Initial support for agentless #1267

ishustava · 2022-06-09T16:36:10Z

Changes proposed in this PR:
Add initial support for the basic service mesh running with agentless.

Update connect-inject deployment to talk to consul servers (currently only in-cluster servers are supported; external servers support will come in a later PR)
Update endpoints controller to register and deregister services and health checks in the catalog and stop using agent APIs
Update connect-init command to take the -node-name flag so that it can search for services within a given node using catalog APIs
Add k8s probes to the envoy container
Provide -node-name flag to the consul connect envoy command so that we can generate correct configuration
Selectively disable acceptance tests that don't yet work in this configuration

How I've tested this PR:
acceptance tests

How I expect reviewers to test this PR:
👀
TODO:

add k8s probes to envoy container
fix acceptance tests
~~add support for external servers~~ (will come in a separate PR as this one is already big)

Checklist:

Tests added
CHANGELOG entry added

HashiCorp engineers only, community PRs should not add a changelog entry.
Entries should use present tense (e.g. Add support for...)

ishustava · 2022-06-20T16:51:44Z

.circleci/config.yml

+#      - acceptance-tproxy:
+#          context: consul-ci
+#          requires:
+#            - dev-upload-docker


tproxy is not yet supported

ishustava · 2022-06-20T19:26:38Z

charts/consul/test/unit/client-config-configmap.bats

 @test "client/ConfigMap: enable with global.enabled false" {
  cd `chart_dir`
  local actual=$(helm template \
      -s templates/client-config-configmap.yaml  \
+      --set 'client.enabled=true' \


Clients are now disabled by default (previously they were enabled), and so lots of bats tests needed to be changed to enable clients explicitly

ishustava · 2022-06-20T19:28:50Z

charts/consul/test/unit/connect-inject-deployment.bats

-#--------------------------------------------------------------------
-# global.tls.enableAutoEncrypt


Auto-encrypt is no longer supported for the connect-inject deployment as this is a setting used only when talking to consul clients.

ishustava · 2022-06-20T20:40:07Z

control-plane/connect-inject/endpoints_controller.go

-// which in this case are Pods. It only returns true if the Pod is a Consul Client Agent Pod. It reads the labels
-// from the meta of the resource and uses the values of the "app" and "component" label to validate that
-// the Pod is a Consul Client Agent.
-func (r *EndpointsController) filterAgentPods(object client.Object) bool {


This code might come back to better handle upgrades but removing it for now as I'm not sure yet how upgrades will be handled.

good point. but in that case, we would just re-enqueue all the endpoints I think.

ndhanushkodi

This looks so great!! Thanks for the helpful comments all around and also reviewing this made me realize how well the k8s agentless RFC is written!!!

ndhanushkodi · 2022-06-22T05:49:48Z

charts/consul/templates/connect-inject-deployment.yaml

-              fieldPath: status.hostIP
-          {{- if .Values.global.tls.enabled }}
-        - name: CONSUL_CACERT
-          value: /consul/tls/ca/tls.crt


clarifying q for my understanding: did this used to be the CA for server and client agents and now when clients are disabled it's only the server agent CA?

yeah exactly! and more specifically, when using auto-encrypt the CA for the client will be different (connect CA) and so we needed to mount a client-specific CA in that case. Without clients, we'd only need the server CA.

ahhh thank you for the clarification!!

control-plane/connect-inject/container_init.go

ndhanushkodi · 2022-06-24T06:31:51Z

control-plane/connect-inject/endpoints_controller.go

+	ConsulKubernetesCheckType = "kubernetes-readiness"
+
+	// ConsulKubernetesCheckName is the name of health check in Consul for Kubernetes readiness status.
+	ConsulKubernetesCheckName = "Kubernetes Readiness Check"


in a custom health check like this, is the status of the check all consul would care about to decide whether to route traffic to the app?

Add initial support for the basic service mesh running with agentless. * Update connect-inject deployment to talk to consul servers (currently only in-cluster servers are supported; external servers support will come in a later PR) * Update endpoints controller to register and deregister services and health checks in the catalog and stop using agent APIs * Update connect-init command to take the -node-name flag so that it can search for services within a given node using catalog APIs * Add k8s probes to the envoy container * Provide -node-name flag to the consul connect envoy command so that we can generate correct configuration * Selectively disable acceptance tests that don't yet work in this configuration * Disable consul clients by default

ishustava force-pushed the ishustava/agentless-inital-support branch from 0feca58 to de0faf2 Compare June 15, 2022 15:28

ishustava changed the title ~~wip~~ Initial support for agentless Jun 16, 2022

ishustava commented Jun 20, 2022

View reviewed changes

ishustava added 19 commits June 20, 2022 11:13

wip

6125d5f

wip: ep ctrl tests passing

d99d2c8

wip: ep ctrl ent tests passing

29c06cf

wip: connect-init cmd tests passing

19c57e4

container_init tests

784091c

bats

7e152b7

add probes to envoy

95cb295

update consul image

4ec571b

only run acceptance tests that will work

0ad3fff

fix golinter issues

57fc3d7

fix ci config

b83a3db

fix typo

65592b5

fix bats and disable vault acc tests

6f3567d

fix consul ns

43d02ff

delete tokens from the right namespace

5573390

disable controller acc tests

3a14883

don't run tproxy acc tests

254dbab

skip component metrics acc test

505fdca

change CLI upgrade tests

da1aa5a

ishustava force-pushed the ishustava/agentless-inital-support branch 3 times, most recently from 24f2671 to 3df5def Compare June 20, 2022 19:23

ishustava commented Jun 20, 2022

View reviewed changes

skip CLI upgrade test

51e65ff

ishustava force-pushed the ishustava/agentless-inital-support branch from 3df5def to f5479bc Compare June 20, 2022 20:32

ishustava commented Jun 20, 2022

View reviewed changes

ndhanushkodi approved these changes Jun 24, 2022

View reviewed changes

Update container_init.go

7eb59cb

ishustava merged commit 783d0a5 into agentless Jun 24, 2022

ishustava deleted the ishustava/agentless-inital-support branch June 24, 2022 18:56

natitomattis mentioned this pull request Jun 20, 2023

INFRA 11282 team-telnyx/consul-k8s#7

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Initial support for agentless #1267

Initial support for agentless #1267

ishustava commented Jun 9, 2022 •

edited

Loading

ishustava Jun 20, 2022

ishustava Jun 20, 2022

ishustava Jun 20, 2022

ishustava Jun 20, 2022

thisisnotashwin Jun 21, 2022

ndhanushkodi left a comment

ndhanushkodi Jun 22, 2022

ishustava Jun 24, 2022

ndhanushkodi Jun 24, 2022

ndhanushkodi Jun 24, 2022

ishustava Jun 24, 2022

ndhanushkodi Jun 24, 2022

		#--------------------------------------------------------------------
		# global.tls.enableAutoEncrypt

Initial support for agentless #1267

Initial support for agentless #1267

Conversation

ishustava commented Jun 9, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ndhanushkodi left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ishustava commented Jun 9, 2022 •

edited

Loading