	ProjectID string
	Region    string
	Zone      string
	// CredsFile is the path to the provider-gcp service-account JSON key, loaded
	// into the cluster as the crossplane creds Secret.
	CredsFile string
	// CredsNamespace is the creds Secret's namespace. Defaults to crossplane-system.
	CredsNamespace string
	// CredsSecret is the creds Secret name crossplane-config consumes. Defaults to
	// gcp-creds.
	CredsSecret string
	// Keep skips all teardown so the cluster and GCP VM survive for debugging. Unlike
	// GATEWAY_E2E_PRESERVE it does not gate on failure, so it leaks the VM until drained
	// by hand; never use in CI.
	Keep bool
}

Env holds the GCP configuration the suite reads from the process environment. `make test-e2e` (and the operator) source these from .env.

func RequireEnv

func RequireEnv() (Env, error)

RequireEnv reads the GCP configuration, returning an error naming any missing or invalid variables. It returns the error rather than t.Fatal because it runs inside a sync.Once, where runtime.Goexit would abandon the once without a result.

type FirewallAllowed

type FirewallAllowed struct {
	// Protocol is the IP protocol, e.g. "tcp" or "udp".
	Protocol string `json:"IPProtocol"`
	// Ports are the ports admitted for Protocol. An entry with no ports admits the
	// whole protocol; the gateway's rules always enumerate ports.
	Ports []string `json:"ports"`
}

FirewallAllowed is one protocol+ports entry in a firewall rule's allow list.

type FirewallRule

type FirewallRule struct {
	// Name starts with the gateway's NamePrefix, the basis the orphan check filters
	// on.
	Name    string            `json:"name"`
	Allowed []FirewallAllowed `json:"allowed"`
	// TargetServiceAccounts scopes the rule to a gateway's own VM, so two gateways
	// in one shared VPC do not admit each other's ports. An empty list applies the
	// rule VPC-wide.
	TargetServiceAccounts []string `json:"targetServiceAccounts"`
}

FirewallRule is the slice of a GCP firewall rule the isolation assertion reads, decoded from `gcloud compute firewall-rules list --format=json` (GCP's REST resource shape, hence the json tags).

type Stack

type Stack struct {
	Namespace string
	// NamePrefix is the run-unique prefix on every operator-owned object and GCP
	// resource the orphan check filters on. It is also the Gateway CR name.
	NamePrefix string
	// GatewayName is the Gateway CR name; the operator names the XGatewayGCP
	// composite after it.
	GatewayName string
	// Address is the gateway's observed public IP, the host-side probe target.
	Address       string
	TCPPublicPort int
	UDPPublicPort int
	// NodePortPublicPort forwards to the NodePort-backed echo Service.
	NodePortPublicPort int
	// CrossNSPublicPort forwards to the echo Service in the consent-labelled
	// second namespace.
	CrossNSPublicPort int
	// EditedPublicPort is the port the forward-edit subtest adds live.
	EditedPublicPort int
	// The lifecycle subtests attach a runtime forward to these dedicated ports and
	// remove it again, each disjoint from the create-time forwards and negativePort.
	ServiceCreatedPort     int
	ServiceDeletedPort     int
	ConsentTogglePort      int
	TargetPortScenarioPort int
	BackendRolloutPort     int
	ForwardRetargetPort    int
	// NegativePort is a non-forwarded port the negative probes target, dropped at
	// the GCP firewall. Start asserts it is disjoint from the forwarded and WG ports.
	NegativePort int
	// WireguardListenPort is this stack's WireGuard UDP listen port, opened in the
	// gateway's firewall rule; WithWireguardListenPort gives coexisting gateways
	// distinct ports.
	WireguardListenPort int
	// LinkReplicas is the link Deployment's effective replica count (override, or 1).
	// Teardown reads it to decide whether the link PDB should exist, applied only at
	// replicas>1.
	LinkReplicas int32

	// TCPBackendName, NodePortBackendName, and CrossNSBackendName are the echo
	// Deployment names behind the create-time forwards. agnhost /hostname returns the
	// serving pod's name, prefixed by its Deployment's, so a probe matches by prefix.
	TCPBackendName      string
	NodePortBackendName string
	CrossNSBackendName  string
	// TCPBackendPort is the published port of the TCP echo Service. The targetPort
	// subtest forwards to it, first with a wrong targetPort then this one.
	TCPBackendPort int
	// contains filtered or unexported fields
}

Stack holds the per-test resources and the observed gateway facts the data-path assertions read.

type StartOption

type StartOption func(*startConfig)

StartOption configures a per-stack override applied before provisioning.

func WithLinkReplicas

func WithLinkReplicas(n int32) StartOption

WithLinkReplicas brings the gateway up with n link replicas behind leader election, so the HA test gets a hot standby. n must be >=1 (the CRD's minimum).

func WithWireguardListenPort

func WithWireguardListenPort(port int) StartOption

WithWireguardListenPort overrides the stack's WireGuard UDP listen port, so coexisting gateways can run distinct WG ports. It is folded into the negative-port disjointness precondition.

type Suite

type Suite struct {
	// contains filtered or unexported fields
}

Suite holds state created once per `go test` invocation: the kind cluster, the helm driver, the API client, the built operator and link images, and the GCP env. Tests call Start to get a per-test Stack.

func Setup

func Setup(ctx context.Context) (*Suite, error)

Setup provisions the cluster, builds and loads the images, and installs the Crossplane stack, creds Secret, and operator chart. It returns a non-nil *Suite once the cluster handle exists so Teardown can run; only a pre-cluster failure is nil.

func (*Suite) Client

func (s *Suite) Client() *hk8s.Client

Client returns the suite's Kubernetes client, so a test can apply and inspect Gateways directly without going through Start (which would provision a GCP VM).

func (*Suite) Env

func (s *Suite) Env() Env

Env returns the suite's GCP configuration, for tests building a Gateway CR outside Start.

func (*Suite) GatewayFirewallTargets

func (s *Suite) GatewayFirewallTargets(ctx context.Context, namePrefix string) ([]FirewallRule, error)

GatewayFirewallTargets returns the firewall rules whose names start with namePrefix, with their allow list and service-account scoping, so a caller can assert per-gateway firewall isolation in the shared VPC.

func (*Suite) GatewayServiceAccountEmail

func (s *Suite) GatewayServiceAccountEmail(ctx context.Context, namespace, name string) (string, error)

GatewayServiceAccountEmail returns the SA email the operator scopes the named Gateway's firewall rule to. An empty result with a nil error means the composite has not yet observed the SA, distinct from a missing composite, which errors.

func (*Suite) SharedNetworkCount

func (s *Suite) SharedNetworkCount(ctx context.Context) (int, error)

SharedNetworkCount returns 1 if the VPC named SharedNetworkName exists, else 0. It uses the strongly-consistent `networks describe`, not the eventually-consistent list API that can enumerate a just-deleted network and false-fail a post-teardown drain.

func (*Suite) Start

func (s *Suite) Start(ctx context.Context, t *testing.T, opts ...StartOption) (*Stack, error)

Start wraps StartE for the common single-gateway shard, failing the test on error. Tests bringing up several stacks concurrently call StartE directly to collect the error off the test goroutine, where t.Fatal is illegal.

func (*Suite) StartE

func (s *Suite) StartE(ctx context.Context, t *testing.T, opts ...StartOption) (*Stack, error)

StartE brings up a full per-test stack (namespace, echo fixtures, a Gateway CR provisioning a real GCP gateway) and registers teardown via t.Cleanup. It returns every failure as an error rather than t.Fatal, so it is errgroup-safe.

func (*Suite) Teardown

func (s *Suite) Teardown(ctx context.Context, code int)

Teardown deletes the kind cluster the suite provisioned. Invoked from TestMain after m.Run so it never races a Stack still draining GCP; code gates the preserve-on-failure path. No-op on an existing cluster or a nil handle.