feat(policy): add possibility to target real MeshExternalService in MeshTimeout

pkg/plugins/policies/meshtimeout/api/v1alpha1/validator.go

@@ -82,11 +82,13 @@ func validateTo(to []To, topLevelKind common_api.TargetRefKind) validators.Valid
 		case common_api.MeshHTTPRoute, common_api.MeshGateway:
 			supportedKinds = []common_api.TargetRefKind{
 				common_api.Mesh,
+				common_api.MeshExternalService,
 			}
 		default:
 			supportedKinds = []common_api.TargetRefKind{
 				common_api.Mesh,
 				common_api.MeshService,
+				common_api.MeshExternalService,
 				common_api.MeshMultiZoneService,
 			}
 		}

pkg/plugins/policies/meshtimeout/plugin/testdata/real_mesh_external_service.cluster.golden.yaml

@@ -0,0 +1,9 @@
+connectTimeout: 10s
+name: backend
+typedExtensionProtocolOptions:
+  envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+    '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+    commonHttpProtocolOptions:
+      idleTimeout: 3600s
+      maxConnectionDuration: 1080s
+      maxStreamDuration: 420s

pkg/plugins/policies/meshtimeout/plugin/testdata/real_mesh_external_service.listener.golden.yaml

@@ -0,0 +1,38 @@
+address:
+  socketAddress:
+    address: 127.0.0.1
+    portValue: 10001
+filterChains:
+- filters:
+  - name: envoy.filters.network.http_connection_manager
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+      commonHttpProtocolOptions:
+        idleTimeout: 0s
+      httpFilters:
+      - name: envoy.filters.http.router
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+      requestHeadersTimeout: 0s
+      routeConfig:
+        name: outbound:backend
+        requestHeadersToAdd:
+        - header:
+            key: x-kuma-tags
+            value: '&kuma.io/service=web&'
+        validateClusters: false
+        virtualHosts:
+        - domains:
+          - '*'
+          name: backend
+          routes:
+          - match:
+              prefix: /
+            name: 9Zuf5Tg79OuZcQITwBbQykxAk2u4fRKrwYn3//AL4Yo=
+            route:
+              cluster: backend
+              idleTimeout: 9s
+              timeout: 99s
+      statPrefix: outbound_127_0_0_1_10001
+name: outbound:127.0.0.1:10001
+trafficDirection: OUTBOUND

pkg/plugins/policies/meshtimeout/plugin/v1alpha1/plugin_test.go

@@ -49,6 +49,17 @@ var _ = Describe("MeshTimeout", func() {
 		SectionName:  "",
 	}
 
+	backendMeshExternalServiceIdentifier := core_rules.UniqueResourceIdentifier{
+		ResourceIdentifier: core_model.ResourceIdentifier{
+			Name:      "backend",
+			Mesh:      "default",
+			Namespace: "backend-ns",
+			Zone:      "zone-1",
+		},
+		ResourceType: "MeshExternalService",
+		SectionName:  "",
+	}
+
 	type sidecarTestCase struct {
 		resources         []core_xds.Resource
 		toRules           core_rules.ToRules
@@ -471,6 +482,44 @@ var _ = Describe("MeshTimeout", func() {
 			expectedListeners: []string{"real_mesh_service.listener.golden.yaml"},
 			expectedClusters:  []string{"real_mesh_service.cluster.golden.yaml"},
 		}),
+		Entry("targeting real MeshExternalService", sidecarTestCase{
+			resources: []core_xds.Resource{
+				{
+					Name:           "outbound",
+					Origin:         generator.OriginOutbound,
+					Resource:       httpOutboundListener(),
+					Protocol:       core_mesh.ProtocolHTTP,
+					ResourceOrigin: &backendMeshExternalServiceIdentifier,
+				},
+				{
+					Name:           "outbound",
+					Origin:         generator.OriginOutbound,
+					Resource:       test_xds.ClusterWithName("backend"),
+					Protocol:       core_mesh.ProtocolHTTP,
+					ResourceOrigin: &backendMeshExternalServiceIdentifier,
+				},
+			},
+			toRules: core_rules.ToRules{
+				ResourceRules: map[core_rules.UniqueResourceIdentifier]core_rules.ResourceRule{
+					backendMeshExternalServiceIdentifier: {
+						Conf: []interface{}{
+							api.Conf{
+								ConnectionTimeout: test.ParseDuration("10s"),
+								IdleTimeout:       test.ParseDuration("1h"),
+								Http: &api.Http{
+									RequestTimeout:        test.ParseDuration("99s"),
+									StreamIdleTimeout:     test.ParseDuration("9s"),
+									MaxStreamDuration:     test.ParseDuration("7m"),
+									MaxConnectionDuration: test.ParseDuration("18m"),
+								},
+							},
+						},
+					},
+				},
+			},
+			expectedListeners: []string{"real_mesh_external_service.listener.golden.yaml"},
+			expectedClusters:  []string{"real_mesh_external_service.cluster.golden.yaml"},
+		}),
 	)
 
 	type gatewayTestCase struct {

test/e2e_env/universal/meshexternalservice/meshexternalservice.go

@@ -3,6 +3,7 @@ package meshexternalservice
 import (
 	"encoding/base64"
 	"fmt"
+	"time"
 
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
@@ -96,18 +97,20 @@ routing:
 			Install(DemoClientUniversal("mes-demo-client-no-defaults", meshNameNoDefaults, WithTransparentProxy(true))).
 			Setup(universal.Cluster)
 		Expect(err).ToNot(HaveOccurred())
+	})
+
+	AfterEachFailure(func() {
+		DebugUniversal(universal.Cluster, meshNameNoDefaults)
+	})
 
+	BeforeEach(func() {
 		Expect(DeleteMeshResources(universal.Cluster, meshNameNoDefaults,
 			meshretry_api.MeshRetryResourceTypeDescriptor,
 			meshtimeout_api.MeshTimeoutResourceTypeDescriptor,
 			meshcircuitbreaker_api.MeshCircuitBreakerResourceTypeDescriptor,
 		)).To(Succeed())
 	})
 
-	AfterEachFailure(func() {
-		DebugUniversal(universal.Cluster, meshNameNoDefaults)
-	})
-
 	E2EAfterAll(func() {
 		Expect(universal.Cluster.DeleteMeshApps(meshNameNoDefaults)).To(Succeed())
 		Expect(universal.Cluster.DeleteMesh(meshNameNoDefaults)).To(Succeed())
@@ -178,26 +181,11 @@ routing:
 				// then accessing the secured external service succeeds
 				checkSuccessfulRequest("http://ext-srv-tls.extsvc.mesh.local", clientName, Not(ContainSubstring("HTTPS")))
 			})
-
-			It("should route to mesh-external-service with same hostname but different ports", func() {
-				err := universal.Cluster.Install(ResourceUniversal(meshExternalService("ext-srv-1", esHttpContainerName, meshName, 80, false, nil)))
-				Expect(err).ToNot(HaveOccurred())
-
-				err = universal.Cluster.Install(ResourceUniversal(meshExternalService("ext-srv-2", esHttp2ContainerName, meshName, 81, false, nil)))
-				Expect(err).ToNot(HaveOccurred())
-
-				// when access the first external service with .mesh
-				checkSuccessfulRequest("ext-srv-1.extsvc.mesh.local", clientName,
-					And(Not(ContainSubstring("HTTPS")), ContainSubstring("mes-http")))
-
-				checkSuccessfulRequest("ext-srv-2.extsvc.mesh.local", clientName,
-					And(Not(ContainSubstring("HTTPS")), ContainSubstring("mes-http-2")))
-			})
 		})
 	}
 
 	Context("MeshExternalService with MeshRetry", func() {
-		E2EAfterAll(func() {
+		E2EAfterEach(func() {
 			Expect(DeleteMeshResources(universal.Cluster, meshNameNoDefaults,
 				meshretry_api.MeshRetryResourceTypeDescriptor,
 				meshexternalservice_api.MeshExternalServiceResourceTypeDescriptor,
@@ -252,7 +240,7 @@ spec:
 
 				g.Expect(err).ToNot(HaveOccurred())
 				g.Expect(response.ResponseCode).To(Equal(503))
-			}, "10s", "100ms").Should(Succeed())
+			}, "30s", "100ms").Should(Succeed())
 
 			By("Apply a MeshRetry policy")
 			Expect(universal.Cluster.Install(YamlUniversal(meshRetryPolicy))).To(Succeed())
@@ -267,5 +255,75 @@ spec:
 		})
 	})
 
+	Context("MeshExternalService with MeshTimeout", func() {
+		E2EAfterEach(func() {
+			Expect(DeleteMeshResources(universal.Cluster, meshNameNoDefaults,
+				meshtimeout_api.MeshTimeoutResourceTypeDescriptor,
+				meshexternalservice_api.MeshExternalServiceResourceTypeDescriptor,
+			)).To(Succeed())
+		})
+
+		It("should target real MeshExternalService resource", func() {
+			meshExternalService := fmt.Sprintf(`
+type: MeshExternalService
+name: mes-timeout
+mesh: %s
+spec:
+  match:
+    type: HostnameGenerator
+    port: 80
+    protocol: http
+  endpoints:
+    - address: %s
+      port: 80
+`, meshNameNoDefaults, esHttpContainerName)
+			timeoutConfig := fmt.Sprintf(`
+type: MeshTimeout
+name: timeout-for-mes
+mesh: %s
+spec:
+  targetRef:
+    kind: Mesh
+  to:
+    - targetRef:
+        kind: MeshExternalService
+        name: mes-timeout
+      default:
+        idleTimeout: 20s
+        http:
+          requestTimeout: 2s
+          maxStreamDuration: 20s`, meshNameNoDefaults)
+
+			Expect(universal.Cluster.Install(YamlUniversal(meshExternalService))).To(Succeed())
+
+			// given no MeshTimeout
+			By("request should pass with the delay")
+			Eventually(func(g Gomega) {
+				start := time.Now()
+				_, err := client.CollectEchoResponse(
+					universal.Cluster, "mes-demo-client-no-defaults", "mes-timeout.extsvc.mesh.local",
+					client.WithHeader("x-set-response-delay-ms", "5000"),
+					client.WithMaxTime(10),
+				)
+				g.Expect(err).ToNot(HaveOccurred())
+				g.Expect(time.Since(start)).To(BeNumerically(">", time.Second*5))
+			}, "30s", "1s").Should(Succeed())
+
+			// when timeout applied
+			Expect(universal.Cluster.Install(YamlUniversal(timeoutConfig))).To(Succeed())
+
+			// then should timeout after 5 seconds
+			Eventually(func(g Gomega) {
+				response, err := client.CollectFailure(
+					universal.Cluster, "mes-demo-client-no-defaults", "mes-timeout.extsvc.mesh.local",
+					client.WithHeader("x-set-response-delay-ms", "5000"),
+					client.WithMaxTime(10),
+				)
+				g.Expect(err).ToNot(HaveOccurred())
+				g.Expect(response.ResponseCode).To(Equal(504))
+			}, "30s", "1s", MustPassRepeatedly(3)).Should(Succeed())
+		})
+	})
+
 	contextFor("without default policies", meshNameNoDefaults, "mes-demo-client-no-defaults")
 }