diff --git a/acceptance/tests-v2/mesh/mesh_inject_test.go b/acceptance/tests-v2/mesh/mesh_inject_test.go index e6deb4aa8c..0ebccbc7ab 100644 --- a/acceptance/tests-v2/mesh/mesh_inject_test.go +++ b/acceptance/tests-v2/mesh/mesh_inject_test.go @@ -19,6 +19,8 @@ import ( "github.com/hashicorp/consul-k8s/acceptance/framework/logger" ) +const multiport = "multiport" + // Test that mesh sidecar proxies work for an application with multiple ports. The multiport application is a Pod listening on // two ports. This tests inbound connections to each port of the multiport app, and outbound connections from the // multiport app to static-server. @@ -35,8 +37,8 @@ func TestMeshInject_MultiportService(t *testing.T) { ctx := suite.Environment().DefaultContext(t) helmValues := map[string]string{ - "global.image": "ndhanushkodi/consul-dev:multiport36", - "global.imageK8S": "ndhanushkodi/consul-k8s-dev:multiport20", + "global.image": "ndhanushkodi/consul-dev:multiport37", + "global.imageK8S": "ndhanushkodi/consul-k8s-dev:multiport25", "global.imageConsulDataplane": "hashicorppreview/consul-dataplane:1.3-dev", "global.experiments[0]": "resource-apis", // The UI is not supported for v2 in 1.17, so for now it must be disabled. @@ -79,6 +81,22 @@ func TestMeshInject_MultiportService(t *testing.T) { // Check connection from static-client to multiport-admin. k8s.CheckStaticServerConnectionSuccessfulWithMessage(t, ctx.KubectlOptions(t), connhelper.StaticClientName, "hello world from 9090 admin", "http://multiport:9090") + + // Test that kubernetes readiness status is synced to Consul. This will make the multi port pods unhealthy + // and check inbound connections to the multi port pods' services. + // Create the files so that the readiness probes of the multi port pod fails. + logger.Log(t, "testing k8s -> consul health checks sync by making the multiport unhealthy") + k8s.RunKubectl(t, ctx.KubectlOptions(t), "exec", "deploy/"+multiport, "-c", "multiport", "--", "touch", "/tmp/unhealthy-multiport") + logger.Log(t, "testing k8s -> consul health checks sync by making the multiport-admin unhealthy") + k8s.RunKubectl(t, ctx.KubectlOptions(t), "exec", "deploy/"+multiport, "-c", "multiport-admin", "--", "touch", "/tmp/unhealthy-multiport-admin") + + // The readiness probe should take a moment to be reflected in Consul, CheckStaticServerConnection will retry + // until Consul marks the service instance unavailable for mesh traffic, causing the connection to fail. + // We are expecting a "connection reset by peer" error because in a case of health checks, + // there will be no healthy proxy host to connect to. That's why we can't assert that we receive an empty reply + // from server, which is the case when a connection is unsuccessful due to intentions in other tests. + k8s.CheckStaticServerConnectionMultipleFailureMessages(t, ctx.KubectlOptions(t), connhelper.StaticClientName, false, []string{"curl: (56) Recv failure: Connection reset by peer", "curl: (52) Empty reply from server"}, "", "http://multiport:8080") + k8s.CheckStaticServerConnectionMultipleFailureMessages(t, ctx.KubectlOptions(t), connhelper.StaticClientName, false, []string{"curl: (56) Recv failure: Connection reset by peer", "curl: (52) Empty reply from server"}, "", "http://multiport:9090") }) } } diff --git a/control-plane/connect-inject/controllers/pod/pod_controller.go b/control-plane/connect-inject/controllers/pod/pod_controller.go index 9feb090043..358aebf9e4 100644 --- a/control-plane/connect-inject/controllers/pod/pod_controller.go +++ b/control-plane/connect-inject/controllers/pod/pod_controller.go @@ -815,6 +815,7 @@ func getHealthStatusFromPod(pod corev1.Pod) pbcatalog.Health { return pbcatalog.Health_HEALTH_PASSING } } + return pbcatalog.Health_HEALTH_CRITICAL }