Skip to content

Commit 9b839f2

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #2076 from meyskens/meyskens/aditional-referencegrant-tests
conformance against invalid ReferenceGrants in HTTPRoute and TLSRoute
2 parents 8f43a27 + e3c6ccc commit 9b839f2

9 files changed

+497
-0
lines changed

‎conformance/base/manifests.yaml

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -307,6 +307,68 @@ metadata:
307307
---
308308
apiVersion: v1
309309
kind: Service
310+
metadata:
311+
name: tls-backend
312+
namespace: gateway-conformance-app-backend
313+
spec:
314+
selector:
315+
app: tls-backend
316+
ports:
317+
- protocol: TCP
318+
port: 443
319+
targetPort: 8443
320+
---
321+
apiVersion: apps/v1
322+
kind: Deployment
323+
metadata:
324+
name: tls-backend
325+
namespace: gateway-conformance-app-backend
326+
labels:
327+
app: tls-backend
328+
spec:
329+
replicas: 1
330+
selector:
331+
matchLabels:
332+
app: tls-backend
333+
template:
334+
metadata:
335+
labels:
336+
app: tls-backend
337+
spec:
338+
containers:
339+
- name: tls-backend
340+
image: gcr.io/k8s-staging-ingressconformance/echoserver:v20221109-7ee2f3e
341+
volumeMounts:
342+
- name: secret-volume
343+
mountPath: /etc/secret-volume
344+
env:
345+
- name: POD_NAME
346+
valueFrom:
347+
fieldRef:
348+
fieldPath: metadata.name
349+
- name: NAMESPACE
350+
valueFrom:
351+
fieldRef:
352+
fieldPath: metadata.namespace
353+
- name: TLS_SERVER_CERT
354+
value: /etc/secret-volume/crt
355+
- name: TLS_SERVER_PRIVKEY
356+
value: /etc/secret-volume/key
357+
resources:
358+
requests:
359+
cpu: 10m
360+
volumes:
361+
- name: secret-volume
362+
secret:
363+
secretName: tls-passthrough-checks-certificate
364+
items:
365+
- key: tls.crt
366+
path: crt
367+
- key: tls.key
368+
path: key
369+
---
370+
apiVersion: v1
371+
kind: Service
310372
metadata:
311373
name: app-backend-v1
312374
namespace: gateway-conformance-app-backend

‎conformance/tests/httproute-invalid-reference-grant.go

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
/*
2+
Copyright 2023 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package tests
18+
19+
import (
20+
"testing"
21+
22+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
23+
"k8s.io/apimachinery/pkg/types"
24+
25+
"sigs.k8s.io/gateway-api/apis/v1beta1"
26+
"sigs.k8s.io/gateway-api/conformance/utils/http"
27+
"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
28+
"sigs.k8s.io/gateway-api/conformance/utils/suite"
29+
)
30+
31+
func init() {
32+
ConformanceTests = append(ConformanceTests, HTTPRouteInvalidReferenceGrant)
33+
}
34+
35+
var HTTPRouteInvalidReferenceGrant = suite.ConformanceTest{
36+
ShortName: "HTTPRouteInvalidReferenceGrant",
37+
Description: "A single HTTPRoute in the gateway-conformance-infra namespace, with a backendRef in another namespace without valid ReferenceGrant, should have the ResolvedRefs condition set to False and not forward HTTP requests to any backend",
38+
Features: []suite.SupportedFeature{
39+
suite.SupportGateway,
40+
suite.SupportHTTPRoute,
41+
suite.SupportReferenceGrant,
42+
},
43+
Manifests: []string{"tests/httproute-invalid-reference-grant.yaml"},
44+
Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
45+
routeNN := types.NamespacedName{Name: "reference-grant", Namespace: "gateway-conformance-infra"}
46+
gwNN := types.NamespacedName{Name: "same-namespace", Namespace: "gateway-conformance-infra"}
47+
gwAddr := kubernetes.GatewayAndHTTPRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), routeNN)
48+
49+
t.Run("HTTPRoute with BackendRef in another namespace and no ReferenceGrant covering the Service has a ResolvedRefs Condition with status False and Reason RefNotPermitted", func(t *testing.T) {
50+
resolvedRefsCond := metav1.Condition{
51+
Type: string(v1beta1.RouteConditionResolvedRefs),
52+
Status: metav1.ConditionFalse,
53+
Reason: string(v1beta1.RouteReasonRefNotPermitted),
54+
}
55+
56+
kubernetes.HTTPRouteMustHaveCondition(t, suite.Client, suite.TimeoutConfig, routeNN, gwNN, resolvedRefsCond)
57+
})
58+
59+
t.Run("Simple HTTP request not should reach web-backend", func(t *testing.T) {
60+
http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, http.ExpectedResponse{
61+
Request: http.Request{
62+
Method: "GET",
63+
Path: "/",
64+
},
65+
Response: http.Response{StatusCode: 500},
66+
Backend: "web-backend",
67+
Namespace: "gateway-conformance-web-backend",
68+
})
69+
})
70+
},
71+
}

‎conformance/tests/httproute-invalid-reference-grant.yaml

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
---
2+
apiVersion: gateway.networking.k8s.io/v1beta1
3+
kind: ReferenceGrant
4+
metadata:
5+
name: reference-grant-wrong-namespace
6+
namespace: gateway-conformance-infra
7+
spec:
8+
from:
9+
- group: gateway.networking.k8s.io
10+
kind: HTTPRoute
11+
namespace: gateway-conformance-infra
12+
to:
13+
- group: ""
14+
kind: Service
15+
name: web-backend
16+
---
17+
apiVersion: gateway.networking.k8s.io/v1beta1
18+
kind: ReferenceGrant
19+
metadata:
20+
name: reference-grant-wrong-from-group
21+
namespace: gateway-conformance-web-backend
22+
spec:
23+
from:
24+
- group: not-the-group-youre-looking-for
25+
kind: HTTPRoute
26+
namespace: gateway-conformance-infra
27+
to:
28+
- group: ""
29+
kind: Service
30+
name: web-backend
31+
---
32+
apiVersion: gateway.networking.k8s.io/v1beta1
33+
kind: ReferenceGrant
34+
metadata:
35+
name: reference-grant-wrong-from-kind
36+
namespace: gateway-conformance-web-backend
37+
spec:
38+
from:
39+
- group: gateway.networking.k8s.io
40+
kind: Gateway
41+
namespace: gateway-conformance-infra
42+
to:
43+
- group: ""
44+
kind: Service
45+
name: web-backend
46+
---
47+
apiVersion: gateway.networking.k8s.io/v1beta1
48+
kind: ReferenceGrant
49+
metadata:
50+
name: reference-grant-wrong-from-namespace
51+
namespace: gateway-conformance-web-backend
52+
spec:
53+
from:
54+
- group: gateway.networking.k8s.io
55+
kind: HTTPRoute
56+
namespace: not-the-namespace-youre-looking-for
57+
to:
58+
- group: ""
59+
kind: Service
60+
name: web-backend
61+
---
62+
apiVersion: gateway.networking.k8s.io/v1beta1
63+
kind: ReferenceGrant
64+
metadata:
65+
name: reference-grant-wrong-to-group
66+
namespace: gateway-conformance-web-backend
67+
spec:
68+
from:
69+
- group: gateway.networking.k8s.io
70+
kind: HTTPRoute
71+
namespace: gateway-conformance-infra
72+
to:
73+
- group: not-the-group-youre-looking-for
74+
kind: Service
75+
name: web-backend
76+
---
77+
apiVersion: gateway.networking.k8s.io/v1beta1
78+
kind: ReferenceGrant
79+
metadata:
80+
name: reference-grant-wrong-to-kind
81+
namespace: gateway-conformance-web-backend
82+
spec:
83+
from:
84+
- group: gateway.networking.k8s.io
85+
kind: HTTPRoute
86+
namespace: gateway-conformance-infra
87+
to:
88+
- group: ""
89+
kind: Secret
90+
name: web-backend
91+
---
92+
apiVersion: gateway.networking.k8s.io/v1beta1
93+
kind: ReferenceGrant
94+
metadata:
95+
name: reference-grant-wrong-to-name
96+
namespace: gateway-conformance-web-backend
97+
spec:
98+
from:
99+
- group: gateway.networking.k8s.io
100+
kind: HTTPRoute
101+
namespace: gateway-conformance-infra
102+
to:
103+
- group: ""
104+
kind: Secret
105+
name: not-the-service-youre-looking-for
106+
---
107+
apiVersion: gateway.networking.k8s.io/v1beta1
108+
kind: HTTPRoute
109+
metadata:
110+
name: reference-grant
111+
namespace: gateway-conformance-infra
112+
spec:
113+
parentRefs:
114+
- name: same-namespace
115+
rules:
116+
- backendRefs:
117+
- name: web-backend
118+
namespace: gateway-conformance-web-backend
119+
port: 8080

‎conformance/tests/tlsroute-invalid-reference-grant.go

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
/*
2+
Copyright 2023 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package tests
18+
19+
import (
20+
"testing"
21+
22+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
23+
"k8s.io/apimachinery/pkg/types"
24+
25+
"sigs.k8s.io/gateway-api/apis/v1beta1"
26+
"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
27+
"sigs.k8s.io/gateway-api/conformance/utils/suite"
28+
)
29+
30+
func init() {
31+
ConformanceTests = append(ConformanceTests, TLSRouteInvalidReferenceGrant)
32+
}
33+
34+
var TLSRouteInvalidReferenceGrant = suite.ConformanceTest{
35+
ShortName: "TLSRouteInvalidReferenceGrant",
36+
Description: "A single TLSRoute in the gateway-conformance-infra namespace, with a backendRef in another namespace without valid ReferenceGrant, should have the ResolvedRefs condition set to False",
37+
Features: []suite.SupportedFeature{
38+
suite.SupportGateway,
39+
suite.SupportTLSRoute,
40+
suite.SupportReferenceGrant,
41+
},
42+
Manifests: []string{"tests/tlsroute-invalid-reference-grant.yaml"},
43+
Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
44+
routeNN := types.NamespacedName{Name: "gateway-conformance-infra-test", Namespace: "gateway-conformance-infra"}
45+
gwNN := types.NamespacedName{Name: "gateway-tlsroute-referencegrant", Namespace: "gateway-conformance-infra"}
46+
47+
kubernetes.GatewayAndTLSRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), routeNN)
48+
49+
t.Run("TLSRoute with BackendRef in another namespace and no ReferenceGrant covering the Service has a ResolvedRefs Condition with status False and Reason RefNotPermitted", func(t *testing.T) {
50+
resolvedRefsCond := metav1.Condition{
51+
Type: string(v1beta1.RouteConditionResolvedRefs),
52+
Status: metav1.ConditionFalse,
53+
Reason: string(v1beta1.RouteReasonRefNotPermitted),
54+
}
55+
56+
kubernetes.TLSRouteMustHaveCondition(t, suite.Client, suite.TimeoutConfig, routeNN, gwNN, resolvedRefsCond)
57+
})
58+
},
59+
}

0 commit comments

Comments
 (0)