@@ -7,13 +7,15 @@ import (
77 extensionsv1alpha1 "github.com/gardener/gardener/pkg/apis/extensions/v1alpha1"
88 "github.com/gardener/gardener/pkg/apis/resources/v1alpha1"
99 . "github.com/gardener/gardener/pkg/utils/test/matchers"
10+ "github.com/go-logr/logr"
1011 . "github.com/onsi/ginkgo/v2"
1112 . "github.com/onsi/gomega"
1213 istionetworkingv1beta1 "istio.io/client-go/pkg/apis/networking/v1beta1"
1314 corev1 "k8s.io/api/core/v1"
1415 apierrors "k8s.io/apimachinery/pkg/api/errors"
1516 metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1617 "k8s.io/apimachinery/pkg/types"
18+ "k8s.io/utils/ptr"
1719
1820 "github.com/stackitcloud/gardener-extension-acl/pkg/controller/config"
1921 "github.com/stackitcloud/gardener-extension-acl/pkg/envoyfilters"
@@ -26,11 +28,13 @@ var _ = Describe("actuator test", func() {
2628 shootNamespace1 , shootNamespace2 string
2729 istioNamespace1 , istioNamespace2 string
2830 istioNamespace1Selector , istioNamespace2Selector map [string ]string
31+ istioIngressGatewayServiceName string
2932 )
3033
3134 BeforeEach (func () {
3235 shootNamespace1 = createNewShootNamespace ()
3336 istioNamespace1 = createNewIstioNamespace ()
37+ istioIngressGatewayServiceName = "istio-ingressgateway"
3438 istioNamespace1Selector = map [string ]string {
3539 "app" : "istio-ingressgateway" ,
3640 "istio" : istioNamespace1 ,
@@ -41,6 +45,24 @@ var _ = Describe("actuator test", func() {
4145 createNewIstioDeployment (istioNamespace1 , istioNamespace1Selector )
4246 createNewCluster (shootNamespace1 )
4347 createNewInfrastructure (shootNamespace1 )
48+ createNewService (
49+ istioIngressGatewayServiceName ,
50+ istioNamespace1 ,
51+ istioNamespace1Selector ,
52+ corev1 .ServiceTypeLoadBalancer ,
53+ )
54+ updateServiceStatus (
55+ istioIngressGatewayServiceName ,
56+ istioNamespace1 ,
57+ corev1.ServiceStatus {
58+ LoadBalancer : corev1.LoadBalancerStatus {
59+ Ingress : []corev1.LoadBalancerIngress {{
60+ IP : "1.1.1.1" ,
61+ IPMode : ptr .To (corev1 .LoadBalancerIPModeProxy ),
62+ }},
63+ },
64+ },
65+ )
4466
4567 a = getNewActuator ()
4668 })
@@ -222,6 +244,87 @@ var _ = Describe("actuator test", func() {
222244 })
223245 })
224246
247+ Describe ("reconciliation of an extension object running on a managedSeed" , func () {
248+ AfterEach (func () {
249+ deleteShootInfo ()
250+ })
251+
252+ It ("should not get the egressIPs if the LoadBalancer IPMode is not set to Proxy" , func () {
253+ updateServiceStatus (
254+ istioIngressGatewayServiceName ,
255+ istioNamespace1 ,
256+ corev1.ServiceStatus {},
257+ )
258+ Expect (a .usesProxyTypeLBService (ctx , logr.Logger {}, istioNamespace1Selector )).To (BeFalse ())
259+
260+ updateServiceStatus (
261+ istioIngressGatewayServiceName ,
262+ istioNamespace1 ,
263+ corev1.ServiceStatus {
264+ LoadBalancer : corev1.LoadBalancerStatus {
265+ Ingress : []corev1.LoadBalancerIngress {{
266+ IP : "1.1.1.1" ,
267+ IPMode : ptr .To (corev1 .LoadBalancerIPModeVIP ),
268+ }},
269+ },
270+ },
271+ )
272+ Expect (a .usesProxyTypeLBService (ctx , logr.Logger {}, istioNamespace1Selector )).To (BeFalse ())
273+ })
274+
275+ It ("should get the egressIPs if the LoadBalancer IPMode is set to Proxy" , func () {
276+ Expect (a .usesProxyTypeLBService (ctx , logr.Logger {}, istioNamespace1Selector )).To (BeTrue ())
277+ })
278+
279+ It ("should return an empty slice of egressIPs if no shoot-info ConfigMap exists" , func () {
280+ cidrs , err := a .getSeedEgressIPOnManagedSeeds (ctx )
281+ Expect (err ).ToNot (HaveOccurred ())
282+ Expect (cidrs ).To (BeEmpty ())
283+ })
284+
285+ It ("should fail to return egressIPs if the shoot-info ConfigMap contains invalid CIDRs" , func () {
286+ createShootInfo ([]string {"1.1.1.1" , "1.1.1.2/32" })
287+
288+ _ , err := a .getSeedEgressIPOnManagedSeeds (ctx )
289+ Expect (err ).To (HaveOccurred ())
290+ })
291+
292+ It ("should return the egressIP CIDRs of the shoot-info ConfigMap" , func () {
293+ c := []string {"1.1.1.1/32" , "1.1.1.2/32" }
294+ createShootInfo (c )
295+
296+ cidrs , err := a .getSeedEgressIPOnManagedSeeds (ctx )
297+ Expect (err ).ToNot (HaveOccurred ())
298+ Expect (cidrs ).To (BeEquivalentTo (c ))
299+ })
300+
301+ It ("should create ACLs including egressIPs of managedSeed" , func () {
302+ createShootInfo ([]string {"1.1.1.1/32" , "1.1.1.2/32" })
303+
304+ extSpec := extensionspec.ExtensionSpec {
305+ Rule : & envoyfilters.ACLRule {
306+ Cidrs : []string {"1.2.3.4/24" },
307+ Action : "ALLOW" ,
308+ Type : "remote_ip" ,
309+ },
310+ }
311+ extSpecJSON , err := json .Marshal (extSpec )
312+ Expect (err ).NotTo (HaveOccurred ())
313+ ext := createNewExtension (shootNamespace1 , extSpecJSON )
314+ Expect (ext ).To (Not (BeNil ()))
315+
316+ Expect (a .Reconcile (ctx , logger , ext )).To (Succeed ())
317+
318+ mr := & v1alpha1.ManagedResource {}
319+ Expect (k8sClient .Get (ctx , types.NamespacedName {Name : ResourceNameSeed , Namespace : shootNamespace1 }, mr )).To (Succeed ())
320+ secret := & corev1.Secret {}
321+ Expect (k8sClient .Get (ctx , types.NamespacedName {Name : mr .Spec .SecretRefs [0 ].Name , Namespace : shootNamespace1 }, secret )).To (Succeed ())
322+ Expect (secret .Data ["seed" ]).To (ContainSubstring ("1.2.3.4" ))
323+ Expect (secret .Data ["seed" ]).To (ContainSubstring ("1.1.1.1" ))
324+ Expect (secret .Data ["seed" ]).To (ContainSubstring ("1.1.1.2" ))
325+ })
326+ })
327+
225328 Describe ("a shoot switching the istio namespace (e.g. when being migrated to HA)" , func () {
226329 It ("should modify the EnvoyFilter objects accordingly" , func () {
227330 By ("1) creating the EnvoyFilter object correctly in the ORIGINAL namespace" )
@@ -453,6 +556,7 @@ var _ = Describe("actuator unit test", func() {
453556func getNewActuator () * actuator {
454557 return & actuator {
455558 client : k8sClient ,
559+ reader : k8sClient ,
456560 config : cfg ,
457561 extensionConfig : config.Config {
458562 ChartPath : "../../charts" ,
0 commit comments