-
Notifications
You must be signed in to change notification settings - Fork 26
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* AuthorizationPolicy processor for ExtAuth * consolidate pkg * Revert "consolidate pkg" This reverts commit 4ffbcff. * ra * Final touches before integration tests * Add int tests * Fix withFrom * Add integration tests * Update oauth2-server-mock.yaml * Fix regex * Remove requirement for more than one rule * Add error log * Revert old features * Add validation * Revert revert tests * Adapt check to test ALLOW creation * Change path * Fix bad regex * Fix init for custom label * Docs * Add restricions doc * Add EOF * review suggestions * Apply suggestions from code review Co-authored-by: Natalia Sitko <[email protected]> * Apply documentation review remarks * Split code for external authorizer validation * Export CorsPolicyBuilder, because it is used by exported function. * Introduce hook to update Istio CR ext auth config as part of the test run * Introduce hook to update Istio CR ext auth config as part of the test run * Introduce hook to update Istio CR ext auth config as part of the test run * Store simplified ext-auth in v1beta1 and revert CRD validation * Fix lint error * Store all as annotation * Remove parentheses * Fix lint issue * Add yet another unit test * Update docs/release-notes/2.6.0.md Co-authored-by: Natalia Sitko <[email protected]> --------- Co-authored-by: Marek Kołodziejczak <[email protected]> Co-authored-by: Marek Kolodziejczak <[email protected]> Co-authored-by: Tim Riffer <[email protected]> Co-authored-by: Natalia Sitko <[email protected]> Co-authored-by: Tim Riffer <[email protected]>
- Loading branch information
6 people
authored
Sep 10, 2024
1 parent
ee87585
commit 19d1639
Showing
86 changed files
with
1,840 additions
and
691 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,124 @@ | ||
| package v2alpha1_test | ||
|
|
||
| import ( | ||
| apirulev1beta1 "github.com/kyma-project/api-gateway/apis/gateway/v1beta1" | ||
| apirulev2alpha1 "github.com/kyma-project/api-gateway/apis/gateway/v2alpha1" | ||
| v2alpha1 "github.com/kyma-project/api-gateway/internal/builders/builders_test/v2alpha1_test" | ||
| . "github.com/onsi/ginkgo/v2" | ||
| . "github.com/onsi/gomega" | ||
| ) | ||
|
|
||
| const annotationKey = "gateway.kyma-project.io/v2alpha1-rules" | ||
|
|
||
| var dummyExtAuthRule = v2alpha1.NewRuleBuilder(). | ||
| WithPath("/test"). | ||
| WithMethods("GET"). | ||
| WithExtAuth(v2alpha1.NewExtAuthBuilder(). | ||
| WithAuthorizers("test-authorizer"). | ||
| WithRestriction(&apirulev2alpha1.JwtConfig{ | ||
| Authentications: []*apirulev2alpha1.JwtAuthentication{ | ||
| { | ||
| Issuer: "test-issuer", | ||
| JwksUri: "test-jwks-uri", | ||
| FromHeaders: []*apirulev2alpha1.JwtHeader{ | ||
| { | ||
| Name: "test-header", | ||
| Prefix: "test-prefix", | ||
| }, | ||
| }, | ||
| FromParams: []string{"test-param"}, | ||
| }, | ||
| }, | ||
| Authorizations: nil, | ||
| }). | ||
| Build()). | ||
| Build() | ||
|
|
||
| var _ = Describe("ExtAuthStorage", func() { | ||
| It("Should store extAuth in v1beta1 through annotation and a rule with only handler name set", func() { | ||
| // given | ||
| v2alpha1APIRule := v2alpha1.NewAPIRuleBuilderWithDummyData().WithRules(dummyExtAuthRule).Build() | ||
|
|
||
| // when | ||
| var betaConverted apirulev1beta1.APIRule | ||
| err := v2alpha1APIRule.ConvertTo(&betaConverted) | ||
| Expect(err).ToNot(HaveOccurred()) | ||
|
|
||
| //then | ||
| annotations := betaConverted.GetAnnotations() | ||
| Expect(annotations).To(HaveKey(annotationKey)) | ||
| Expect(betaConverted.Spec.Rules).To(HaveLen(1)) | ||
| Expect(betaConverted.Spec.Rules[0].Path).To(Equal("/test")) | ||
| Expect(betaConverted.Spec.Rules[0].Methods).To(BeEquivalentTo([]apirulev1beta1.HttpMethod{"GET"})) | ||
| Expect(betaConverted.Spec.Rules[0].AccessStrategies).To(HaveLen(1)) | ||
| Expect(betaConverted.Spec.Rules[0].AccessStrategies[0].Handler.Name).To(BeEquivalentTo("ext-auth")) | ||
| Expect(betaConverted.Spec.Rules[0].AccessStrategies[0].Config).To(BeNil()) | ||
| }) | ||
| }) | ||
|
|
||
| var _ = Describe("ExtAuthConversion", func() { | ||
|
|
||
| DescribeTable("Should convert back and forth correctly with ExtAuth set", func(expectedRules []*apirulev2alpha1.Rule) { | ||
| // given | ||
| v2alpha1APIRule := v2alpha1.NewAPIRuleBuilderWithDummyData().WithRules(expectedRules...).Build() | ||
| var betaConverted apirulev1beta1.APIRule | ||
| err := v2alpha1APIRule.ConvertTo(&betaConverted) | ||
| Expect(err).ToNot(HaveOccurred()) | ||
|
|
||
| // when | ||
| var v2alpha1ConvertedRule apirulev2alpha1.APIRule | ||
| err = v2alpha1ConvertedRule.ConvertFrom(&betaConverted) | ||
|
|
||
| // then | ||
| Expect(err).ToNot(HaveOccurred()) | ||
| Expect(v2alpha1ConvertedRule.Spec.Rules).To(HaveLen(len(expectedRules))) | ||
| for i, rule := range v2alpha1ConvertedRule.Spec.Rules { | ||
| Expect(rule.Path).To(Equal(expectedRules[i].Path)) | ||
| Expect(rule.Methods).To(BeEquivalentTo(expectedRules[i].Methods)) | ||
| Expect(rule.Service).To(BeEquivalentTo(expectedRules[i].Service)) | ||
| Expect(rule.NoAuth).To(Equal(expectedRules[i].NoAuth)) | ||
| Expect(rule.Jwt != nil).To(Equal(expectedRules[i].Jwt != nil)) | ||
| if rule.Jwt != nil { | ||
| Expect(rule.Jwt.Authorizations).To(BeEquivalentTo(expectedRules[i].Jwt.Authorizations)) | ||
| Expect(rule.Jwt.Authentications).To(BeEquivalentTo(expectedRules[i].Jwt.Authentications)) | ||
| } | ||
| Expect(rule.ExtAuth != nil).To(Equal(expectedRules[i].ExtAuth != nil)) | ||
| if rule.ExtAuth != nil { | ||
| Expect(rule.ExtAuth.ExternalAuthorizers).To(BeEquivalentTo(expectedRules[i].ExtAuth.ExternalAuthorizers)) | ||
| Expect(rule.ExtAuth.Restrictions != nil).To(Equal(expectedRules[i].ExtAuth.Restrictions != nil)) | ||
| if rule.ExtAuth.Restrictions != nil { | ||
| Expect(rule.ExtAuth.Restrictions.Authentications).To(BeEquivalentTo(expectedRules[i].ExtAuth.Restrictions.Authentications)) | ||
| Expect(rule.ExtAuth.Restrictions.Authorizations).To(BeEquivalentTo(expectedRules[i].ExtAuth.Restrictions.Authorizations)) | ||
| } | ||
| } | ||
| } | ||
| }, | ||
| Entry("Should convert APIRule with no ExtAuth", []*apirulev2alpha1.Rule{}), | ||
| Entry("Should convert APIRule with only ExtAuth", []*apirulev2alpha1.Rule{dummyExtAuthRule}), | ||
| Entry("Should preserve order of rules when ExtAuth is in the middle", []*apirulev2alpha1.Rule{ | ||
| v2alpha1.NewRuleBuilder(). | ||
| WithPath("/first"). | ||
| NoAuth(). | ||
| Build(), | ||
| dummyExtAuthRule, | ||
| v2alpha1.NewRuleBuilder(). | ||
| WithPath("/third"). | ||
| NoAuth(). | ||
| Build(), | ||
| }), | ||
| Entry("Should preserve order of rules when ExtAuth is at the end", []*apirulev2alpha1.Rule{ | ||
| v2alpha1.NewRuleBuilder(). | ||
| WithPath("/first"). | ||
| NoAuth(). | ||
| Build(), | ||
| dummyExtAuthRule, | ||
| }), | ||
| Entry("Should preserve order of rules when ExtAuth is at the beginning", []*apirulev2alpha1.Rule{ | ||
| dummyExtAuthRule, | ||
| v2alpha1.NewRuleBuilder(). | ||
| WithPath("/second"). | ||
| NoAuth(). | ||
| Build(), | ||
| }), | ||
| ) | ||
| }) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.