Skip to content

Commit aa021b6

Browse files
phuhung273phuhung273
committed
mqtt, use different cert hostname
1 parent 791c8a8 commit aa021b6

File tree

6 files changed

+121
-19
lines changed

6 files changed

+121
-19
lines changed

‎conformance/tests/tlsroute-terminate-simple-same-namespace.go‎

Lines changed: 35 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -17,15 +17,19 @@ limitations under the License.
1717
package tests
1818

1919
import (
20+
"crypto/tls"
21+
"crypto/x509"
22+
"fmt"
2023
"testing"
2124

2225
"k8s.io/apimachinery/pkg/types"
2326

24-
"sigs.k8s.io/gateway-api/conformance/utils/http"
2527
"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
2628
"sigs.k8s.io/gateway-api/conformance/utils/suite"
27-
"sigs.k8s.io/gateway-api/conformance/utils/tls"
29+
"sigs.k8s.io/gateway-api/conformance/utils/tlog"
2830
"sigs.k8s.io/gateway-api/pkg/features"
31+
32+
mqtt "github.com/eclipse/paho.mqtt.golang"
2933
)
3034

3135
func init() {
@@ -43,9 +47,9 @@ var TLSRouteTerminateSimpleSameNamespace = suite.ConformanceTest{
4347
Manifests: []string{"tests/tlsroute-terminate-simple-same-namespace.yaml"},
4448
Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
4549
ns := "gateway-conformance-infra"
46-
routeNN := types.NamespacedName{Name: "gateway-conformance-infra-test", Namespace: ns}
50+
routeNN := types.NamespacedName{Name: "gateway-conformance-mqtt-test", Namespace: ns}
4751
gwNN := types.NamespacedName{Name: "gateway-tlsroute-terminate", Namespace: ns}
48-
certNN := types.NamespacedName{Name: "tls-checks-certificate", Namespace: ns}
52+
caCertNN := types.NamespacedName{Name: "tls-checks-ca-certificate", Namespace: ns}
4953

5054
kubernetes.NamespacesMustBeReady(t, suite.Client, suite.TimeoutConfig, []string{ns})
5155

@@ -55,17 +59,36 @@ var TLSRouteTerminateSimpleSameNamespace = suite.ConformanceTest{
5559
}
5660
serverStr := string(hostnames[0])
5761

58-
cPem, keyPem, err := GetTLSSecret(suite.Client, certNN)
62+
caConfigMap, err := kubernetes.GetConfigMapData(suite.Client, caCertNN)
5963
if err != nil {
6064
t.Fatalf("unexpected error finding TLS secret: %v", err)
6165
}
62-
t.Run("Simple TLS request matching TLSRoute should reach infra-backend", func(t *testing.T) {
63-
tls.MakeTLSRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, cPem, keyPem, serverStr,
64-
http.ExpectedResponse{
65-
Request: http.Request{Host: serverStr, Path: "/"},
66-
Backend: "infra-backend-v2",
67-
Namespace: "gateway-conformance-infra",
68-
})
66+
caString, ok := caConfigMap["ca.crt"]
67+
if !ok {
68+
t.Fatalf("ca.crt not found in configmap: %s/%s", caCertNN.Namespace, caCertNN.Name)
69+
}
70+
71+
t.Run("Simple MQTT TLS request matching TLSRoute should reach mqtt-backend", func(t *testing.T) {
72+
tlog.Logf(t, "Establishing MQTT connection to host %s via %s", serverStr, gwAddr)
73+
74+
certpool := x509.NewCertPool()
75+
if !certpool.AppendCertsFromPEM([]byte(caString)) {
76+
t.Fatal("Failed to append CA certificate")
77+
}
78+
79+
opts := mqtt.NewClientOptions()
80+
opts.AddBroker(fmt.Sprintf("tls://%s", gwAddr))
81+
opts.SetTLSConfig(&tls.Config{
82+
RootCAs: certpool,
83+
ServerName: serverStr,
84+
})
85+
opts.SetConnectRetry(true)
86+
87+
client := mqtt.NewClient(opts)
88+
token := client.Connect()
89+
if token.Wait() && token.Error() != nil {
90+
t.Fatalf("Connection failed: %v", token.Error())
91+
}
6992
})
7093
},
7194
}

‎conformance/tests/tlsroute-terminate-simple-same-namespace.yaml‎

Lines changed: 65 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,17 @@
11
apiVersion: gateway.networking.k8s.io/v1alpha3
22
kind: TLSRoute
33
metadata:
4-
name: gateway-conformance-infra-test
4+
name: gateway-conformance-mqtt-test
55
namespace: gateway-conformance-infra
66
spec:
77
parentRefs:
88
- name: gateway-tlsroute-terminate
99
namespace: gateway-conformance-infra
1010
hostnames:
11-
- abc.example.com
11+
- tls.terminate.com
1212
rules:
1313
- backendRefs:
14-
- name: infra-backend-v2
14+
- name: mqtt-backend
1515
port: 8080
1616
---
1717
apiVersion: gateway.networking.k8s.io/v1
@@ -22,10 +22,10 @@ metadata:
2222
spec:
2323
gatewayClassName: "{GATEWAY_CLASS_NAME}"
2424
listeners:
25-
- name: https
26-
port: 443
25+
- name: mqtt
26+
port: 1883
2727
protocol: TLS
28-
hostname: abc.example.com
28+
hostname: tls.terminate.com
2929
allowedRoutes:
3030
namespaces:
3131
from: Same
@@ -34,4 +34,62 @@ spec:
3434
tls:
3535
mode: Terminate
3636
certificateRefs:
37-
- name: tls-checks-certificate
37+
- name: tls-terminate-checks-certificate
38+
---
39+
apiVersion: v1
40+
kind: Service
41+
metadata:
42+
name: mqtt-backend
43+
namespace: gateway-conformance-infra
44+
spec:
45+
selector:
46+
app: mqtt-backend
47+
ports:
48+
- protocol: TCP
49+
port: 8080
50+
targetPort: 1883
51+
---
52+
apiVersion: apps/v1
53+
kind: Deployment
54+
metadata:
55+
name: mqtt-backend
56+
namespace: gateway-conformance-infra
57+
labels:
58+
app: mqtt-backend
59+
spec:
60+
replicas: 1
61+
selector:
62+
matchLabels:
63+
app: mqtt-backend
64+
template:
65+
metadata:
66+
labels:
67+
app: mqtt-backend
68+
spec:
69+
containers:
70+
- name: mqtt-backend
71+
# https://hub.docker.com/_/eclipse-mosquitto
72+
image: eclipse-mosquitto:2
73+
volumeMounts:
74+
- name: config
75+
mountPath: /mosquitto/config/mosquitto.conf
76+
subPath: mosquitto.conf
77+
ports:
78+
- containerPort: 1883
79+
resources:
80+
requests:
81+
cpu: 10m
82+
volumes:
83+
- name: config
84+
configMap:
85+
name: mosquitto-config
86+
---
87+
apiVersion: v1
88+
kind: ConfigMap
89+
metadata:
90+
name: mosquitto-config
91+
namespace: gateway-conformance-infra
92+
data:
93+
mosquitto.conf: |
94+
listener 1883
95+
allow_anonymous true

‎conformance/utils/kubernetes/helpers.go‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1037,3 +1037,17 @@ func BackendTLSPolicyMustHaveLatestConditions(t *testing.T, r *gatewayv1.Backend
10371037
}
10381038
}
10391039
}
1040+
1041+
// GetConfigMapData fetches the named ConfigMap
1042+
func GetConfigMapData(client client.Client, name types.NamespacedName) (map[string]string, error) {
1043+
ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
1044+
defer cancel()
1045+
1046+
configMap := &v1.ConfigMap{}
1047+
err := client.Get(ctx, name, configMap)
1048+
if err != nil {
1049+
return nil, fmt.Errorf("error fetching ConfigMap: %w", err)
1050+
}
1051+
1052+
return configMap.Data, nil
1053+
}

‎conformance/utils/suite/suite.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -384,6 +384,10 @@ func (suite *ConformanceTestSuite) Setup(t *testing.T, tests []ConformanceTest)
384384
secret = kubernetes.MustCreateCASignedCertSecret(t, "gateway-conformance-infra", "tls-checks-certificate", []string{"abc.example.com", "spiffe://abc.example.com/test-identity", "other.example.com"}, ca, caPrivKey)
385385
suite.Applier.MustApplyObjectsWithCleanup(t, suite.Client, suite.TimeoutConfig, []client.Object{secret}, suite.Cleanup)
386386

387+
// The following secret is used for TLSRoute mode Terminate validation
388+
secret = kubernetes.MustCreateCASignedCertSecret(t, "gateway-conformance-infra", "tls-terminate-checks-certificate", []string{"tls.terminate.com"}, ca, caPrivKey)
389+
suite.Applier.MustApplyObjectsWithCleanup(t, suite.Client, suite.TimeoutConfig, []client.Object{secret}, suite.Cleanup)
390+
387391
// The following CA ceritficate is used for BackendTLSPolicy testing to intentionally force TLS validation to fail.
388392
caConfigMap, _, _ = kubernetes.MustCreateCACertConfigMap(t, "gateway-conformance-infra", "mismatch-ca-certificate")
389393
suite.Applier.MustApplyObjectsWithCleanup(t, suite.Client, suite.TimeoutConfig, []client.Object{caConfigMap}, suite.Cleanup)

‎go.mod‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ module sigs.k8s.io/gateway-api
33
go 1.24.0
44

55
require (
6+
github.com/eclipse/paho.mqtt.golang v1.5.1
67
github.com/elastic/crd-ref-docs v0.2.0
78
github.com/miekg/dns v1.1.68
89
github.com/stretchr/testify v1.11.1

‎go.sum‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
2323
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
2424
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
2525
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
26+
github.com/eclipse/paho.mqtt.golang v1.5.1 h1:/VSOv3oDLlpqR2Epjn1Q7b2bSTplJIeV2ISgCl2W7nE=
27+
github.com/eclipse/paho.mqtt.golang v1.5.1/go.mod h1:1/yJCneuyOoCOzKSsOTUc0AJfpsItBGWvYpBLimhArU=
2628
github.com/elastic/crd-ref-docs v0.2.0 h1:U17MyGX71j4qfKTvYxbR4qZGoA1hc2thy7kseGYmP+o=
2729
github.com/elastic/crd-ref-docs v0.2.0/go.mod h1:0bklkJhTG7nC6AVsdDi0wt5bGoqvzdZSzMMQkilZ6XM=
2830
github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=

0 commit comments

Comments
 (0)