// TestSingleMTLSGateway_ServerKeyCertRotation tests a single mTLS ingress gateway with SDS enabled.
// Verifies behavior in these scenarios.
// (1) create two kubernetes secrets to provision server key/cert and client CA cert, and
// verify that mTLS connection could establish to deliver HTTPS request.
// (2) replace kubernetes secret to rotate server key/cert, and verify that mTLS connection could
// not establish. This is because client is still using old server CA cert to validate server cert,
// and the new server cert cannot pass validation at client side.
// (3) do another key/cert rotation to use the correct server key/cert this time, and verify that
// mTLS connection could establish to deliver HTTPS request.
TestSingleMTLSGateway_ServerKeyCertRotation tests a single mTLS ingress gateway with SDS enabled.
Verifies behavior in these scenarios.
(1) create two kubernetes secrets to provision server key/cert and client CA cert, and
verify that mTLS connection could establish to deliver HTTPS request.
(2) replace kubernetes secret to rotate server key/cert, and verify that mTLS connection could
not establish. This is because client is still using old server CA cert to validate server cert,
and the new server cert cannot pass validation at client side.
(3) do another key/cert rotation to use the correct server key/cert this time, and verify that
mTLS connection could establish to deliver HTTPS request.
// TestSingleMTLSGateway_ServerKeyCertRotation tests a single mTLS ingress gateway with SDS enabled . // Verifies behavior in these scenarios . // ( 1 ) create two kubernetes secrets to provision server key / cert and client CA cert and // verify that mTLS connection could establish to deliver HTTPS request . // ( 2 ) replace kubernetes secret to rotate server key / cert and verify that mTLS connection could // not establish . This is because client is still using old server CA cert to validate server cert // and the new server cert cannot pass validation at client side . // ( 3 ) do another key / cert rotation to use the correct server key / cert this time and verify that // mTLS connection could establish to deliver HTTPS request .
func TestSingleMTLSGateway_ServerKeyCertRotation(t *testing.T) {
	framework.
		NewTest(t).
		RequiresEnvironment(environment.Kube).
		Run(func(ctx framework.TestContext) {
			ingressutil.DeployBookinfo(t, ctx, g, ingressutil.SingleMTLSGateway)
			ingressutil.CreateIngressKubeSecret(t, ctx, credCaName, ingress.Mtls, ingressutil.IngressCredentialCaCertA)
			ingressutil.CreateIngressKubeSecret(t, ctx, credName, ingress.Mtls,
				ingressutil.IngressCredentialServerKeyCertA)
			ingA := ingress.NewOrFail(t, ctx, ingress.Config{Istio: inst})
			err := ingressutil.WaitUntilGatewaySdsStatsGE(t, ingA, 2, 10*time.Second)
			if err != nil {
				t.Errorf("sds update stats does not match: %v", err)
			}
			err = ingressutil.WaitUntilGatewayActiveListenerStatsGE(t, ingA, 2, 30*time.Second)
			if err != nil {
				t.Errorf("total active listener stats does not match: %v", err)
			}
			tlsContext := ingressutil.TLSContext{
				CaCert:     ingressutil.CaCertA,
				PrivateKey: ingressutil.TLSClientKeyA,
				Cert:       ingressutil.TLSClientCertA,
			}
			err = ingressutil.VisitProductPage(ingA, host, ingress.Mtls, tlsContext, 30*time.Second,
				ingressutil.ExpectedResponse{ResponseCode: 200, ErrorMessage: ""}, t)
			if err != nil {
				t.Errorf("unable to retrieve code 200 from product page at host %s: %v", host, err)
			}
			ingressutil.RotateSecrets(t, ctx, credName, ingress.Mtls, ingressutil.IngressCredentialServerKeyCertB)
			err = ingressutil.WaitUntilGatewaySdsStatsGE(t, ingA, 3, 30*time.Second)
			if err != nil {
				t.Errorf("sds update stats does not match: %v", err)
			}
			err = ingressutil.VisitProductPage(ingA, host, ingress.Mtls, tlsContext, 30*time.Second,
				ingressutil.ExpectedResponse{ResponseCode: 0, ErrorMessage: "certificate signed by unknown authority"}, t)
			if err != nil {
				t.Errorf("unable to retrieve 0 from product page at host %s: %v", host, err)
			}
			ingressutil.RotateSecrets(t, ctx, credName, ingress.Mtls, ingressutil.IngressCredentialServerKeyCertA)
			err = ingressutil.WaitUntilGatewaySdsStatsGE(t, ingA, 4, 30*time.Second)
			if err != nil {
				t.Errorf("sds update stats does not match: %v", err)
			}
			err = ingressutil.VisitProductPage(ingA, host, ingress.Mtls, tlsContext, 30*time.Second,
				ingressutil.ExpectedResponse{ResponseCode: 200, ErrorMessage: ""}, t)
			if err != nil {
				t.Errorf("unable to retrieve code 200 from product page at host %s: %v", host, err)
			}
		})
}
func TestSingleMTLSGateway_ServerKeyCertRotation ( t * testing . T ) { framework . NewTest ( t ) . RequiresEnvironment ( environment . Kube ) . Run ( func ( ctx framework . TestContext ) { ingressutil . DeployBookinfo ( t , ctx , g , ingressutil . SingleMTLSGateway ) ingressutil . CreateIngressKubeSecret ( t , ctx , credCaName , ingress . Mtls , ingressutil . IngressCredentialCaCertA ) ingressutil . CreateIngressKubeSecret ( t , ctx , credName , ingress . Mtls , ingressutil . IngressCredentialServerKeyCertA ) ingA := ingress . NewOrFail ( t , ctx , ingress . Config { Istio : inst } ) err := ingressutil . WaitUntilGatewaySdsStatsGE ( t , ingA , 2 , 10 * time . Second ) if err != nil { t . Errorf ( " " , err ) } err = ingressutil . WaitUntilGatewayActiveListenerStatsGE ( t , ingA , 2 , 30 * time . Second ) if err != nil { t . Errorf ( " " , err ) } tlsContext := ingressutil . TLSContext { CaCert : ingressutil . CaCertA , PrivateKey : ingressutil . TLSClientKeyA , Cert : ingressutil . TLSClientCertA , } err = ingressutil . VisitProductPage ( ingA , host , ingress . Mtls , tlsContext , 30 * time . Second , ingressutil . ExpectedResponse { ResponseCode : 200 , ErrorMessage : " " } , t ) if err != nil { t . Errorf ( " " , host , err ) } ingressutil . RotateSecrets ( t , ctx , credName , ingress . Mtls , ingressutil . IngressCredentialServerKeyCertB ) err = ingressutil . WaitUntilGatewaySdsStatsGE ( t , ingA , 3 , 30 * time . Second ) if err != nil { t . Errorf ( " " , err ) } err = ingressutil . VisitProductPage ( ingA , host , ingress . Mtls , tlsContext , 30 * time . Second , ingressutil . ExpectedResponse { ResponseCode : 0 , ErrorMessage : " " } , t ) if err != nil { t . Errorf ( " " , host , err ) } ingressutil . RotateSecrets ( t , ctx , credName , ingress . Mtls , ingressutil . IngressCredentialServerKeyCertA ) err = ingressutil . WaitUntilGatewaySdsStatsGE ( t , ingA , 4 , 30 * time . Second ) if err != nil { t . Errorf ( " " , err ) } err = ingressutil . VisitProductPage ( ingA , host , ingress . Mtls , tlsContext , 30 * time . Second , ingressutil . ExpectedResponse { ResponseCode : 200 , ErrorMessage : " " } , t ) if err != nil { t . Errorf ( " " , host , err ) } } ) }
TestSingleMTLSGateway_ServerKeyCertRotation tests a single mTLS ingress gateway with SDS enabled.
TestSingleMTLSGateway_ServerKeyCertRotation tests a single mTLS ingress gateway with SDS enabled .
// Add two kubernetes secrets to provision server key/cert and client CA cert for ingress gateway. // Expect 2 SDS updates, one for the server key/cert update, and one for the CA cert update. // Expect 2 active listeners, one listens on 443 and the other listens on 15090 // key/cert rotation using mis-matched server key/cert. The server cert cannot pass validation // at client side. // Expect 1 more SDS updates for the server key/cert update. // Client uses old server CA cert to set up SSL connection would fail. // key/cert rotation using matched server key/cert. This time the server cert is able to pass // validation at client side. // Expect 1 more SDS updates for the server key/cert update. // Use old CA cert to set up SSL connection would succeed this time.