Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

workaroud for the flaky oidc e2e test #4603

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
+21 −8
Open

workaroud for the flaky oidc e2e test #4603

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
21fb4f1
workaroud for the flaky oidc e2e test
zhaohuabing Nov 1, 2024
1e16d24
add issue link
zhaohuabing Nov 1, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 21 additions & 8 deletions test/e2e/tests/oidc.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ import (
corev1 "k8s.io/api/core/v1"
"k8s.io/apimachinery/pkg/types"
"k8s.io/apimachinery/pkg/util/wait"
"sigs.k8s.io/controller-runtime/pkg/client"
gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
gwapiv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
gwhttp "sigs.k8s.io/gateway-api/conformance/utils/http"
Expand Down Expand Up @@ -119,7 +120,7 @@ func testOIDC(t *testing.T, suite *suite.ConformanceTestSuite) {
WaitForPods(t, suite.Client, ns, map[string]string{"job-name": "setup-keycloak"}, corev1.PodSucceeded, podInitialized)

// Initialize the test OIDC client that will keep track of the state of the OIDC login process
client, err := NewOIDCTestClient(
oidcClient, err := NewOIDCTestClient(
WithLoggingOptions(t.Log, true),
// Map the application and keycloak cluster DNS name to the gateway address
WithCustomAddressMappings(map[string]string{
Expand All @@ -135,13 +136,25 @@ func testOIDC(t *testing.T, suite *suite.ConformanceTestSuite) {

// Send a request to the http route with OIDC configured.
// It will be redirected to the keycloak login page
res, err := client.Get(testURL, true)
require.NoError(t, err, "Failed to get the login page")
require.Equal(t, 200, res.StatusCode, "Expected 200 OK")
res, err := oidcClient.Get(testURL, true)
if err != nil {
tlog.Logf(t, "failed to get the login page: %v", err)
return false, nil
}
if res.StatusCode != http.StatusOK {
tlog.Logf(t, "Failed to get the login page, expected 200 OK, got %d", res.StatusCode)
return false, nil
}

// Parse the response body to get the URL where the login page would post the user-entered credentials
if err := client.ParseLoginForm(res.Body, keyCloakLoginFormID); err != nil {
if err := oidcClient.ParseLoginForm(res.Body, keyCloakLoginFormID); err != nil {
tlog.Logf(t, "failed to parse login form: %v", err)
// restart the envoy proxy to recover from the error, this is a workaround for the flaky test: https://github.com/envoyproxy/gateway/issues/3898
// TODO: we should investigate the root cause of the flakiness and remove this workaround
proxyLabel := map[string]string{"gateway.envoyproxy.io/owning-gateway-name": "same-namespace"}
err := suite.Client.DeleteAllOf(context.TODO(), &corev1.Pod{}, client.MatchingLabels(proxyLabel), client.InNamespace("envoy-gateway-system"))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we force a rollout/restart instead of deleting?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It doesnt matter here. We just need to restart the Envoy pod to repush the xDS.

require.NoError(t, err)
WaitForPods(t, suite.Client, "envoy-gateway-system", proxyLabel, corev1.PodRunning, podInitialized)
return false, nil
}

Expand All @@ -153,7 +166,7 @@ func testOIDC(t *testing.T, suite *suite.ConformanceTestSuite) {

// Submit the login form to the IdP.
// This will authenticate and redirect back to the application
res, err := client.Login(map[string]string{"username": username, "password": password, "credentialId": ""})
res, err := oidcClient.Login(map[string]string{"username": username, "password": password, "credentialId": ""})
require.NoError(t, err, "Failed to login to the IdP")

// Verify that we get the expected response from the application
Expand All @@ -163,14 +176,14 @@ func testOIDC(t *testing.T, suite *suite.ConformanceTestSuite) {
require.Contains(t, string(body), "infra-backend-v1", "Expected response from the application")

// Verify that we can access the application without logging in again
res, err = client.Get(testURL, false)
res, err = oidcClient.Get(testURL, false)
require.NoError(t, err)
require.Equal(t, http.StatusOK, res.StatusCode)
require.Contains(t, string(body), "infra-backend-v1", "Expected response from the application")

// Verify that we can logout
// Note: OAuth2 filter just clears its cookies and does not log out from the IdP.
res, err = client.Get(logoutURL, false)
res, err = oidcClient.Get(logoutURL, false)
require.NoError(t, err)
require.Equal(t, http.StatusFound, res.StatusCode)

Expand Down