1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
|
// Copyright Yahoo. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
package com.yahoo.container.jdisc;
import com.google.common.jimfs.Jimfs;
import com.yahoo.cloud.config.DataplaneProxyConfig;
import com.yahoo.jdisc.http.server.jetty.DataplaneProxyCredentials;
import com.yahoo.security.KeyUtils;
import com.yahoo.security.X509CertificateUtils;
import com.yahoo.security.X509CertificateWithKey;
import org.junit.jupiter.api.Test;
import org.mockito.Mockito;
import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.nio.file.FileSystem;
import java.nio.file.Files;
import java.nio.file.Path;
import java.time.Duration;
import static com.yahoo.yolean.Exceptions.uncheck;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.mockito.ArgumentMatchers.any;
import static org.mockito.Mockito.doThrow;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.reset;
import static org.mockito.Mockito.times;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.when;
public class DataplaneProxyServiceTest {
private FileSystem fileSystem = Jimfs.newFileSystem();
DataplaneProxyService.ProxyCommands proxyCommandsMock = mock(DataplaneProxyService.ProxyCommands.class);
@Test
public void starts_and_reloads_if_no_errors() throws IOException {
DataplaneProxyService service = dataplaneProxyService(proxyCommandsMock);
assertEquals(DataplaneProxyService.NginxState.INITIALIZING, service.state());
service.reconfigure(proxyConfig(), credentials(fileSystem));
// Simulate executor next tick
service.converge();
assertEquals(DataplaneProxyService.NginxState.RUNNING, service.state());
// Trigger reload by recreating the proxy config (generates new server cert)
service.reconfigure(proxyConfig(), credentials(fileSystem));
service.converge();
assertEquals(DataplaneProxyService.NginxState.RUNNING, service.state());
}
@Test
public void retries_startup_errors() throws IOException {
Mockito.doThrow(new RuntimeException("IO error")).doNothing().when(proxyCommandsMock).start(any());
DataplaneProxyService service = dataplaneProxyService(proxyCommandsMock);
assertEquals(DataplaneProxyService.NginxState.INITIALIZING, service.state());
service.reconfigure(proxyConfig(), credentials(fileSystem));
// Start nginx, starting will fail, so the service should be in INITIALIZING state
service.converge();
assertEquals(DataplaneProxyService.NginxState.INITIALIZING, service.state());
service.converge();
assertEquals(DataplaneProxyService.NginxState.RUNNING, service.state());
}
@Test
public void retries_reload_errors() throws IOException {
Mockito.doThrow(new RuntimeException("IO error")).doNothing().when(proxyCommandsMock).reload();
when(proxyCommandsMock.isRunning()).thenReturn(false);
DataplaneProxyService service = dataplaneProxyService(proxyCommandsMock);
// Make sure service in running state
service.reconfigure(proxyConfig(), credentials(fileSystem));
service.converge();
assertEquals(DataplaneProxyService.NginxState.RUNNING, service.state());
when(proxyCommandsMock.isRunning()).thenReturn(true);
// Trigger reload, verifies 2nd attempt succeeds
service.reconfigure(proxyConfig(), credentials(fileSystem));
service.converge();
assertEquals(DataplaneProxyService.NginxState.RELOAD_REQUIRED, service.state());
service.converge();
assertEquals(DataplaneProxyService.NginxState.RUNNING, service.state());
verify(proxyCommandsMock, times(2)).reload();
}
@Test
public void converges_to_wanted_state_when_nginx_not_running() throws IOException {
DataplaneProxyService.ProxyCommands proxyCommands = new TestProxyCommands();
DataplaneProxyService service = dataplaneProxyService(proxyCommands);
assertFalse(proxyCommands.isRunning());
service.reconfigure(proxyConfig(), credentials(fileSystem));
service.converge();
assertEquals(DataplaneProxyService.NginxState.RUNNING, service.state());
assertTrue(proxyCommands.isRunning());
// Simulate nginx process dying
proxyCommands.stop();
assertFalse(proxyCommands.isRunning());
service.converge();
assertTrue(proxyCommands.isRunning());
}
@Test
public void shuts_down() throws IOException {
DataplaneProxyService.ProxyCommands proxyCommands = new TestProxyCommands();
DataplaneProxyService service = dataplaneProxyService(proxyCommands);
service.converge();
assertTrue(proxyCommands.isRunning());
assertEquals(DataplaneProxyService.NginxState.RUNNING, service.state());
new Thread(service::deconstruct).start(); // deconstruct will block until nginx is stopped
// Wait for above thread to set the wanted state to STOPPED
while (service.wantedState() != DataplaneProxyService.NginxState.STOPPED) {
try {
Thread.sleep(10);
} catch (InterruptedException e) {
}
}
service.converge();
assertEquals(service.state(), DataplaneProxyService.NginxState.STOPPED);
assertFalse(proxyCommands.isRunning());
}
@Test
public void stops_executor_when_nginx_stop_throws() throws IOException, InterruptedException {
DataplaneProxyService.ProxyCommands mockProxyCommands = mock(DataplaneProxyService.ProxyCommands.class);
DataplaneProxyService service = dataplaneProxyService(mockProxyCommands);
service.converge();
when (mockProxyCommands.isRunning()).thenReturn(true);
assertEquals(DataplaneProxyService.NginxState.RUNNING, service.state());
reset(proxyCommandsMock);
when(mockProxyCommands.isRunning()).thenReturn(true).thenReturn(false);
doThrow(new RuntimeException("Failed to stop proxy")).when(proxyCommandsMock).stop();
Thread thread = new Thread(service::deconstruct);// deconstruct will block until nginx is stopped
thread.start();
// Wait for above thread to set the wanted state to STOPPED
while (service.wantedState() != DataplaneProxyService.NginxState.STOPPED) {
try {
Thread.sleep(10);
} catch (InterruptedException e) {
}
}
service.converge();
assertEquals(service.state(), DataplaneProxyService.NginxState.STOPPED);
thread.join();
verify(mockProxyCommands, times(1)).stop();
}
private DataplaneProxyService dataplaneProxyService(DataplaneProxyService.ProxyCommands proxyCommands) throws IOException {
Path root = fileSystem.getPath("/opt/vespa");
Path nginxConf = root.resolve("conf/nginx/nginx.conf.template");
Files.createDirectories(nginxConf.getParent());
Files.write(nginxConf, "".getBytes(StandardCharsets.UTF_8));
DataplaneProxyService service = new DataplaneProxyService(root, proxyCommands, 100);
return service;
}
private DataplaneProxyConfig proxyConfig() {
X509CertificateWithKey selfSigned = X509CertificateUtils.createSelfSigned("cn=test", Duration.ofMinutes(10));
return new DataplaneProxyConfig.Builder()
.mtlsPort(1234)
.tokenPort(1235)
.serverCertificate(X509CertificateUtils.toPem(selfSigned.certificate()))
.serverKey(KeyUtils.toPem(selfSigned.privateKey()))
.build();
}
private DataplaneProxyCredentials credentials(FileSystem fileSystem) {
Path path = fileSystem.getPath("/tmp");
uncheck(() -> Files.createDirectories(path));
return new DataplaneProxyCredentials(path.resolve("cert.pem"), path.resolve("key.pem"));
}
private static class TestProxyCommands implements DataplaneProxyService.ProxyCommands {
private boolean running = false;
@Override
public void start(Path configFile) {
running = true;
}
@Override
public void stop() {
running = false;
}
@Override
public void reload() {
}
@Override
public boolean isRunning() {
return running;
}
}
}
|
