Add peering integration tests

test/integration/connect/envoy/case-cfg-splitter-peering-ingress-gateways/alpha/base.hcl

@@ -0,0 +1,5 @@
+primary_datacenter = "alpha"
+log_level          = "trace"
+peering {
+  enabled = true
+}

test/integration/connect/envoy/case-cfg-splitter-peering-ingress-gateways/alpha/config_entries.hcl

@@ -0,0 +1,34 @@
+config_entries {
+  bootstrap = [
+    {
+      kind = "proxy-defaults"
+      name = "global"
+
+      config {
+        protocol = "tcp"
+      }
+    },
+    {
+      kind = "exported-services"
+      name = "default"
+      services = [
+        {
+          name = "s1"
+          consumers = [
+            {
+              peer_name = "alpha-to-primary"
+            }
+          ]
+        },
+        {
+          name = "s2"
+          consumers = [
+            {
+              peer_name = "alpha-to-primary"
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}

test/integration/connect/envoy/case-cfg-splitter-peering-ingress-gateways/alpha/service_gateway.hcl

@@ -0,0 +1,5 @@
+services {
+  name = "mesh-gateway"
+  kind = "mesh-gateway"
+  port = 4432
+}

test/integration/connect/envoy/case-cfg-splitter-peering-ingress-gateways/alpha/service_s1.hcl

@@ -0,0 +1,10 @@
+services {
+  name = "s1"
+  port = 8080
+  checks = []
+  connect {
+    sidecar_service {
+      checks = []
+    }
+  }
+}

test/integration/connect/envoy/case-cfg-splitter-peering-ingress-gateways/alpha/service_s2.hcl

@@ -0,0 +1,10 @@
+services {
+  name = "s2"
+  port = 8181
+  checks = []
+  connect {
+    sidecar_service {
+      checks = []
+    }
+  }
+}

test/integration/connect/envoy/case-cfg-splitter-peering-ingress-gateways/alpha/setup.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+set -euo pipefail
+
+wait_for_config_entry proxy-defaults global alpha
+wait_for_config_entry exported-services default alpha
+
+register_services alpha
+
+gen_envoy_bootstrap s1 19001 alpha
+gen_envoy_bootstrap s2 19002 alpha
+gen_envoy_bootstrap mesh-gateway 19003 alpha true

test/integration/connect/envoy/case-cfg-splitter-peering-ingress-gateways/alpha/verify.bats

@@ -0,0 +1,34 @@
+#!/usr/bin/env bats
+
+load helpers
+
+@test "proxies are running correct version" {
+  assert_envoy_version 19001
+  assert_envoy_version 19002
+}
+
+@test "s1 proxy admin is up on :19001" {
+  retry_default curl -f -s localhost:19001/stats -o /dev/null
+}
+
+@test "s2 proxy admin is up on :19002" {
+  retry_default curl -f -s localhost:19002/stats -o /dev/null
+}
+
+@test "gateway-alpha proxy admin is up on :19003" {
+  retry_default curl -f -s localhost:19003/stats -o /dev/null
+}
+
+@test "proxy listeners should be up and have right cert" {
+  assert_proxy_presents_cert_uri localhost:21000 s1 alpha
+  assert_proxy_presents_cert_uri localhost:21001 s2 alpha
+}
+
+@test "s1 and s2 proxies should be healthy" {
+  assert_service_has_healthy_instances s1 1 alpha
+  assert_service_has_healthy_instances s2 1 alpha
+}
+
+@test "gateway-alpha should be up and listening" {
+  retry_long nc -z consul-alpha-client:4432
+}

test/integration/connect/envoy/case-cfg-splitter-peering-ingress-gateways/bind.hcl

@@ -0,0 +1,2 @@
+bind_addr = "0.0.0.0"
+advertise_addr = "{{ GetInterfaceIP \"eth0\" }}"

test/integration/connect/envoy/case-cfg-splitter-peering-ingress-gateways/capture.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+snapshot_envoy_admin localhost:20000 ingress-gateway primary || true
+snapshot_envoy_admin localhost:19000 s1 primary || true
+snapshot_envoy_admin localhost:19001 s1 alpha || true
+snapshot_envoy_admin localhost:19002 s2 alpha || true
+snapshot_envoy_admin localhost:19003 mesh-gateway alpha || true

test/integration/connect/envoy/case-cfg-splitter-peering-ingress-gateways/primary/base.hcl

@@ -0,0 +1,3 @@
+peering {
+  enabled = true
+}

test/integration/connect/envoy/case-cfg-splitter-peering-ingress-gateways/primary/config_entries.hcl

@@ -0,0 +1,88 @@
+config_entries {
+
+  bootstrap {
+    kind = "proxy-defaults"
+    name = "global"
+    config {
+      protocol = "http"
+    }
+  }
+
+  bootstrap {
+    kind = "ingress-gateway"
+    name = "ingress-gateway"
+    listeners = [
+      {
+        protocol = "http"
+        port     = 9999
+        services = [
+          {
+            name = "peer-s2"
+          }
+        ]
+      },
+      {
+        protocol = "http"
+        port     = 10000
+        services = [
+          {
+            name = "peer-s1"
+          }
+        ]
+      },
+      {
+        protocol = "http"
+        port     = 10001
+        services = [
+          {
+            name = "s1"
+          }
+        ]
+      },
+      {
+        protocol = "http"
+        port     = 10002
+        services = [
+          {
+            name = "split"
+          }
+        ]
+      }
+    ]
+  }
+
+  bootstrap {
+    kind = "service-resolver"
+    name = "peer-s1"
+
+    redirect = {
+      service = "s1"
+      peer = "primary-to-alpha"
+    }
+  }
+
+  bootstrap {
+    kind = "service-resolver"
+    name = "peer-s2"
+
+    redirect = {
+      service = "s2"
+      peer = "primary-to-alpha"
+    }
+  }
+
+  bootstrap {
+    kind = "service-splitter"
+    name = "split"
+    splits = [
+      {
+        Weight = 50
+        Service = "peer-s1"
+      },
+      {
+        Weight = 50
+        Service = "peer-s2"
+      },
+    ]
+  }
+}

test/integration/connect/envoy/case-cfg-splitter-peering-ingress-gateways/primary/service_ingress.hcl

@@ -0,0 +1,4 @@
+services {
+  name = "ingress-gateway"
+  kind = "ingress-gateway"
+}

test/integration/connect/envoy/case-cfg-splitter-peering-ingress-gateways/primary/setup.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+set -eEuo pipefail
+
+# wait for bootstrap to apply config entries
+wait_for_config_entry ingress-gateway ingress-gateway
+wait_for_config_entry proxy-defaults global
+wait_for_config_entry service-resolver peer-s1
+wait_for_config_entry service-resolver peer-s2
+
+register_services primary
+
+gen_envoy_bootstrap ingress-gateway 20000 primary true
+gen_envoy_bootstrap s1 19000 primary

test/integration/connect/envoy/case-cfg-splitter-peering-ingress-gateways/primary/verify.bats

@@ -0,0 +1,70 @@
+#!/usr/bin/env bats
+
+load helpers
+
+
+@test "ingress-primary proxy admin is up" {
+  retry_default curl -f -s localhost:20000/stats -o /dev/null
+}
+
+@test "s1 proxy admin is up" {
+  retry_default curl -f -s localhost:19000/stats -o /dev/null
+}
+
+@test "services should be healthy in primary" {
+  assert_service_has_healthy_instances s1 1 alpha
+}
+
+@test "services should be healthy in alpha" {
+  assert_service_has_healthy_instances s1 1 alpha
+  assert_service_has_healthy_instances s2 1 alpha
+}
+
+@test "mesh-gateway should have healthy endpoints" {
+  assert_upstream_has_endpoints_in_status consul-alpha-client:19003 s1 HEALTHY 1
+  assert_upstream_has_endpoints_in_status consul-alpha-client:19003 s2 HEALTHY 1
+}
+
+@test "peer the two clusters together" {
+  create_peering primary alpha
+}
+
+@test "s1 alpha proxies should be healthy in primary" {
+  assert_service_has_healthy_instances s1 1 primary "" "" primary-to-alpha
+}
+
+@test "s2 alpha proxies should be healthy in primary" {
+  assert_service_has_healthy_instances s2 1 primary "" "" primary-to-alpha
+}
+
+@test "ingress should have healthy endpoints to alpha s1 and s2" {
+  assert_upstream_has_endpoints_in_status 127.0.0.1:20000 s1.default.primary-to-alpha.external HEALTHY 1
+  assert_upstream_has_endpoints_in_status 127.0.0.1:20000 s2.default.primary-to-alpha.external HEALTHY 1
+}
+
+@test "requests through ingress should proxy to alpha" {
+  assert_expected_fortio_name s1-alpha peer-s1.ingress.consul 10000
+  assert_expected_fortio_name s2-alpha peer-s2.ingress.consul 9999
+}
+
+@test "ingress made 1 connection to alpha s1" {
+  assert_envoy_metric_at_least 127.0.0.1:20000 "cluster.s1.default.primary-to-alpha.external.*cx_total" 1
+}
+
+@test "ingress made 1 connection to alpha s2" {
+  assert_envoy_metric_at_least 127.0.0.1:20000 "cluster.s2.default.primary-to-alpha.external.*cx_total" 1
+}
+
+@test "no requests contacted primary s1" {
+  assert_envoy_metric 127.0.0.1:19000 "http.public_listener.rq_total" 0
+}
+
+@test "requests through ingress should proxy to primary s1" {
+  assert_expected_fortio_name s1 s1.ingress.consul 10001
+  assert_envoy_metric 127.0.0.1:19000 "http.public_listener.rq_total" 1
+}
+
+@test "requests through ingress to splitter should go to alpha" {
+  retry_default assert_expected_fortio_name s1-alpha split.ingress.consul 10002
+  retry_default assert_expected_fortio_name s2-alpha split.ingress.consul 10002
+}

test/integration/connect/envoy/case-cfg-splitter-peering-ingress-gateways/vars.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+
+export REQUIRED_SERVICES="s1 s1-sidecar-proxy s1-alpha s1-sidecar-proxy-alpha s2-alpha s2-sidecar-proxy-alpha gateway-alpha ingress-gateway-primary"
+export REQUIRE_PEERS=1