Method Test_MTLS_SPIFFE

internal/xds/bootstrap/tlscreds/bundle_ext_test.go:361–407

Test_MTLS_SPIFFE configures a client and server. The server has a certificate chain that is compatible with the client's configured SPIFFE bundle map. An MTLS connection is attempted between the two and checked for success.

(t *testing.T)

// chain that is compatible with the client's configured SPIFFE bundle map. An
// MTLS connection is attempted between the two and checked for success.
func (s) Test_MTLS_SPIFFE(t *testing.T) {
	testutils.SetEnvConfig(t, &envconfig.XDSSPIFFEEnabled, true)
	tests := []struct {
		name         string
		serverOption grpc.ServerOption
	}{
		{
			name:         "MTLS SPIFFE",
			serverOption: grpc.Creds(testutils.CreateServerTLSCredentialsCompatibleWithSPIFFE(t, tls.RequireAndVerifyClientCert)),
		},
		{
			name:         "MTLS SPIFFE Chain",
			serverOption: grpc.Creds(testutils.CreateServerTLSCredentialsCompatibleWithSPIFFEChain(t, tls.RequireAndVerifyClientCert)),
		},
	}
	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			s := stubserver.StartTestService(t, nil, tc.serverOption)
			defer s.Stop()

			cfg := fmt.Sprintf(`{
	"certificate_file": "%s",
	"private_key_file": "%s",
	"spiffe_trust_bundle_map_file": "%s"
}`,
				testdata.Path("spiffe_end2end/client_spiffe.pem"),
				testdata.Path("spiffe_end2end/client.key"),
				testdata.Path("spiffe_end2end/client_spiffebundle.json"))
			tlsBundle, stop, err := tlscreds.NewBundle([]byte(cfg))
			if err != nil {
				t.Fatalf("Failed to create TLS bundle: %v", err)
			}
			defer stop()
			conn, err := grpc.NewClient(s.Address, grpc.WithCredentialsBundle(tlsBundle), grpc.WithAuthority("x.test.example.com"))
			if err != nil {
				t.Fatalf("Error dialing: %v", err)
			}
			defer conn.Close()
			client := testgrpc.NewTestServiceClient(conn)
			ctx, cancel := context.WithTimeout(context.Background(), defaultTestTimeout)
			defer cancel()
			if _, err = client.EmptyCall(ctx, &testpb.Empty{}); err != nil {
				t.Errorf("EmptyCall(): got error %v when expected to succeed", err)
			}
		})
	}
}

// Test_MTLS_SPIFFE_FlagDisabled configures a client and server. The server has
// a certificate chain that is compatible with the client's configured SPIFFE