Repository: grpc/grpc-go
File: internal/xds/bootstrap/tlscreds/bundle_ext_test.go (Go)

Code before:
		t.Log(server)
		_, err = client.EmptyCall(ctx, &testpb.Empty{})
		const wantErr = "certificate signed by unknown authority"
		if status.Code(err) == codes.Unavailable && strings.Contains(err.Error(), wantErr) {
			// Certs have reloaded.
			server.Stop()
			break
		}
		t.Logf("EmptyCall() got err: %s, want code: %s, want err: %s", err, codes.Unavailable, wantErr)
		server.Stop()
	}
	if ctx.Err() != nil {
		t.Errorf("Timed out waiting for CA certs reloading")
	}
}

// Test_SPIFFE_Reloading sets up a client and server. The client is configured
// to use a SPIFFE bundle map, and the server is configured to use TLS creds
// compatible with this bundle. A handshake is performed and connection is
// expected to be successful. Then we change the client's SPIFFE Bundle Map file
// on disk to one that should fail with the server's credentials. This change
// should be picked up by the client via our file reloading. Another handshake
// is performed and checked for failure, ensuring that gRPC is correctly using
// the changed-on-disk bundle map.
func (s) Test_SPIFFE_Reloading(t *testing.T) {
	testutils.SetEnvConfig(t, &envconfig.XDSSpiffeEnabled, true)
	clientSPIFFEBundle, err := os.ReadFile(testdata.Path("spiffe_end2end/client_spiffebundle.json"))
	if err != nil {
		t.Fatalf("Failed to read test SPIFFE bundle: %v", err)
	}

	// Write CA certs to a temporary file so that we can modify it later.
	spiffePath := t.TempDir() + "/client_spiffe.json"
	if err = os.WriteFile(spiffePath, clientSPIFFEBundle, 0644); err != nil {
		t.Fatalf("Failed to write test SPIFFE Bundle %v: %v", clientSPIFFEBundle, err)
	}
	cfg := fmt.Sprintf(`{
		"spiffe_trust_bundle_map_file": "%s",
		"refresh_interval": ".01s"
	}`, spiffePath)
	tlsBundle, stop, err := tlscreds.NewBundle([]byte(cfg))
	if err != nil {
		t.Fatalf("Failed to create TLS bundle: %v", err)
	}
	defer stop()

	l, err := testutils.LocalTCPListener()
	if err != nil {
		t.Fatalf("testutils.LocalTCPListener() failed: %v", err)
	}
	lis := testutils.NewRestartableListener(l)

Review comment (suggestion):
And same here. If we are going to guard this with the env var, we need to have a test case where the env var is set to `false`.

Code after:
		t.Log(server)
		_, err = client.EmptyCall(ctx, &testpb.Empty{})
		const wantErr = "certificate signed by unknown authority"
		if status.Code(err) == codes.Unavailable && strings.Contains(err.Error(), wantErr) {
			// Certs have reloaded.
			server.Stop()
			break
		}
		t.Logf("EmptyCall() got err: %s, want code: %s, want err: %s", err, codes.Unavailable, wantErr)
		server.Stop()
	}
	if ctx.Err() != nil {
		t.Errorf("Timed out waiting for CA certs reloading")
	}
}

// Test_SPIFFE_Reloading sets up a client and server. The client is configured
// to use a SPIFFE bundle map, and the server is configured to use TLS creds
// compatible with this bundle. A handshake is performed and connection is
// expected to be successful. Then we change the client's SPIFFE Bundle Map file
// on disk to one that should fail with the server's credentials. This change
// should be picked up by the client via our file reloading. Another handshake
// is performed and checked for failure, ensuring that gRPC is correctly using
// the changed-on-disk bundle map.
func (s) Test_SPIFFE_Reloading(t *testing.T) {
	testutils.SetEnvConfig(t, &envconfig.XDSSPIFFEEnabled, true)
	clientSPIFFEBundle, err := os.ReadFile(testdata.Path("spiffe_end2end/client_spiffebundle.json"))
	if err != nil {
		t.Fatalf("Failed to read test SPIFFE bundle: %v", err)
	}

	// Write CA certs to a temporary file so that we can modify it later.
	spiffePath := t.TempDir() + "/client_spiffe.json"
	if err = os.WriteFile(spiffePath, clientSPIFFEBundle, 0644); err != nil {
		t.Fatalf("Failed to write test SPIFFE Bundle %v: %v", clientSPIFFEBundle, err)
	}
	cfg := fmt.Sprintf(`{
		"spiffe_trust_bundle_map_file": "%s",
		"refresh_interval": ".01s"
	}`, spiffePath)
	tlsBundle, stop, err := tlscreds.NewBundle([]byte(cfg))
	if err != nil {
		t.Fatalf("Failed to create TLS bundle: %v", err)
	}
	defer stop()

	l, err := testutils.LocalTCPListener()
	if err != nil {
		t.Fatalf("testutils.LocalTCPListener() failed: %v", err)
	}
	lis := testutils.NewRestartableListener(l)