diff --git a/cmd/dataplane/main.go b/cmd/dataplane/main.go index a1c4cbcc6f..65f898df69 100644 --- a/cmd/dataplane/main.go +++ b/cmd/dataplane/main.go @@ -18,11 +18,12 @@ package main import ( "fmt" - "github.com/prometheus/client_golang/prometheus" - "github.com/prometheus/client_golang/prometheus/collectors" "net/http" "os" + "github.com/prometheus/client_golang/prometheus" + "github.com/prometheus/client_golang/prometheus/collectors" + "k8s.io/klog/v2" "k8s.io/ingress-nginx/internal/ingress/controller" diff --git a/cmd/dbg/main.go b/cmd/dbg/main.go index 41a3c27726..b63bcf5fef 100644 --- a/cmd/dbg/main.go +++ b/cmd/dbg/main.go @@ -114,7 +114,6 @@ func main() { fmt.Println(err) os.Exit(1) } - } func backendsAll() { @@ -155,10 +154,16 @@ func backendsList() { fmt.Println(unmarshalErr) return } - backends := f.([]interface{}) + backends, ok := f.([]interface{}) + if !ok { + fmt.Printf("unexpected type: %T", f) + } for _, backendi := range backends { - backend := backendi.(map[string]interface{}) + backend, ok := backendi.(map[string]interface{}) + if !ok { + fmt.Printf("unexpected type: %T", backendi) + } fmt.Println(backend["name"].(string)) } } @@ -180,12 +185,22 @@ func backendsGet(name string) { fmt.Println(unmarshalErr) return } - backends := f.([]interface{}) + backends, ok := f.([]interface{}) + if !ok { + fmt.Printf("unexpected type: %T", f) + } for _, backendi := range backends { - backend := backendi.(map[string]interface{}) + backend, ok := backendi.(map[string]interface{}) + if !ok { + fmt.Printf("unexpected type: %T", backendi) + } if backend["name"].(string) == name { - printed, _ := json.MarshalIndent(backend, "", " ") + printed, err := json.MarshalIndent(backend, "", " ") + if err != nil { + fmt.Println(err) + return + } fmt.Println(string(printed)) return } @@ -213,18 +228,7 @@ func certGet(host string) { } func general() { - //TODO: refactor to obtain ingress-nginx pod count from the api server - /* - statusCode, body, requestErr := nginx.NewGetStatusRequest(generalPath) - if requestErr != nil { - fmt.Println(requestErr) - return - } - if statusCode != 200 { - fmt.Printf("Nginx returned code %v\n", statusCode) - return - } - */ + // TODO: refactor to obtain ingress-nginx pod count from the api server var prettyBuffer bytes.Buffer indentErr := json.Indent(&prettyBuffer, []byte("{}"), "", " ") diff --git a/cmd/nginx/logger.go b/cmd/nginx/logger.go index 13ec095fa7..323085c830 100644 --- a/cmd/nginx/logger.go +++ b/cmd/nginx/logger.go @@ -47,5 +47,4 @@ func logger(address string) { server.Wait() klog.Infof("Stopping logger") - } diff --git a/cmd/nginx/main.go b/cmd/nginx/main.go index 508e940e15..1d30091ef5 100644 --- a/cmd/nginx/main.go +++ b/cmd/nginx/main.go @@ -153,7 +153,6 @@ func main() { if errExists == nil { conf.IsChroot = true go logger(conf.InternalLoggerAddress) - } go metrics.StartHTTPServer(conf.HealthCheckHost, conf.ListenPorts.Health, mux) @@ -282,10 +281,10 @@ func checkService(key string, kubeClient *kubernetes.Clientset) error { } if errors.IsNotFound(err) { - return fmt.Errorf("No service with name %v found in namespace %v: %v", name, ns, err) + return fmt.Errorf("no service with name %v found in namespace %v: %v", name, ns, err) } - return fmt.Errorf("Unexpected error searching service with name %v in namespace %v: %v", name, ns, err) + return fmt.Errorf("unexpected error searching service with name %v in namespace %v: %v", name, ns, err) } return nil diff --git a/cmd/nginx/main_test.go b/cmd/nginx/main_test.go index f57c02c5e4..13f1e9eecb 100644 --- a/cmd/nginx/main_test.go +++ b/cmd/nginx/main_test.go @@ -47,7 +47,7 @@ func TestCreateApiserverClient(t *testing.T) { func init() { // the default value of nginx.TemplatePath assumes the template exists in // the root filesystem and not in the rootfs directory - path, err := filepath.Abs(filepath.Join("../../rootfs/", nginx.TemplatePath)) + path, err := filepath.Abs(filepath.Join("..", "..", "rootfs", nginx.TemplatePath)) if err == nil { nginx.TemplatePath = path } @@ -87,14 +87,14 @@ func TestHandleSigterm(t *testing.T) { ingressflags.ResetForTesting(func() { t.Fatal("bad parse") }) - os.Setenv("POD_NAME", podName) - os.Setenv("POD_NAMESPACE", namespace) + t.Setenv("POD_NAME", podName) + t.Setenv("POD_NAMESPACE", namespace) oldArgs := os.Args defer func() { - os.Setenv("POD_NAME", "") - os.Setenv("POD_NAMESPACE", "") + t.Setenv("POD_NAME", "") + t.Setenv("POD_NAMESPACE", "") os.Args = oldArgs }() diff --git a/cmd/plugin/commands/backends/backends.go b/cmd/plugin/commands/backends/backends.go index afc98e4d6d..ff44fd9c21 100644 --- a/cmd/plugin/commands/backends/backends.go +++ b/cmd/plugin/commands/backends/backends.go @@ -63,13 +63,14 @@ func CreateCommand(flags *genericclioptions.ConfigFlags) *cobra.Command { return cmd } -func backends(flags *genericclioptions.ConfigFlags, podName string, deployment string, selector string, container string, backend string, onlyList bool) error { +func backends(flags *genericclioptions.ConfigFlags, podName, deployment, selector, container, backend string, onlyList bool) error { var command []string - if onlyList { + switch { + case onlyList: command = []string{"/dbg", "backends", "list"} - } else if backend != "" { + case backend != "": command = []string{"/dbg", "backends", "get", backend} - } else { + default: command = []string{"/dbg", "backends", "all"} } diff --git a/cmd/plugin/commands/certs/certs.go b/cmd/plugin/commands/certs/certs.go index 1f08b52169..ee27cf1b12 100644 --- a/cmd/plugin/commands/certs/certs.go +++ b/cmd/plugin/commands/certs/certs.go @@ -59,7 +59,7 @@ func CreateCommand(flags *genericclioptions.ConfigFlags) *cobra.Command { return cmd } -func certs(flags *genericclioptions.ConfigFlags, podName string, deployment string, selector string, container string, host string) error { +func certs(flags *genericclioptions.ConfigFlags, podName, deployment, selector, container, host string) error { command := []string{"/dbg", "certs", "get", host} pod, err := request.ChoosePod(flags, podName, deployment, selector) diff --git a/cmd/plugin/commands/conf/conf.go b/cmd/plugin/commands/conf/conf.go index a7f03a0627..090fb40bb5 100644 --- a/cmd/plugin/commands/conf/conf.go +++ b/cmd/plugin/commands/conf/conf.go @@ -55,7 +55,7 @@ func CreateCommand(flags *genericclioptions.ConfigFlags) *cobra.Command { return cmd } -func conf(flags *genericclioptions.ConfigFlags, host string, podName string, deployment string, selector string, container string) error { +func conf(flags *genericclioptions.ConfigFlags, host, podName, deployment, selector, container string) error { pod, err := request.ChoosePod(flags, podName, deployment, selector) if err != nil { return err diff --git a/cmd/plugin/commands/exec/exec.go b/cmd/plugin/commands/exec/exec.go index f06aaeb230..8e853c5344 100644 --- a/cmd/plugin/commands/exec/exec.go +++ b/cmd/plugin/commands/exec/exec.go @@ -55,7 +55,7 @@ type execFlags struct { Stdin bool } -func exec(flags *genericclioptions.ConfigFlags, podName string, deployment string, selector string, container string, cmd []string, opts execFlags) error { +func exec(flags *genericclioptions.ConfigFlags, podName, deployment, selector, container string, cmd []string, opts execFlags) error { pod, err := request.ChoosePod(flags, podName, deployment, selector) if err != nil { return err diff --git a/cmd/plugin/commands/general/general.go b/cmd/plugin/commands/general/general.go index fa6c1301f2..cea4035625 100644 --- a/cmd/plugin/commands/general/general.go +++ b/cmd/plugin/commands/general/general.go @@ -47,7 +47,7 @@ func CreateCommand(flags *genericclioptions.ConfigFlags) *cobra.Command { return cmd } -func general(flags *genericclioptions.ConfigFlags, podName string, deployment string, selector string, container string) error { +func general(flags *genericclioptions.ConfigFlags, podName, deployment, selector, container string) error { pod, err := request.ChoosePod(flags, podName, deployment, selector) if err != nil { return err diff --git a/cmd/plugin/commands/ingresses/ingresses.go b/cmd/plugin/commands/ingresses/ingresses.go index dff9671038..8a25418db1 100644 --- a/cmd/plugin/commands/ingresses/ingresses.go +++ b/cmd/plugin/commands/ingresses/ingresses.go @@ -74,9 +74,9 @@ func ingresses(flags *genericclioptions.ConfigFlags, host string, allNamespaces if host != "" { rowsWithHost := make([]ingressRow, 0) - for _, row := range rows { - if row.Host == host { - rowsWithHost = append(rowsWithHost, row) + for i := range rows { + if rows[i].Host == host { + rowsWithHost = append(rowsWithHost, rows[i]) } } rows = rowsWithHost @@ -91,7 +91,8 @@ func ingresses(flags *genericclioptions.ConfigFlags, host string, allNamespaces fmt.Fprintln(printer, "INGRESS NAME\tHOST+PATH\tADDRESSES\tTLS\tSERVICE\tSERVICE PORT\tENDPOINTS") } - for _, row := range rows { + for i := range rows { + row := &rows[i] var tlsMsg string if row.TLS { tlsMsg = "YES" @@ -134,8 +135,8 @@ type ingressRow struct { func getIngressRows(ingresses *[]networking.Ingress) []ingressRow { rows := make([]ingressRow, 0) - for _, ing := range *ingresses { - + for i := range *ingresses { + ing := &(*ingresses)[i] address := "" for _, lbIng := range ing.Status.LoadBalancer.Ingress { if len(lbIng.IP) > 0 { @@ -182,7 +183,7 @@ func getIngressRows(ingresses *[]networking.Ingress) []ingressRow { for _, rule := range ing.Spec.Rules { _, hasTLS := tlsHosts[rule.Host] - //Handle ingress with no paths + // Handle ingress with no paths if rule.HTTP == nil { row := ingressRow{ Namespace: ing.Namespace, diff --git a/cmd/plugin/commands/ingresses/ingresses_test.go b/cmd/plugin/commands/ingresses/ingresses_test.go index 6a8d8837ff..7a90efe462 100644 --- a/cmd/plugin/commands/ingresses/ingresses_test.go +++ b/cmd/plugin/commands/ingresses/ingresses_test.go @@ -24,7 +24,6 @@ import ( ) func TestGetIngressInformation(t *testing.T) { - testcases := map[string]struct { ServiceBackend *networking.IngressServiceBackend wantName string diff --git a/cmd/plugin/commands/lint/main.go b/cmd/plugin/commands/lint/main.go index 2daf8eb870..847fe86c9a 100644 --- a/cmd/plugin/commands/lint/main.go +++ b/cmd/plugin/commands/lint/main.go @@ -111,11 +111,13 @@ type lintOptions struct { } func (opts *lintOptions) Validate() error { + //nolint:dogsled // Ignore 3 blank identifiers _, _, _, err := util.ParseVersionString(opts.versionFrom) if err != nil { return err } + //nolint:dogsled // Ignore 3 blank identifiers _, _, _, err = util.ParseVersionString(opts.versionTo) if err != nil { return err @@ -131,9 +133,9 @@ type lint interface { Version() string } -func checkObjectArray(lints []lint, objects []kmeta.Object, opts lintOptions) { +func checkObjectArray(allLints []lint, objects []kmeta.Object, opts lintOptions) { usedLints := make([]lint, 0) - for _, lint := range lints { + for _, lint := range allLints { lintVersion := lint.Version() if lint.Version() == "" { lintVersion = "0.0.0" @@ -189,7 +191,7 @@ func ingresses(opts lintOptions) error { return err } - var iLints []lints.IngressLint = lints.GetIngressLints() + iLints := lints.GetIngressLints() genericLints := make([]lint, len(iLints)) for i := range iLints { genericLints[i] = iLints[i] @@ -216,7 +218,7 @@ func deployments(opts lintOptions) error { return err } - var iLints []lints.DeploymentLint = lints.GetDeploymentLints() + iLints := lints.GetDeploymentLints() genericLints := make([]lint, len(iLints)) for i := range iLints { genericLints[i] = iLints[i] diff --git a/cmd/plugin/commands/logs/logs.go b/cmd/plugin/commands/logs/logs.go index 56f4fc640f..22068d469e 100644 --- a/cmd/plugin/commands/logs/logs.go +++ b/cmd/plugin/commands/logs/logs.go @@ -95,7 +95,7 @@ func (o *logsFlags) toStrings() []string { return r } -func logs(flags *genericclioptions.ConfigFlags, podName string, deployment string, selector string, container string, opts logsFlags) error { +func logs(flags *genericclioptions.ConfigFlags, podName, deployment, selector, container string, opts logsFlags) error { pod, err := request.ChoosePod(flags, podName, deployment, selector) if err != nil { return err diff --git a/cmd/plugin/commands/ssh/ssh.go b/cmd/plugin/commands/ssh/ssh.go index fe1b3e9fe8..a4762d781f 100644 --- a/cmd/plugin/commands/ssh/ssh.go +++ b/cmd/plugin/commands/ssh/ssh.go @@ -45,7 +45,7 @@ func CreateCommand(flags *genericclioptions.ConfigFlags) *cobra.Command { return cmd } -func ssh(flags *genericclioptions.ConfigFlags, podName string, deployment string, selector string, container string) error { +func ssh(flags *genericclioptions.ConfigFlags, podName, deployment, selector, container string) error { pod, err := request.ChoosePod(flags, podName, deployment, selector) if err != nil { return err diff --git a/cmd/plugin/kubectl/kubectl.go b/cmd/plugin/kubectl/kubectl.go index 1171e92183..cb33243fc1 100644 --- a/cmd/plugin/kubectl/kubectl.go +++ b/cmd/plugin/kubectl/kubectl.go @@ -38,11 +38,11 @@ func PodExecString(flags *genericclioptions.ConfigFlags, pod *apiv1.Pod, contain // ExecToString runs a kubectl subcommand and returns stdout as a string func ExecToString(flags *genericclioptions.ConfigFlags, args []string) (string, error) { - kArgs := getKubectlConfigFlags(flags) - kArgs = append(kArgs, args...) + kubectlArgs := getKubectlConfigFlags(flags) + kubectlArgs = append(kubectlArgs, args...) buf := bytes.NewBuffer(make([]byte, 0)) - err := execToWriter(append([]string{"kubectl"}, kArgs...), buf) + err := execToWriter(append([]string{"kubectl"}, kubectlArgs...), buf) if err != nil { return "", err } @@ -51,9 +51,9 @@ func ExecToString(flags *genericclioptions.ConfigFlags, args []string) (string, // Exec replaces the current process with a kubectl invocation func Exec(flags *genericclioptions.ConfigFlags, args []string) error { - kArgs := getKubectlConfigFlags(flags) - kArgs = append(kArgs, args...) - return execCommand(append([]string{"kubectl"}, kArgs...)) + kubectlArgs := getKubectlConfigFlags(flags) + kubectlArgs = append(kubectlArgs, args...) + return execCommand(append([]string{"kubectl"}, kubectlArgs...)) } // Replaces the currently running process with the given command @@ -70,6 +70,7 @@ func execCommand(args []string) error { // Runs a command and returns stdout func execToWriter(args []string, writer io.Writer) error { + //nolint:gosec // Ignore G204 error cmd := exec.Command(args[0], args[1:]...) op, err := cmd.StdoutPipe() @@ -78,7 +79,7 @@ func execToWriter(args []string, writer io.Writer) error { } go func() { - io.Copy(writer, op) //nolint:errcheck + io.Copy(writer, op) //nolint:errcheck // Ignore the error }() err = cmd.Run() if err != nil { @@ -106,7 +107,6 @@ func getKubectlConfigFlags(flags *genericclioptions.ConfigFlags) []string { appendStringFlag(o, flags.Password, "password") appendStringFlag(o, flags.ClusterName, "cluster") appendStringFlag(o, flags.AuthInfoName, "user") - //appendStringFlag(o, flags.Namespace, "namespace") appendStringFlag(o, flags.Context, "context") appendStringFlag(o, flags.APIServer, "server") appendBoolFlag(o, flags.Insecure, "insecure-skip-tls-verify") @@ -128,7 +128,7 @@ func appendBoolFlag(out *[]string, in *bool, flag string) { } } -func appendStringArrayFlag(out *[]string, in *[]string, flag string) { +func appendStringArrayFlag(out, in *[]string, flag string) { if in != nil && len(*in) > 0 { *out = append(*out, fmt.Sprintf("--%v=%v'", flag, strings.Join(*in, ","))) } diff --git a/cmd/plugin/lints/deployment.go b/cmd/plugin/lints/deployment.go index a1c473f1e6..ce1712284b 100644 --- a/cmd/plugin/lints/deployment.go +++ b/cmd/plugin/lints/deployment.go @@ -35,7 +35,10 @@ type DeploymentLint struct { // Check returns true if the lint detects an issue func (lint DeploymentLint) Check(obj kmeta.Object) bool { - cmp := obj.(*v1.Deployment) + cmp, ok := obj.(*v1.Deployment) + if !ok { + util.PrintError(fmt.Errorf("unexpected type: %T", obj)) + } return lint.f(*cmp) } @@ -72,11 +75,11 @@ func removedFlag(flag string, issueNumber int, version string) DeploymentLint { issue: issueNumber, version: version, f: func(dep v1.Deployment) bool { - if !isIngressNginxDeployment(dep) { + if !isIngressNginxDeployment(&dep) { return false } - args := getNginxArgs(dep) + args := getNginxArgs(&dep) for _, arg := range args { if strings.HasPrefix(arg, fmt.Sprintf("--%v", flag)) { return true @@ -88,8 +91,9 @@ func removedFlag(flag string, issueNumber int, version string) DeploymentLint { } } -func getNginxArgs(dep v1.Deployment) []string { - for _, container := range dep.Spec.Template.Spec.Containers { +func getNginxArgs(dep *v1.Deployment) []string { + for i := range dep.Spec.Template.Spec.Containers { + container := &dep.Spec.Template.Spec.Containers[i] if len(container.Args) > 0 && container.Args[0] == "/nginx-ingress-controller" { return container.Args } @@ -97,10 +101,10 @@ func getNginxArgs(dep v1.Deployment) []string { return make([]string, 0) } -func isIngressNginxDeployment(dep v1.Deployment) bool { +func isIngressNginxDeployment(dep *v1.Deployment) bool { containers := dep.Spec.Template.Spec.Containers - for _, container := range containers { - if len(container.Args) > 0 && container.Args[0] == "/nginx-ingress-controller" { + for i := range containers { + if len(containers[i].Args) > 0 && containers[i].Args[0] == "/nginx-ingress-controller" { return true } } diff --git a/cmd/plugin/lints/ingress.go b/cmd/plugin/lints/ingress.go index ea08bfd8bc..d5ad42e2cd 100644 --- a/cmd/plugin/lints/ingress.go +++ b/cmd/plugin/lints/ingress.go @@ -30,13 +30,16 @@ type IngressLint struct { message string issue int version string - f func(ing networking.Ingress) bool + f func(ing *networking.Ingress) bool } // Check returns true if the lint detects an issue func (lint IngressLint) Check(obj kmeta.Object) bool { - ing := obj.(*networking.Ingress) - return lint.f(*ing) + ing, ok := obj.(*networking.Ingress) + if !ok { + util.PrintError(fmt.Errorf("unexpected type: %T", obj)) + } + return lint.f(ing) } // Message is a description of the lint @@ -94,7 +97,7 @@ func GetIngressLints() []IngressLint { } } -func xForwardedPrefixIsBool(ing networking.Ingress) bool { +func xForwardedPrefixIsBool(ing *networking.Ingress) bool { for name, val := range ing.Annotations { if strings.HasSuffix(name, "/x-forwarded-prefix") && (val == "true" || val == "false") { return true @@ -103,7 +106,7 @@ func xForwardedPrefixIsBool(ing networking.Ingress) bool { return false } -func annotationPrefixIsNginxCom(ing networking.Ingress) bool { +func annotationPrefixIsNginxCom(ing *networking.Ingress) bool { for name := range ing.Annotations { if strings.HasPrefix(name, "nginx.com/") { return true @@ -112,7 +115,7 @@ func annotationPrefixIsNginxCom(ing networking.Ingress) bool { return false } -func annotationPrefixIsNginxOrg(ing networking.Ingress) bool { +func annotationPrefixIsNginxOrg(ing *networking.Ingress) bool { for name := range ing.Annotations { if strings.HasPrefix(name, "nginx.org/") { return true @@ -121,7 +124,7 @@ func annotationPrefixIsNginxOrg(ing networking.Ingress) bool { return false } -func rewriteTargetWithoutCaptureGroup(ing networking.Ingress) bool { +func rewriteTargetWithoutCaptureGroup(ing *networking.Ingress) bool { for name, val := range ing.Annotations { if strings.HasSuffix(name, "/rewrite-target") && !strings.Contains(val, "$1") { return true @@ -135,7 +138,7 @@ func removedAnnotation(annotationName string, issueNumber int, version string) I message: fmt.Sprintf("Contains the removed %v annotation.", annotationName), issue: issueNumber, version: version, - f: func(ing networking.Ingress) bool { + f: func(ing *networking.Ingress) bool { for annotation := range ing.Annotations { if strings.HasSuffix(annotation, "/"+annotationName) { return true @@ -146,7 +149,7 @@ func removedAnnotation(annotationName string, issueNumber int, version string) I } } -func satisfyDirective(ing networking.Ingress) bool { +func satisfyDirective(ing *networking.Ingress) bool { for name, val := range ing.Annotations { if strings.HasSuffix(name, "/configuration-snippet") { return strings.Contains(val, "satisfy") diff --git a/cmd/plugin/main.go b/cmd/plugin/main.go index f3a809715f..e9a8ea59a5 100644 --- a/cmd/plugin/main.go +++ b/cmd/plugin/main.go @@ -24,7 +24,7 @@ import ( "k8s.io/cli-runtime/pkg/genericclioptions" - //Just importing this is supposed to allow cloud authentication + // Just importing this is supposed to allow cloud authentication // eg GCP, AWS, Azure ... _ "k8s.io/client-go/plugin/pkg/client/auth" diff --git a/cmd/plugin/request/request.go b/cmd/plugin/request/request.go index fd47564a90..55df85d5e0 100644 --- a/cmd/plugin/request/request.go +++ b/cmd/plugin/request/request.go @@ -35,7 +35,7 @@ import ( ) // ChoosePod finds a pod either by deployment or by name -func ChoosePod(flags *genericclioptions.ConfigFlags, podName string, deployment string, selector string) (apiv1.Pod, error) { +func ChoosePod(flags *genericclioptions.ConfigFlags, podName, deployment, selector string) (apiv1.Pod, error) { if podName != "" { return GetNamedPod(flags, podName) } @@ -54,9 +54,9 @@ func GetNamedPod(flags *genericclioptions.ConfigFlags, name string) (apiv1.Pod, return apiv1.Pod{}, err } - for _, pod := range allPods { - if pod.Name == name { - return pod, nil + for i := range allPods { + if allPods[i].Name == name { + return allPods[i], nil } } @@ -132,7 +132,7 @@ func GetIngressDefinitions(flags *genericclioptions.ConfigFlags, namespace strin } // GetNumEndpoints counts the number of endpointslices adresses for the service with the given name -func GetNumEndpoints(flags *genericclioptions.ConfigFlags, namespace string, serviceName string) (*int, error) { +func GetNumEndpoints(flags *genericclioptions.ConfigFlags, namespace, serviceName string) (*int, error) { epss, err := GetEndpointSlicesByName(flags, namespace, serviceName) if err != nil { return nil, err @@ -143,25 +143,26 @@ func GetNumEndpoints(flags *genericclioptions.ConfigFlags, namespace string, ser } ret := 0 - for _, eps := range epss { - for _, ep := range eps.Endpoints { - ret += len(ep.Addresses) + for i := range epss { + eps := &epss[i] + for j := range eps.Endpoints { + ret += len(eps.Endpoints[j].Addresses) } } return &ret, nil } // GetEndpointSlicesByName returns the endpointSlices for the service with the given name -func GetEndpointSlicesByName(flags *genericclioptions.ConfigFlags, namespace string, name string) ([]discoveryv1.EndpointSlice, error) { +func GetEndpointSlicesByName(flags *genericclioptions.ConfigFlags, namespace, name string) ([]discoveryv1.EndpointSlice, error) { allEndpointsSlices, err := getEndpointSlices(flags, namespace) if err != nil { return nil, err } var eps []discoveryv1.EndpointSlice - for _, slice := range allEndpointsSlices { - if svcName, ok := slice.ObjectMeta.GetLabels()[discoveryv1.LabelServiceName]; ok { + for i := range allEndpointsSlices { + if svcName, ok := allEndpointsSlices[i].ObjectMeta.GetLabels()[discoveryv1.LabelServiceName]; ok { if svcName == name { - eps = append(eps, slice) + eps = append(eps, allEndpointsSlices[i]) } } } @@ -182,7 +183,7 @@ func getEndpointSlices(flags *genericclioptions.ConfigFlags, namespace string) ( tryAllNamespacesEndpointSlicesCache(flags) } - cachedEndpointSlices = tryFilteringEndpointSlicesFromAllNamespacesCache(flags, namespace) + cachedEndpointSlices = tryFilteringEndpointSlicesFromAllNamespacesCache(namespace) if cachedEndpointSlices != nil { return *cachedEndpointSlices, nil @@ -217,13 +218,13 @@ func tryAllNamespacesEndpointSlicesCache(flags *genericclioptions.ConfigFlags) { } } -func tryFilteringEndpointSlicesFromAllNamespacesCache(flags *genericclioptions.ConfigFlags, namespace string) *[]discoveryv1.EndpointSlice { +func tryFilteringEndpointSlicesFromAllNamespacesCache(namespace string) *[]discoveryv1.EndpointSlice { allEndpointSlices := endpointSlicesCache[""] if allEndpointSlices != nil { endpointSlices := make([]discoveryv1.EndpointSlice, 0) - for _, slice := range *allEndpointSlices { - if slice.Namespace == namespace { - endpointSlices = append(endpointSlices, slice) + for i := range *allEndpointSlices { + if (*allEndpointSlices)[i].Namespace == namespace { + endpointSlices = append(endpointSlices, (*allEndpointSlices)[i]) } } endpointSlicesCache[namespace] = &endpointSlices @@ -242,9 +243,9 @@ func GetServiceByName(flags *genericclioptions.ConfigFlags, name string, service services = &servicesArray } - for _, svc := range *services { - if svc.Name == name { - return svc, nil + for i := range *services { + if (*services)[i].Name == name { + return (*services)[i], nil } } @@ -288,7 +289,6 @@ func getLabeledPods(flags *genericclioptions.ConfigFlags, label string) ([]apiv1 pods, err := api.Pods(namespace).List(context.TODO(), metav1.ListOptions{ LabelSelector: label, }) - if err != nil { return make([]apiv1.Pod, 0), err } @@ -303,9 +303,9 @@ func getDeploymentPods(flags *genericclioptions.ConfigFlags, deployment string) } ingressPods := make([]apiv1.Pod, 0) - for _, pod := range pods { - if util.PodInDeployment(pod, deployment) { - ingressPods = append(ingressPods, pod) + for i := range pods { + if util.PodInDeployment(&pods[i], deployment) { + ingressPods = append(ingressPods, pods[i]) } } @@ -331,5 +331,4 @@ func getServices(flags *genericclioptions.ConfigFlags) ([]apiv1.Service, error) } return services.Items, nil - } diff --git a/cmd/plugin/util/util.go b/cmd/plugin/util/util.go index e1910140da..aa753689aa 100644 --- a/cmd/plugin/util/util.go +++ b/cmd/plugin/util/util.go @@ -47,17 +47,25 @@ func PrintError(e error) { } // ParseVersionString returns the major, minor, and patch numbers of a version string -func ParseVersionString(v string) (int, int, int, error) { +func ParseVersionString(v string) (major, minor, patch int, err error) { parts := versionRegex.FindStringSubmatch(v) if len(parts) != 4 { return 0, 0, 0, fmt.Errorf("could not parse %v as a version string (like 0.20.3)", v) } - major, _ := strconv.Atoi(parts[1]) - minor, _ := strconv.Atoi(parts[2]) - patch, _ := strconv.Atoi(parts[3]) - + major, err = strconv.Atoi(parts[1]) + if err != nil { + return 0, 0, 0, err + } + minor, err = strconv.Atoi(parts[2]) + if err != nil { + return 0, 0, 0, err + } + patch, err = strconv.Atoi(parts[3]) + if err != nil { + return 0, 0, 0, err + } return major, minor, patch, nil } @@ -90,7 +98,7 @@ func isVersionLessThan(a, b string) bool { // PodInDeployment returns whether a pod is part of a deployment with the given name // a pod is considered to be in {deployment} if it is owned by a replicaset with a name of format {deployment}-otherchars -func PodInDeployment(pod apiv1.Pod, deployment string) bool { +func PodInDeployment(pod *apiv1.Pod, deployment string) bool { for _, owner := range pod.OwnerReferences { if owner.Controller == nil || !*owner.Controller || owner.Kind != "ReplicaSet" { continue @@ -138,7 +146,7 @@ func AddContainerFlag(cmd *cobra.Command) *string { // GetNamespace takes a set of kubectl flag values and returns the namespace we should be operating in func GetNamespace(flags *genericclioptions.ConfigFlags) string { namespace, _, err := flags.ToRawKubeConfigLoader().Namespace() - if err != nil || len(namespace) == 0 { + if err != nil || namespace == "" { namespace = apiv1.NamespaceDefault } return namespace diff --git a/docs/e2e-tests.md b/docs/e2e-tests.md index c45b1e72c0..398304c57c 100644 --- a/docs/e2e-tests.md +++ b/docs/e2e-tests.md @@ -716,7 +716,7 @@ Do not try to edit it manually. ### [[Flag] watch namespace selector](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/namespace_selector.go#L30) -- [should ingore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/namespace_selector.go#L63) +- [should ignore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/namespace_selector.go#L63) ### [[Security] no-auth-locations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L33) diff --git a/images/fastcgi-helloserver/rootfs/main.go b/images/fastcgi-helloserver/rootfs/main.go index a42c9a4879..710f90f2ce 100644 --- a/images/fastcgi-helloserver/rootfs/main.go +++ b/images/fastcgi-helloserver/rootfs/main.go @@ -16,13 +16,13 @@ func hello(w http.ResponseWriter, r *http.Request) { } key := keys[0] - fmt.Fprintf(w, "Hello "+string(key)+"!") + fmt.Fprintf(w, "Hello "+key+"!") } func main() { http.HandleFunc("/hello", hello) - l, err := net.Listen("tcp", "0.0.0.0:9000") + l, err := net.Listen("tcp", "0.0.0.0:9000") //nolint:gosec // Ignore the gosec error since it's a hello server if err != nil { panic(err) } diff --git a/images/go-grpc-greeter-server/rootfs/main.go b/images/go-grpc-greeter-server/rootfs/main.go index 569273dfdd..d7fc362086 100644 --- a/images/go-grpc-greeter-server/rootfs/main.go +++ b/images/go-grpc-greeter-server/rootfs/main.go @@ -41,7 +41,7 @@ type hwServer struct { } // SayHello implements helloworld.GreeterServer -func (s *hwServer) SayHello(ctx context.Context, in *hwpb.HelloRequest) (*hwpb.HelloReply, error) { +func (s *hwServer) SayHello(_ context.Context, in *hwpb.HelloRequest) (*hwpb.HelloReply, error) { return &hwpb.HelloReply{Message: "Hello " + in.Name}, nil } @@ -49,7 +49,7 @@ type ecServer struct { ecpb.UnimplementedEchoServer } -func (s *ecServer) UnaryEcho(ctx context.Context, req *ecpb.EchoRequest) (*ecpb.EchoResponse, error) { +func (s *ecServer) UnaryEcho(_ context.Context, req *ecpb.EchoRequest) (*ecpb.EchoResponse, error) { return &ecpb.EchoResponse{Message: req.Message}, nil } diff --git a/internal/admission/controller/main.go b/internal/admission/controller/main.go index f59bf2091c..888818c895 100644 --- a/internal/admission/controller/main.go +++ b/internal/admission/controller/main.go @@ -42,19 +42,16 @@ type IngressAdmission struct { Checker Checker } -var ( - ingressResource = metav1.GroupVersionKind{ - Group: networking.GroupName, - Version: "v1", - Kind: "Ingress", - } -) +var ingressResource = metav1.GroupVersionKind{ + Group: networking.GroupName, + Version: "v1", + Kind: "Ingress", +} // HandleAdmission populates the admission Response // with Allowed=false if the Object is an ingress that would prevent nginx to reload the configuration // with Allowed=true otherwise func (ia *IngressAdmission) HandleAdmission(obj runtime.Object) (runtime.Object, error) { - review, isV1 := obj.(*admissionv1.AdmissionReview) if !isV1 { return nil, fmt.Errorf("request is not of type AdmissionReview v1 or v1beta1") diff --git a/internal/admission/controller/main_test.go b/internal/admission/controller/main_test.go index 8c42f87efe..1d223cc9e9 100644 --- a/internal/admission/controller/main_test.go +++ b/internal/admission/controller/main_test.go @@ -33,12 +33,12 @@ type failTestChecker struct { t *testing.T } -func (ftc failTestChecker) CheckIngress(ing *networking.Ingress) error { +func (ftc failTestChecker) CheckIngress(_ *networking.Ingress) error { ftc.t.Error("checker should not be called") return nil } -func (ftc failTestChecker) CheckWarning(ing *networking.Ingress) ([]string, error) { +func (ftc failTestChecker) CheckWarning(_ *networking.Ingress) ([]string, error) { ftc.t.Error("checker should not be called") return nil, nil } diff --git a/internal/admission/controller/server.go b/internal/admission/controller/server.go index 3fa70971f2..7fc61bcbbd 100644 --- a/internal/admission/controller/server.go +++ b/internal/admission/controller/server.go @@ -26,9 +26,7 @@ import ( "k8s.io/klog/v2" ) -var ( - scheme = runtime.NewScheme() -) +var scheme = runtime.NewScheme() func init() { if err := admissionv1.AddToScheme(scheme); err != nil { diff --git a/internal/ingress/annotations/alias/main.go b/internal/ingress/annotations/alias/main.go index 4a5e6f1883..7a33e648e2 100644 --- a/internal/ingress/annotations/alias/main.go +++ b/internal/ingress/annotations/alias/main.go @@ -72,7 +72,7 @@ func (a alias) Parse(ing *networking.Ingress) (interface{}, error) { aliases := sets.NewString() for _, alias := range strings.Split(val, ",") { alias = strings.TrimSpace(alias) - if len(alias) == 0 { + if alias == "" { continue } diff --git a/internal/ingress/annotations/alias/main_test.go b/internal/ingress/annotations/alias/main_test.go index 1965f2630b..f1d68c1f74 100644 --- a/internal/ingress/annotations/alias/main_test.go +++ b/internal/ingress/annotations/alias/main_test.go @@ -65,9 +65,9 @@ func TestParse(t *testing.T) { if testCase.skipValidation { parser.EnableAnnotationValidation = false } - defer func() { + t.Cleanup(func() { parser.EnableAnnotationValidation = true - }() + }) result, err := ap.Parse(ing) if (err != nil) != testCase.wantErr { t.Errorf("ParseAliasAnnotation() annotation: %s, error = %v, wantErr %v", testCase.annotations, err, testCase.wantErr) diff --git a/internal/ingress/annotations/annotations.go b/internal/ingress/annotations/annotations.go index 5371e6eb74..38843c2dbd 100644 --- a/internal/ingress/annotations/annotations.go +++ b/internal/ingress/annotations/annotations.go @@ -86,37 +86,36 @@ type Ingress struct { CorsConfig cors.Config CustomHTTPErrors []int DefaultBackend *apiv1.Service - //TODO: Change this back into an error when https://github.com/imdario/mergo/issues/100 is resolved - FastCGI fastcgi.Config - Denied *string - ExternalAuth authreq.Config - EnableGlobalAuth bool - HTTP2PushPreload bool - Opentracing opentracing.Config - Opentelemetry opentelemetry.Config - Proxy proxy.Config - ProxySSL proxyssl.Config - RateLimit ratelimit.Config - GlobalRateLimit globalratelimit.Config - Redirect redirect.Config - Rewrite rewrite.Config - Satisfy string - ServerSnippet string - ServiceUpstream bool - SessionAffinity sessionaffinity.Config - SSLPassthrough bool - UsePortInRedirects bool - UpstreamHashBy upstreamhashby.Config - LoadBalancing string - UpstreamVhost string - Denylist ipdenylist.SourceRange - XForwardedPrefix string - SSLCipher sslcipher.Config - Logs log.Config - ModSecurity modsecurity.Config - Mirror mirror.Config - StreamSnippet string - Allowlist ipallowlist.SourceRange + FastCGI fastcgi.Config + Denied *string + ExternalAuth authreq.Config + EnableGlobalAuth bool + HTTP2PushPreload bool + Opentracing opentracing.Config + Opentelemetry opentelemetry.Config + Proxy proxy.Config + ProxySSL proxyssl.Config + RateLimit ratelimit.Config + GlobalRateLimit globalratelimit.Config + Redirect redirect.Config + Rewrite rewrite.Config + Satisfy string + ServerSnippet string + ServiceUpstream bool + SessionAffinity sessionaffinity.Config + SSLPassthrough bool + UsePortInRedirects bool + UpstreamHashBy upstreamhashby.Config + LoadBalancing string + UpstreamVhost string + Denylist ipdenylist.SourceRange + XForwardedPrefix string + SSLCipher sslcipher.Config + Logs log.Config + ModSecurity modsecurity.Config + Mirror mirror.Config + StreamSnippet string + Allowlist ipallowlist.SourceRange } // Extractor defines the annotation parsers to be used in the extraction of annotations diff --git a/internal/ingress/annotations/annotations_test.go b/internal/ingress/annotations/annotations_test.go index 2b2a64268e..5f8128e0d1 100644 --- a/internal/ingress/annotations/annotations_test.go +++ b/internal/ingress/annotations/annotations_test.go @@ -64,7 +64,11 @@ func (m mockCfg) GetService(name string) (*apiv1.Service, error) { } func (m mockCfg) GetAuthCertificate(name string) (*resolver.AuthSSLCert, error) { - if secret, _ := m.GetSecret(name); secret != nil { + secret, err := m.GetSecret(name) + if err != nil { + return nil, err + } + if secret != nil { return &resolver.AuthSSLCert{ Secret: name, CAFileName: "/opt/ca.pem", @@ -270,9 +274,9 @@ func TestCors(t *testing.T) { if r.CorsAllowCredentials != foo.credentials { t.Errorf("Returned %v but expected %v for Cors Credentials", r.CorsAllowCredentials, foo.credentials) } - } } + func TestCustomHTTPErrors(t *testing.T) { ec := NewAnnotationExtractor(mockCfg{}) ing := buildIngress() diff --git a/internal/ingress/annotations/auth/main.go b/internal/ingress/annotations/auth/main.go index beecebdb1b..7c7fde7b83 100644 --- a/internal/ingress/annotations/auth/main.go +++ b/internal/ingress/annotations/auth/main.go @@ -50,7 +50,7 @@ var ( ) var AuthSecretConfig = parser.AnnotationConfig{ - Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Validator: parser.ValidateRegex(parser.BasicCharsRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, // Medium as it allows a subset of chars Documentation: `This annotation defines the name of the Secret that contains the usernames and passwords which are granted access to the paths defined in the Ingress rules. `, @@ -61,20 +61,20 @@ var authSecretAnnotations = parser.Annotation{ Annotations: parser.AnnotationFields{ AuthSecretAnnotation: AuthSecretConfig, authSecretTypeAnnotation: { - Validator: parser.ValidateRegex(*authSecretTypeRegex, true), + Validator: parser.ValidateRegex(authSecretTypeRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskLow, Documentation: `This annotation what is the format of auth-secret value. Can be "auth-file" that defines the content of an htpasswd file, or "auth-map" where each key is a user and each value is the password.`, }, authRealmAnnotation: { - Validator: parser.ValidateRegex(*parser.CharsWithSpace, false), + Validator: parser.ValidateRegex(parser.CharsWithSpace, false), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, // Medium as it allows a subset of chars Documentation: `This annotation defines the realm (message) that should be shown to user when authentication is requested.`, }, authTypeAnnotation: { - Validator: parser.ValidateRegex(*authTypeRegex, true), + Validator: parser.ValidateRegex(authTypeRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskLow, Documentation: `This annotation defines the basic authentication type. Should be "basic" or "digest"`, @@ -167,14 +167,14 @@ func (a auth) Parse(ing *networking.Ingress) (interface{}, error) { s, err := parser.GetStringAnnotation(AuthSecretAnnotation, ing, a.annotationConfig.Annotations) if err != nil { - return nil, ing_errors.LocationDenied{ + return nil, ing_errors.LocationDeniedError{ Reason: fmt.Errorf("error reading secret name from annotation: %w", err), } } sns, sname, err := cache.SplitMetaNamespaceKey(s) if err != nil { - return nil, ing_errors.LocationDenied{ + return nil, ing_errors.LocationDeniedError{ Reason: fmt.Errorf("error reading secret name from annotation: %w", err), } } @@ -185,7 +185,7 @@ func (a auth) Parse(ing *networking.Ingress) (interface{}, error) { secCfg := a.r.GetSecurityConfiguration() // We don't accept different namespaces for secrets. if !secCfg.AllowCrossNamespaceResources && sns != ing.Namespace { - return nil, ing_errors.LocationDenied{ + return nil, ing_errors.LocationDeniedError{ Reason: fmt.Errorf("cross namespace usage of secrets is not allowed"), } } @@ -193,7 +193,7 @@ func (a auth) Parse(ing *networking.Ingress) (interface{}, error) { name := fmt.Sprintf("%v/%v", sns, sname) secret, err := a.r.GetSecret(name) if err != nil { - return nil, ing_errors.LocationDenied{ + return nil, ing_errors.LocationDeniedError{ Reason: fmt.Errorf("unexpected error reading secret %s: %w", name, err), } } @@ -217,7 +217,7 @@ func (a auth) Parse(ing *networking.Ingress) (interface{}, error) { return nil, err } default: - return nil, ing_errors.LocationDenied{ + return nil, ing_errors.LocationDeniedError{ Reason: fmt.Errorf("invalid auth-secret-type in annotation, must be 'auth-file' or 'auth-map': %w", err), } } @@ -238,14 +238,14 @@ func (a auth) Parse(ing *networking.Ingress) (interface{}, error) { func dumpSecretAuthFile(filename string, secret *api.Secret) error { val, ok := secret.Data["auth"] if !ok { - return ing_errors.LocationDenied{ + return ing_errors.LocationDeniedError{ Reason: fmt.Errorf("the secret %s does not contain a key with value auth", secret.Name), } } err := os.WriteFile(filename, val, file.ReadWriteByUser) if err != nil { - return ing_errors.LocationDenied{ + return ing_errors.LocationDeniedError{ Reason: fmt.Errorf("unexpected error creating password file: %w", err), } } @@ -264,7 +264,7 @@ func dumpSecretAuthMap(filename string, secret *api.Secret) error { err := os.WriteFile(filename, []byte(builder.String()), file.ReadWriteByUser) if err != nil { - return ing_errors.LocationDenied{ + return ing_errors.LocationDeniedError{ Reason: fmt.Errorf("unexpected error creating password file: %w", err), } } diff --git a/internal/ingress/annotations/auth/main_test.go b/internal/ingress/annotations/auth/main_test.go index 2a9dc7c721..868f31a05c 100644 --- a/internal/ingress/annotations/auth/main_test.go +++ b/internal/ingress/annotations/auth/main_test.go @@ -32,6 +32,15 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +//nolint:gosec // Ignore hardcoded credentials error in testing +const ( + authType = "basic" + authRealm = "-realm-" + defaultDemoSecret = "default/demo-secret" + othernsDemoSecret = "otherns/demo-secret" + demoSecret = "demo-secret" +) + func buildIngress() *networking.Ingress { defaultBackend := networking.IngressBackend{ Service: &networking.IngressServiceBackend{ @@ -80,7 +89,7 @@ type mockSecret struct { } func (m mockSecret) GetSecret(name string) (*api.Secret, error) { - if name != "default/demo-secret" && name != "otherns/demo-secret" { + if name != defaultDemoSecret && name != othernsDemoSecret { return nil, fmt.Errorf("there is no secret with name %v", name) } @@ -92,7 +101,7 @@ func (m mockSecret) GetSecret(name string) (*api.Secret, error) { return &api.Secret{ ObjectMeta: meta_v1.ObjectMeta{ Namespace: ns, - Name: "demo-secret", + Name: demoSecret, }, Data: map[string][]byte{"auth": []byte("foo:$apr1$OFG3Xybp$ckL0FHDAkoXYIlH9.cysT0")}, }, nil @@ -129,9 +138,9 @@ func TestIngressInvalidRealm(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = "basic" + data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = authType data[parser.GetAnnotationWithPrefix(authRealmAnnotation)] = "something weird ; location trying to { break }" - data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = "demo-secret" + data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = demoSecret ing.SetAnnotations(data) _, dir, _ := dummySecretContent(t) @@ -148,14 +157,14 @@ func TestIngressInvalidDifferentNamespace(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = "basic" - data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = "otherns/demo-secret" + data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = authType + data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = othernsDemoSecret ing.SetAnnotations(data) _, dir, _ := dummySecretContent(t) defer os.RemoveAll(dir) - expected := ing_errors.LocationDenied{ + expected := ing_errors.LocationDeniedError{ Reason: errors.New("cross namespace usage of secrets is not allowed"), } _, err := NewParser(dir, &mockSecret{}).Parse(ing) @@ -168,8 +177,8 @@ func TestIngressInvalidDifferentNamespaceAllowed(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = "basic" - data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = "otherns/demo-secret" + data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = authType + data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = othernsDemoSecret ing.SetAnnotations(data) _, dir, _ := dummySecretContent(t) @@ -187,14 +196,14 @@ func TestIngressInvalidSecretName(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = "basic" + data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = authType data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = "demo-secret;xpto" ing.SetAnnotations(data) _, dir, _ := dummySecretContent(t) defer os.RemoveAll(dir) - expected := ing_errors.LocationDenied{ + expected := ing_errors.LocationDeniedError{ Reason: errors.New("error reading secret name from annotation: annotation nginx.ingress.kubernetes.io/auth-secret contains invalid value"), } _, err := NewParser(dir, &mockSecret{}).Parse(ing) @@ -207,13 +216,13 @@ func TestInvalidIngressAuthNoSecret(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = "basic" + data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = authType ing.SetAnnotations(data) _, dir, _ := dummySecretContent(t) defer os.RemoveAll(dir) - expected := ing_errors.LocationDenied{ + expected := ing_errors.LocationDeniedError{ Reason: errors.New("error reading secret name from annotation: ingress rule without annotations"), } _, err := NewParser(dir, &mockSecret{}).Parse(ing) @@ -226,9 +235,9 @@ func TestIngressAuth(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = "basic" - data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = "demo-secret" - data[parser.GetAnnotationWithPrefix(authRealmAnnotation)] = "-realm-" + data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = authType + data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = demoSecret + data[parser.GetAnnotationWithPrefix(authRealmAnnotation)] = authRealm ing.SetAnnotations(data) _, dir, _ := dummySecretContent(t) @@ -242,10 +251,10 @@ func TestIngressAuth(t *testing.T) { if !ok { t.Errorf("expected a BasicDigest type") } - if auth.Type != "basic" { + if auth.Type != authType { t.Errorf("Expected basic as auth type but returned %s", auth.Type) } - if auth.Realm != "-realm-" { + if auth.Realm != authRealm { t.Errorf("Expected -realm- as realm but returned %s", auth.Realm) } if !auth.Secured { @@ -257,9 +266,9 @@ func TestIngressAuthWithoutSecret(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = "basic" + data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = authType data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = "invalid-secret" - data[parser.GetAnnotationWithPrefix(authRealmAnnotation)] = "-realm-" + data[parser.GetAnnotationWithPrefix(authRealmAnnotation)] = authRealm ing.SetAnnotations(data) _, dir, _ := dummySecretContent(t) @@ -275,10 +284,10 @@ func TestIngressAuthInvalidSecretKey(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = "basic" - data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = "demo-secret" + data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = authType + data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = demoSecret data[parser.GetAnnotationWithPrefix(authSecretTypeAnnotation)] = "invalid-type" - data[parser.GetAnnotationWithPrefix(authRealmAnnotation)] = "-realm-" + data[parser.GetAnnotationWithPrefix(authRealmAnnotation)] = authRealm ing.SetAnnotations(data) _, dir, _ := dummySecretContent(t) @@ -290,7 +299,7 @@ func TestIngressAuthInvalidSecretKey(t *testing.T) { } } -func dummySecretContent(t *testing.T) (string, string, *api.Secret) { +func dummySecretContent(t *testing.T) (fileName, dir string, s *api.Secret) { dir, err := os.MkdirTemp("", fmt.Sprintf("%v", time.Now().Unix())) if err != nil { t.Error(err) @@ -301,7 +310,10 @@ func dummySecretContent(t *testing.T) (string, string, *api.Secret) { t.Error(err) } defer tmpfile.Close() - s, _ := mockSecret{}.GetSecret("default/demo-secret") + s, err = mockSecret{}.GetSecret(defaultDemoSecret) + if err != nil { + t.Errorf("unexpected error: %v", err) + } return tmpfile.Name(), dir, s } diff --git a/internal/ingress/annotations/authreq/main.go b/internal/ingress/annotations/authreq/main.go index b8ba4f125b..c66b0ed470 100644 --- a/internal/ingress/annotations/authreq/main.go +++ b/internal/ingress/annotations/authreq/main.go @@ -57,25 +57,25 @@ var authReqAnnotations = parser.Annotation{ Group: "authentication", Annotations: parser.AnnotationFields{ authReqURLAnnotation: { - Validator: parser.ValidateRegex(*parser.URLWithNginxVariableRegex, true), + Validator: parser.ValidateRegex(parser.URLWithNginxVariableRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskHigh, Documentation: `This annotation allows to indicate the URL where the HTTP request should be sent`, }, authReqMethodAnnotation: { - Validator: parser.ValidateRegex(*methodsRegex, true), + Validator: parser.ValidateRegex(methodsRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskLow, Documentation: `This annotation allows to specify the HTTP method to use`, }, authReqSigninAnnotation: { - Validator: parser.ValidateRegex(*parser.URLWithNginxVariableRegex, true), + Validator: parser.ValidateRegex(parser.URLWithNginxVariableRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskHigh, Documentation: `This annotation allows to specify the location of the error page`, }, authReqSigninRedirParamAnnotation: { - Validator: parser.ValidateRegex(*parser.URLIsValidRegex, true), + Validator: parser.ValidateRegex(parser.URLIsValidRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation allows to specify the URL parameter in the error page which should contain the original URL for a failed signin request`, @@ -87,7 +87,7 @@ var authReqAnnotations = parser.Annotation{ Documentation: `This annotation allows to specify a custom snippet to use with external authentication`, }, authReqCacheKeyAnnotation: { - Validator: parser.ValidateRegex(*parser.NGINXVariable, true), + Validator: parser.ValidateRegex(parser.NGINXVariable, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation enables caching for auth requests.`, @@ -117,26 +117,26 @@ var authReqAnnotations = parser.Annotation{ Documentation: `This annotation specifies a duration in seconds which an idle keepalive connection to an upstream server will stay open`, }, authReqCacheDuration: { - Validator: parser.ValidateRegex(*parser.ExtendedCharsRegex, false), + Validator: parser.ValidateRegex(parser.ExtendedCharsRegex, false), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation allows to specify a caching time for auth responses based on their response codes, e.g. 200 202 30m`, }, authReqResponseHeadersAnnotation: { - Validator: parser.ValidateRegex(*parser.HeadersVariable, true), + Validator: parser.ValidateRegex(parser.HeadersVariable, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation sets the headers to pass to backend once authentication request completes. They should be separated by comma.`, }, authReqProxySetHeadersAnnotation: { - Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Validator: parser.ValidateRegex(parser.BasicCharsRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation sets the name of a ConfigMap that specifies headers to pass to the authentication service. Only ConfigMaps on the same namespace are allowed`, }, authReqRequestRedirectAnnotation: { - Validator: parser.ValidateRegex(*parser.URLIsValidRegex, true), + Validator: parser.ValidateRegex(parser.URLIsValidRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation allows to specify the X-Auth-Request-Redirect header value`, @@ -249,8 +249,8 @@ func (e1 *Config) Equal(e2 *Config) bool { var ( methodsRegex = regexp.MustCompile("(GET|HEAD|POST|PUT|PATCH|DELETE|CONNECT|OPTIONS|TRACE)") headerRegexp = regexp.MustCompile(`^[a-zA-Z\d\-_]+$`) - statusCodeRegex = regexp.MustCompile(`^[\d]{3}$`) - durationRegex = regexp.MustCompile(`^[\d]+(ms|s|m|h|d|w|M|y)$`) // see http://nginx.org/en/docs/syntax.html + statusCodeRegex = regexp.MustCompile(`^\d{3}$`) + durationRegex = regexp.MustCompile(`^\d+(ms|s|m|h|d|w|M|y)$`) // see http://nginx.org/en/docs/syntax.html ) // ValidMethod checks is the provided string a valid HTTP method @@ -273,7 +273,7 @@ func ValidCacheDuration(duration string) bool { seenDuration := false for _, element := range elements { - if len(element) == 0 { + if element == "" { continue } if statusCodeRegex.MatchString(element) { @@ -304,6 +304,8 @@ func NewParser(r resolver.Resolver) parser.IngressAnnotation { // ParseAnnotations parses the annotations contained in the ingress // rule used to use an Config URL as source for authentication +// +//nolint:gocyclo // Ignore function complexity error func (a authReq) Parse(ing *networking.Ingress) (interface{}, error) { // Required Parameters urlString, err := parser.GetStringAnnotation(authReqURLAnnotation, ing, a.annotationConfig.Annotations) @@ -313,7 +315,7 @@ func (a authReq) Parse(ing *networking.Ingress) (interface{}, error) { authURL, err := parser.StringToURL(urlString) if err != nil { - return nil, ing_errors.LocationDenied{Reason: fmt.Errorf("could not parse auth-url annotation: %v", err)} + return nil, ing_errors.LocationDeniedError{Reason: fmt.Errorf("could not parse auth-url annotation: %v", err)} } authMethod, err := parser.GetStringAnnotation(authReqMethodAnnotation, ing, a.annotationConfig.Annotations) @@ -410,7 +412,7 @@ func (a authReq) Parse(ing *networking.Ingress) (interface{}, error) { if err != nil && ing_errors.IsValidationError(err) { return nil, ing_errors.NewLocationDenied("validation error") } - if len(hstr) != 0 { + if hstr != "" { harr := strings.Split(hstr, ",") for _, header := range harr { header = strings.TrimSpace(header) @@ -430,7 +432,7 @@ func (a authReq) Parse(ing *networking.Ingress) (interface{}, error) { cns, _, err := cache.SplitMetaNamespaceKey(proxySetHeaderMap) if err != nil { - return nil, ing_errors.LocationDenied{ + return nil, ing_errors.LocationDeniedError{ Reason: fmt.Errorf("error reading configmap name %s from annotation: %w", proxySetHeaderMap, err), } } @@ -442,7 +444,7 @@ func (a authReq) Parse(ing *networking.Ingress) (interface{}, error) { secCfg := a.r.GetSecurityConfiguration() // We don't accept different namespaces for secrets. if !secCfg.AllowCrossNamespaceResources && cns != ing.Namespace { - return nil, ing_errors.LocationDenied{ + return nil, ing_errors.LocationDeniedError{ Reason: fmt.Errorf("cross namespace usage of secrets is not allowed"), } } @@ -499,7 +501,7 @@ func (a authReq) Parse(ing *networking.Ingress) (interface{}, error) { // It will always return at least one duration (the default duration) func ParseStringToCacheDurations(input string) ([]string, error) { authCacheDuration := []string{} - if len(input) != 0 { + if input != "" { arr := strings.Split(input, ",") for _, duration := range arr { duration = strings.TrimSpace(duration) diff --git a/internal/ingress/annotations/authreq/main_test.go b/internal/ingress/annotations/authreq/main_test.go index dc5188c8a1..3e6df3d3b5 100644 --- a/internal/ingress/annotations/authreq/main_test.go +++ b/internal/ingress/annotations/authreq/main_test.go @@ -17,7 +17,6 @@ limitations under the License. package authreq import ( - "fmt" "reflect" "testing" @@ -113,7 +112,7 @@ func TestAnnotations(t *testing.T) { data[parser.GetAnnotationWithPrefix("auth-url")] = test.url data[parser.GetAnnotationWithPrefix("auth-signin")] = test.signinURL data[parser.GetAnnotationWithPrefix("auth-signin-redirect-param")] = test.signinURLRedirectParam - data[parser.GetAnnotationWithPrefix("auth-method")] = fmt.Sprintf("%v", test.method) + data[parser.GetAnnotationWithPrefix("auth-method")] = test.method data[parser.GetAnnotationWithPrefix("auth-request-redirect")] = test.requestRedirect data[parser.GetAnnotationWithPrefix("auth-snippet")] = test.authSnippet data[parser.GetAnnotationWithPrefix("auth-cache-key")] = test.authCacheKey @@ -331,7 +330,6 @@ func TestKeepaliveAnnotations(t *testing.T) { } func TestParseStringToCacheDurations(t *testing.T) { - tests := []struct { title string duration string @@ -346,7 +344,6 @@ func TestParseStringToCacheDurations(t *testing.T) { } for _, test := range tests { - dur, err := ParseStringToCacheDurations(test.duration) if test.expErr { if err == nil { diff --git a/internal/ingress/annotations/authreqglobal/main.go b/internal/ingress/annotations/authreqglobal/main.go index a1641e085c..e8a2590471 100644 --- a/internal/ingress/annotations/authreqglobal/main.go +++ b/internal/ingress/annotations/authreqglobal/main.go @@ -55,7 +55,6 @@ func NewParser(r resolver.Resolver) parser.IngressAnnotation { // ParseAnnotations parses the annotations contained in the ingress // rule used to enable or disable global external authentication func (a authReqGlobal) Parse(ing *networking.Ingress) (interface{}, error) { - enableGlobalAuth, err := parser.GetBoolAnnotation(enableGlobalAuthAnnotation, ing, a.annotationConfig.Annotations) if err != nil { enableGlobalAuth = true diff --git a/internal/ingress/annotations/authreqglobal/main_test.go b/internal/ingress/annotations/authreqglobal/main_test.go index 0313edcf5e..734f97c0f3 100644 --- a/internal/ingress/annotations/authreqglobal/main_test.go +++ b/internal/ingress/annotations/authreqglobal/main_test.go @@ -77,7 +77,10 @@ func TestAnnotation(t *testing.T) { data[parser.GetAnnotationWithPrefix("enable-global-auth")] = "false" ing.SetAnnotations(data) - i, _ := NewParser(&resolver.Mock{}).Parse(ing) + i, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } u, ok := i.(bool) if !ok { t.Errorf("expected a Config type") diff --git a/internal/ingress/annotations/authtls/main.go b/internal/ingress/annotations/authtls/main.go index 5d6763e8bc..adedb084a0 100644 --- a/internal/ingress/annotations/authtls/main.go +++ b/internal/ingress/annotations/authtls/main.go @@ -18,11 +18,10 @@ package authtls import ( "fmt" + "regexp" networking "k8s.io/api/networking/v1" - "regexp" - "k8s.io/ingress-nginx/internal/ingress/annotations/parser" ing_errors "k8s.io/ingress-nginx/internal/ingress/errors" "k8s.io/ingress-nginx/internal/ingress/resolver" @@ -45,20 +44,20 @@ var ( regexChars = regexp.QuoteMeta(`()|=`) authVerifyClientRegex = regexp.MustCompile(`on|off|optional|optional_no_ca`) commonNameRegex = regexp.MustCompile(`^CN=[/\-.\_\~a-zA-Z0-9` + regexChars + `]*$`) - redirectRegex = regexp.MustCompile(`^((https?://)?[A-Za-z0-9\-\.]*(:[0-9]+)?/[A-Za-z0-9\-\.]*)?$`) + redirectRegex = regexp.MustCompile(`^((https?://)?[A-Za-z0-9\-.]*(:\d+)?/[A-Za-z0-9\-.]*)?$`) ) var authTLSAnnotations = parser.Annotation{ Group: "authentication", Annotations: parser.AnnotationFields{ annotationAuthTLSSecret: { - Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Validator: parser.ValidateRegex(parser.BasicCharsRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, // Medium as it allows a subset of chars Documentation: `This annotation defines the secret that contains the certificate chain of allowed certs`, }, annotationAuthTLSVerifyClient: { - Validator: parser.ValidateRegex(*authVerifyClientRegex, true), + Validator: parser.ValidateRegex(authVerifyClientRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, // Medium as it allows a subset of chars Documentation: `This annotation enables verification of client certificates. Can be "on", "off", "optional" or "optional_no_ca"`, @@ -70,7 +69,7 @@ var authTLSAnnotations = parser.Annotation{ Documentation: `This annotation defines validation depth between the provided client certificate and the Certification Authority chain.`, }, annotationAuthTLSErrorPage: { - Validator: parser.ValidateRegex(*redirectRegex, true), + Validator: parser.ValidateRegex(redirectRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskHigh, Documentation: `This annotation defines the URL/Page that user should be redirected in case of a Certificate Authentication Error`, @@ -82,7 +81,7 @@ var authTLSAnnotations = parser.Annotation{ Documentation: `This annotation defines if the received certificates should be passed or not to the upstream server in the header "ssl-client-cert"`, }, annotationAuthTLSMatchCN: { - Validator: parser.ValidateRegex(*commonNameRegex, true), + Validator: parser.ValidateRegex(commonNameRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskHigh, Documentation: `This annotation adds a sanity check for the CN of the client certificate that is sent over using a string / regex starting with "CN="`, @@ -130,9 +129,9 @@ func (assl1 *Config) Equal(assl2 *Config) bool { } // NewParser creates a new TLS authentication annotation parser -func NewParser(resolver resolver.Resolver) parser.IngressAnnotation { +func NewParser(r resolver.Resolver) parser.IngressAnnotation { return authTLS{ - r: resolver, + r: r, annotationConfig: authTLSAnnotations, } } @@ -169,7 +168,7 @@ func (a authTLS) Parse(ing *networking.Ingress) (interface{}, error) { authCert, err := a.r.GetAuthCertificate(tlsauthsecret) if err != nil { e := fmt.Errorf("error obtaining certificate: %w", err) - return &Config{}, ing_errors.LocationDenied{Reason: e} + return &Config{}, ing_errors.LocationDeniedError{Reason: e} } config.AuthSSLCert = *authCert diff --git a/internal/ingress/annotations/authtls/main_test.go b/internal/ingress/annotations/authtls/main_test.go index a1f3f0f92c..0dd442e4f6 100644 --- a/internal/ingress/annotations/authtls/main_test.go +++ b/internal/ingress/annotations/authtls/main_test.go @@ -27,6 +27,11 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + defaultDemoSecret = "default/demo-secret" + off = "off" +) + func buildIngress() *networking.Ingress { defaultBackend := networking.IngressBackend{ Service: &networking.IngressServiceBackend{ @@ -77,23 +82,22 @@ type mockSecret struct { // GetAuthCertificate from mockSecret mocks the GetAuthCertificate for authTLS func (m mockSecret) GetAuthCertificate(name string) (*resolver.AuthSSLCert, error) { - if name != "default/demo-secret" { + if name != defaultDemoSecret { return nil, errors.Errorf("there is no secret with name %v", name) } return &resolver.AuthSSLCert{ - Secret: "default/demo-secret", + Secret: defaultDemoSecret, CAFileName: "/ssl/ca.crt", CASHA: "abc", }, nil - } func TestAnnotations(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix(annotationAuthTLSSecret)] = "default/demo-secret" + data[parser.GetAnnotationWithPrefix(annotationAuthTLSSecret)] = defaultDemoSecret ing.SetAnnotations(data) @@ -108,7 +112,7 @@ func TestAnnotations(t *testing.T) { t.Errorf("expected *Config but got %v", u) } - secret, err := fakeSecret.GetAuthCertificate("default/demo-secret") + secret, err := fakeSecret.GetAuthCertificate(defaultDemoSecret) if err != nil { t.Errorf("unexpected error getting secret %v", err) } @@ -132,7 +136,7 @@ func TestAnnotations(t *testing.T) { t.Errorf("expected empty string, but got %v", u.MatchCN) } - data[parser.GetAnnotationWithPrefix(annotationAuthTLSVerifyClient)] = "off" + data[parser.GetAnnotationWithPrefix(annotationAuthTLSVerifyClient)] = off data[parser.GetAnnotationWithPrefix(annotationAuthTLSVerifyDepth)] = "2" data[parser.GetAnnotationWithPrefix(annotationAuthTLSErrorPage)] = "ok.com/error" data[parser.GetAnnotationWithPrefix(annotationAuthTLSPassCertToUpstream)] = "true" @@ -153,8 +157,8 @@ func TestAnnotations(t *testing.T) { if u.AuthSSLCert.Secret != secret.Secret { t.Errorf("expected %v but got %v", secret.Secret, u.AuthSSLCert.Secret) } - if u.VerifyClient != "off" { - t.Errorf("expected %v but got %v", "off", u.VerifyClient) + if u.VerifyClient != off { + t.Errorf("expected %v but got %v", off, u.VerifyClient) } if u.ValidationDepth != 2 { t.Errorf("expected %v but got %v", 2, u.ValidationDepth) @@ -262,28 +266,21 @@ func TestInvalidAnnotations(t *testing.T) { if u.MatchCN != "" { t.Errorf("expected empty string but got %v", u.MatchCN) } - } func TestEquals(t *testing.T) { cfg1 := &Config{} cfg2 := &Config{} - // Same config - result := cfg1.Equal(cfg1) - if result != true { - t.Errorf("Expected true") - } - // compare nil - result = cfg1.Equal(nil) + result := cfg1.Equal(nil) if result != false { t.Errorf("Expected false") } // Different Certs sslCert1 := resolver.AuthSSLCert{ - Secret: "default/demo-secret", + Secret: defaultDemoSecret, CAFileName: "/ssl/ca.crt", CASHA: "abc", } @@ -302,7 +299,7 @@ func TestEquals(t *testing.T) { // Different Verify Client cfg1.VerifyClient = "on" - cfg2.VerifyClient = "off" + cfg2.VerifyClient = off result = cfg1.Equal(cfg2) if result != false { t.Errorf("Expected false") diff --git a/internal/ingress/annotations/backendprotocol/main.go b/internal/ingress/annotations/backendprotocol/main.go index 2704ce9f62..62674c4e5c 100644 --- a/internal/ingress/annotations/backendprotocol/main.go +++ b/internal/ingress/annotations/backendprotocol/main.go @@ -25,9 +25,7 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) -var ( - validProtocols = []string{"auto_http", "http", "https", "grpc", "grpcs", "fcgi"} -) +var validProtocols = []string{"auto_http", "http", "https", "grpc", "grpcs", "fcgi"} const ( http = "HTTP" diff --git a/internal/ingress/annotations/backendprotocol/main_test.go b/internal/ingress/annotations/backendprotocol/main_test.go index 490be447b2..cb1ec779f6 100644 --- a/internal/ingress/annotations/backendprotocol/main_test.go +++ b/internal/ingress/annotations/backendprotocol/main_test.go @@ -44,6 +44,7 @@ func buildIngress() *networking.Ingress { }, } } + func TestParseInvalidAnnotations(t *testing.T) { ing := buildIngress() @@ -56,7 +57,7 @@ func TestParseInvalidAnnotations(t *testing.T) { if !ok { t.Errorf("expected a string type") } - if val != "HTTP" { + if val != http { t.Errorf("expected HTTPS but %v returned", val) } @@ -72,7 +73,7 @@ func TestParseInvalidAnnotations(t *testing.T) { if !ok { t.Errorf("expected a string type") } - if val != "HTTP" { + if val != http { t.Errorf("expected HTTPS but %v returned", val) } @@ -88,7 +89,7 @@ func TestParseInvalidAnnotations(t *testing.T) { if !ok { t.Errorf("expected a string type") } - if val != "HTTP" { + if val != http { t.Errorf("expected HTTPS but %v returned", val) } } diff --git a/internal/ingress/annotations/canary/main.go b/internal/ingress/annotations/canary/main.go index 119f091819..be57616753 100644 --- a/internal/ingress/annotations/canary/main.go +++ b/internal/ingress/annotations/canary/main.go @@ -57,7 +57,7 @@ var CanaryAnnotations = parser.Annotation{ Documentation: `This annotation The total weight of traffic. If unspecified, it defaults to 100`, }, canaryByHeaderAnnotation: { - Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Validator: parser.ValidateRegex(parser.BasicCharsRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation defines the header that should be used for notifying the Ingress to route the request to the service specified in the Canary Ingress. @@ -65,7 +65,7 @@ var CanaryAnnotations = parser.Annotation{ For any other value, the header will be ignored and the request compared against the other canary rules by precedence`, }, canaryByHeaderValueAnnotation: { - Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Validator: parser.ValidateRegex(parser.BasicCharsRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation defines the header value to match for notifying the Ingress to route the request to the service specified in the Canary Ingress. @@ -74,7 +74,7 @@ var CanaryAnnotations = parser.Annotation{ It doesn't have any effect if the 'canary-by-header' annotation is not defined`, }, canaryByHeaderPatternAnnotation: { - Validator: parser.ValidateRegex(*parser.IsValidRegex, false), + Validator: parser.ValidateRegex(parser.IsValidRegex, false), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation works the same way as canary-by-header-value except it does PCRE Regex matching. @@ -82,7 +82,7 @@ var CanaryAnnotations = parser.Annotation{ When the given Regex causes error during request processing, the request will be considered as not matching.`, }, canaryByCookieAnnotation: { - Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Validator: parser.ValidateRegex(parser.BasicCharsRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation defines the cookie that should be used for notifying the Ingress to route the request to the service specified in the Canary Ingress. @@ -189,7 +189,7 @@ func (c canary) GetDocumentation() parser.AnnotationFields { return c.annotationConfig.Annotations } -func (a canary) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (c canary) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(c.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, CanaryAnnotations.Annotations) } diff --git a/internal/ingress/annotations/canary/main_test.go b/internal/ingress/annotations/canary/main_test.go index ddfc0a9c4e..1787ddb859 100644 --- a/internal/ingress/annotations/canary/main_test.go +++ b/internal/ingress/annotations/canary/main_test.go @@ -17,6 +17,7 @@ limitations under the License. package canary import ( + "strconv" "testing" api "k8s.io/api/core/v1" @@ -24,8 +25,6 @@ import ( metaV1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" - "strconv" - "k8s.io/ingress-nginx/internal/ingress/resolver" ) @@ -93,7 +92,6 @@ func TestCanaryInvalid(t *testing.T) { if val.Weight != 0 { t.Errorf("Expected %v but got %v", 0, val.Weight) } - } func TestAnnotations(t *testing.T) { @@ -133,10 +131,9 @@ func TestAnnotations(t *testing.T) { } continue - } else { - if err != nil { - t.Errorf("%v: expected nil but returned error %v", test.title, err) - } + } + if err != nil { + t.Errorf("%v: expected nil but returned error %v", test.title, err) } canaryConfig, ok := i.(*Config) diff --git a/internal/ingress/annotations/clientbodybuffersize/main.go b/internal/ingress/annotations/clientbodybuffersize/main.go index aa1485df29..c0fa797139 100644 --- a/internal/ingress/annotations/clientbodybuffersize/main.go +++ b/internal/ingress/annotations/clientbodybuffersize/main.go @@ -31,7 +31,7 @@ var clientBodyBufferSizeConfig = parser.Annotation{ Group: "backend", Annotations: parser.AnnotationFields{ clientBodyBufferSizeAnnotation: { - Validator: parser.ValidateRegex(*parser.SizeRegex, true), + Validator: parser.ValidateRegex(parser.SizeRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskLow, // Low, as it allows just a set of options Documentation: `Sets buffer size for reading client request body per location. @@ -65,7 +65,7 @@ func (cbbs clientBodyBufferSize) Parse(ing *networking.Ingress) (interface{}, er return parser.GetStringAnnotation(clientBodyBufferSizeAnnotation, ing, cbbs.annotationConfig.Annotations) } -func (a clientBodyBufferSize) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (cbbs clientBodyBufferSize) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(cbbs.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, clientBodyBufferSizeConfig.Annotations) } diff --git a/internal/ingress/annotations/clientbodybuffersize/main_test.go b/internal/ingress/annotations/clientbodybuffersize/main_test.go index 0f2c8474ae..62257aeb91 100644 --- a/internal/ingress/annotations/clientbodybuffersize/main_test.go +++ b/internal/ingress/annotations/clientbodybuffersize/main_test.go @@ -57,6 +57,7 @@ func TestParse(t *testing.T) { for _, testCase := range testCases { ing.SetAnnotations(testCase.annotations) + //nolint:errcheck // Ignore the error since invalid cases will be checked with expected results result, _ := ap.Parse(ing) if result != testCase.expected { t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations) diff --git a/internal/ingress/annotations/connection/main.go b/internal/ingress/annotations/connection/main.go index 9e96b6ab10..b0242ac23e 100644 --- a/internal/ingress/annotations/connection/main.go +++ b/internal/ingress/annotations/connection/main.go @@ -29,15 +29,13 @@ const ( connectionProxyHeaderAnnotation = "connection-proxy-header" ) -var ( - validConnectionHeaderValue = regexp.MustCompile(`^(close|keep-alive)$`) -) +var validConnectionHeaderValue = regexp.MustCompile(`^(close|keep-alive)$`) var connectionHeadersAnnotations = parser.Annotation{ Group: "backend", Annotations: parser.AnnotationFields{ connectionProxyHeaderAnnotation: { - Validator: parser.ValidateRegex(*validConnectionHeaderValue, true), + Validator: parser.ValidateRegex(validConnectionHeaderValue, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskLow, Documentation: `This annotation allows setting a specific value for "proxy_set_header Connection" directive. Right now it is restricted to "close" or "keep-alive"`, diff --git a/internal/ingress/annotations/connection/main_test.go b/internal/ingress/annotations/connection/main_test.go index a952883855..1b9361f31b 100644 --- a/internal/ingress/annotations/connection/main_test.go +++ b/internal/ingress/annotations/connection/main_test.go @@ -66,6 +66,5 @@ func TestParse(t *testing.T) { if !p.Equal(testCase.expected) { t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, p, testCase.annotations) } - } } diff --git a/internal/ingress/annotations/cors/main.go b/internal/ingress/annotations/cors/main.go index cc30b8405d..39e02f21be 100644 --- a/internal/ingress/annotations/cors/main.go +++ b/internal/ingress/annotations/cors/main.go @@ -43,9 +43,9 @@ var ( // * Sets a group that can be (https?://)?*?.something.com:port? // * Allows this to be repeated as much as possible, and separated by comma // Otherwise it should be '*' - corsOriginRegexValidator = regexp.MustCompile(`^((((https?://)?(\*\.)?[A-Za-z0-9\-\.]*(:[0-9]+)?,?)+)|\*)?$`) + corsOriginRegexValidator = regexp.MustCompile(`^((((https?://)?(\*\.)?[A-Za-z0-9\-.]*(:\d+)?,?)+)|\*)?$`) // corsOriginRegex defines the regex for validation inside Parse - corsOriginRegex = regexp.MustCompile(`^(https?://(\*\.)?[A-Za-z0-9\-\.]*(:[0-9]+)?|\*)?$`) + corsOriginRegex = regexp.MustCompile(`^(https?://(\*\.)?[A-Za-z0-9\-.]*(:\d+)?|\*)?$`) // Method must contain valid methods list (PUT, GET, POST, BLA) // May contain or not spaces between each verb corsMethodsRegex = regexp.MustCompile(`^([A-Za-z]+,?\s?)+$`) @@ -74,7 +74,7 @@ var corsAnnotation = parser.Annotation{ Documentation: `This annotation enables Cross-Origin Resource Sharing (CORS) in an Ingress rule`, }, corsAllowOriginAnnotation: { - Validator: parser.ValidateRegex(*corsOriginRegexValidator, true), + Validator: parser.ValidateRegex(corsOriginRegexValidator, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation controls what's the accepted Origin for CORS. @@ -82,14 +82,14 @@ var corsAnnotation = parser.Annotation{ It also supports single level wildcard subdomains and follows this format: http(s)://*.foo.bar, http(s)://*.bar.foo:8080 or http(s)://*.abc.bar.foo:9000`, }, corsAllowHeadersAnnotation: { - Validator: parser.ValidateRegex(*parser.HeadersVariable, true), + Validator: parser.ValidateRegex(parser.HeadersVariable, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation controls which headers are accepted. This is a multi-valued field, separated by ',' and accepts letters, numbers, _ and -`, }, corsAllowMethodsAnnotation: { - Validator: parser.ValidateRegex(*corsMethodsRegex, true), + Validator: parser.ValidateRegex(corsMethodsRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation controls which methods are accepted. @@ -102,7 +102,7 @@ var corsAnnotation = parser.Annotation{ Documentation: `This annotation controls if credentials can be passed during CORS operations.`, }, corsExposeHeadersAnnotation: { - Validator: parser.ValidateRegex(*corsExposeHeadersRegex, true), + Validator: parser.ValidateRegex(corsExposeHeadersRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation controls which headers are exposed to response. @@ -260,7 +260,7 @@ func (c cors) GetDocumentation() parser.AnnotationFields { return c.annotationConfig.Annotations } -func (a cors) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (c cors) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(c.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, corsAnnotation.Annotations) } diff --git a/internal/ingress/annotations/customhttperrors/main.go b/internal/ingress/annotations/customhttperrors/main.go index c3c9b5be3f..f3c72a22fc 100644 --- a/internal/ingress/annotations/customhttperrors/main.go +++ b/internal/ingress/annotations/customhttperrors/main.go @@ -31,16 +31,14 @@ const ( customHTTPErrorsAnnotation = "custom-http-errors" ) -var ( - // We accept anything between 400 and 599, on a comma separated. - arrayOfHTTPErrors = regexp.MustCompile(`^(?:[4,5][0-9][0-9],?)*$`) -) +// We accept anything between 400 and 599, on a comma separated. +var arrayOfHTTPErrors = regexp.MustCompile(`^(?:[4,5]\d{2},?)*$`) var customHTTPErrorsAnnotations = parser.Annotation{ Group: "backend", Annotations: parser.AnnotationFields{ customHTTPErrorsAnnotation: { - Validator: parser.ValidateRegex(*arrayOfHTTPErrors, true), + Validator: parser.ValidateRegex(arrayOfHTTPErrors, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskLow, Documentation: `If a default backend annotation is specified on the ingress, the errors code specified on this annotation @@ -72,7 +70,7 @@ func (e customhttperrors) Parse(ing *networking.Ingress) (interface{}, error) { } cSplit := strings.Split(c, ",") - var codes []int + codes := make([]int, 0, len(cSplit)) for _, i := range cSplit { num, err := strconv.Atoi(i) if err != nil { @@ -88,7 +86,7 @@ func (e customhttperrors) GetDocumentation() parser.AnnotationFields { return e.annotationConfig.Annotations } -func (a customhttperrors) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (e customhttperrors) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(e.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, customHTTPErrorsAnnotations.Annotations) } diff --git a/internal/ingress/annotations/defaultbackend/main.go b/internal/ingress/annotations/defaultbackend/main.go index f3ca004dd8..9ae44f0523 100644 --- a/internal/ingress/annotations/defaultbackend/main.go +++ b/internal/ingress/annotations/defaultbackend/main.go @@ -57,14 +57,14 @@ func NewParser(r resolver.Resolver) parser.IngressAnnotation { // Parse parses the annotations contained in the ingress to use // a custom default backend -func (db backend) Parse(ing *networking.Ingress) (interface{}, error) { - s, err := parser.GetStringAnnotation(defaultBackendAnnotation, ing, db.annotationConfig.Annotations) +func (b backend) Parse(ing *networking.Ingress) (interface{}, error) { + s, err := parser.GetStringAnnotation(defaultBackendAnnotation, ing, b.annotationConfig.Annotations) if err != nil { return nil, err } name := fmt.Sprintf("%v/%v", ing.Namespace, s) - svc, err := db.r.GetService(name) + svc, err := b.r.GetService(name) if err != nil { return nil, fmt.Errorf("unexpected error reading service %s: %w", name, err) } @@ -72,11 +72,11 @@ func (db backend) Parse(ing *networking.Ingress) (interface{}, error) { return svc, nil } -func (db backend) GetDocumentation() parser.AnnotationFields { - return db.annotationConfig.Annotations +func (b backend) GetDocumentation() parser.AnnotationFields { + return b.annotationConfig.Annotations } -func (a backend) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (b backend) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(b.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, defaultBackendAnnotations.Annotations) } diff --git a/internal/ingress/annotations/fastcgi/main.go b/internal/ingress/annotations/fastcgi/main.go index 96dbc71597..882de5b1ca 100644 --- a/internal/ingress/annotations/fastcgi/main.go +++ b/internal/ingress/annotations/fastcgi/main.go @@ -35,22 +35,20 @@ const ( fastCGIParamsAnnotation = "fastcgi-params-configmap" ) -var ( - // fast-cgi valid parameters is just a single file name (like index.php) - regexValidIndexAnnotationAndKey = regexp.MustCompile(`^[A-Za-z0-9\.\-\_]+$`) -) +// fast-cgi valid parameters is just a single file name (like index.php) +var regexValidIndexAnnotationAndKey = regexp.MustCompile(`^[A-Za-z0-9.\-\_]+$`) var fastCGIAnnotations = parser.Annotation{ Group: "fastcgi", Annotations: parser.AnnotationFields{ fastCGIIndexAnnotation: { - Validator: parser.ValidateRegex(*regexValidIndexAnnotationAndKey, true), + Validator: parser.ValidateRegex(regexValidIndexAnnotationAndKey, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation can be used to specify an index file`, }, fastCGIParamsAnnotation: { - Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Validator: parser.ValidateRegex(parser.BasicCharsRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation can be used to specify a ConfigMap containing the fastcgi parameters as a key/value. @@ -98,7 +96,6 @@ func NewParser(r resolver.Resolver) parser.IngressAnnotation { // ParseAnnotations parses the annotations contained in the ingress // rule used to indicate the fastcgiConfig. func (a fastcgi) Parse(ing *networking.Ingress) (interface{}, error) { - fcgiConfig := Config{} if ing.GetAnnotations() == nil { @@ -125,7 +122,7 @@ func (a fastcgi) Parse(ing *networking.Ingress) (interface{}, error) { cmns, cmn, err := cache.SplitMetaNamespaceKey(cm) if err != nil { - return fcgiConfig, ing_errors.LocationDenied{ + return fcgiConfig, ing_errors.LocationDeniedError{ Reason: fmt.Errorf("error reading configmap name from annotation: %w", err), } } @@ -139,7 +136,7 @@ func (a fastcgi) Parse(ing *networking.Ingress) (interface{}, error) { cm = fmt.Sprintf("%v/%v", ing.Namespace, cmn) cmap, err := a.r.GetConfigMap(cm) if err != nil { - return fcgiConfig, ing_errors.LocationDenied{ + return fcgiConfig, ing_errors.LocationDeniedError{ Reason: fmt.Errorf("unexpected error reading configmap %s: %w", cm, err), } } diff --git a/internal/ingress/annotations/fastcgi/main_test.go b/internal/ingress/annotations/fastcgi/main_test.go index 3296ded655..bc5e2755f9 100644 --- a/internal/ingress/annotations/fastcgi/main_test.go +++ b/internal/ingress/annotations/fastcgi/main_test.go @@ -155,7 +155,6 @@ func TestParseFastCGIInvalidParamsConfigMapAnnotation(t *testing.T) { invalidConfigMapList := []string{"unknown/configMap", "unknown/config/map"} for _, configmap := range invalidConfigMapList { - data := map[string]string{} data[parser.GetAnnotationWithPrefix("fastcgi-params-configmap")] = configmap ing.SetAnnotations(data) @@ -239,11 +238,9 @@ func TestParseFastCGIParamsConfigMapAnnotationWithDifferentNS(t *testing.T) { if err == nil { t.Errorf("Different namespace configmap should return an error") } - } func TestConfigEquality(t *testing.T) { - var nilConfig *Config config := Config{ @@ -297,7 +294,6 @@ func TestConfigEquality(t *testing.T) { } func Test_fastcgi_Parse(t *testing.T) { - tests := []struct { name string index string @@ -378,7 +374,6 @@ func Test_fastcgi_Parse(t *testing.T) { } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - ing := buildIngress() data := map[string]string{} diff --git a/internal/ingress/annotations/globalratelimit/main.go b/internal/ingress/annotations/globalratelimit/main.go index 41f58fd57a..0aec29f66d 100644 --- a/internal/ingress/annotations/globalratelimit/main.go +++ b/internal/ingress/annotations/globalratelimit/main.go @@ -25,7 +25,6 @@ import ( "k8s.io/klog/v2" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" - "k8s.io/ingress-nginx/internal/ingress/errors" ing_errors "k8s.io/ingress-nginx/internal/ingress/errors" "k8s.io/ingress-nginx/internal/ingress/resolver" "k8s.io/ingress-nginx/internal/net" @@ -57,7 +56,7 @@ var globalRateLimitAnnotationConfig = parser.Annotation{ Documentation: `Configures a time window (i.e 1m) that the limit is applied`, }, globalRateLimitKeyAnnotation: { - Validator: parser.ValidateRegex(*parser.NGINXVariable, true), + Validator: parser.ValidateRegex(parser.NGINXVariable, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskHigh, Documentation: `This annotation Configures a key for counting the samples. Defaults to $remote_addr. @@ -123,23 +122,23 @@ func (a globalratelimit) Parse(ing *networking.Ingress) (interface{}, error) { config := &Config{} limit, err := parser.GetIntAnnotation(globalRateLimitAnnotation, ing, a.annotationConfig.Annotations) - if err != nil && errors.IsInvalidContent(err) { + if err != nil && ing_errors.IsInvalidContent(err) { return nil, err } rawWindowSize, err := parser.GetStringAnnotation(globalRateLimitWindowAnnotation, ing, a.annotationConfig.Annotations) - if err != nil && errors.IsValidationError(err) { - return config, ing_errors.LocationDenied{ + if err != nil && ing_errors.IsValidationError(err) { + return config, ing_errors.LocationDeniedError{ Reason: fmt.Errorf("failed to parse 'global-rate-limit-window' value: %w", err), } } - if limit == 0 || len(rawWindowSize) == 0 { + if limit == 0 || rawWindowSize == "" { return config, nil } windowSize, err := time.ParseDuration(rawWindowSize) if err != nil { - return config, ing_errors.LocationDenied{ + return config, ing_errors.LocationDeniedError{ Reason: fmt.Errorf("failed to parse 'global-rate-limit-window' value: %w", err), } } @@ -148,12 +147,12 @@ func (a globalratelimit) Parse(ing *networking.Ingress) (interface{}, error) { if err != nil { klog.Warningf("invalid %s, defaulting to %s", globalRateLimitKeyAnnotation, defaultKey) } - if len(key) == 0 { + if key == "" { key = defaultKey } rawIgnoredCIDRs, err := parser.GetStringAnnotation(globalRateLimitIgnoredCidrsAnnotation, ing, a.annotationConfig.Annotations) - if err != nil && errors.IsInvalidContent(err) { + if err != nil && ing_errors.IsInvalidContent(err) { return nil, err } ignoredCIDRs, err := net.ParseCIDRs(rawIgnoredCIDRs) @@ -161,7 +160,7 @@ func (a globalratelimit) Parse(ing *networking.Ingress) (interface{}, error) { return nil, err } - config.Namespace = strings.Replace(string(ing.UID), "-", "", -1) + config.Namespace = strings.ReplaceAll(string(ing.UID), "-", "") config.Limit = limit config.WindowSize = int(windowSize.Seconds()) config.Key = key diff --git a/internal/ingress/annotations/globalratelimit/main_test.go b/internal/ingress/annotations/globalratelimit/main_test.go index 5d79226666..b1a7ab71b2 100644 --- a/internal/ingress/annotations/globalratelimit/main_test.go +++ b/internal/ingress/annotations/globalratelimit/main_test.go @@ -30,8 +30,10 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) -const UID = "31285d47-b150-4dcf-bd6f-12c46d769f6e" -const expectedUID = "31285d47b1504dcfbd6f12c46d769f6e" +const ( + UID = "31285d47-b150-4dcf-bd6f-12c46d769f6e" + expectedUID = "31285d47b1504dcfbd6f12c46d769f6e" +) func buildIngress() *networking.Ingress { defaultBackend := networking.IngressBackend{ @@ -190,10 +192,19 @@ func TestGlobalRateLimiting(t *testing.T) { t.Errorf("expected error '%v' but got '%v'", testCase.expectedErr, actualErr) } - actualConfig := i.(*Config) + actualConfig, ok := i.(*Config) + if !ok { + t.Errorf("expected Config type but got %T", i) + } if !testCase.expectedConfig.Equal(actualConfig) { - expectedJSON, _ := json.Marshal(testCase.expectedConfig) - actualJSON, _ := json.Marshal(actualConfig) + expectedJSON, err := json.Marshal(testCase.expectedConfig) + if err != nil { + t.Errorf("failed to marshal expected config: %v", err) + } + actualJSON, err := json.Marshal(actualConfig) + if err != nil { + t.Errorf("failed to marshal actual config: %v", err) + } t.Errorf("%v: expected config '%s' but got '%s'", testCase.title, expectedJSON, actualJSON) } } diff --git a/internal/ingress/annotations/http2pushpreload/main.go b/internal/ingress/annotations/http2pushpreload/main.go index af9f90aa94..123940d9d3 100644 --- a/internal/ingress/annotations/http2pushpreload/main.go +++ b/internal/ingress/annotations/http2pushpreload/main.go @@ -62,7 +62,7 @@ func (h2pp http2PushPreload) GetDocumentation() parser.AnnotationFields { return h2pp.annotationConfig.Annotations } -func (a http2PushPreload) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (h2pp http2PushPreload) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(h2pp.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, http2PushPreloadAnnotations.Annotations) } diff --git a/internal/ingress/annotations/ipallowlist/main.go b/internal/ingress/annotations/ipallowlist/main.go index d9d454c978..23a3bd9e78 100644 --- a/internal/ingress/annotations/ipallowlist/main.go +++ b/internal/ingress/annotations/ipallowlist/main.go @@ -96,16 +96,15 @@ func (a ipallowlist) Parse(ing *networking.Ingress) (interface{}, error) { return &SourceRange{CIDR: defaultAllowlistSourceRange}, nil } - return &SourceRange{CIDR: defaultAllowlistSourceRange}, ing_errors.LocationDenied{ + return &SourceRange{CIDR: defaultAllowlistSourceRange}, ing_errors.LocationDeniedError{ Reason: err, } - } values := strings.Split(val, ",") ipnets, ips, err := net.ParseIPNets(values...) if err != nil && len(ips) == 0 { - return &SourceRange{CIDR: defaultAllowlistSourceRange}, ing_errors.LocationDenied{ + return &SourceRange{CIDR: defaultAllowlistSourceRange}, ing_errors.LocationDeniedError{ Reason: fmt.Errorf("the annotation does not contain a valid IP address or network: %w", err), } } diff --git a/internal/ingress/annotations/ipdenylist/main.go b/internal/ingress/annotations/ipdenylist/main.go index f17ce079af..e8f02fe50b 100644 --- a/internal/ingress/annotations/ipdenylist/main.go +++ b/internal/ingress/annotations/ipdenylist/main.go @@ -93,16 +93,15 @@ func (a ipdenylist) Parse(ing *networking.Ingress) (interface{}, error) { return &SourceRange{CIDR: defaultDenylistSourceRange}, nil } - return &SourceRange{CIDR: defaultDenylistSourceRange}, ing_errors.LocationDenied{ + return &SourceRange{CIDR: defaultDenylistSourceRange}, ing_errors.LocationDeniedError{ Reason: err, } - } values := strings.Split(val, ",") ipnets, ips, err := net.ParseIPNets(values...) if err != nil && len(ips) == 0 { - return &SourceRange{CIDR: defaultDenylistSourceRange}, ing_errors.LocationDenied{ + return &SourceRange{CIDR: defaultDenylistSourceRange}, ing_errors.LocationDeniedError{ Reason: fmt.Errorf("the annotation does not contain a valid IP address or network: %w", err), } } diff --git a/internal/ingress/annotations/loadbalancing/main_test.go b/internal/ingress/annotations/loadbalancing/main_test.go index b0442c37fc..a5205e523b 100644 --- a/internal/ingress/annotations/loadbalancing/main_test.go +++ b/internal/ingress/annotations/loadbalancing/main_test.go @@ -54,6 +54,7 @@ func TestParse(t *testing.T) { for _, testCase := range testCases { ing.SetAnnotations(testCase.annotations) + //nolint:errcheck // Ignore the error since invalid cases will be checked with expected results result, _ := ap.Parse(ing) if result != testCase.expected { t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations) diff --git a/internal/ingress/annotations/log/main.go b/internal/ingress/annotations/log/main.go index ec08292a9e..82d50bac37 100644 --- a/internal/ingress/annotations/log/main.go +++ b/internal/ingress/annotations/log/main.go @@ -101,7 +101,7 @@ func (l log) GetDocumentation() parser.AnnotationFields { return l.annotationConfig.Annotations } -func (a log) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (l log) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(l.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, logAnnotations.Annotations) } diff --git a/internal/ingress/annotations/log/main_test.go b/internal/ingress/annotations/log/main_test.go index df97c2e5b5..950612b5bd 100644 --- a/internal/ingress/annotations/log/main_test.go +++ b/internal/ingress/annotations/log/main_test.go @@ -76,7 +76,10 @@ func TestIngressAccessLogConfig(t *testing.T) { data[parser.GetAnnotationWithPrefix(enableAccessLogAnnotation)] = "false" ing.SetAnnotations(data) - log, _ := NewParser(&resolver.Mock{}).Parse(ing) + log, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } nginxLogs, ok := log.(*Config) if !ok { t.Errorf("expected a Config type") @@ -94,7 +97,10 @@ func TestIngressRewriteLogConfig(t *testing.T) { data[parser.GetAnnotationWithPrefix(enableRewriteLogAnnotation)] = "true" ing.SetAnnotations(data) - log, _ := NewParser(&resolver.Mock{}).Parse(ing) + log, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error parsing annotations %v", err) + } nginxLogs, ok := log.(*Config) if !ok { t.Errorf("expected a Config type") @@ -112,7 +118,10 @@ func TestInvalidBoolConfig(t *testing.T) { data[parser.GetAnnotationWithPrefix(enableRewriteLogAnnotation)] = "blo" ing.SetAnnotations(data) - log, _ := NewParser(&resolver.Mock{}).Parse(ing) + log, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } nginxLogs, ok := log.(*Config) if !ok { t.Errorf("expected a Config type") diff --git a/internal/ingress/annotations/mirror/main.go b/internal/ingress/annotations/mirror/main.go index 2d417dece7..d51bdd27c6 100644 --- a/internal/ingress/annotations/mirror/main.go +++ b/internal/ingress/annotations/mirror/main.go @@ -34,15 +34,13 @@ const ( mirrorHostAnnotation = "mirror-host" ) -var ( - OnOffRegex = regexp.MustCompile(`^(on|off)$`) -) +var OnOffRegex = regexp.MustCompile(`^(on|off)$`) var mirrorAnnotation = parser.Annotation{ Group: "mirror", Annotations: parser.AnnotationFields{ mirrorRequestBodyAnnotation: { - Validator: parser.ValidateRegex(*OnOffRegex, true), + Validator: parser.ValidateRegex(OnOffRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskLow, Documentation: `This annotation defines if the request-body should be sent to the mirror backend. Can be 'on' or 'off'`, diff --git a/internal/ingress/annotations/modsecurity/main.go b/internal/ingress/annotations/modsecurity/main.go index 5a9aaa7295..80ae78937e 100644 --- a/internal/ingress/annotations/modsecurity/main.go +++ b/internal/ingress/annotations/modsecurity/main.go @@ -27,7 +27,7 @@ import ( const ( modsecEnableAnnotation = "enable-modsecurity" modsecEnableOwaspCoreAnnotation = "enable-owasp-core-rules" - modesecTransactionIdAnnotation = "modsecurity-transaction-id" + modesecTransactionIDAnnotation = "modsecurity-transaction-id" modsecSnippetAnnotation = "modsecurity-snippet" ) @@ -46,8 +46,8 @@ var modsecurityAnnotation = parser.Annotation{ Risk: parser.AnnotationRiskLow, Documentation: `This annotation enables the OWASP Core Rule Set`, }, - modesecTransactionIdAnnotation: { - Validator: parser.ValidateRegex(*parser.NGINXVariable, true), + modesecTransactionIDAnnotation: { + Validator: parser.ValidateRegex(parser.NGINXVariable, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskHigh, Documentation: `This annotation enables passing an NGINX variable to ModSecurity.`, @@ -98,9 +98,9 @@ func (modsec1 *Config) Equal(modsec2 *Config) bool { } // NewParser creates a new ModSecurity annotation parser -func NewParser(resolver resolver.Resolver) parser.IngressAnnotation { +func NewParser(r resolver.Resolver) parser.IngressAnnotation { return modSecurity{ - r: resolver, + r: r, annotationConfig: modsecurityAnnotation, } } @@ -134,10 +134,10 @@ func (a modSecurity) Parse(ing *networking.Ingress) (interface{}, error) { config.OWASPRules = false } - config.TransactionID, err = parser.GetStringAnnotation(modesecTransactionIdAnnotation, ing, a.annotationConfig.Annotations) + config.TransactionID, err = parser.GetStringAnnotation(modesecTransactionIDAnnotation, ing, a.annotationConfig.Annotations) if err != nil { if errors.IsInvalidContent(err) { - klog.Warningf("annotation %s contains invalid directive, defaulting", modesecTransactionIdAnnotation) + klog.Warningf("annotation %s contains invalid directive, defaulting", modesecTransactionIDAnnotation) } config.TransactionID = "" } diff --git a/internal/ingress/annotations/modsecurity/main_test.go b/internal/ingress/annotations/modsecurity/main_test.go index 2ddbdf7e3a..0c9b3a9c70 100644 --- a/internal/ingress/annotations/modsecurity/main_test.go +++ b/internal/ingress/annotations/modsecurity/main_test.go @@ -69,8 +69,14 @@ func TestParse(t *testing.T) { for _, testCase := range testCases { ing.SetAnnotations(testCase.annotations) - result, _ := ap.Parse(ing) - config := result.(*Config) + result, err := ap.Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } + config, ok := result.(*Config) + if !ok { + t.Errorf("unexpected type: %T", result) + } if !config.Equal(&testCase.expected) { t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations) } diff --git a/internal/ingress/annotations/opentelemetry/main.go b/internal/ingress/annotations/opentelemetry/main.go index a029087dad..ca91085483 100644 --- a/internal/ingress/annotations/opentelemetry/main.go +++ b/internal/ingress/annotations/opentelemetry/main.go @@ -51,7 +51,7 @@ var otelAnnotations = parser.Annotation{ Documentation: `This annotation enables or disables using spans from incoming requests as parent for created ones`, }, otelOperationNameAnnotation: { - Validator: parser.ValidateRegex(*regexOperationName, true), + Validator: parser.ValidateRegex(regexOperationName, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation defines what operation name should be added to the span`, @@ -75,7 +75,6 @@ type Config struct { // Equal tests for equality between two Config types func (bd1 *Config) Equal(bd2 *Config) bool { - if bd1.Set != bd2.Set { return false } @@ -150,7 +149,7 @@ func (c opentelemetry) GetDocumentation() parser.AnnotationFields { return c.annotationConfig.Annotations } -func (a opentelemetry) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (c opentelemetry) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(c.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, otelAnnotations.Annotations) } diff --git a/internal/ingress/annotations/opentelemetry/main_test.go b/internal/ingress/annotations/opentelemetry/main_test.go index c78ebc8b32..e5c1de0b38 100644 --- a/internal/ingress/annotations/opentelemetry/main_test.go +++ b/internal/ingress/annotations/opentelemetry/main_test.go @@ -26,6 +26,8 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const enableAnnotation = "true" + func buildIngress() *networking.Ingress { defaultBackend := networking.IngressBackend{ Service: &networking.IngressServiceBackend{ @@ -73,10 +75,13 @@ func TestIngressAnnotationOpentelemetrySetTrue(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix(enableOpenTelemetryAnnotation)] = "true" + data[parser.GetAnnotationWithPrefix(enableOpenTelemetryAnnotation)] = enableAnnotation ing.SetAnnotations(data) - val, _ := NewParser(&resolver.Mock{}).Parse(ing) + val, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } openTelemetry, ok := val.(*Config) if !ok { t.Errorf("expected a Config type") @@ -103,7 +108,10 @@ func TestIngressAnnotationOpentelemetrySetFalse(t *testing.T) { data[parser.GetAnnotationWithPrefix(enableOpenTelemetryAnnotation)] = "false" ing.SetAnnotations(data) - val, _ := NewParser(&resolver.Mock{}).Parse(ing) + val, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } openTelemetry, ok := val.(*Config) if !ok { t.Errorf("expected a Config type") @@ -123,8 +131,8 @@ func TestIngressAnnotationOpentelemetryTrustSetTrue(t *testing.T) { data := map[string]string{} opName := "foo-op" - data[parser.GetAnnotationWithPrefix(enableOpenTelemetryAnnotation)] = "true" - data[parser.GetAnnotationWithPrefix(otelTrustSpanAnnotation)] = "true" + data[parser.GetAnnotationWithPrefix(enableOpenTelemetryAnnotation)] = enableAnnotation + data[parser.GetAnnotationWithPrefix(otelTrustSpanAnnotation)] = enableAnnotation data[parser.GetAnnotationWithPrefix(otelOperationNameAnnotation)] = opName ing.SetAnnotations(data) @@ -163,7 +171,7 @@ func TestIngressAnnotationOpentelemetryWithBadOpName(t *testing.T) { data := map[string]string{} opName := "fooxpto_123$la;" - data[parser.GetAnnotationWithPrefix(enableOpenTelemetryAnnotation)] = "true" + data[parser.GetAnnotationWithPrefix(enableOpenTelemetryAnnotation)] = enableAnnotation data[parser.GetAnnotationWithPrefix(otelOperationNameAnnotation)] = opName ing.SetAnnotations(data) @@ -180,7 +188,10 @@ func TestIngressAnnotationOpentelemetryUnset(t *testing.T) { data := map[string]string{} ing.SetAnnotations(data) - val, _ := NewParser(&resolver.Mock{}).Parse(ing) + val, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } _, ok := val.(*Config) if !ok { t.Errorf("expected a Config type") diff --git a/internal/ingress/annotations/opentracing/main.go b/internal/ingress/annotations/opentracing/main.go index 7c8671f9dc..9d7995a8ac 100644 --- a/internal/ingress/annotations/opentracing/main.go +++ b/internal/ingress/annotations/opentracing/main.go @@ -89,13 +89,13 @@ func NewParser(r resolver.Resolver) parser.IngressAnnotation { } } -func (s opentracing) Parse(ing *networking.Ingress) (interface{}, error) { - enabled, err := parser.GetBoolAnnotation(enableOpentracingAnnotation, ing, s.annotationConfig.Annotations) +func (o opentracing) Parse(ing *networking.Ingress) (interface{}, error) { + enabled, err := parser.GetBoolAnnotation(enableOpentracingAnnotation, ing, o.annotationConfig.Annotations) if err != nil { return &Config{}, nil } - trustSpan, err := parser.GetBoolAnnotation(opentracingTrustSpanAnnotation, ing, s.annotationConfig.Annotations) + trustSpan, err := parser.GetBoolAnnotation(opentracingTrustSpanAnnotation, ing, o.annotationConfig.Annotations) if err != nil { return &Config{Set: true, Enabled: enabled}, nil } @@ -103,11 +103,11 @@ func (s opentracing) Parse(ing *networking.Ingress) (interface{}, error) { return &Config{Set: true, Enabled: enabled, TrustSet: true, TrustEnabled: trustSpan}, nil } -func (s opentracing) GetDocumentation() parser.AnnotationFields { - return s.annotationConfig.Annotations +func (o opentracing) GetDocumentation() parser.AnnotationFields { + return o.annotationConfig.Annotations } -func (a opentracing) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (o opentracing) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(o.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, opentracingAnnotations.Annotations) } diff --git a/internal/ingress/annotations/opentracing/main_test.go b/internal/ingress/annotations/opentracing/main_test.go index b7b62ac9d9..f59e604387 100644 --- a/internal/ingress/annotations/opentracing/main_test.go +++ b/internal/ingress/annotations/opentracing/main_test.go @@ -26,6 +26,8 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const enableAnnotation = "true" + func buildIngress() *networking.Ingress { defaultBackend := networking.IngressBackend{ Service: &networking.IngressServiceBackend{ @@ -73,10 +75,13 @@ func TestIngressAnnotationOpentracingSetTrue(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix(enableOpentracingAnnotation)] = "true" + data[parser.GetAnnotationWithPrefix(enableOpentracingAnnotation)] = enableAnnotation ing.SetAnnotations(data) - val, _ := NewParser(&resolver.Mock{}).Parse(ing) + val, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error %v", err) + } openTracing, ok := val.(*Config) if !ok { t.Errorf("expected a Config type") @@ -95,7 +100,10 @@ func TestIngressAnnotationOpentracingSetFalse(t *testing.T) { data[parser.GetAnnotationWithPrefix(enableOpentracingAnnotation)] = "false" ing.SetAnnotations(data) - val, _ := NewParser(&resolver.Mock{}).Parse(ing) + val, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error %v", err) + } openTracing, ok := val.(*Config) if !ok { t.Errorf("expected a Config type") @@ -110,11 +118,14 @@ func TestIngressAnnotationOpentracingTrustSetTrue(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix(enableOpentracingAnnotation)] = "true" - data[parser.GetAnnotationWithPrefix(opentracingTrustSpanAnnotation)] = "true" + data[parser.GetAnnotationWithPrefix(enableOpentracingAnnotation)] = enableAnnotation + data[parser.GetAnnotationWithPrefix(opentracingTrustSpanAnnotation)] = enableAnnotation ing.SetAnnotations(data) - val, _ := NewParser(&resolver.Mock{}).Parse(ing) + val, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error %v", err) + } openTracing, ok := val.(*Config) if !ok { t.Errorf("expected a Config type") @@ -136,7 +147,11 @@ func TestIngressAnnotationOpentracingUnset(t *testing.T) { data := map[string]string{} ing.SetAnnotations(data) - val, _ := NewParser(&resolver.Mock{}).Parse(ing) + val, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } + _, ok := val.(*Config) if !ok { t.Errorf("expected a Config type") diff --git a/internal/ingress/annotations/parser/main.go b/internal/ingress/annotations/parser/main.go index 951970e270..554ad9dde7 100644 --- a/internal/ingress/annotations/parser/main.go +++ b/internal/ingress/annotations/parser/main.go @@ -118,7 +118,7 @@ func (a ingAnnotations) parseString(name string) (string, error) { val, ok := a[name] if ok { s := normalizeString(val) - if len(s) == 0 { + if s == "" { return "", errors.NewInvalidAnnotationContent(name, val) } @@ -248,13 +248,14 @@ func StringToURL(input string) (*url.URL, error) { return nil, fmt.Errorf("%v is not a valid URL: %v", input, err) } - if parsedURL.Scheme == "" { + switch { + case parsedURL.Scheme == "": return nil, fmt.Errorf("url scheme is empty") - } else if parsedURL.Host == "" { + case parsedURL.Host == "": return nil, fmt.Errorf("url host is empty") - } else if strings.Contains(parsedURL.Host, "..") { + case strings.Contains(parsedURL.Host, ".."): return nil, fmt.Errorf("invalid url host") + default: + return parsedURL, nil } - - return parsedURL, nil } diff --git a/internal/ingress/annotations/parser/main_test.go b/internal/ingress/annotations/parser/main_test.go index beca49370c..0f7ecb4598 100644 --- a/internal/ingress/annotations/parser/main_test.go +++ b/internal/ingress/annotations/parser/main_test.go @@ -93,14 +93,16 @@ func TestGetStringAnnotation(t *testing.T) { {"valid - A", "string", "A ", "A", false}, {"valid - B", "string", " B", "B", false}, {"empty", "string", " ", "", true}, - {"valid multiline", "string", ` + { + "valid multiline", "string", ` rewrite (?i)/arcgis/rest/services/Utilities/Geometry/GeometryServer(.*)$ /arcgis/rest/services/Utilities/Geometry/GeometryServer$1 break; rewrite (?i)/arcgis/services/Utilities/Geometry/GeometryServer(.*)$ /arcgis/services/Utilities/Geometry/GeometryServer$1 break; `, ` rewrite (?i)/arcgis/rest/services/Utilities/Geometry/GeometryServer(.*)$ /arcgis/rest/services/Utilities/Geometry/GeometryServer$1 break; rewrite (?i)/arcgis/services/Utilities/Geometry/GeometryServer(.*)$ /arcgis/services/Utilities/Geometry/GeometryServer$1 break; `, - false}, + false, + }, } data := map[string]string{} @@ -213,8 +215,10 @@ func TestGetIntAnnotation(t *testing.T) { func TestStringToURL(t *testing.T) { validURL := "http://bar.foo.com/external-auth" - validParsedURL, _ := url.Parse(validURL) - + validParsedURL, err := url.Parse(validURL) + if err != nil { + t.Errorf("unexpected error: %v", err) + } tests := []struct { title string url string diff --git a/internal/ingress/annotations/parser/validators.go b/internal/ingress/annotations/parser/validators.go index e14b486eb1..ab9b4799fa 100644 --- a/internal/ingress/annotations/parser/validators.go +++ b/internal/ingress/annotations/parser/validators.go @@ -52,7 +52,7 @@ var ( var IsValidRegex = regexp.MustCompile("^[/" + alphaNumericChars + regexEnabledChars + "]*$") // SizeRegex validates sizes understood by NGINX, like 1000, 100k, 1000M -var SizeRegex = regexp.MustCompile("^(?i)[0-9]+[bkmg]?$") +var SizeRegex = regexp.MustCompile(`^(?i)\d+[bkmg]?$`) // URLRegex is used to validate a URL but with only a specific set of characters: // It is alphanumericChar + ":", "?", "&" @@ -103,7 +103,7 @@ func ValidateServerName(value string) error { // ValidateRegex receives a regex as an argument and uses it to validate // the value of the field. // Annotation can define if the spaces should be trimmed before validating the value -func ValidateRegex(regex regexp.Regexp, removeSpace bool) AnnotationValidator { +func ValidateRegex(regex *regexp.Regexp, removeSpace bool) AnnotationValidator { return func(s string) error { if removeSpace { s = strings.ReplaceAll(s, " ", "") @@ -117,7 +117,7 @@ func ValidateRegex(regex regexp.Regexp, removeSpace bool) AnnotationValidator { // ValidateOptions receives an array of valid options that can be the value of annotation. // If no valid option is found, it will return an error -func ValidateOptions(options []string, caseSensitive bool, trimSpace bool) AnnotationValidator { +func ValidateOptions(options []string, caseSensitive, trimSpace bool) AnnotationValidator { return func(s string) error { if trimSpace { s = strings.TrimSpace(s) @@ -161,7 +161,7 @@ func ValidateDuration(value string) error { // ValidateNull always return null values and should not be widely used. // It is used on the "snippet" annotations, as it is up to the admin to allow its // usage, knowing it can be critical! -func ValidateNull(value string) error { +func ValidateNull(_ string) error { return nil } diff --git a/internal/ingress/annotations/parser/validators_test.go b/internal/ingress/annotations/parser/validators_test.go index 2aa6cec375..e7aeb15ca4 100644 --- a/internal/ingress/annotations/parser/validators_test.go +++ b/internal/ingress/annotations/parser/validators_test.go @@ -223,7 +223,6 @@ func Test_checkAnnotation(t *testing.T) { } func TestCheckAnnotationRisk(t *testing.T) { - tests := []struct { name string annotations map[string]string diff --git a/internal/ingress/annotations/proxy/main.go b/internal/ingress/annotations/proxy/main.go index a2d10ca909..7fb1c814ec 100644 --- a/internal/ingress/annotations/proxy/main.go +++ b/internal/ingress/annotations/proxy/main.go @@ -45,9 +45,7 @@ const ( proxyMaxTempFileSizeAnnotation = "proxy-max-temp-file-size" ) -var ( - validUpstreamAnnotation = regexp.MustCompile(`^((error|timeout|invalid_header|http_500|http_502|http_503|http_504|http_403|http_404|http_429|non_idempotent|off)\s?)+$`) -) +var validUpstreamAnnotation = regexp.MustCompile(`^((error|timeout|invalid_header|http_500|http_502|http_503|http_504|http_403|http_404|http_429|non_idempotent|off)\s?)+$`) var proxyAnnotations = parser.Annotation{ Group: "backend", @@ -78,32 +76,32 @@ var proxyAnnotations = parser.Annotation{ By default proxy buffers number is set as 4`, }, proxyBufferSizeAnnotation: { - Validator: parser.ValidateRegex(*parser.SizeRegex, true), + Validator: parser.ValidateRegex(parser.SizeRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskLow, Documentation: `This annotation sets the size of the buffer proxy_buffer_size used for reading the first part of the response received from the proxied server. By default proxy buffer size is set as "4k".`, }, proxyCookiePathAnnotation: { - Validator: parser.ValidateRegex(*parser.URLIsValidRegex, true), + Validator: parser.ValidateRegex(parser.URLIsValidRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation sets a text that should be changed in the path attribute of the "Set-Cookie" header fields of a proxied server response.`, }, proxyCookieDomainAnnotation: { - Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Validator: parser.ValidateRegex(parser.BasicCharsRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation ets a text that should be changed in the domain attribute of the "Set-Cookie" header fields of a proxied server response.`, }, proxyBodySizeAnnotation: { - Validator: parser.ValidateRegex(*parser.SizeRegex, true), + Validator: parser.ValidateRegex(parser.SizeRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation allows setting the maximum allowed size of a client request body.`, }, proxyNextUpstreamAnnotation: { - Validator: parser.ValidateRegex(*validUpstreamAnnotation, false), + Validator: parser.ValidateRegex(validUpstreamAnnotation, false), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation defines when the next upstream should be used. @@ -129,13 +127,13 @@ var proxyAnnotations = parser.Annotation{ Documentation: `This annotation enables or disables buffering of a client request body.`, }, proxyRedirectFromAnnotation: { - Validator: parser.ValidateRegex(*parser.URLIsValidRegex, true), + Validator: parser.ValidateRegex(parser.URLIsValidRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `The annotations proxy-redirect-from and proxy-redirect-to will set the first and second parameters of NGINX's proxy_redirect directive respectively`, }, proxyRedirectToAnnotation: { - Validator: parser.ValidateRegex(*parser.URLIsValidRegex, true), + Validator: parser.ValidateRegex(parser.URLIsValidRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `The annotations proxy-redirect-from and proxy-redirect-to will set the first and second parameters of NGINX's proxy_redirect directive respectively`, @@ -153,7 +151,7 @@ var proxyAnnotations = parser.Annotation{ Documentation: `This annotations sets the HTTP protocol version for proxying. Can be "1.0" or "1.1".`, }, proxyMaxTempFileSizeAnnotation: { - Validator: parser.ValidateRegex(*parser.SizeRegex, true), + Validator: parser.ValidateRegex(parser.SizeRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskLow, Documentation: `This annotation defines the maximum size of a temporary file when buffering responses.`, @@ -253,7 +251,8 @@ type proxy struct { // NewParser creates a new reverse proxy configuration annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return proxy{r: r, + return proxy{ + r: r, annotationConfig: proxyAnnotations, } } diff --git a/internal/ingress/annotations/proxy/main_test.go b/internal/ingress/annotations/proxy/main_test.go index fa185551b8..9446ae9709 100644 --- a/internal/ingress/annotations/proxy/main_test.go +++ b/internal/ingress/annotations/proxy/main_test.go @@ -28,6 +28,12 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + off = "off" + proxyHTTPVersion = "1.0" + proxyMaxTempFileSize = "128k" +) + func buildIngress() *networking.Ingress { defaultBackend := networking.IngressBackend{ Service: &networking.IngressServiceBackend{ @@ -87,7 +93,7 @@ func (m mockBackend) GetDefaultBackend() defaults.Backend { ProxyNextUpstreamTimeout: 0, ProxyNextUpstreamTries: 3, ProxyRequestBuffering: "on", - ProxyBuffering: "off", + ProxyBuffering: off, ProxyHTTPVersion: "1.1", ProxyMaxTempFileSize: "1024m", } @@ -103,13 +109,13 @@ func TestProxy(t *testing.T) { data[parser.GetAnnotationWithPrefix("proxy-buffers-number")] = "8" data[parser.GetAnnotationWithPrefix("proxy-buffer-size")] = "1k" data[parser.GetAnnotationWithPrefix("proxy-body-size")] = "2k" - data[parser.GetAnnotationWithPrefix("proxy-next-upstream")] = "off" + data[parser.GetAnnotationWithPrefix("proxy-next-upstream")] = off data[parser.GetAnnotationWithPrefix("proxy-next-upstream-timeout")] = "5" data[parser.GetAnnotationWithPrefix("proxy-next-upstream-tries")] = "3" - data[parser.GetAnnotationWithPrefix("proxy-request-buffering")] = "off" + data[parser.GetAnnotationWithPrefix("proxy-request-buffering")] = off data[parser.GetAnnotationWithPrefix("proxy-buffering")] = "on" - data[parser.GetAnnotationWithPrefix("proxy-http-version")] = "1.0" - data[parser.GetAnnotationWithPrefix("proxy-max-temp-file-size")] = "128k" + data[parser.GetAnnotationWithPrefix("proxy-http-version")] = proxyHTTPVersion + data[parser.GetAnnotationWithPrefix("proxy-max-temp-file-size")] = proxyMaxTempFileSize ing.SetAnnotations(data) i, err := NewParser(mockBackend{}).Parse(ing) @@ -138,7 +144,7 @@ func TestProxy(t *testing.T) { if p.BodySize != "2k" { t.Errorf("expected 2k as body-size but returned %v", p.BodySize) } - if p.NextUpstream != "off" { + if p.NextUpstream != off { t.Errorf("expected off as next-upstream but returned %v", p.NextUpstream) } if p.NextUpstreamTimeout != 5 { @@ -147,16 +153,16 @@ func TestProxy(t *testing.T) { if p.NextUpstreamTries != 3 { t.Errorf("expected 3 as next-upstream-tries but returned %v", p.NextUpstreamTries) } - if p.RequestBuffering != "off" { + if p.RequestBuffering != off { t.Errorf("expected off as request-buffering but returned %v", p.RequestBuffering) } if p.ProxyBuffering != "on" { t.Errorf("expected on as proxy-buffering but returned %v", p.ProxyBuffering) } - if p.ProxyHTTPVersion != "1.0" { + if p.ProxyHTTPVersion != proxyHTTPVersion { t.Errorf("expected 1.0 as proxy-http-version but returned %v", p.ProxyHTTPVersion) } - if p.ProxyMaxTempFileSize != "128k" { + if p.ProxyMaxTempFileSize != proxyMaxTempFileSize { t.Errorf("expected 128k as proxy-max-temp-file-size but returned %v", p.ProxyMaxTempFileSize) } } @@ -176,8 +182,8 @@ func TestProxyComplex(t *testing.T) { data[parser.GetAnnotationWithPrefix("proxy-next-upstream-tries")] = "3" data[parser.GetAnnotationWithPrefix("proxy-request-buffering")] = "off" data[parser.GetAnnotationWithPrefix("proxy-buffering")] = "on" - data[parser.GetAnnotationWithPrefix("proxy-http-version")] = "1.0" - data[parser.GetAnnotationWithPrefix("proxy-max-temp-file-size")] = "128k" + data[parser.GetAnnotationWithPrefix("proxy-http-version")] = proxyHTTPVersion + data[parser.GetAnnotationWithPrefix("proxy-max-temp-file-size")] = proxyMaxTempFileSize ing.SetAnnotations(data) i, err := NewParser(mockBackend{}).Parse(ing) @@ -221,10 +227,10 @@ func TestProxyComplex(t *testing.T) { if p.ProxyBuffering != "on" { t.Errorf("expected on as proxy-buffering but returned %v", p.ProxyBuffering) } - if p.ProxyHTTPVersion != "1.0" { + if p.ProxyHTTPVersion != proxyHTTPVersion { t.Errorf("expected 1.0 as proxy-http-version but returned %v", p.ProxyHTTPVersion) } - if p.ProxyMaxTempFileSize != "128k" { + if p.ProxyMaxTempFileSize != proxyMaxTempFileSize { t.Errorf("expected 128k as proxy-max-temp-file-size but returned %v", p.ProxyMaxTempFileSize) } } diff --git a/internal/ingress/annotations/proxyssl/main.go b/internal/ingress/annotations/proxyssl/main.go index 40ee18aa0f..0e854cd217 100644 --- a/internal/ingress/annotations/proxyssl/main.go +++ b/internal/ingress/annotations/proxyssl/main.go @@ -24,7 +24,6 @@ import ( networking "k8s.io/api/networking/v1" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" - "k8s.io/ingress-nginx/internal/ingress/errors" ing_errors "k8s.io/ingress-nginx/internal/ingress/errors" "k8s.io/ingress-nginx/internal/ingress/resolver" "k8s.io/ingress-nginx/internal/k8s" @@ -42,7 +41,7 @@ const ( var ( proxySSLOnOffRegex = regexp.MustCompile(`^(on|off)$`) proxySSLProtocolRegex = regexp.MustCompile(`^(SSLv2|SSLv3|TLSv1|TLSv1\.1|TLSv1\.2|TLSv1\.3| )*$`) - proxySSLCiphersRegex = regexp.MustCompile(`^[A-Za-z0-9\+\:\_\-\!]*$`) + proxySSLCiphersRegex = regexp.MustCompile(`^[A-Za-z0-9\+:\_\-!]*$`) ) const ( @@ -59,7 +58,7 @@ var proxySSLAnnotation = parser.Annotation{ Group: "proxy", Annotations: parser.AnnotationFields{ proxySSLSecretAnnotation: { - Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Validator: parser.ValidateRegex(parser.BasicCharsRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation specifies a Secret with the certificate tls.crt, key tls.key in PEM format used for authentication to a proxied HTTPS server. @@ -68,14 +67,14 @@ var proxySSLAnnotation = parser.Annotation{ Just secrets on the same namespace of the ingress can be used.`, }, proxySSLCiphersAnnotation: { - Validator: parser.ValidateRegex(*proxySSLCiphersRegex, true), + Validator: parser.ValidateRegex(proxySSLCiphersRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation Specifies the enabled ciphers for requests to a proxied HTTPS server. The ciphers are specified in the format understood by the OpenSSL library.`, }, proxySSLProtocolsAnnotation: { - Validator: parser.ValidateRegex(*proxySSLProtocolRegex, true), + Validator: parser.ValidateRegex(proxySSLProtocolRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskLow, Documentation: `This annotation enables the specified protocols for requests to a proxied HTTPS server.`, @@ -88,7 +87,7 @@ var proxySSLAnnotation = parser.Annotation{ This value is also passed through SNI when a connection is established to the proxied HTTPS server.`, }, proxySSLVerifyAnnotation: { - Validator: parser.ValidateRegex(*proxySSLOnOffRegex, true), + Validator: parser.ValidateRegex(proxySSLOnOffRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskLow, Documentation: `This annotation enables or disables verification of the proxied HTTPS server certificate. (default: off)`, @@ -100,7 +99,7 @@ var proxySSLAnnotation = parser.Annotation{ Documentation: `This annotation Sets the verification depth in the proxied HTTPS server certificates chain. (default: 1).`, }, proxySSLServerNameAnnotation: { - Validator: parser.ValidateRegex(*proxySSLOnOffRegex, true), + Validator: parser.ValidateRegex(proxySSLOnOffRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskLow, Documentation: `This annotation enables passing of the server name through TLS Server Name Indication extension (SNI, RFC 6066) when establishing a connection with the proxied HTTPS server.`, @@ -150,10 +149,11 @@ func (pssl1 *Config) Equal(pssl2 *Config) bool { } // NewParser creates a new TLS authentication annotation parser -func NewParser(resolver resolver.Resolver) parser.IngressAnnotation { +func NewParser(r resolver.Resolver) parser.IngressAnnotation { return proxySSL{ - r: resolver, - annotationConfig: proxySSLAnnotation} + r: r, + annotationConfig: proxySSLAnnotation, + } } type proxySSL struct { @@ -208,13 +208,13 @@ func (p proxySSL) Parse(ing *networking.Ingress) (interface{}, error) { proxyCert, err := p.r.GetAuthCertificate(proxysslsecret) if err != nil { e := fmt.Errorf("error obtaining certificate: %w", err) - return &Config{}, ing_errors.LocationDenied{Reason: e} + return &Config{}, ing_errors.LocationDeniedError{Reason: e} } config.AuthSSLCert = *proxyCert config.Ciphers, err = parser.GetStringAnnotation(proxySSLCiphersAnnotation, ing, p.annotationConfig.Annotations) if err != nil { - if errors.IsValidationError(err) { + if ing_errors.IsValidationError(err) { klog.Warningf("invalid value passed to proxy-ssl-ciphers, defaulting to %s", defaultProxySSLCiphers) } config.Ciphers = defaultProxySSLCiphers @@ -222,7 +222,7 @@ func (p proxySSL) Parse(ing *networking.Ingress) (interface{}, error) { config.Protocols, err = parser.GetStringAnnotation(proxySSLProtocolsAnnotation, ing, p.annotationConfig.Annotations) if err != nil { - if errors.IsValidationError(err) { + if ing_errors.IsValidationError(err) { klog.Warningf("invalid value passed to proxy-ssl-protocols, defaulting to %s", defaultProxySSLProtocols) } config.Protocols = defaultProxySSLProtocols @@ -232,7 +232,7 @@ func (p proxySSL) Parse(ing *networking.Ingress) (interface{}, error) { config.ProxySSLName, err = parser.GetStringAnnotation(proxySSLNameAnnotation, ing, p.annotationConfig.Annotations) if err != nil { - if errors.IsValidationError(err) { + if ing_errors.IsValidationError(err) { klog.Warningf("invalid value passed to proxy-ssl-name, defaulting to empty") } config.ProxySSLName = "" @@ -260,7 +260,7 @@ func (p proxySSL) GetDocumentation() parser.AnnotationFields { return p.annotationConfig.Annotations } -func (a proxySSL) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (p proxySSL) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(p.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, proxySSLAnnotation.Annotations) } diff --git a/internal/ingress/annotations/proxyssl/main_test.go b/internal/ingress/annotations/proxyssl/main_test.go index edd65343eb..a20c6813db 100644 --- a/internal/ingress/annotations/proxyssl/main_test.go +++ b/internal/ingress/annotations/proxyssl/main_test.go @@ -27,6 +27,14 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + defaultDemoSecret = "default/demo-secret" + proxySslCiphers = "HIGH:-SHA" + off = "off" + sslServerName = "w00t" + defaultProtocol = "SSLv2 TLSv1 TLSv1.2 TLSv1.3" +) + func buildIngress() *networking.Ingress { defaultBackend := networking.IngressBackend{ Service: &networking.IngressServiceBackend{ @@ -77,28 +85,27 @@ type mockSecret struct { // GetAuthCertificate from mockSecret mocks the GetAuthCertificate for backend certificate authentication func (m mockSecret) GetAuthCertificate(name string) (*resolver.AuthSSLCert, error) { - if name != "default/demo-secret" { + if name != defaultDemoSecret { return nil, errors.Errorf("there is no secret with name %v", name) } return &resolver.AuthSSLCert{ - Secret: "default/demo-secret", + Secret: defaultDemoSecret, CAFileName: "/ssl/ca.crt", CASHA: "abc", }, nil - } func TestAnnotations(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix(proxySSLSecretAnnotation)] = "default/demo-secret" - data[parser.GetAnnotationWithPrefix("proxy-ssl-ciphers")] = "HIGH:-SHA" + data[parser.GetAnnotationWithPrefix(proxySSLSecretAnnotation)] = defaultDemoSecret + data[parser.GetAnnotationWithPrefix("proxy-ssl-ciphers")] = proxySslCiphers data[parser.GetAnnotationWithPrefix("proxy-ssl-name")] = "$host" data[parser.GetAnnotationWithPrefix("proxy-ssl-protocols")] = "TLSv1.3 SSLv2 TLSv1 TLSv1.2" data[parser.GetAnnotationWithPrefix("proxy-ssl-server-name")] = "on" - data[parser.GetAnnotationWithPrefix("proxy-ssl-session-reuse")] = "off" + data[parser.GetAnnotationWithPrefix("proxy-ssl-session-reuse")] = off data[parser.GetAnnotationWithPrefix("proxy-ssl-verify")] = "on" data[parser.GetAnnotationWithPrefix("proxy-ssl-verify-depth")] = "3" @@ -115,7 +122,7 @@ func TestAnnotations(t *testing.T) { t.Errorf("expected *Config but got %v", u) } - secret, err := fakeSecret.GetAuthCertificate("default/demo-secret") + secret, err := fakeSecret.GetAuthCertificate(defaultDemoSecret) if err != nil { t.Errorf("unexpected error getting secret %v", err) } @@ -123,11 +130,11 @@ func TestAnnotations(t *testing.T) { if u.AuthSSLCert.Secret != secret.Secret { t.Errorf("expected %v but got %v", secret.Secret, u.AuthSSLCert.Secret) } - if u.Ciphers != "HIGH:-SHA" { - t.Errorf("expected %v but got %v", "HIGH:-SHA", u.Ciphers) + if u.Ciphers != proxySslCiphers { + t.Errorf("expected %v but got %v", proxySslCiphers, u.Ciphers) } - if u.Protocols != "SSLv2 TLSv1 TLSv1.2 TLSv1.3" { - t.Errorf("expected %v but got %v", "SSLv2 TLSv1 TLSv1.2 TLSv1.3", u.Protocols) + if u.Protocols != defaultProtocol { + t.Errorf("expected %v but got %v", defaultProtocol, u.Protocols) } if u.Verify != "on" { t.Errorf("expected %v but got %v", "on", u.Verify) @@ -141,7 +148,6 @@ func TestAnnotations(t *testing.T) { if u.ProxySSLServerName != "on" { t.Errorf("expected %v but got %v", "on", u.ProxySSLServerName) } - } func TestInvalidAnnotations(t *testing.T) { @@ -172,11 +178,11 @@ func TestInvalidAnnotations(t *testing.T) { } // Invalid optional Annotations - data[parser.GetAnnotationWithPrefix("proxy-ssl-secret")] = "default/demo-secret" + data[parser.GetAnnotationWithPrefix("proxy-ssl-secret")] = defaultDemoSecret data[parser.GetAnnotationWithPrefix("proxy-ssl-protocols")] = "TLSv111 SSLv1" - data[parser.GetAnnotationWithPrefix("proxy-ssl-server-name")] = "w00t" - data[parser.GetAnnotationWithPrefix("proxy-ssl-session-reuse")] = "w00t" - data[parser.GetAnnotationWithPrefix("proxy-ssl-verify")] = "w00t" + data[parser.GetAnnotationWithPrefix("proxy-ssl-server-name")] = sslServerName + data[parser.GetAnnotationWithPrefix("proxy-ssl-session-reuse")] = sslServerName + data[parser.GetAnnotationWithPrefix("proxy-ssl-verify")] = sslServerName data[parser.GetAnnotationWithPrefix("proxy-ssl-verify-depth")] = "abcd" ing.SetAnnotations(data) @@ -207,21 +213,15 @@ func TestEquals(t *testing.T) { cfg1 := &Config{} cfg2 := &Config{} - // Same config - result := cfg1.Equal(cfg1) - if result != true { - t.Errorf("Expected true") - } - // compare nil - result = cfg1.Equal(nil) + result := cfg1.Equal(nil) if result != false { t.Errorf("Expected false") } // Different Certs sslCert1 := resolver.AuthSSLCert{ - Secret: "default/demo-secret", + Secret: defaultDemoSecret, CAFileName: "/ssl/ca.crt", CASHA: "abc", } @@ -240,7 +240,7 @@ func TestEquals(t *testing.T) { // Different Ciphers cfg1.Ciphers = "DEFAULT" - cfg2.Ciphers = "HIGH:-SHA" + cfg2.Ciphers = proxySslCiphers result = cfg1.Equal(cfg2) if result != false { t.Errorf("Expected false") @@ -248,22 +248,22 @@ func TestEquals(t *testing.T) { cfg2.Ciphers = "DEFAULT" // Different Protocols - cfg1.Protocols = "SSLv2 TLSv1 TLSv1.2 TLSv1.3" + cfg1.Protocols = defaultProtocol cfg2.Protocols = "SSLv3 TLSv1 TLSv1.2 TLSv1.3" result = cfg1.Equal(cfg2) if result != false { t.Errorf("Expected false") } - cfg2.Protocols = "SSLv2 TLSv1 TLSv1.2 TLSv1.3" + cfg2.Protocols = defaultProtocol // Different Verify - cfg1.Verify = "off" + cfg1.Verify = off cfg2.Verify = "on" result = cfg1.Equal(cfg2) if result != false { t.Errorf("Expected false") } - cfg2.Verify = "off" + cfg2.Verify = off // Different VerifyDepth cfg1.VerifyDepth = 1 @@ -275,13 +275,13 @@ func TestEquals(t *testing.T) { cfg2.VerifyDepth = 1 // Different ProxySSLServerName - cfg1.ProxySSLServerName = "off" + cfg1.ProxySSLServerName = off cfg2.ProxySSLServerName = "on" result = cfg1.Equal(cfg2) if result != false { t.Errorf("Expected false") } - cfg2.ProxySSLServerName = "off" + cfg2.ProxySSLServerName = off // Equal Configs result = cfg1.Equal(cfg2) diff --git a/internal/ingress/annotations/ratelimit/main.go b/internal/ingress/annotations/ratelimit/main.go index 39161a2c09..e79c698bf2 100644 --- a/internal/ingress/annotations/ratelimit/main.go +++ b/internal/ingress/annotations/ratelimit/main.go @@ -288,7 +288,7 @@ func (a ratelimit) Parse(ing *networking.Ingress) (interface{}, error) { func encode(s string) string { str := base64.URLEncoding.EncodeToString([]byte(s)) - return strings.Replace(str, "=", "", -1) + return strings.ReplaceAll(str, "=", "") } func (a ratelimit) GetDocumentation() parser.AnnotationFields { diff --git a/internal/ingress/annotations/redirect/redirect.go b/internal/ingress/annotations/redirect/redirect.go index 89513c83c2..b58e35171f 100644 --- a/internal/ingress/annotations/redirect/redirect.go +++ b/internal/ingress/annotations/redirect/redirect.go @@ -54,14 +54,14 @@ var redirectAnnotations = parser.Annotation{ Documentation: `In some scenarios is required to redirect from www.domain.com to domain.com or vice versa. To enable this feature use this annotation.`, }, temporalRedirectAnnotation: { - Validator: parser.ValidateRegex(*parser.URLIsValidRegex, false), + Validator: parser.ValidateRegex(parser.URLIsValidRegex, false), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, // Medium, as it allows arbitrary URLs that needs to be validated Documentation: `This annotation allows you to return a temporal redirect (Return Code 302) instead of sending data to the upstream. For example setting this annotation to https://www.google.com would redirect everything to Google with a Return Code of 302 (Moved Temporarily).`, }, permanentRedirectAnnotation: { - Validator: parser.ValidateRegex(*parser.URLIsValidRegex, false), + Validator: parser.ValidateRegex(parser.URLIsValidRegex, false), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, // Medium, as it allows arbitrary URLs that needs to be validated Documentation: `This annotation allows to return a permanent redirect (Return Code 301) instead of sending data to the upstream. @@ -174,11 +174,11 @@ func isValidURL(s string) error { return nil } -func (a redirect) GetDocumentation() parser.AnnotationFields { - return a.annotationConfig.Annotations +func (r redirect) GetDocumentation() parser.AnnotationFields { + return r.annotationConfig.Annotations } -func (a redirect) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (r redirect) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(r.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, redirectAnnotations.Annotations) } diff --git a/internal/ingress/annotations/redirect/redirect_test.go b/internal/ingress/annotations/redirect/redirect_test.go index 5a61f364db..bd2f98211f 100644 --- a/internal/ingress/annotations/redirect/redirect_test.go +++ b/internal/ingress/annotations/redirect/redirect_test.go @@ -136,7 +136,6 @@ func TestTemporalRedirect(t *testing.T) { } func TestIsValidURL(t *testing.T) { - invalid := "ok.com" urlParse, err := url.Parse(invalid) if err != nil { diff --git a/internal/ingress/annotations/rewrite/main.go b/internal/ingress/annotations/rewrite/main.go index 84dc93bf03..cd9ed3993e 100644 --- a/internal/ingress/annotations/rewrite/main.go +++ b/internal/ingress/annotations/rewrite/main.go @@ -40,7 +40,7 @@ var rewriteAnnotations = parser.Annotation{ Group: "rewrite", Annotations: parser.AnnotationFields{ rewriteTargetAnnotation: { - Validator: parser.ValidateRegex(*parser.RegexPathWithCapture, false), + Validator: parser.ValidateRegex(parser.RegexPathWithCapture, false), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation allows to specify the target URI where the traffic must be redirected. It can contain regular characters and captured @@ -72,7 +72,7 @@ var rewriteAnnotations = parser.Annotation{ the pathType should also be defined as 'ImplementationSpecific'.`, }, appRootAnnotation: { - Validator: parser.ValidateRegex(*parser.RegexPathWithCapture, false), + Validator: parser.ValidateRegex(parser.RegexPathWithCapture, false), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation defines the Application Root that the Controller must redirect if it's in / context`, diff --git a/internal/ingress/annotations/rewrite/main_test.go b/internal/ingress/annotations/rewrite/main_test.go index 6b97d2e014..b68b901b49 100644 --- a/internal/ingress/annotations/rewrite/main_test.go +++ b/internal/ingress/annotations/rewrite/main_test.go @@ -120,7 +120,10 @@ func TestSSLRedirect(t *testing.T) { data[parser.GetAnnotationWithPrefix("rewrite-target")] = defRoute ing.SetAnnotations(data) - i, _ := NewParser(mockBackend{redirect: true}).Parse(ing) + i, err := NewParser(mockBackend{redirect: true}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } redirect, ok := i.(*Config) if !ok { t.Errorf("expected a Redirect type") @@ -132,7 +135,10 @@ func TestSSLRedirect(t *testing.T) { data[parser.GetAnnotationWithPrefix("rewrite-target")] = "/xpto/$1/abc/$2" ing.SetAnnotations(data) - i, _ = NewParser(mockBackend{redirect: true}).Parse(ing) + i, err = NewParser(mockBackend{redirect: true}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } redirect, ok = i.(*Config) if !ok { t.Errorf("expected a Redirect type") @@ -144,7 +150,10 @@ func TestSSLRedirect(t *testing.T) { data[parser.GetAnnotationWithPrefix("rewrite-target")] = "/xpto/xas{445}" ing.SetAnnotations(data) - i, _ = NewParser(mockBackend{redirect: true}).Parse(ing) + i, err = NewParser(mockBackend{redirect: true}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } redirect, ok = i.(*Config) if !ok { t.Errorf("expected a Redirect type") @@ -156,7 +165,10 @@ func TestSSLRedirect(t *testing.T) { data[parser.GetAnnotationWithPrefix("ssl-redirect")] = "false" ing.SetAnnotations(data) - i, _ = NewParser(mockBackend{redirect: false}).Parse(ing) + i, err = NewParser(mockBackend{redirect: false}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } redirect, ok = i.(*Config) if !ok { t.Errorf("expected a Redirect type") @@ -173,7 +185,10 @@ func TestForceSSLRedirect(t *testing.T) { data[parser.GetAnnotationWithPrefix("rewrite-target")] = defRoute ing.SetAnnotations(data) - i, _ := NewParser(mockBackend{redirect: true}).Parse(ing) + i, err := NewParser(mockBackend{redirect: true}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } redirect, ok := i.(*Config) if !ok { t.Errorf("expected a Redirect type") @@ -185,7 +200,10 @@ func TestForceSSLRedirect(t *testing.T) { data[parser.GetAnnotationWithPrefix("force-ssl-redirect")] = "true" ing.SetAnnotations(data) - i, _ = NewParser(mockBackend{redirect: false}).Parse(ing) + i, err = NewParser(mockBackend{redirect: false}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } redirect, ok = i.(*Config) if !ok { t.Errorf("expected a Redirect type") @@ -194,6 +212,7 @@ func TestForceSSLRedirect(t *testing.T) { t.Errorf("Expected true but returned false") } } + func TestAppRoot(t *testing.T) { ap := NewParser(mockBackend{redirect: true}) @@ -241,7 +260,10 @@ func TestUseRegex(t *testing.T) { data[parser.GetAnnotationWithPrefix("use-regex")] = "true" ing.SetAnnotations(data) - i, _ := NewParser(mockBackend{redirect: true}).Parse(ing) + i, err := NewParser(mockBackend{redirect: true}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } redirect, ok := i.(*Config) if !ok { t.Errorf("expected a App Context") diff --git a/internal/ingress/annotations/satisfy/main.go b/internal/ingress/annotations/satisfy/main.go index 45187fe5c4..13a4532c16 100644 --- a/internal/ingress/annotations/satisfy/main.go +++ b/internal/ingress/annotations/satisfy/main.go @@ -69,7 +69,7 @@ func (s satisfy) GetDocumentation() parser.AnnotationFields { return s.annotationConfig.Annotations } -func (a satisfy) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (s satisfy) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(s.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, satisfyAnnotations.Annotations) } diff --git a/internal/ingress/annotations/serversnippet/main_test.go b/internal/ingress/annotations/serversnippet/main_test.go index 601e11a42a..72e757dc18 100644 --- a/internal/ingress/annotations/serversnippet/main_test.go +++ b/internal/ingress/annotations/serversnippet/main_test.go @@ -54,6 +54,7 @@ func TestParse(t *testing.T) { for _, testCase := range testCases { ing.SetAnnotations(testCase.annotations) + //nolint:errcheck // Ignore the error since invalid cases will be checked with expected results result, _ := ap.Parse(ing) if result != testCase.expected { t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations) diff --git a/internal/ingress/annotations/serviceupstream/main.go b/internal/ingress/annotations/serviceupstream/main.go index e662f73c3d..d1851bc7b6 100644 --- a/internal/ingress/annotations/serviceupstream/main.go +++ b/internal/ingress/annotations/serviceupstream/main.go @@ -69,7 +69,7 @@ func (s serviceUpstream) GetDocumentation() parser.AnnotationFields { return s.annotationConfig.Annotations } -func (a serviceUpstream) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (s serviceUpstream) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(s.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, serviceUpstreamAnnotations.Annotations) } diff --git a/internal/ingress/annotations/serviceupstream/main_test.go b/internal/ingress/annotations/serviceupstream/main_test.go index 2751208ecb..e6216ee5a3 100644 --- a/internal/ingress/annotations/serviceupstream/main_test.go +++ b/internal/ingress/annotations/serviceupstream/main_test.go @@ -77,7 +77,10 @@ func TestIngressAnnotationServiceUpstreamEnabled(t *testing.T) { data[parser.GetAnnotationWithPrefix(serviceUpstreamAnnotation)] = "true" ing.SetAnnotations(data) - val, _ := NewParser(&resolver.Mock{}).Parse(ing) + val, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } enabled, ok := val.(bool) if !ok { t.Errorf("expected a bool type") @@ -96,7 +99,10 @@ func TestIngressAnnotationServiceUpstreamSetFalse(t *testing.T) { data[parser.GetAnnotationWithPrefix(serviceUpstreamAnnotation)] = "false" ing.SetAnnotations(data) - val, _ := NewParser(&resolver.Mock{}).Parse(ing) + val, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } enabled, ok := val.(bool) if !ok { t.Errorf("expected a bool type") @@ -110,7 +116,10 @@ func TestIngressAnnotationServiceUpstreamSetFalse(t *testing.T) { data = map[string]string{} ing.SetAnnotations(data) - val, _ = NewParser(&resolver.Mock{}).Parse(ing) + val, err = NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } enabled, ok = val.(bool) if !ok { t.Errorf("expected a bool type") @@ -137,7 +146,10 @@ func (m mockBackend) GetDefaultBackend() defaults.Backend { func TestParseAnnotationsWithDefaultConfig(t *testing.T) { ing := buildIngress() - val, _ := NewParser(mockBackend{}).Parse(ing) + val, err := NewParser(mockBackend{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } enabled, ok := val.(bool) if !ok { @@ -158,7 +170,10 @@ func TestParseAnnotationsOverridesDefaultConfig(t *testing.T) { data[parser.GetAnnotationWithPrefix(serviceUpstreamAnnotation)] = "false" ing.SetAnnotations(data) - val, _ := NewParser(mockBackend{}).Parse(ing) + val, err := NewParser(mockBackend{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } enabled, ok := val.(bool) if !ok { diff --git a/internal/ingress/annotations/sessionaffinity/main.go b/internal/ingress/annotations/sessionaffinity/main.go index 0a4a59dbcb..cc2095de47 100644 --- a/internal/ingress/annotations/sessionaffinity/main.go +++ b/internal/ingress/annotations/sessionaffinity/main.go @@ -63,13 +63,15 @@ const ( // This is used to control the cookie change after request failure annotationAffinityCookieChangeOnFailure = "session-cookie-change-on-failure" + + cookieAffinity = "cookie" ) var sessionAffinityAnnotations = parser.Annotation{ Group: "affinity", Annotations: parser.AnnotationFields{ annotationAffinityType: { - Validator: parser.ValidateOptions([]string{"cookie"}, true, true), + Validator: parser.ValidateOptions([]string{cookieAffinity}, true, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskLow, Documentation: `This annotation enables and sets the affinity type in all Upstreams of an Ingress. This way, a request will always be directed to the same upstream server. The only affinity type available for NGINX is cookie`, @@ -91,7 +93,7 @@ var sessionAffinityAnnotations = parser.Annotation{ Setting this to legacy will restore original canary behavior, when session affinity was ignored.`, }, annotationAffinityCookieName: { - Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Validator: parser.ValidateRegex(parser.BasicCharsRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation allows to specify the name of the cookie that will be used to route the requests`, @@ -103,25 +105,25 @@ var sessionAffinityAnnotations = parser.Annotation{ Documentation: `This annotation set the cookie as secure regardless the protocol of the incoming request`, }, annotationAffinityCookieExpires: { - Validator: parser.ValidateRegex(*affinityCookieExpiresRegex, true), + Validator: parser.ValidateRegex(affinityCookieExpiresRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation is a legacy version of "session-cookie-max-age" for compatibility with older browsers, generates an "Expires" cookie directive by adding the seconds to the current date`, }, annotationAffinityCookieMaxAge: { - Validator: parser.ValidateRegex(*affinityCookieExpiresRegex, false), + Validator: parser.ValidateRegex(affinityCookieExpiresRegex, false), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation sets the time until the cookie expires`, }, annotationAffinityCookiePath: { - Validator: parser.ValidateRegex(*parser.URLIsValidRegex, true), + Validator: parser.ValidateRegex(parser.URLIsValidRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation defines the Path that will be set on the cookie (required if your Ingress paths use regular expressions)`, }, annotationAffinityCookieDomain: { - Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Validator: parser.ValidateRegex(parser.BasicCharsRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation defines the Domain attribute of the sticky cookie.`, @@ -149,9 +151,7 @@ var sessionAffinityAnnotations = parser.Annotation{ }, } -var ( - affinityCookieExpiresRegex = regexp.MustCompile(`(^0|-?[1-9]\d*$)`) -) +var affinityCookieExpiresRegex = regexp.MustCompile(`(^0|-?[1-9]\d*$)`) // Config describes the per ingress session affinity config type Config struct { @@ -186,6 +186,11 @@ type Cookie struct { ConditionalSameSiteNone bool `json:"conditional-samesite-none"` } +type affinity struct { + r resolver.Resolver + annotationConfig parser.Annotation +} + // cookieAffinityParse gets the annotation values related to Cookie Affinity // It also sets default values when no value or incorrect value is found func (a affinity) cookieAffinityParse(ing *networking.Ingress) *Cookie { @@ -252,11 +257,6 @@ func NewParser(r resolver.Resolver) parser.IngressAnnotation { } } -type affinity struct { - r resolver.Resolver - annotationConfig parser.Annotation -} - // ParseAnnotations parses the annotations contained in the ingress // rule used to configure the affinity directives func (a affinity) Parse(ing *networking.Ingress) (interface{}, error) { @@ -279,11 +279,10 @@ func (a affinity) Parse(ing *networking.Ingress) (interface{}, error) { } switch at { - case "cookie": + case cookieAffinity: cookie = a.cookieAffinityParse(ing) default: klog.V(3).InfoS("No default affinity found", "ingress", ing.Name) - } return &Config{ diff --git a/internal/ingress/annotations/sessionaffinity/main_test.go b/internal/ingress/annotations/sessionaffinity/main_test.go index cffe57fec5..cecf8cf8ff 100644 --- a/internal/ingress/annotations/sessionaffinity/main_test.go +++ b/internal/ingress/annotations/sessionaffinity/main_test.go @@ -83,7 +83,11 @@ func TestIngressAffinityCookieConfig(t *testing.T) { data[parser.GetAnnotationWithPrefix(annotationAffinityCookieSecure)] = "true" ing.SetAnnotations(data) - affin, _ := NewParser(&resolver.Mock{}).Parse(ing) + affin, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error parsing annotations: %v", err) + } + nginxAffinity, ok := affin.(*Config) if !ok { t.Errorf("expected a Config type") diff --git a/internal/ingress/annotations/snippet/main_test.go b/internal/ingress/annotations/snippet/main_test.go index 921afeea8e..b29b2950de 100644 --- a/internal/ingress/annotations/snippet/main_test.go +++ b/internal/ingress/annotations/snippet/main_test.go @@ -54,6 +54,7 @@ func TestParse(t *testing.T) { for _, testCase := range testCases { ing.SetAnnotations(testCase.annotations) + //nolint:errcheck // Ignore the error since invalid cases will be checked with expected results result, _ := ap.Parse(ing) if result != testCase.expected { t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations) diff --git a/internal/ingress/annotations/sslcipher/main.go b/internal/ingress/annotations/sslcipher/main.go index c30f12424b..685ef90bf3 100644 --- a/internal/ingress/annotations/sslcipher/main.go +++ b/internal/ingress/annotations/sslcipher/main.go @@ -31,10 +31,8 @@ const ( sslCipherAnnotation = "ssl-ciphers" ) -var ( - // Should cover something like "ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP" - regexValidSSLCipher = regexp.MustCompile(`^[A-Za-z0-9!:+\-]*$`) -) +// Should cover something like "ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP" +var regexValidSSLCipher = regexp.MustCompile(`^[A-Za-z0-9!:+\-]*$`) var sslCipherAnnotations = parser.Annotation{ Group: "backend", @@ -47,7 +45,7 @@ var sslCipherAnnotations = parser.Annotation{ This configuration specifies that server ciphers should be preferred over client ciphers when using the SSLv3 and TLS protocols.`, }, sslCipherAnnotation: { - Validator: parser.ValidateRegex(*regexValidSSLCipher, true), + Validator: parser.ValidateRegex(regexValidSSLCipher, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskLow, Documentation: `Using this annotation will set the ssl_ciphers directive at the server level. This configuration is active for all the paths in the host.`, @@ -104,7 +102,7 @@ func (sc sslCipher) GetDocumentation() parser.AnnotationFields { return sc.annotationConfig.Annotations } -func (a sslCipher) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (sc sslCipher) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(sc.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, sslCipherAnnotations.Annotations) } diff --git a/internal/ingress/annotations/sslcipher/main_test.go b/internal/ingress/annotations/sslcipher/main_test.go index ac6808e068..167466fefd 100644 --- a/internal/ingress/annotations/sslcipher/main_test.go +++ b/internal/ingress/annotations/sslcipher/main_test.go @@ -42,8 +42,11 @@ func TestParse(t *testing.T) { expectErr bool }{ {map[string]string{annotationSSLCiphers: "ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP"}, Config{"ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP", ""}, false}, - {map[string]string{annotationSSLCiphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"}, - Config{"ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256", ""}, false}, + { + map[string]string{annotationSSLCiphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"}, + Config{"ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256", ""}, + false, + }, {map[string]string{annotationSSLCiphers: ""}, Config{"", ""}, false}, {map[string]string{annotationSSLPreferServerCiphers: "true"}, Config{"", "on"}, false}, {map[string]string{annotationSSLPreferServerCiphers: "false"}, Config{"", "off"}, false}, diff --git a/internal/ingress/annotations/sslpassthrough/main.go b/internal/ingress/annotations/sslpassthrough/main.go index 1557d4243d..c06db8715a 100644 --- a/internal/ingress/annotations/sslpassthrough/main.go +++ b/internal/ingress/annotations/sslpassthrough/main.go @@ -47,7 +47,8 @@ type sslpt struct { // NewParser creates a new SSL passthrough annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return sslpt{r: r, + return sslpt{ + r: r, annotationConfig: sslPassthroughAnnotations, } } diff --git a/internal/ingress/annotations/streamsnippet/main_test.go b/internal/ingress/annotations/streamsnippet/main_test.go index 997b7be707..e8a1ff8d0a 100644 --- a/internal/ingress/annotations/streamsnippet/main_test.go +++ b/internal/ingress/annotations/streamsnippet/main_test.go @@ -38,7 +38,8 @@ func TestParse(t *testing.T) { annotations map[string]string expected string }{ - {map[string]string{annotation: "server { listen: 8000; proxy_pass 127.0.0.1:80}"}, + { + map[string]string{annotation: "server { listen: 8000; proxy_pass 127.0.0.1:80}"}, "server { listen: 8000; proxy_pass 127.0.0.1:80}", }, {map[string]string{annotation: "false"}, "false"}, @@ -56,6 +57,7 @@ func TestParse(t *testing.T) { for _, testCase := range testCases { ing.SetAnnotations(testCase.annotations) + //nolint:errcheck // Ignore the error since invalid cases will be checked with expected results result, _ := ap.Parse(ing) if result != testCase.expected { t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations) diff --git a/internal/ingress/annotations/upstreamhashby/main.go b/internal/ingress/annotations/upstreamhashby/main.go index bc07f70fbb..25cc88b8e8 100644 --- a/internal/ingress/annotations/upstreamhashby/main.go +++ b/internal/ingress/annotations/upstreamhashby/main.go @@ -41,7 +41,7 @@ var upstreamHashByAnnotations = parser.Annotation{ Group: "backend", Annotations: parser.AnnotationFields{ upstreamHashByAnnotation: { - Validator: parser.ValidateRegex(*hashByRegex, true), + Validator: parser.ValidateRegex(hashByRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskHigh, // High, this annotation allows accessing NGINX variables Documentation: `This annotation defines the nginx variable, text value or any combination thereof to use for consistent hashing. diff --git a/internal/ingress/annotations/xforwardedprefix/main.go b/internal/ingress/annotations/xforwardedprefix/main.go index fc4d5798d3..530afbb010 100644 --- a/internal/ingress/annotations/xforwardedprefix/main.go +++ b/internal/ingress/annotations/xforwardedprefix/main.go @@ -31,7 +31,7 @@ var xForwardedForAnnotations = parser.Annotation{ Group: "backend", Annotations: parser.AnnotationFields{ xForwardedForPrefixAnnotation: { - Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Validator: parser.ValidateRegex(parser.BasicCharsRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskLow, // Low, as it allows regexes but on a very limited set Documentation: `This annotation can be used to add the non-standard X-Forwarded-Prefix header to the upstream request with a string value`, @@ -54,15 +54,15 @@ func NewParser(r resolver.Resolver) parser.IngressAnnotation { // Parse parses the annotations contained in the ingress rule // used to add an x-forwarded-prefix header to the request -func (cbbs xforwardedprefix) Parse(ing *networking.Ingress) (interface{}, error) { - return parser.GetStringAnnotation(xForwardedForPrefixAnnotation, ing, cbbs.annotationConfig.Annotations) +func (x xforwardedprefix) Parse(ing *networking.Ingress) (interface{}, error) { + return parser.GetStringAnnotation(xForwardedForPrefixAnnotation, ing, x.annotationConfig.Annotations) } -func (cbbs xforwardedprefix) GetDocumentation() parser.AnnotationFields { - return cbbs.annotationConfig.Annotations +func (x xforwardedprefix) GetDocumentation() parser.AnnotationFields { + return x.annotationConfig.Annotations } -func (a xforwardedprefix) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (x xforwardedprefix) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(x.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, xForwardedForAnnotations.Annotations) } diff --git a/internal/ingress/annotations/xforwardedprefix/main_test.go b/internal/ingress/annotations/xforwardedprefix/main_test.go index d873a44128..f28b6b10e6 100644 --- a/internal/ingress/annotations/xforwardedprefix/main_test.go +++ b/internal/ingress/annotations/xforwardedprefix/main_test.go @@ -54,6 +54,7 @@ func TestParse(t *testing.T) { for _, testCase := range testCases { ing.SetAnnotations(testCase.annotations) + //nolint:errcheck // Ignore the error since invalid cases will be checked with expected results result, _ := ap.Parse(ing) if result != testCase.expected { t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations) diff --git a/internal/ingress/controller/certificate.go b/internal/ingress/controller/certificate.go index e8707c716e..76aafec3cb 100644 --- a/internal/ingress/controller/certificate.go +++ b/internal/ingress/controller/certificate.go @@ -100,7 +100,7 @@ func matchHostnames(pattern, host string) bool { host = strings.TrimSuffix(host, ".") pattern = strings.TrimSuffix(pattern, ".") - if len(pattern) == 0 || len(host) == 0 { + if pattern == "" || host == "" { return false } diff --git a/internal/ingress/controller/checker.go b/internal/ingress/controller/checker.go index 3229778bbf..d1bf19ddf4 100644 --- a/internal/ingress/controller/checker.go +++ b/internal/ingress/controller/checker.go @@ -29,7 +29,7 @@ import ( ) // Name returns the healthcheck name -func (n NGINXController) Name() string { +func (n *NGINXController) Name() string { return "nginx-ingress-controller" } diff --git a/internal/ingress/controller/checker_test.go b/internal/ingress/controller/checker_test.go index 2d63efc091..5fb6b09fdd 100644 --- a/internal/ingress/controller/checker_test.go +++ b/internal/ingress/controller/checker_test.go @@ -32,7 +32,7 @@ import ( ) func TestNginxCheck(t *testing.T) { - var tests = []struct { + tests := []struct { healthzPath string }{ {"/healthz"}, @@ -42,7 +42,6 @@ func TestNginxCheck(t *testing.T) { for _, tt := range tests { testName := fmt.Sprintf("health path: %s", tt.healthzPath) t.Run(testName, func(t *testing.T) { - mux := http.NewServeMux() listener, err := tryListen("tcp", fmt.Sprintf(":%v", nginx.StatusPort)) @@ -50,7 +49,7 @@ func TestNginxCheck(t *testing.T) { t.Fatalf("creating tcp listener: %s", err) } defer listener.Close() - + //nolint:gosec // Ignore not configured ReadHeaderTimeout in testing server := &httptest.Server{ Listener: listener, Config: &http.Server{ @@ -103,10 +102,10 @@ func TestNginxCheck(t *testing.T) { } }() go func() { - cmd.Wait() //nolint:errcheck + cmd.Wait() //nolint:errcheck // Ignore the error }() - if _, err := pidFile.Write([]byte(fmt.Sprintf("%v", pid))); err != nil { + if _, err := fmt.Fprintf(pidFile, "%v", pid); err != nil { t.Errorf("unexpected error writing the pid file: %v", err) } @@ -121,7 +120,7 @@ func TestNginxCheck(t *testing.T) { }) // pollute pid file - pidFile.Write([]byte("999999")) //nolint:errcheck + pidFile.WriteString("999999") //nolint:errcheck // Ignore the error pidFile.Close() t.Run("bad pid", func(t *testing.T) { @@ -134,7 +133,7 @@ func TestNginxCheck(t *testing.T) { } func callHealthz(expErr bool, healthzPath string, mux *http.ServeMux) error { - req, err := http.NewRequest(http.MethodGet, healthzPath, nil) + req, err := http.NewRequest(http.MethodGet, healthzPath, http.NoBody) if err != nil { return fmt.Errorf("healthz error: %v", err) } diff --git a/internal/ingress/controller/config/config.go b/internal/ingress/controller/config/config.go index 60cef489a8..0dafa78a29 100644 --- a/internal/ingress/controller/config/config.go +++ b/internal/ingress/controller/config/config.go @@ -29,10 +29,8 @@ import ( "k8s.io/ingress-nginx/pkg/util/runtime" ) -var ( - // EnableSSLChainCompletion Autocomplete SSL certificate chains with missing intermediate CA certificates. - EnableSSLChainCompletion = false -) +// EnableSSLChainCompletion Autocomplete SSL certificate chains with missing intermediate CA certificates. +var EnableSSLChainCompletion = false const ( // http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size @@ -91,7 +89,7 @@ const ( // Configuration represents the content of nginx.conf file type Configuration struct { - defaults.Backend `json:",squash"` //nolint:staticcheck + defaults.Backend `json:",squash"` //nolint:staticcheck // Ignore unknown JSON option "squash" error // AllowSnippetAnnotations enable users to add their own snippets via ingress annotation. // If disabled, only snippets added via ConfigMap are added to ingress. @@ -141,9 +139,9 @@ type Configuration struct { // By default access logs go to /var/log/nginx/access.log AccessLogPath string `json:"access-log-path,omitempty"` - // HttpAccessLogPath sets the path of the access logs for http context globally if enabled + // HTTPAccessLogPath sets the path of the access logs for http context globally if enabled // http://nginx.org/en/docs/http/ngx_http_log_module.html#access_log - HttpAccessLogPath string `json:"http-access-log-path,omitempty"` + HTTPAccessLogPath string `json:"http-access-log-path,omitempty"` // StreamAccessLogPath sets the path of the access logs for stream context globally if enabled // http://nginx.org/en/docs/stream/ngx_stream_log_module.html#access_log @@ -230,19 +228,19 @@ type Configuration struct { // https://nginx.org/en/docs/http/ngx_http_v2_module.html#http2_max_field_size // HTTP2MaxFieldSize Limits the maximum size of an HPACK-compressed request header field - // NOTE: Deprecated + // Deprecated: HTTP2MaxFieldSize is deprecated. HTTP2MaxFieldSize string `json:"http2-max-field-size,omitempty"` // https://nginx.org/en/docs/http/ngx_http_v2_module.html#http2_max_header_size // HTTP2MaxHeaderSize Limits the maximum size of the entire request header list after HPACK decompression - // NOTE: Deprecated + // Deprecated: HTTP2MaxHeaderSize is deprecated. HTTP2MaxHeaderSize string `json:"http2-max-header-size,omitempty"` // http://nginx.org/en/docs/http/ngx_http_v2_module.html#http2_max_requests // HTTP2MaxRequests Sets the maximum number of requests (including push requests) that can be served // through one HTTP/2 connection, after which the next client request will lead to connection closing // and the need of establishing a new connection. - // NOTE: Deprecated + // Deprecated: HTTP2MaxRequests is deprecated. HTTP2MaxRequests int `json:"http2-max-requests,omitempty"` // http://nginx.org/en/docs/http/ngx_http_v2_module.html#http2_max_concurrent_streams @@ -552,7 +550,7 @@ type Configuration struct { UseForwardedHeaders bool `json:"use-forwarded-headers"` // Sets whether to enable the real ip module - EnableRealIp bool `json:"enable-real-ip"` + EnableRealIP bool `json:"enable-real-ip"` // Sets the header field for identifying the originating IP address of a client // Default is X-Forwarded-For @@ -621,7 +619,7 @@ type Configuration struct { // Default: 0.01 OtelSamplerRatio float32 `json:"otel-sampler-ratio"` - //OtelSamplerParentBased specifies the parent based sampler to be use for any traces created + // OtelSamplerParentBased specifies the parent based sampler to be use for any traces created // Default: true OtelSamplerParentBased bool `json:"otel-sampler-parent-based"` @@ -891,7 +889,7 @@ func NewDefault() Configuration { EnableUnderscoresInHeaders: false, ErrorLogLevel: errorLevel, UseForwardedHeaders: false, - EnableRealIp: false, + EnableRealIP: false, ForwardedForHeader: "X-Forwarded-For", ComputeFullForwardedFor: false, ProxyAddOriginalURIHeader: false, @@ -1039,41 +1037,41 @@ func NewDefault() Configuration { // TemplateConfig contains the nginx configuration to render the file nginx.conf type TemplateConfig struct { - ProxySetHeaders map[string]string - AddHeaders map[string]string - BacklogSize int - Backends []*ingress.Backend - PassthroughBackends []*ingress.SSLPassthroughBackend - Servers []*ingress.Server - TCPBackends []ingress.L4Service - UDPBackends []ingress.L4Service - HealthzURI string - Cfg Configuration - IsIPV6Enabled bool - IsSSLPassthroughEnabled bool - NginxStatusIpv4Whitelist []string - NginxStatusIpv6Whitelist []string - RedirectServers interface{} - ListenPorts *ListenPorts - PublishService *apiv1.Service - EnableMetrics bool - MaxmindEditionFiles *[]string - MonitorMaxBatchSize int - PID string - StatusPath string - StatusPort int - StreamPort int - StreamSnippets []string + ProxySetHeaders map[string]string `json:"ProxySetHeaders"` + AddHeaders map[string]string `json:"AddHeaders"` + BacklogSize int `json:"BacklogSize"` + Backends []*ingress.Backend `json:"Backends"` + PassthroughBackends []*ingress.SSLPassthroughBackend `json:"PassthroughBackends"` + Servers []*ingress.Server `json:"Servers"` + TCPBackends []ingress.L4Service `json:"TCPBackends"` + UDPBackends []ingress.L4Service `json:"UDPBackends"` + HealthzURI string `json:"HealthzURI"` + Cfg Configuration `json:"Cfg"` + IsIPV6Enabled bool `json:"IsIPV6Enabled"` + IsSSLPassthroughEnabled bool `json:"IsSSLPassthroughEnabled"` + NginxStatusIpv4Whitelist []string `json:"NginxStatusIpv4Whitelist"` + NginxStatusIpv6Whitelist []string `json:"NginxStatusIpv6Whitelist"` + RedirectServers interface{} `json:"RedirectServers"` + ListenPorts *ListenPorts `json:"ListenPorts"` + PublishService *apiv1.Service `json:"PublishService"` + EnableMetrics bool `json:"EnableMetrics"` + MaxmindEditionFiles *[]string `json:"MaxmindEditionFiles"` + MonitorMaxBatchSize int `json:"MonitorMaxBatchSize"` + PID string `json:"PID"` + StatusPath string `json:"StatusPath"` + StatusPort int `json:"StatusPort"` + StreamPort int `json:"StreamPort"` + StreamSnippets []string `json:"StreamSnippets"` } // ListenPorts describe the ports required to run the // NGINX Ingress controller type ListenPorts struct { - HTTP int - HTTPS int - Health int - Default int - SSLProxy int + HTTP int `json:"HTTP"` + HTTPS int `json:"HTTPS"` + Health int `json:"Health"` + Default int `json:"Default"` + SSLProxy int `json:"SSLProxy"` } // GlobalExternalAuth describe external authentication configuration for the diff --git a/internal/ingress/controller/controller.go b/internal/ingress/controller/controller.go index f405bdcbb6..f2ad4639b7 100644 --- a/internal/ingress/controller/controller.go +++ b/internal/ingress/controller/controller.go @@ -114,7 +114,7 @@ type Configuration struct { DisableCatchAll bool - IngressClassConfiguration *ingressclass.IngressClassConfiguration + IngressClassConfiguration *ingressclass.Configuration ValidationWebhook string ValidationWebhookCertPath string @@ -143,7 +143,7 @@ type Configuration struct { func getIngressPodZone(svc *apiv1.Service) string { svcKey := k8s.MetaNamespaceKey(svc) if svcZoneAnnotation, ok := svc.ObjectMeta.GetAnnotations()[apiv1.AnnotationTopologyMode]; ok { - if strings.ToLower(svcZoneAnnotation) == "auto" { + if strings.EqualFold(svcZoneAnnotation, "auto") { if foundZone, ok := k8s.IngressNodeDetails.GetLabels()[apiv1.LabelTopologyZone]; ok { klog.V(3).Infof("Svc has topology aware annotation enabled, try to use zone %q where controller pod is running for Service %q ", foundZone, svcKey) return foundZone @@ -154,7 +154,7 @@ func getIngressPodZone(svc *apiv1.Service) string { } // GetPublishService returns the Service used to set the load-balancer status of Ingresses. -func (n NGINXController) GetPublishService() *apiv1.Service { +func (n *NGINXController) GetPublishService() *apiv1.Service { s, err := n.store.GetService(n.cfg.PublishService) if err != nil { return nil @@ -189,13 +189,16 @@ func (n *NGINXController) syncIngress(interface{}) error { if !utilingress.IsDynamicConfigurationEnough(pcfg, n.runningConfig) { klog.InfoS("Configuration changes detected, backend reload required") - hash, _ := hashstructure.Hash(pcfg, hashstructure.FormatV1, &hashstructure.HashOptions{ + hash, err := hashstructure.Hash(pcfg, hashstructure.FormatV1, &hashstructure.HashOptions{ TagName: "json", }) + if err != nil { + klog.Errorf("unexpected error hashing configuration: %v", err) + } pcfg.ConfigurationChecksum = fmt.Sprintf("%v", hash) - err := n.OnUpdate(*pcfg) + err = n.OnUpdate(*pcfg) if err != nil { n.metricCollector.IncReloadErrorCount() n.metricCollector.ConfigSuccess(hash, false) @@ -263,7 +266,7 @@ func (n *NGINXController) syncIngress(interface{}) error { func (n *NGINXController) CheckWarning(ing *networking.Ingress) ([]string, error) { warnings := make([]string, 0) - var deprecatedAnnotations = sets.NewString() + deprecatedAnnotations := sets.NewString() deprecatedAnnotations.Insert( "enable-influxdb", "influxdb-measurement", @@ -335,7 +338,7 @@ func (n *NGINXController) CheckIngress(ing *networking.Ingress) error { } if n.cfg.DisableCatchAll && ing.Spec.DefaultBackend != nil { - return fmt.Errorf("This deployment is trying to create a catch-all ingress while DisableCatchAll flag is set to true. Remove '.spec.defaultBackend' or set DisableCatchAll flag to false.") + return fmt.Errorf("this deployment is trying to create a catch-all ingress while DisableCatchAll flag is set to true. Remove '.spec.defaultBackend' or set DisableCatchAll flag to false") } startRender := time.Now().UnixNano() / 1000000 cfg := n.store.GetBackendConfiguration() @@ -355,10 +358,9 @@ func (n *NGINXController) CheckIngress(ing *networking.Ingress) error { } for key, value := range ing.ObjectMeta.GetAnnotations() { - if parser.AnnotationsPrefix != parser.DefaultAnnotationsPrefix { if strings.HasPrefix(key, fmt.Sprintf("%s/", parser.DefaultAnnotationsPrefix)) { - return fmt.Errorf("This deployment has a custom annotation prefix defined. Use '%s' instead of '%s'", parser.AnnotationsPrefix, parser.DefaultAnnotationsPrefix) + return fmt.Errorf("this deployment has a custom annotation prefix defined. Use '%s' instead of '%s'", parser.AnnotationsPrefix, parser.DefaultAnnotationsPrefix) } } @@ -374,10 +376,9 @@ func (n *NGINXController) CheckIngress(ing *networking.Ingress) error { return fmt.Errorf("%s annotation cannot be used. Snippet directives are disabled by the Ingress administrator", key) } - if len(cfg.GlobalRateLimitMemcachedHost) == 0 && strings.HasPrefix(key, fmt.Sprintf("%s/%s", parser.AnnotationsPrefix, "global-rate-limit")) { + if cfg.GlobalRateLimitMemcachedHost == "" && strings.HasPrefix(key, fmt.Sprintf("%s/%s", parser.AnnotationsPrefix, "global-rate-limit")) { return fmt.Errorf("'global-rate-limit*' annotations require 'global-rate-limit-memcached-host' settings configured in the global configmap") } - } k8s.SetDefaultNGINXPathType(ing) @@ -401,7 +402,7 @@ func (n *NGINXController) CheckIngress(ing *networking.Ingress) error { startTest := time.Now().UnixNano() / 1000000 _, servers, pcfg := n.getConfiguration(ings) - err = checkOverlap(ing, allIngresses, servers) + err = checkOverlap(ing, servers) if err != nil { n.metricCollector.IncCheckErrorCount(ing.ObjectMeta.Namespace, ing.Name) return err @@ -452,7 +453,7 @@ func (n *NGINXController) getStreamServices(configmapName string, proto apiv1.Pr return []ingress.L4Service{} } - var svcs []ingress.L4Service + svcs := make([]ingress.L4Service, 0, len(configmap.Data)) var svcProxyProtocol ingress.ProxyProtocol rp := []int{ @@ -489,10 +490,10 @@ func (n *NGINXController) getStreamServices(configmapName string, proto apiv1.Pr svcProxyProtocol.Encode = false // Proxy Protocol is only compatible with TCP Services if len(nsSvcPort) >= 3 && proto == apiv1.ProtocolTCP { - if len(nsSvcPort) >= 3 && strings.ToUpper(nsSvcPort[2]) == "PROXY" { + if len(nsSvcPort) >= 3 && strings.EqualFold(nsSvcPort[2], "PROXY") { svcProxyProtocol.Decode = true } - if len(nsSvcPort) == 4 && strings.ToUpper(nsSvcPort[3]) == "PROXY" { + if len(nsSvcPort) == 4 && strings.EqualFold(nsSvcPort[3], "PROXY") { svcProxyProtocol.Encode = true } } @@ -532,6 +533,7 @@ func (n *NGINXController) getStreamServices(configmapName string, proto apiv1.Pr klog.V(3).Infof("Searching Endpoints with %v port number %d for Service %q", proto, targetPort, nsName) for i := range svc.Spec.Ports { sp := svc.Spec.Ports[i] + //nolint:gosec // Ignore G109 error if sp.Port == int32(targetPort) { if sp.Protocol == proto { endps = getEndpointsFromSlices(svc, &sp, proto, zone, n.store.GetServiceEndpointsSlices) @@ -574,7 +576,7 @@ func (n *NGINXController) getDefaultUpstream() *ingress.Backend { } svcKey := n.cfg.DefaultService - if len(svcKey) == 0 { + if svcKey == "" { upstream.Endpoints = append(upstream.Endpoints, n.DefaultEndpoint()) return upstream } @@ -690,13 +692,14 @@ func dropSnippetDirectives(anns *annotations.Ingress, ingKey string) { klog.V(3).Infof("Ingress %q tried to use stream-snippet and the annotation is disabled by the admin. Removing the annotation", ingKey) anns.StreamSnippet = "" } - } } // getBackendServers returns a list of Upstream and Server to be used by the // backend. An upstream can be used in multiple servers if the namespace, // service name and port are the same. +// +//nolint:gocyclo // Ignore function complexity error func (n *NGINXController) getBackendServers(ingresses []*ingress.Ingress) ([]*ingress.Backend, []*ingress.Server) { du := n.getDefaultUpstream() upstreams := n.createUpstreams(ingresses, du) @@ -1030,7 +1033,7 @@ func (n *NGINXController) createUpstreams(data []*ingress.Ingress, du *ingress.B // configure traffic shaping for canary if anns.Canary.Enabled { upstreams[defBackend].NoServer = true - upstreams[defBackend].TrafficShapingPolicy = newTrafficShapingPolicy(anns.Canary) + upstreams[defBackend].TrafficShapingPolicy = newTrafficShapingPolicy(&anns.Canary) } if len(upstreams[defBackend].Endpoints) == 0 { @@ -1095,7 +1098,7 @@ func (n *NGINXController) createUpstreams(data []*ingress.Ingress, du *ingress.B // configure traffic shaping for canary if anns.Canary.Enabled { upstreams[name].NoServer = true - upstreams[name].TrafficShapingPolicy = newTrafficShapingPolicy(anns.Canary) + upstreams[name].TrafficShapingPolicy = newTrafficShapingPolicy(&anns.Canary) } if len(upstreams[name].Endpoints) == 0 { @@ -1206,7 +1209,6 @@ func (n *NGINXController) serviceEndpoints(svcKey, backendPort string) ([]ingres if strconv.Itoa(int(servicePort.Port)) == backendPort || servicePort.TargetPort.String() == backendPort || servicePort.Name == backendPort { - endps := getEndpointsFromSlices(svc, &servicePort, apiv1.ProtocolTCP, zone, n.store.GetServiceEndpointsSlices) if len(endps) == 0 { klog.Warningf("Service %q does not have any active Endpoint.", svcKey) @@ -1239,8 +1241,8 @@ func (n *NGINXController) getDefaultSSLCertificate() *ingress.SSLCert { // one root location, which uses a default backend if left unspecified. func (n *NGINXController) createServers(data []*ingress.Ingress, upstreams map[string]*ingress.Backend, - du *ingress.Backend) map[string]*ingress.Server { - + du *ingress.Backend, +) map[string]*ingress.Server { servers := make(map[string]*ingress.Server, len(data)) allAliases := make(map[string][]string, len(data)) @@ -1282,7 +1284,8 @@ func (n *NGINXController) createServers(data []*ingress.Ingress, Rewrite: false, }, }, - }} + }, + } // initialize all other servers for _, ing := range data { @@ -1532,7 +1535,7 @@ func locationApplyAnnotations(loc *ingress.Location, anns *annotations.Ingress) } // OK to merge canary ingresses iff there exists one or more ingresses to potentially merge into -func nonCanaryIngressExists(ingresses []*ingress.Ingress, canaryIngresses []*ingress.Ingress) bool { +func nonCanaryIngressExists(ingresses, canaryIngresses []*ingress.Ingress) bool { return len(ingresses)-len(canaryIngresses) > 0 } @@ -1540,12 +1543,12 @@ func nonCanaryIngressExists(ingresses []*ingress.Ingress, canaryIngresses []*ing // 1) names of backends do not match and canary doesn't merge into itself // 2) primary name is not the default upstream // 3) the primary has a server -func canMergeBackend(primary *ingress.Backend, alternative *ingress.Backend) bool { +func canMergeBackend(primary, alternative *ingress.Backend) bool { return alternative != nil && primary.Name != alternative.Name && primary.Name != defUpstreamName && !primary.NoServer } // Performs the merge action and checks to ensure that one two alternative backends do not merge into each other -func mergeAlternativeBackend(ing *ingress.Ingress, priUps *ingress.Backend, altUps *ingress.Backend) bool { +func mergeAlternativeBackend(ing *ingress.Ingress, priUps, altUps *ingress.Backend) bool { if priUps.NoServer { klog.Warningf("unable to merge alternative backend %v into primary backend %v because %v is a primary backend", altUps.Name, priUps.Name, priUps.Name) @@ -1563,8 +1566,7 @@ func mergeAlternativeBackend(ing *ingress.Ingress, priUps *ingress.Backend, altU priUps.SessionAffinity.DeepCopyInto(&altUps.SessionAffinity) } - priUps.AlternativeBackends = - append(priUps.AlternativeBackends, altUps.Name) + priUps.AlternativeBackends = append(priUps.AlternativeBackends, altUps.Name) return true } @@ -1574,8 +1576,8 @@ func mergeAlternativeBackend(ing *ingress.Ingress, priUps *ingress.Backend, altU // to a backend's alternative list. // If no match is found, then the serverless backend is deleted. func mergeAlternativeBackends(ing *ingress.Ingress, upstreams map[string]*ingress.Backend, - servers map[string]*ingress.Server) { - + servers map[string]*ingress.Server, +) { // merge catch-all alternative backends if ing.Spec.DefaultBackend != nil { upsName := upstreamName(ing.Namespace, ing.Spec.DefaultBackend.Service) @@ -1585,7 +1587,6 @@ func mergeAlternativeBackends(ing *ingress.Ingress, upstreams map[string]*ingres if altUps == nil { klog.Warningf("alternative backend %s has already been removed", upsName) } else { - merged := false altEqualsPri := false @@ -1676,8 +1677,8 @@ func mergeAlternativeBackends(ing *ingress.Ingress, upstreams map[string]*ingres // extractTLSSecretName returns the name of the Secret containing a SSL // certificate for the given host name, or an empty string. func extractTLSSecretName(host string, ing *ingress.Ingress, - getLocalSSLCert func(string) (*ingress.SSLCert, error)) string { - + getLocalSSLCert func(string) (*ingress.SSLCert, error), +) string { if ing == nil { return "" } @@ -1694,7 +1695,6 @@ func extractTLSSecretName(host string, ing *ingress.Ingress, // no TLS host matching host name, try each TLS host for matching SAN or CN for _, tls := range ing.Spec.TLS { - if tls.SecretName == "" { // There's no secretName specified, so it will never be available continue @@ -1753,6 +1753,7 @@ func externalNamePorts(name string, svc *apiv1.Service) *apiv1.ServicePort { } for _, svcPort := range svc.Spec.Ports { + //nolint:gosec // Ignore G109 error if svcPort.Port != int32(port) { continue } @@ -1771,13 +1772,14 @@ func externalNamePorts(name string, svc *apiv1.Service) *apiv1.ServicePort { // ExternalName without port return &apiv1.ServicePort{ - Protocol: "TCP", + Protocol: "TCP", + //nolint:gosec // Ignore G109 error Port: int32(port), TargetPort: intstr.FromInt(port), } } -func checkOverlap(ing *networking.Ingress, ingresses []*ingress.Ingress, servers []*ingress.Server) error { +func checkOverlap(ing *networking.Ingress, servers []*ingress.Server) error { for _, rule := range ing.Spec.Rules { if rule.HTTP == nil { continue @@ -1870,7 +1872,7 @@ func (n *NGINXController) getStreamSnippets(ingresses []*ingress.Ingress) []stri } // newTrafficShapingPolicy creates new ingress.TrafficShapingPolicy instance using canary configuration -func newTrafficShapingPolicy(cfg canary.Config) ingress.TrafficShapingPolicy { +func newTrafficShapingPolicy(cfg *canary.Config) ingress.TrafficShapingPolicy { return ingress.TrafficShapingPolicy{ Weight: cfg.Weight, WeightTotal: cfg.WeightTotal, diff --git a/internal/ingress/controller/controller_test.go b/internal/ingress/controller/controller_test.go index c353d1b5ea..c07fcfadf2 100644 --- a/internal/ingress/controller/controller_test.go +++ b/internal/ingress/controller/controller_test.go @@ -60,51 +60,56 @@ import ( "k8s.io/ingress-nginx/pkg/util/file" ) +const ( + exampleBackend = "example-http-svc-1-80" + TRUE = "true" +) + type fakeIngressStore struct { ingresses []*ingress.Ingress configuration ngx_config.Configuration } -func (fakeIngressStore) GetIngressClass(ing *networking.Ingress, icConfig *ingressclass.IngressClassConfiguration) (string, error) { +func (fakeIngressStore) GetIngressClass(_ *networking.Ingress, _ *ingressclass.Configuration) (string, error) { return "nginx", nil } -func (fis fakeIngressStore) GetBackendConfiguration() ngx_config.Configuration { +func (fis *fakeIngressStore) GetBackendConfiguration() ngx_config.Configuration { return fis.configuration } -func (fis fakeIngressStore) GetSecurityConfiguration() defaults.SecurityConfiguration { +func (fis *fakeIngressStore) GetSecurityConfiguration() defaults.SecurityConfiguration { return defaults.SecurityConfiguration{ AnnotationsRiskLevel: fis.configuration.AnnotationsRiskLevel, AllowCrossNamespaceResources: fis.configuration.AllowCrossNamespaceResources, } } -func (fakeIngressStore) GetConfigMap(key string) (*corev1.ConfigMap, error) { +func (fakeIngressStore) GetConfigMap(_ string) (*corev1.ConfigMap, error) { return nil, fmt.Errorf("test error") } -func (fakeIngressStore) GetSecret(key string) (*corev1.Secret, error) { +func (fakeIngressStore) GetSecret(_ string) (*corev1.Secret, error) { return nil, fmt.Errorf("test error") } -func (fakeIngressStore) GetService(key string) (*corev1.Service, error) { +func (fakeIngressStore) GetService(_ string) (*corev1.Service, error) { return nil, fmt.Errorf("test error") } -func (fakeIngressStore) GetServiceEndpointsSlices(key string) ([]*discoveryv1.EndpointSlice, error) { +func (fakeIngressStore) GetServiceEndpointsSlices(_ string) ([]*discoveryv1.EndpointSlice, error) { return nil, fmt.Errorf("test error") } -func (fis fakeIngressStore) ListIngresses() []*ingress.Ingress { +func (fis *fakeIngressStore) ListIngresses() []*ingress.Ingress { return fis.ingresses } -func (fis fakeIngressStore) FilterIngresses(ingresses []*ingress.Ingress, filterFunc store.IngressFilterFunc) []*ingress.Ingress { +func (fis *fakeIngressStore) FilterIngresses(ingresses []*ingress.Ingress, _ store.IngressFilterFunc) []*ingress.Ingress { return ingresses } -func (fakeIngressStore) GetLocalSSLCert(name string) (*ingress.SSLCert, error) { +func (fakeIngressStore) GetLocalSSLCert(_ string) (*ingress.SSLCert, error) { return nil, fmt.Errorf("test error") } @@ -120,7 +125,7 @@ func (fakeIngressStore) GetDefaultBackend() defaults.Backend { return defaults.Backend{} } -func (fakeIngressStore) Run(stopCh chan struct{}) {} +func (fakeIngressStore) Run(_ chan struct{}) {} type testNginxTestCommand struct { t *testing.T @@ -129,7 +134,7 @@ type testNginxTestCommand struct { err error } -func (ntc testNginxTestCommand) ExecCommand(args ...string) *exec.Cmd { +func (ntc testNginxTestCommand) ExecCommand(_ ...string) *exec.Cmd { return nil } @@ -152,7 +157,7 @@ func (ntc testNginxTestCommand) Test(cfg string) ([]byte, error) { type fakeTemplate struct{} -func (fakeTemplate) Write(conf ngx_config.TemplateConfig) ([]byte, error) { +func (fakeTemplate) Write(conf *ngx_config.TemplateConfig) ([]byte, error) { r := []byte{} for _, s := range conf.Servers { if len(r) > 0 { @@ -196,7 +201,7 @@ func TestCheckIngress(t *testing.T) { nginx.metricCollector = metric.DummyCollector{} nginx.t = fakeTemplate{} - nginx.store = fakeIngressStore{ + nginx.store = &fakeIngressStore{ ingresses: []*ingress.Ingress{}, } @@ -226,7 +231,7 @@ func TestCheckIngress(t *testing.T) { } t.Run("When the hostname is updated", func(t *testing.T) { - nginx.store = fakeIngressStore{ + nginx.store = &fakeIngressStore{ ingresses: []*ingress.Ingress{ { Ingress: *ing, @@ -273,7 +278,7 @@ func TestCheckIngress(t *testing.T) { }) t.Run("When snippets are disabled and user tries to use snippet annotation", func(t *testing.T) { - nginx.store = fakeIngressStore{ + nginx.store = &fakeIngressStore{ ingresses: []*ingress.Ingress{}, configuration: ngx_config.Configuration{ AllowSnippetAnnotations: false, @@ -290,7 +295,7 @@ func TestCheckIngress(t *testing.T) { }) t.Run("When invalid directives are used in annotation values", func(t *testing.T) { - nginx.store = fakeIngressStore{ + nginx.store = &fakeIngressStore{ ingresses: []*ingress.Ingress{}, configuration: ngx_config.Configuration{ AnnotationValueWordBlocklist: "invalid_directive, another_directive", @@ -366,12 +371,11 @@ func TestCheckIngress(t *testing.T) { } func TestCheckWarning(t *testing.T) { - // Ensure no panic with wrong arguments - var nginx = &NGINXController{} + nginx := &NGINXController{} nginx.t = fakeTemplate{} - nginx.store = fakeIngressStore{ + nginx.store = &fakeIngressStore{ ingresses: []*ingress.Ingress{}, } @@ -390,7 +394,7 @@ func TestCheckWarning(t *testing.T) { }, } t.Run("when a deprecated annotation is used a warning should be returned", func(t *testing.T) { - ing.ObjectMeta.Annotations[parser.GetAnnotationWithPrefix("enable-influxdb")] = "true" + ing.ObjectMeta.Annotations[parser.GetAnnotationWithPrefix("enable-influxdb")] = TRUE defer func() { ing.ObjectMeta.Annotations = map[string]string{} }() @@ -407,7 +411,6 @@ func TestCheckWarning(t *testing.T) { }) t.Run("When an invalid pathType is used, a warning should be returned", func(t *testing.T) { - rules := ing.Spec.DeepCopy().Rules ing.Spec.Rules = []networking.IngressRule{ { @@ -443,8 +446,8 @@ func TestCheckWarning(t *testing.T) { } t.Run("adding invalid annotations increases the warning count", func(t *testing.T) { - ing.ObjectMeta.Annotations[parser.GetAnnotationWithPrefix("enable-influxdb")] = "true" - ing.ObjectMeta.Annotations[parser.GetAnnotationWithPrefix("secure-verify-ca-secret")] = "true" + ing.ObjectMeta.Annotations[parser.GetAnnotationWithPrefix("enable-influxdb")] = TRUE + ing.ObjectMeta.Annotations[parser.GetAnnotationWithPrefix("secure-verify-ca-secret")] = TRUE ing.ObjectMeta.Annotations[parser.GetAnnotationWithPrefix("influxdb-host")] = "blabla" defer func() { ing.ObjectMeta.Annotations = map[string]string{} @@ -472,6 +475,7 @@ func TestCheckWarning(t *testing.T) { }) } +//nolint:dupl // Ignore dupl errors for similar test case func TestMergeAlternativeBackends(t *testing.T) { testCases := map[string]struct { ingress *ingress.Ingress @@ -1537,8 +1541,8 @@ func TestExtractTLSSecretName(t *testing.T) { } } +//nolint:gocyclo // Ignore function complexity error func TestGetBackendServers(t *testing.T) { - testCases := []struct { Ingresses []*ingress.Ingress Validate func(ingresses []*ingress.Ingress, upstreams []*ingress.Backend, servers []*ingress.Server) @@ -2078,7 +2082,7 @@ func TestGetBackendServers(t *testing.T) { t.Errorf("server hostname should be 'example.com', got '%s'", s.Hostname) } - if s.Locations[0].Backend != "example-http-svc-1-80" || s.Locations[1].Backend != "example-http-svc-1-80" || s.Locations[2].Backend != "example-http-svc-1-80" { + if s.Locations[0].Backend != exampleBackend || s.Locations[1].Backend != exampleBackend || s.Locations[2].Backend != exampleBackend { t.Errorf("all location backend should be 'example-http-svc-1-80'") } @@ -2087,7 +2091,7 @@ func TestGetBackendServers(t *testing.T) { return } - if upstreams[0].Name != "example-http-svc-1-80" { + if upstreams[0].Name != exampleBackend { t.Errorf("example-http-svc-1-80 should be first upstream, got %s", upstreams[0].Name) return } @@ -2101,6 +2105,7 @@ func TestGetBackendServers(t *testing.T) { SetConfigMap: testConfigMap, }, { + //nolint:dupl // Ignore dupl errors for similar test case Ingresses: []*ingress.Ingress{ { Ingress: networking.Ingress{ @@ -2208,6 +2213,7 @@ func TestGetBackendServers(t *testing.T) { SetConfigMap: testConfigMap, }, { + //nolint:dupl // Ignore dupl errors for similar test case Ingresses: []*ingress.Ingress{ { Ingress: networking.Ingress{ @@ -2319,7 +2325,7 @@ func TestGetBackendServers(t *testing.T) { SelfLink: fmt.Sprintf("/api/v1/namespaces/%s/configmaps/config", ns), }, Data: map[string]string{ - "proxy-ssl-location-only": "true", + "proxy-ssl-location-only": TRUE, }, } }, @@ -2380,7 +2386,7 @@ func TestGetBackendServers(t *testing.T) { SelfLink: fmt.Sprintf("/api/v1/namespaces/%s/configmaps/config", ns), }, Data: map[string]string{ - "proxy-ssl-location-only": "true", + "proxy-ssl-location-only": TRUE, }, } }, @@ -2449,7 +2455,6 @@ func TestGetBackendServers(t *testing.T) { if len(s.Locations[0].Allowlist.CIDR) != 1 || s.Locations[0].Allowlist.CIDR[0] != "10.0.0.0/24" { t.Errorf("allow list was incorrectly dropped, len should be 1 and contain 10.0.0.0/24") } - }, SetConfigMap: func(ns string) *corev1.ConfigMap { return &corev1.ConfigMap{ @@ -2520,7 +2525,7 @@ func newNGINXController(t *testing.T) *NGINXController { channels.NewRingChannel(10), false, true, - &ingressclass.IngressClassConfiguration{ + &ingressclass.Configuration{ Controller: "k8s.io/ingress-nginx", AnnotationValue: "nginx", }, @@ -2586,7 +2591,7 @@ func newDynamicNginxController(t *testing.T, setConfigMap func(string) *corev1.C channels.NewRingChannel(10), false, true, - &ingressclass.IngressClassConfiguration{ + &ingressclass.Configuration{ Controller: "k8s.io/ingress-nginx", AnnotationValue: "nginx", }, diff --git a/internal/ingress/controller/endpointslices.go b/internal/ingress/controller/endpointslices.go index ca6e595c84..4f98e3ce7a 100644 --- a/internal/ingress/controller/endpointslices.go +++ b/internal/ingress/controller/endpointslices.go @@ -36,8 +36,8 @@ import ( // getEndpointsFromSlices returns a list of Endpoint structs for a given service/target port combination. func getEndpointsFromSlices(s *corev1.Service, port *corev1.ServicePort, proto corev1.Protocol, zoneForHints string, - getServiceEndpointsSlices func(string) ([]*discoveryv1.EndpointSlice, error)) []ingress.Endpoint { - + getServiceEndpointsSlices func(string) ([]*discoveryv1.EndpointSlice, error), +) []ingress.Endpoint { upsServers := []ingress.Endpoint{} if s == nil || port == nil { @@ -94,7 +94,7 @@ func getEndpointsFromSlices(s *corev1.Service, port *corev1.ServicePort, proto c if !reflect.DeepEqual(*epPort.Protocol, proto) { continue } - var targetPort int32 = 0 + var targetPort int32 if port.Name == "" { // port.Name is optional if there is only one port targetPort = *epPort.Port diff --git a/internal/ingress/controller/endpointslices_test.go b/internal/ingress/controller/endpointslices_test.go index b61e9a4f37..69ef3ef1b9 100644 --- a/internal/ingress/controller/endpointslices_test.go +++ b/internal/ingress/controller/endpointslices_test.go @@ -27,6 +27,7 @@ import ( "k8s.io/ingress-nginx/pkg/apis/ingress" ) +//nolint:dupl // Ignore dupl errors for similar test case func TestGetEndpointsFromSlices(t *testing.T) { tests := []struct { name string diff --git a/internal/ingress/controller/ingressclass/ingressclass.go b/internal/ingress/controller/ingressclass/ingressclass.go index 95bd98d0f3..90c6a4d675 100644 --- a/internal/ingress/controller/ingressclass/ingressclass.go +++ b/internal/ingress/controller/ingressclass/ingressclass.go @@ -29,9 +29,9 @@ const ( DefaultAnnotationValue = "nginx" ) -// IngressClassConfiguration defines the various aspects of IngressClass parsing +// Configuration defines the various aspects of IngressClass parsing // and how the controller should behave in each case -type IngressClassConfiguration struct { +type Configuration struct { // Controller defines the controller value this daemon watch to. // Defaults to "k8s.io/ingress-nginx" defined in flags Controller string @@ -45,7 +45,7 @@ type IngressClassConfiguration struct { // IgnoreIngressClass defines if Controller should ignore the IngressClass Object if no permissions are // granted on IngressClass IgnoreIngressClass bool - //IngressClassByName defines if the Controller should watch for Ingress Classes by + // IngressClassByName defines if the Controller should watch for Ingress Classes by // .metadata.name together with .spec.Controller IngressClassByName bool } diff --git a/internal/ingress/controller/nginx.go b/internal/ingress/controller/nginx.go index 6c25aa34f7..30f7855867 100644 --- a/internal/ingress/controller/nginx.go +++ b/internal/ingress/controller/nginx.go @@ -113,7 +113,7 @@ func NewNGINXController(config *Configuration, mc metric.Collector) *NGINXContro if n.cfg.ValidationWebhook != "" { n.validationWebhookServer = &http.Server{ Addr: config.ValidationWebhook, - //G112 (CWE-400): Potential Slowloris Attack + // G112 (CWE-400): Potential Slowloris Attack ReadHeaderTimeout: 10 * time.Second, Handler: adm_controller.NewAdmissionControllerServer(&adm_controller.IngressAdmission{Checker: n}), TLSConfig: ssl.NewTLSListener(n.cfg.ValidationWebhookCertPath, n.cfg.ValidationWebhookKeyPath).TLSConfig(), @@ -429,7 +429,7 @@ func (n *NGINXController) start(cmd *exec.Cmd) { } // DefaultEndpoint returns the default endpoint to be use as default server that returns 404. -func (n NGINXController) DefaultEndpoint() ingress.Endpoint { +func (n *NGINXController) DefaultEndpoint() ingress.Endpoint { return ingress.Endpoint{ Address: "127.0.0.1", Port: fmt.Sprintf("%v", n.cfg.ListenPorts.Default), @@ -438,8 +438,9 @@ func (n NGINXController) DefaultEndpoint() ingress.Endpoint { } // generateTemplate returns the nginx configuration file content -func (n NGINXController) generateTemplate(cfg ngx_config.Configuration, ingressCfg ingress.Configuration) ([]byte, error) { - +// +//nolint:gocritic // the cfg shouldn't be changed, and shouldn't be mutated by other processes while being rendered. +func (n *NGINXController) generateTemplate(cfg ngx_config.Configuration, ingressCfg ingress.Configuration) ([]byte, error) { if n.cfg.EnableSSLPassthrough { servers := []*tcpproxy.TCPServer{} for _, pb := range ingressCfg.PassthroughBackends { @@ -458,6 +459,7 @@ func (n NGINXController) generateTemplate(cfg ngx_config.Configuration, ingressC } } else { for _, sp := range svc.Spec.Ports { + //nolint:gosec // Ignore G109 error if sp.Port == int32(port) { port = int(sp.Port) break @@ -563,7 +565,7 @@ func (n NGINXController) generateTemplate(cfg ngx_config.Configuration, ingressC if err != nil { klog.Warningf("Error reading Secret %q from local store: %v", secretName, err) } else { - nsSecName := strings.Replace(secretName, "/", "-", -1) + nsSecName := strings.ReplaceAll(secretName, "/", "-") dh, ok := secret.Data["dhparam.pem"] if ok { pemFileName, err := ssl.AddOrUpdateDHParam(nsSecName, dh) @@ -589,7 +591,7 @@ func (n NGINXController) generateTemplate(cfg ngx_config.Configuration, ingressC } } - tc := ngx_config.TemplateConfig{ + tc := &ngx_config.TemplateConfig{ ProxySetHeaders: setHeaders, AddHeaders: addHeaders, BacklogSize: sysctlSomaxconn(), @@ -623,7 +625,7 @@ func (n NGINXController) generateTemplate(cfg ngx_config.Configuration, ingressC // testTemplate checks if the NGINX configuration inside the byte array is valid // running the command "nginx -t" using a temporal file. -func (n NGINXController) testTemplate(cfg []byte) error { +func (n *NGINXController) testTemplate(cfg []byte) error { if len(cfg) == 0 { return fmt.Errorf("invalid NGINX configuration (empty)") } @@ -658,6 +660,8 @@ Error: %v // changes were detected. The received backend Configuration is merged with the // configuration ConfigMap before generating the final configuration file. // Returns nil in case the backend was successfully reloaded. +// +//nolint:gocritic // the cfg shouldn't be changed, and shouldn't be mutated by other processes while being rendered. func (n *NGINXController) OnUpdate(ingressCfg ingress.Configuration) error { cfg := n.store.GetBackendConfiguration() cfg.Resolver = n.resolver @@ -667,12 +671,12 @@ func (n *NGINXController) OnUpdate(ingressCfg ingress.Configuration) error { return err } - err = createOpentracingCfg(cfg) + err = createOpentracingCfg(&cfg) if err != nil { return err } - err = createOpentelemetryCfg(cfg) + err = createOpentelemetryCfg(&cfg) if err != nil { return err } @@ -683,7 +687,10 @@ func (n *NGINXController) OnUpdate(ingressCfg ingress.Configuration) error { } if klog.V(2).Enabled() { - src, _ := os.ReadFile(cfgPath) + src, err := os.ReadFile(cfgPath) + if err != nil { + return err + } if !bytes.Equal(src, content) { tmpfile, err := os.CreateTemp("", "new-nginx-cfg") if err != nil { @@ -694,11 +701,14 @@ func (n *NGINXController) OnUpdate(ingressCfg ingress.Configuration) error { if err != nil { return err } - + //nolint:gosec //Ignore G204 error diffOutput, err := exec.Command("diff", "-I", "'# Configuration.*'", "-u", cfgPath, tmpfile.Name()).CombinedOutput() if err != nil { if exitError, ok := err.(*exec.ExitError); ok { - ws := exitError.Sys().(syscall.WaitStatus) + ws, ok := exitError.Sys().(syscall.WaitStatus) + if !ok { + klog.Errorf("unexpected type: %T", exitError.Sys()) + } if ws.ExitStatus() == 2 { klog.Warningf("Failed to executing diff command: %v", err) } @@ -828,9 +838,10 @@ func (n *NGINXController) configureDynamically(pcfg *ingress.Configuration) erro return nil } -func updateStreamConfiguration(TCPEndpoints []ingress.L4Service, UDPEndpoints []ingress.L4Service) error { +func updateStreamConfiguration(tcpEndpoints, udpEndpoints []ingress.L4Service) error { streams := make([]ingress.Backend, 0) - for _, ep := range TCPEndpoints { + for i := range tcpEndpoints { + ep := &tcpEndpoints[i] var service *apiv1.Service if ep.Service != nil { service = &apiv1.Service{Spec: ep.Service.Spec} @@ -844,7 +855,8 @@ func updateStreamConfiguration(TCPEndpoints []ingress.L4Service, UDPEndpoints [] Service: service, }) } - for _, ep := range UDPEndpoints { + for i := range udpEndpoints { + ep := &udpEndpoints[i] var service *apiv1.Service if ep.Service != nil { service = &apiv1.Service{Spec: ep.Service.Spec} @@ -1034,7 +1046,7 @@ ratio = {{ .OtelSamplerRatio }} parent_based = {{ .OtelSamplerParentBased }} ` -func datadogOpentracingCfg(cfg ngx_config.Configuration) (string, error) { +func datadogOpentracingCfg(cfg *ngx_config.Configuration) (string, error) { m := map[string]interface{}{ "service": cfg.DatadogServiceName, "agent_host": cfg.DatadogCollectorHost, @@ -1058,7 +1070,7 @@ func datadogOpentracingCfg(cfg ngx_config.Configuration) (string, error) { return string(buf), nil } -func opentracingCfgFromTemplate(cfg ngx_config.Configuration, tmplName string, tmplText string) (string, error) { +func opentracingCfgFromTemplate(cfg *ngx_config.Configuration, tmplName, tmplText string) (string, error) { tmpl, err := template.New(tmplName).Parse(tmplText) if err != nil { return "", err @@ -1073,17 +1085,18 @@ func opentracingCfgFromTemplate(cfg ngx_config.Configuration, tmplName string, t return tmplBuf.String(), nil } -func createOpentracingCfg(cfg ngx_config.Configuration) error { +func createOpentracingCfg(cfg *ngx_config.Configuration) error { var configData string var err error - if cfg.ZipkinCollectorHost != "" { + switch { + case cfg.ZipkinCollectorHost != "": configData, err = opentracingCfgFromTemplate(cfg, "zipkin", zipkinTmpl) - } else if cfg.JaegerCollectorHost != "" || cfg.JaegerEndpoint != "" { + case cfg.JaegerCollectorHost != "" || cfg.JaegerEndpoint != "": configData, err = opentracingCfgFromTemplate(cfg, "jaeger", jaegerTmpl) - } else if cfg.DatadogCollectorHost != "" { + case cfg.DatadogCollectorHost != "": configData, err = datadogOpentracingCfg(cfg) - } else { + default: configData = "{}" } @@ -1097,8 +1110,7 @@ func createOpentracingCfg(cfg ngx_config.Configuration) error { return os.WriteFile("/etc/nginx/opentracing.json", []byte(expanded), file.ReadWriteByUser) } -func createOpentelemetryCfg(cfg ngx_config.Configuration) error { - +func createOpentelemetryCfg(cfg *ngx_config.Configuration) error { tmpl, err := template.New("otel").Parse(otelTmpl) if err != nil { return err @@ -1123,7 +1135,10 @@ func cleanTempNginxCfg() error { return filepath.SkipDir } - dur, _ := time.ParseDuration("-5m") + dur, err := time.ParseDuration("-5m") + if err != nil { + return err + } fiveMinutesAgo := time.Now().Add(dur) if strings.HasPrefix(info.Name(), tempNginxPattern) && info.ModTime().Before(fiveMinutesAgo) { files = append(files, path) diff --git a/internal/ingress/controller/nginx_test.go b/internal/ingress/controller/nginx_test.go index 56eb0f324e..c68b0b1883 100644 --- a/internal/ingress/controller/nginx_test.go +++ b/internal/ingress/controller/nginx_test.go @@ -58,6 +58,7 @@ func TestConfigureDynamically(t *testing.T) { server := &httptest.Server{ Listener: listener, + //nolint:gosec // Ignore not configured ReadHeaderTimeout in testing Config: &http.Server{ Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusCreated) @@ -76,23 +77,17 @@ func TestConfigureDynamically(t *testing.T) { switch r.URL.Path { case "/configuration/backends": - { - if strings.Contains(body, "target") { - t.Errorf("unexpected target reference in JSON content: %v", body) - } + if strings.Contains(body, "target") { + t.Errorf("unexpected target reference in JSON content: %v", body) + } - if !strings.Contains(body, "service") { - t.Errorf("service reference should be present in JSON content: %v", body) - } + if !strings.Contains(body, "service") { + t.Errorf("service reference should be present in JSON content: %v", body) } case "/configuration/general": - { - } case "/configuration/servers": - { - if !strings.Contains(body, `{"certificates":{},"servers":{"myapp.fake":"-1"}}`) { - t.Errorf("should be present in JSON content: %v", body) - } + if !strings.Contains(body, `{"certificates":{},"servers":{"myapp.fake":"-1"}}`) { + t.Errorf("should be present in JSON content: %v", body) } default: t.Errorf("unknown request to %s", r.URL.Path) @@ -218,6 +213,7 @@ func TestConfigureCertificates(t *testing.T) { server := &httptest.Server{ Listener: listener, + //nolint:gosec // Ignore not configured ReadHeaderTimeout in testing Config: &http.Server{ Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusCreated) @@ -414,6 +410,7 @@ func TestCleanTempNginxCfg(t *testing.T) { } } +//nolint:unparam // Ingnore `network` always receives `"tcp"` error func tryListen(network, address string) (l net.Listener, err error) { condFunc := func() (bool, error) { l, err = net.Listen(network, address) diff --git a/internal/ingress/controller/process/nginx.go b/internal/ingress/controller/process/nginx.go index 70227ac2e4..fdf5016168 100644 --- a/internal/ingress/controller/process/nginx.go +++ b/internal/ingress/controller/process/nginx.go @@ -30,7 +30,10 @@ func IsRespawnIfRequired(err error) bool { return false } - waitStatus := exitError.Sys().(syscall.WaitStatus) + waitStatus, ok := exitError.Sys().(syscall.WaitStatus) + if !ok { + return false + } klog.Warningf(` ------------------------------------------------------------------------------- NGINX master process died (%v): %v diff --git a/internal/ingress/controller/status.go b/internal/ingress/controller/status.go index 3b0a41ab8e..e061b2cb71 100644 --- a/internal/ingress/controller/status.go +++ b/internal/ingress/controller/status.go @@ -50,7 +50,7 @@ func setupLeaderElection(config *leaderElectionConfig) { var cancelContext context.CancelFunc - var newLeaderCtx = func(ctx context.Context) context.CancelFunc { + newLeaderCtx := func(ctx context.Context) context.CancelFunc { // allow to cancel the context in case we stop being the leader leaderCtx, cancel := context.WithCancel(ctx) go elector.Run(leaderCtx) @@ -86,8 +86,10 @@ func setupLeaderElection(config *leaderElectionConfig) { } broadcaster := record.NewBroadcaster() - hostname, _ := os.Hostname() - + hostname, err := os.Hostname() + if err != nil { + klog.Errorf("unexpected error getting hostname: %v", err) + } recorder := broadcaster.NewRecorder(scheme.Scheme, apiv1.EventSource{ Component: "ingress-leader-elector", Host: hostname, @@ -107,7 +109,7 @@ func setupLeaderElection(config *leaderElectionConfig) { ttl := 30 * time.Second - elector, err := leaderelection.NewLeaderElector(leaderelection.LeaderElectionConfig{ + elector, err = leaderelection.NewLeaderElector(leaderelection.LeaderElectionConfig{ Lock: lock, LeaseDuration: ttl, RenewDeadline: ttl / 2, diff --git a/internal/ingress/controller/store/backend_ssl.go b/internal/ingress/controller/store/backend_ssl.go index 6f0fcf189d..81b508cd23 100644 --- a/internal/ingress/controller/store/backend_ssl.go +++ b/internal/ingress/controller/store/backend_ssl.go @@ -88,10 +88,11 @@ func (s *k8sStore) getPemCertificate(secretName string) (*ingress.SSLCert, error auth := secret.Data["auth"] // namespace/secretName -> namespace-secretName - nsSecName := strings.Replace(secretName, "/", "-", -1) + nsSecName := strings.ReplaceAll(secretName, "/", "-") var sslCert *ingress.SSLCert - if okcert && okkey { + switch { + case okcert && okkey: if cert == nil { return nil, fmt.Errorf("key 'tls.crt' missing from Secret %q", secretName) } @@ -144,7 +145,7 @@ func (s *k8sStore) getPemCertificate(secretName string) (*ingress.SSLCert, error } klog.V(3).InfoS(msg) - } else if len(ca) > 0 { + case len(ca) > 0: sslCert, err = ssl.CreateCACert(ca) if err != nil { return nil, fmt.Errorf("unexpected error creating SSL Cert: %v", err) @@ -166,7 +167,7 @@ func (s *k8sStore) getPemCertificate(secretName string) (*ingress.SSLCert, error // makes this secret in 'syncSecret' to be used for Certificate Authentication // this does not enable Certificate Authentication klog.V(3).InfoS("Configuring Secret for TLS authentication", "secret", secretName) - } else { + default: if auth != nil { return nil, ErrSecretForAuth } diff --git a/internal/ingress/controller/store/endpointslice.go b/internal/ingress/controller/store/endpointslice.go index 78d0886951..61bc63ae7b 100644 --- a/internal/ingress/controller/store/endpointslice.go +++ b/internal/ingress/controller/store/endpointslice.go @@ -38,7 +38,7 @@ func (s *EndpointSliceLister) MatchByKey(key string) ([]*discoveryv1.EndpointSli keyNsLen = 0 } else { // count '/' char - keyNsLen += 1 + keyNsLen++ } // filter endpointSlices owned by svc for _, listKey := range s.ListKeys() { diff --git a/internal/ingress/controller/store/endpointslice_test.go b/internal/ingress/controller/store/endpointslice_test.go index 1342575aee..5d423a3a6f 100644 --- a/internal/ingress/controller/store/endpointslice_test.go +++ b/internal/ingress/controller/store/endpointslice_test.go @@ -87,7 +87,6 @@ func TestEndpointSliceLister(t *testing.T) { t.Errorf("unexpected error %v", err) } eps, err := el.MatchByKey(key) - if err != nil { t.Errorf("unexpeted error %v", err) } diff --git a/internal/ingress/controller/store/store.go b/internal/ingress/controller/store/store.go index c11e35d766..918dfd41a1 100644 --- a/internal/ingress/controller/store/store.go +++ b/internal/ingress/controller/store/store.go @@ -105,7 +105,7 @@ type Storer interface { Run(stopCh chan struct{}) // GetIngressClass validates given ingress against ingress class configuration and returns the ingress class. - GetIngressClass(ing *networkingv1.Ingress, icConfig *ingressclass.IngressClassConfiguration) (string, error) + GetIngressClass(ing *networkingv1.Ingress, icConfig *ingressclass.Configuration) (string, error) } // EventType type of event associated with an informer @@ -242,7 +242,9 @@ type k8sStore struct { defaultSSLCertificate string } -// New creates a new object store to be used in the ingress controller +// New creates a new object store to be used in the ingress controller. +// +//nolint:gocyclo // Ignore function complexity error. func New( namespace string, namespaceSelector labels.Selector, @@ -252,9 +254,9 @@ func New( updateCh *channels.RingChannel, disableCatchAll bool, deepInspector bool, - icConfig *ingressclass.IngressClassConfiguration, - disableSyncEvents bool) Storer { - + icConfig *ingressclass.Configuration, + disableSyncEvents bool, +) Storer { store := &k8sStore{ informers: &Informer{}, listers: &Lister{}, @@ -474,7 +476,8 @@ func New( _, errOld = store.GetIngressClass(oldIng, icConfig) classCur, errCur = store.GetIngressClass(curIng, icConfig) } - if errOld != nil && errCur == nil { + switch { + case errOld != nil && errCur == nil: if hasCatchAllIngressRule(curIng.Spec) && disableCatchAll { klog.InfoS("ignoring update for catch-all ingress because of --disable-catch-all", "ingress", klog.KObj(curIng)) return @@ -482,11 +485,11 @@ func New( klog.InfoS("creating ingress", "ingress", klog.KObj(curIng), "ingressclass", classCur) recorder.Eventf(curIng, corev1.EventTypeNormal, "Sync", "Scheduled for sync") - } else if errOld == nil && errCur != nil { + case errOld == nil && errCur != nil: klog.InfoS("removing ingress because of unknown ingressclass", "ingress", klog.KObj(curIng)) ingDeleteHandler(old) return - } else if errCur == nil && !reflect.DeepEqual(old, cur) { + case errCur == nil && !reflect.DeepEqual(old, cur): if hasCatchAllIngressRule(curIng.Spec) && disableCatchAll { klog.InfoS("ignoring update for catch-all ingress and delete old one because of --disable-catch-all", "ingress", klog.KObj(curIng)) ingDeleteHandler(old) @@ -494,7 +497,7 @@ func New( } recorder.Eventf(curIng, corev1.EventTypeNormal, "Sync", "Scheduled for sync") - } else { + default: klog.V(3).InfoS("No changes on ingress. Skipping update", "ingress", klog.KObj(curIng)) return } @@ -519,7 +522,10 @@ func New( ingressClassEventHandler := cache.ResourceEventHandlerFuncs{ AddFunc: func(obj interface{}) { - ingressclass := obj.(*networkingv1.IngressClass) + ingressclass, ok := obj.(*networkingv1.IngressClass) + if !ok { + klog.Errorf("unexpected type: %T", obj) + } foundClassByName := false if icConfig.IngressClassByName && ingressclass.Name == icConfig.AnnotationValue { klog.InfoS("adding ingressclass as ingress-class-by-name is configured", "ingressclass", klog.KObj(ingressclass)) @@ -541,7 +547,10 @@ func New( } }, DeleteFunc: func(obj interface{}) { - ingressclass := obj.(*networkingv1.IngressClass) + ingressclass, ok := obj.(*networkingv1.IngressClass) + if !ok { + klog.Errorf("unexpected type: %T", obj) + } if ingressclass.Spec.Controller != icConfig.Controller { klog.InfoS("ignoring ingressclass as the spec.controller is not the same of this ingress", "ingressclass", klog.KObj(ingressclass)) return @@ -557,8 +566,14 @@ func New( } }, UpdateFunc: func(old, cur interface{}) { - oic := old.(*networkingv1.IngressClass) - cic := cur.(*networkingv1.IngressClass) + oic, ok := old.(*networkingv1.IngressClass) + if !ok { + klog.Errorf("unexpected type: %T", old) + } + cic, ok := cur.(*networkingv1.IngressClass) + if !ok { + klog.Errorf("unexpected type: %T", cur) + } if cic.Spec.Controller != icConfig.Controller { klog.InfoS("ignoring ingressclass as the spec.controller is not the same of this ingress", "ingressclass", klog.KObj(cic)) return @@ -581,7 +596,10 @@ func New( secrEventHandler := cache.ResourceEventHandlerFuncs{ AddFunc: func(obj interface{}) { - sec := obj.(*corev1.Secret) + sec, ok := obj.(*corev1.Secret) + if !ok { + klog.Errorf("unexpected type: %T", obj) + } key := k8s.MetaNamespaceKey(sec) if store.defaultSSLCertificate == key { @@ -608,7 +626,10 @@ func New( }, UpdateFunc: func(old, cur interface{}) { if !reflect.DeepEqual(old, cur) { - sec := cur.(*corev1.Secret) + sec, ok := cur.(*corev1.Secret) + if !ok { + klog.Errorf("unexpected type: %T", cur) + } key := k8s.MetaNamespaceKey(sec) if !watchedNamespace(sec.Namespace) { @@ -695,8 +716,14 @@ func New( } }, UpdateFunc: func(old, cur interface{}) { - oeps := old.(*discoveryv1.EndpointSlice) - ceps := cur.(*discoveryv1.EndpointSlice) + oeps, ok := old.(*discoveryv1.EndpointSlice) + if !ok { + klog.Errorf("unexpected type: %T", old) + } + ceps, ok := cur.(*discoveryv1.EndpointSlice) + if !ok { + klog.Errorf("unexpected type: %T", cur) + } if !reflect.DeepEqual(ceps.Endpoints, oeps.Endpoints) { updateCh.In() <- Event{ Type: UpdateEvent, @@ -750,7 +777,10 @@ func New( cmEventHandler := cache.ResourceEventHandlerFuncs{ AddFunc: func(obj interface{}) { - cfgMap := obj.(*corev1.ConfigMap) + cfgMap, ok := obj.(*corev1.ConfigMap) + if !ok { + klog.Errorf("unexpected type: %T", obj) + } key := k8s.MetaNamespaceKey(cfgMap) handleCfgMapEvent(key, cfgMap, "CREATE") }, @@ -759,7 +789,10 @@ func New( return } - cfgMap := cur.(*corev1.ConfigMap) + cfgMap, ok := cur.(*corev1.ConfigMap) + if !ok { + klog.Errorf("unexpected type: %T", cur) + } key := k8s.MetaNamespaceKey(cfgMap) handleCfgMapEvent(key, cfgMap, "UPDATE") }, @@ -767,7 +800,10 @@ func New( serviceHandler := cache.ResourceEventHandlerFuncs{ AddFunc: func(obj interface{}) { - svc := obj.(*corev1.Service) + svc, ok := obj.(*corev1.Service) + if !ok { + klog.Errorf("unexpected type: %T", obj) + } if svc.Spec.Type == corev1.ServiceTypeExternalName { updateCh.In() <- Event{ Type: CreateEvent, @@ -776,7 +812,10 @@ func New( } }, DeleteFunc: func(obj interface{}) { - svc := obj.(*corev1.Service) + svc, ok := obj.(*corev1.Service) + if !ok { + klog.Errorf("unexpected type: %T", obj) + } if svc.Spec.Type == corev1.ServiceTypeExternalName { updateCh.In() <- Event{ Type: DeleteEvent, @@ -785,8 +824,14 @@ func New( } }, UpdateFunc: func(old, cur interface{}) { - oldSvc := old.(*corev1.Service) - curSvc := cur.(*corev1.Service) + oldSvc, ok := old.(*corev1.Service) + if !ok { + klog.Errorf("unexpected type: %T", old) + } + curSvc, ok := cur.(*corev1.Service) + if !ok { + klog.Errorf("unexpected type: %T", cur) + } if reflect.DeepEqual(oldSvc, curSvc) { return @@ -821,7 +866,10 @@ func New( } // do not wait for informers to read the configmap configuration - ns, name, _ := k8s.ParseNameNS(configmap) + ns, name, err := k8s.ParseNameNS(configmap) + if err != nil { + klog.Errorf("unexpected error parsing name and ns: %v", err) + } cm, err := client.CoreV1().ConfigMaps(ns).Get(context.TODO(), name, metav1.GetOptions{}) if err != nil { klog.Warningf("Unexpected error reading configuration configmap: %v", err) @@ -837,10 +885,10 @@ func hasCatchAllIngressRule(spec networkingv1.IngressSpec) bool { return spec.DefaultBackend != nil } -func checkBadAnnotationValue(annotations map[string]string, badwords string) error { +func checkBadAnnotationValue(annotationMap map[string]string, badwords string) error { arraybadWords := strings.Split(strings.TrimSpace(badwords), ",") - for annotation, value := range annotations { + for annotation, value := range annotationMap { if strings.HasPrefix(annotation, fmt.Sprintf("%s/", parser.AnnotationsPrefix)) { for _, forbiddenvalue := range arraybadWords { if strings.Contains(value, forbiddenvalue) { @@ -999,7 +1047,7 @@ func (s *k8sStore) GetService(key string) (*corev1.Service, error) { return s.listers.Service.ByKey(key) } -func (s *k8sStore) GetIngressClass(ing *networkingv1.Ingress, icConfig *ingressclass.IngressClassConfiguration) (string, error) { +func (s *k8sStore) GetIngressClass(ing *networkingv1.Ingress, icConfig *ingressclass.Configuration) (string, error) { // First we try ingressClassName if !icConfig.IgnoreIngressClass && ing.Spec.IngressClassName != nil { iclass, err := s.listers.IngressClass.ByKey(*ing.Spec.IngressClassName) @@ -1010,11 +1058,11 @@ func (s *k8sStore) GetIngressClass(ing *networkingv1.Ingress, icConfig *ingressc } // Then we try annotation - if ingressclass, ok := ing.GetAnnotations()[ingressclass.IngressKey]; ok { - if ingressclass != icConfig.AnnotationValue { + if class, ok := ing.GetAnnotations()[ingressclass.IngressKey]; ok { + if class != icConfig.AnnotationValue { return "", fmt.Errorf("ingress class annotation is not equal to the expected by Ingress Controller") } - return ingressclass, nil + return class, nil } // Then we accept if the WithoutClass is enabled @@ -1055,7 +1103,10 @@ func (s *k8sStore) ListIngresses() []*ingress.Ingress { // filter ingress rules ingresses := make([]*ingress.Ingress, 0) for _, item := range s.listers.IngressWithAnnotation.List() { - ing := item.(*ingress.Ingress) + ing, ok := item.(*ingress.Ingress) + if !ok { + klog.Errorf("unexpected type: %T", item) + } ingresses = append(ingresses, ing) } diff --git a/internal/ingress/controller/store/store_test.go b/internal/ingress/controller/store/store_test.go index 774a45676b..317c0f36c2 100644 --- a/internal/ingress/controller/store/store_test.go +++ b/internal/ingress/controller/store/store_test.go @@ -44,29 +44,27 @@ import ( var pathPrefix networking.PathType = networking.PathTypePrefix -var DefaultClassConfig = &ingressclass.IngressClassConfiguration{ +var DefaultClassConfig = &ingressclass.Configuration{ Controller: ingressclass.DefaultControllerName, AnnotationValue: ingressclass.DefaultAnnotationValue, WatchWithoutClass: false, } -var ( - commonIngressSpec = networking.IngressSpec{ - Rules: []networking.IngressRule{ - { - Host: "dummy", - IngressRuleValue: networking.IngressRuleValue{ - HTTP: &networking.HTTPIngressRuleValue{ - Paths: []networking.HTTPIngressPath{ - { - Path: "/", - PathType: &pathPrefix, - Backend: networking.IngressBackend{ - Service: &networking.IngressServiceBackend{ - Name: "http-svc", - Port: networking.ServiceBackendPort{ - Number: 80, - }, +var commonIngressSpec = networking.IngressSpec{ + Rules: []networking.IngressRule{ + { + Host: "dummy", + IngressRuleValue: networking.IngressRuleValue{ + HTTP: &networking.HTTPIngressRuleValue{ + Paths: []networking.HTTPIngressPath{ + { + Path: "/", + PathType: &pathPrefix, + Backend: networking.IngressBackend{ + Service: &networking.IngressServiceBackend{ + Name: "http-svc", + Port: networking.ServiceBackendPort{ + Number: 80, }, }, }, @@ -75,12 +73,15 @@ var ( }, }, }, - } -) + }, +} + +const updateDummyHost = "update-dummy" +//nolint:gocyclo // Ignore function complexity error func TestStore(t *testing.T) { - //TODO: move env definition to docker image? - os.Setenv("KUBEBUILDER_ASSETS", "/usr/local/bin") + // TODO: move env definition to docker image? + t.Setenv("KUBEBUILDER_ASSETS", "/usr/local/bin") pathPrefix = networking.PathTypePrefix @@ -90,9 +91,12 @@ func TestStore(t *testing.T) { t.Fatalf("error: %v", err) } - emptySelector, _ := labels.Parse("") + emptySelector, err := labels.Parse("") + if err != nil { + t.Fatalf("unexpected error: %v", err) + } - defer te.Stop() //nolint:errcheck + defer te.Stop() //nolint:errcheck // Ignore the error clientSet, err := kubernetes.NewForConfig(cfg) if err != nil { @@ -176,7 +180,11 @@ func TestStore(t *testing.T) { return } - e := evt.(Event) + e, ok := evt.(Event) + if !ok { + return + } + if e.Obj == nil { continue } @@ -230,7 +238,7 @@ func TestStore(t *testing.T) { time.Sleep(1 * time.Second) ni := ing.DeepCopy() - ni.Spec.Rules[0].Host = "update-dummy" + ni.Spec.Rules[0].Host = updateDummyHost _ = ensureIngress(ni, clientSet, t) if err != nil { t.Errorf("error creating ingress: %v", err) @@ -281,7 +289,10 @@ func TestStore(t *testing.T) { return } - e := evt.(Event) + e, ok := evt.(Event) + if !ok { + return + } if e.Obj == nil { continue } @@ -343,7 +354,7 @@ func TestStore(t *testing.T) { defer deleteIngress(invalidIngress, clientSet, t) ni := ing.DeepCopy() - ni.Spec.Rules[0].Host = "update-dummy" + ni.Spec.Rules[0].Host = updateDummyHost _ = ensureIngress(ni, clientSet, t) if err != nil { t.Errorf("error creating ingress: %v", err) @@ -392,7 +403,10 @@ func TestStore(t *testing.T) { return } - e := evt.(Event) + e, ok := evt.(Event) + if !ok { + return + } if e.Obj == nil { continue } @@ -411,7 +425,7 @@ func TestStore(t *testing.T) { } }(updateCh) - ingressClassconfig := &ingressclass.IngressClassConfiguration{ + ingressClassconfig := &ingressclass.Configuration{ Controller: ingressclass.DefaultControllerName, AnnotationValue: ingressclass.DefaultAnnotationValue, WatchWithoutClass: true, @@ -463,7 +477,7 @@ func TestStore(t *testing.T) { time.Sleep(1 * time.Second) validIngressUpdated := validIngress1.DeepCopy() - validIngressUpdated.Spec.Rules[0].Host = "update-dummy" + validIngressUpdated.Spec.Rules[0].Host = updateDummyHost _ = ensureIngress(validIngressUpdated, clientSet, t) if err != nil { t.Errorf("error updating ingress: %v", err) @@ -523,7 +537,10 @@ func TestStore(t *testing.T) { return } - e := evt.(Event) + e, ok := evt.(Event) + if !ok { + return + } if e.Obj == nil { continue } @@ -542,7 +559,7 @@ func TestStore(t *testing.T) { } }(updateCh) - ingressClassconfig := &ingressclass.IngressClassConfiguration{ + ingressClassconfig := &ingressclass.Configuration{ Controller: ingressclass.DefaultControllerName, AnnotationValue: ic, IngressClassByName: true, @@ -581,7 +598,7 @@ func TestStore(t *testing.T) { time.Sleep(1 * time.Second) ingressUpdated := ing.DeepCopy() - ingressUpdated.Spec.Rules[0].Host = "update-dummy" + ingressUpdated.Spec.Rules[0].Host = updateDummyHost _ = ensureIngress(ingressUpdated, clientSet, t) if err != nil { t.Errorf("error updating ingress: %v", err) @@ -630,7 +647,10 @@ func TestStore(t *testing.T) { return } - e := evt.(Event) + e, ok := evt.(Event) + if !ok { + return + } if e.Obj == nil { continue } @@ -684,7 +704,7 @@ func TestStore(t *testing.T) { time.Sleep(1 * time.Second) invalidIngressUpdated := invalidIngress.DeepCopy() - invalidIngressUpdated.Spec.Rules[0].Host = "update-dummy" + invalidIngressUpdated.Spec.Rules[0].Host = updateDummyHost _ = ensureIngress(invalidIngressUpdated, clientSet, t) if err != nil { t.Errorf("error creating ingress: %v", err) @@ -725,7 +745,10 @@ func TestStore(t *testing.T) { return } - e := evt.(Event) + e, ok := evt.(Event) + if !ok { + return + } if e.Obj == nil { continue } @@ -778,7 +801,7 @@ func TestStore(t *testing.T) { time.Sleep(1 * time.Second) invalidIngressUpdated := invalidIngress.DeepCopy() - invalidIngressUpdated.Spec.Rules[0].Host = "update-dummy" + invalidIngressUpdated.Spec.Rules[0].Host = updateDummyHost _ = ensureIngress(invalidIngressUpdated, clientSet, t) if err != nil { t.Errorf("error creating ingress: %v", err) @@ -816,7 +839,10 @@ func TestStore(t *testing.T) { return } - e := evt.(Event) + e, ok := evt.(Event) + if !ok { + return + } if e.Obj == nil { continue } @@ -908,7 +934,10 @@ func TestStore(t *testing.T) { return } - e := evt.(Event) + e, ok := evt.(Event) + if !ok { + return + } if e.Obj == nil { continue } @@ -1008,7 +1037,6 @@ func TestStore(t *testing.T) { if atomic.LoadUint64(&del) != 1 { t.Errorf("expected 1 events of type Delete but %v occurred", del) } - }) t.Run("should create an ingress with a secret which does not exist", func(t *testing.T) { @@ -1032,7 +1060,10 @@ func TestStore(t *testing.T) { return } - e := evt.(Event) + e, ok := evt.(Event) + if !ok { + return + } if e.Obj == nil { continue } @@ -1159,7 +1190,10 @@ func TestStore(t *testing.T) { return } - e := evt.(Event) + e, ok := evt.(Event) + if !ok { + return + } if e.Obj == nil { continue } @@ -1174,7 +1208,10 @@ func TestStore(t *testing.T) { } }(updateCh) - namesapceSelector, _ := labels.Parse("foo=bar") + namesapceSelector, err := labels.Parse("foo=bar") + if err != nil { + t.Errorf("unexpected error: %v", err) + } storer := New( ns, namesapceSelector, @@ -1236,7 +1273,6 @@ func TestStore(t *testing.T) { if atomic.LoadUint64(&del) != 0 { t.Errorf("expected 0 events of type Delete but %v occurred", del) } - }) // test add ingress with secret it doesn't exists and then add secret // check secret is generated on fs @@ -1274,16 +1310,16 @@ func deleteNamespace(ns string, clientSet kubernetes.Interface, t *testing.T) { func createIngressClass(clientSet kubernetes.Interface, t *testing.T, controller string) string { t.Helper() - ingressclass := &networking.IngressClass{ + class := &networking.IngressClass{ ObjectMeta: metav1.ObjectMeta{ Name: fmt.Sprintf("ingress-nginx-%v", time.Now().Unix()), - //Namespace: "xpto" // TODO: We don't support namespaced ingress-class yet + // Namespace: "xpto" // TODO: We don't support namespaced ingress-class yet }, Spec: networking.IngressClassSpec{ Controller: controller, }, } - ic, err := clientSet.NetworkingV1().IngressClasses().Create(context.TODO(), ingressclass, metav1.CreateOptions{}) + ic, err := clientSet.NetworkingV1().IngressClasses().Create(context.TODO(), class, metav1.CreateOptions{}) if err != nil { t.Errorf("error creating ingress class: %v", err) } @@ -1299,7 +1335,7 @@ func deleteIngressClass(ic string, clientSet kubernetes.Interface, t *testing.T) } } -func createConfigMap(clientSet kubernetes.Interface, ns string, t *testing.T) string { +func createConfigMap(clientSet kubernetes.Interface, ns string, t *testing.T) { t.Helper() configMap := &v1.ConfigMap{ @@ -1308,51 +1344,47 @@ func createConfigMap(clientSet kubernetes.Interface, ns string, t *testing.T) st }, } - cm, err := clientSet.CoreV1().ConfigMaps(ns).Create(context.TODO(), configMap, metav1.CreateOptions{}) + _, err := clientSet.CoreV1().ConfigMaps(ns).Create(context.TODO(), configMap, metav1.CreateOptions{}) if err != nil { t.Errorf("error creating the configuration map: %v", err) } - - return cm.Name } -func ensureIngress(ingress *networking.Ingress, clientSet kubernetes.Interface, t *testing.T) *networking.Ingress { +func ensureIngress(ing *networking.Ingress, clientSet kubernetes.Interface, t *testing.T) *networking.Ingress { t.Helper() - ing, err := clientSet.NetworkingV1().Ingresses(ingress.Namespace).Update(context.TODO(), ingress, metav1.UpdateOptions{}) - + newIngress, err := clientSet.NetworkingV1().Ingresses(ing.Namespace).Update(context.TODO(), ing, metav1.UpdateOptions{}) if err != nil { if k8sErrors.IsNotFound(err) { - t.Logf("Ingress %v not found, creating", ingress) + t.Logf("Ingress %v not found, creating", ing) - ing, err = clientSet.NetworkingV1().Ingresses(ingress.Namespace).Create(context.TODO(), ingress, metav1.CreateOptions{}) + newIngress, err = clientSet.NetworkingV1().Ingresses(ing.Namespace).Create(context.TODO(), ing, metav1.CreateOptions{}) if err != nil { - t.Fatalf("error creating ingress %+v: %v", ingress, err) + t.Fatalf("error creating ingress %+v: %v", ing, err) } - t.Logf("Ingress %+v created", ingress) - return ing + t.Logf("Ingress %+v created", ing) + return newIngress } - t.Fatalf("error updating ingress %+v: %v", ingress, err) + t.Fatalf("error updating ingress %+v: %v", ing, err) } - return ing + return newIngress } -func deleteIngress(ingress *networking.Ingress, clientSet kubernetes.Interface, t *testing.T) { +func deleteIngress(ing *networking.Ingress, clientSet kubernetes.Interface, t *testing.T) { t.Helper() - err := clientSet.NetworkingV1().Ingresses(ingress.Namespace).Delete(context.TODO(), ingress.Name, metav1.DeleteOptions{}) - + err := clientSet.NetworkingV1().Ingresses(ing.Namespace).Delete(context.TODO(), ing.Name, metav1.DeleteOptions{}) if err != nil { - t.Errorf("failed to delete ingress %+v: %v", ingress, err) + t.Errorf("failed to delete ingress %+v: %v", ing, err) } - t.Logf("Ingress %+v deleted", ingress) + t.Logf("Ingress %+v deleted", ing) } // newStore creates a new mock object store for tests which do not require the // use of Informers. -func newStore(t *testing.T) *k8sStore { +func newStore() *k8sStore { return &k8sStore{ listers: &Lister{ // add more listers if needed @@ -1369,7 +1401,7 @@ func newStore(t *testing.T) *k8sStore { } func TestUpdateSecretIngressMap(t *testing.T) { - s := newStore(t) + s := newStore() ingTpl := &networking.Ingress{ ObjectMeta: metav1.ObjectMeta{ @@ -1431,7 +1463,9 @@ func TestUpdateSecretIngressMap(t *testing.T) { ing.ObjectMeta.SetAnnotations(map[string]string{ parser.GetAnnotationWithPrefix("auth-secret"): "anotherns/auth", }) - s.listers.Ingress.Update(ing) + if err := s.listers.Ingress.Update(ing); err != nil { + t.Errorf("error updating the Ingress: %v", err) + } s.updateSecretIngressMap(ing) if l := s.secretIngressMap.Len(); l != 0 { @@ -1456,7 +1490,7 @@ func TestUpdateSecretIngressMap(t *testing.T) { } func TestListIngresses(t *testing.T) { - s := newStore(t) + s := newStore() invalidIngressClass := "something" validIngressClass := ingressclass.DefaultControllerName @@ -1586,7 +1620,7 @@ func TestWriteSSLSessionTicketKey(t *testing.T) { } for _, test := range tests { - s := newStore(t) + s := newStore() cmap := &v1.ConfigMap{ Data: map[string]string{ diff --git a/internal/ingress/controller/template/configmap.go b/internal/ingress/controller/template/configmap.go index c73f3b6c05..9dc019bccc 100644 --- a/internal/ingress/controller/template/configmap.go +++ b/internal/ingress/controller/template/configmap.go @@ -91,6 +91,8 @@ const ( ) // ReadConfig obtains the configuration defined by the user merged with the defaults. +// +//nolint:gocyclo // Ignore function complexity error func ReadConfig(src map[string]string) config.Configuration { conf := map[string]string{} // we need to copy the configmap data because the content is altered @@ -116,12 +118,12 @@ func ReadConfig(src map[string]string) config.Configuration { luaSharedDicts := make(map[string]int) debugConnectionsList := make([]string, 0) - //parse lua shared dict values + // parse lua shared dict values if val, ok := conf[luaSharedDictsKey]; ok { delete(conf, luaSharedDictsKey) lsd := splitAndTrimSpace(val, ",") for _, v := range lsd { - v = strings.Replace(v, " ", "", -1) + v = strings.ReplaceAll(v, " ", "") results := strings.SplitN(v, ":", 2) dictName := results[0] size := dictStrToKb(results[1]) @@ -196,7 +198,7 @@ func ReadConfig(src map[string]string) config.Configuration { if ing_net.IsIPV6(ns) { bindAddressIpv6List = append(bindAddressIpv6List, fmt.Sprintf("[%v]", ns)) } else { - bindAddressIpv4List = append(bindAddressIpv4List, fmt.Sprintf("%v", ns)) + bindAddressIpv4List = append(bindAddressIpv4List, ns.String()) } } else { klog.Warningf("%v is not a valid textual representation of an IP address", i) @@ -250,7 +252,7 @@ func ReadConfig(src map[string]string) config.Configuration { if val, ok := conf[globalAuthMethod]; ok { delete(conf, globalAuthMethod) - if len(val) != 0 && !authreq.ValidMethod(val) { + if val != "" && !authreq.ValidMethod(val) { klog.Warningf("Global auth location denied - %v.", "invalid HTTP method") } else { to.GlobalExternalAuth.Method = val @@ -261,7 +263,10 @@ func ReadConfig(src map[string]string) config.Configuration { if val, ok := conf[globalAuthSignin]; ok { delete(conf, globalAuthSignin) - signinURL, _ := parser.StringToURL(val) + signinURL, err := parser.StringToURL(val) + if err != nil { + klog.Errorf("string to URL conversion failed: %v", err) + } if signinURL == nil { klog.Warningf("Global auth location denied - %v.", "global-auth-signin setting is undefined and will not be set") } else { @@ -274,7 +279,10 @@ func ReadConfig(src map[string]string) config.Configuration { delete(conf, globalAuthSigninRedirectParam) redirectParam := strings.TrimSpace(val) - dummySigninURL, _ := parser.StringToURL(fmt.Sprintf("%s?%s=dummy", to.GlobalExternalAuth.SigninURL, redirectParam)) + dummySigninURL, err := parser.StringToURL(fmt.Sprintf("%s?%s=dummy", to.GlobalExternalAuth.SigninURL, redirectParam)) + if err != nil { + klog.Errorf("string to URL conversion failed: %v", err) + } if dummySigninURL == nil { klog.Warningf("Global auth redirect parameter denied - %v.", "global-auth-signin-redirect-param setting is invalid and will not be set") } else { @@ -286,7 +294,7 @@ func ReadConfig(src map[string]string) config.Configuration { if val, ok := conf[globalAuthResponseHeaders]; ok { delete(conf, globalAuthResponseHeaders) - if len(val) != 0 { + if val != "" { harr := splitAndTrimSpace(val, ",") for _, header := range harr { if !authreq.ValidHeader(header) { @@ -385,8 +393,8 @@ func ReadConfig(src map[string]string) config.Configuration { if val, ok := conf[debugConnections]; ok { delete(conf, debugConnections) for _, i := range splitAndTrimSpace(val, ",") { - validIp := net.ParseIP(i) - if validIp != nil { + validIP := net.ParseIP(i) + if validIP != nil { debugConnectionsList = append(debugConnectionsList, i) } else { _, _, err := net.ParseCIDR(i) @@ -415,14 +423,14 @@ func ReadConfig(src map[string]string) config.Configuration { to.DisableIpv6DNS = !ing_net.IsIPv6Enabled() to.LuaSharedDicts = luaSharedDicts - config := &mapstructure.DecoderConfig{ + decoderConfig := &mapstructure.DecoderConfig{ Metadata: nil, WeaklyTypedInput: true, Result: &to, TagName: "json", } - decoder, err := mapstructure.NewDecoder(config) + decoder, err := mapstructure.NewDecoder(decoderConfig) if err != nil { klog.Warningf("unexpected error merging defaults: %v", err) } @@ -456,6 +464,7 @@ func filterErrors(codes []int) []int { return fa } +//nolint:unparam // Ignore `sep` always receives `,` error func splitAndTrimSpace(s, sep string) []string { f := func(c rune) bool { return strings.EqualFold(string(c), sep) @@ -474,8 +483,11 @@ func dictStrToKb(sizeStr string) int { if sizeMatch == nil { return -1 } - size, _ := strconv.Atoi(sizeMatch[1]) // validated already with regex - if sizeMatch[2] == "" || strings.ToLower(sizeMatch[2]) == "m" { + size, err := strconv.Atoi(sizeMatch[1]) // validated already with regex + if err != nil { + klog.Errorf("unexpected error converting size string %s to int: %v", sizeStr, err) + } + if sizeMatch[2] == "" || strings.EqualFold(sizeMatch[2], "m") { size *= 1024 } return size diff --git a/internal/ingress/controller/template/template.go b/internal/ingress/controller/template/template.go index 1474557718..4e51ac6650 100644 --- a/internal/ingress/controller/template/template.go +++ b/internal/ingress/controller/template/template.go @@ -52,6 +52,12 @@ const ( nonIdempotent = "non_idempotent" defBufferSize = 65535 writeIndentOnEmptyLines = true // backward-compatibility + httpProtocol = "HTTP" + autoHTTPProtocol = "AUTO_HTTP" + httpsProtocol = "HTTPS" + grpcProtocol = "GRPC" + grpcsProtocol = "GRPCS" + fcgiProtocol = "FCGI" ) const ( @@ -64,13 +70,13 @@ type Writer interface { // Write renders the template. // NOTE: Implementors must ensure that the content of the returned slice is not modified by the implementation // after the return of this function. - Write(conf config.TemplateConfig) ([]byte, error) + Write(conf *config.TemplateConfig) ([]byte, error) } -// Template ... +// Template ingress template type Template struct { tmpl *text_template.Template - //fw watch.FileWatcher + bp *BufferPool } @@ -97,7 +103,7 @@ func NewTemplate(file string) (*Template, error) { // 2. Collapses multiple empty lines to single one // 3. Re-indent // (ATW: always returns nil) -func cleanConf(in *bytes.Buffer, out *bytes.Buffer) error { +func cleanConf(in, out *bytes.Buffer) error { depth := 0 lineStarted := false emptyLineWritten := false @@ -176,7 +182,7 @@ func cleanConf(in *bytes.Buffer, out *bytes.Buffer) error { // Write populates a buffer using a template with NGINX configuration // and the servers and upstreams created by Ingress rules -func (t *Template) Write(conf config.TemplateConfig) ([]byte, error) { +func (t *Template) Write(conf *config.TemplateConfig) ([]byte, error) { tmplBuf := t.bp.Get() defer t.bp.Put(tmplBuf) @@ -184,14 +190,14 @@ func (t *Template) Write(conf config.TemplateConfig) ([]byte, error) { defer t.bp.Put(outCmdBuf) if klog.V(3).Enabled() { - b, err := json.Marshal(conf) + b, err := json.Marshal(*conf) if err != nil { klog.Errorf("unexpected error: %v", err) } klog.InfoS("NGINX", "configuration", string(b)) } - err := t.tmpl.Execute(tmplBuf, conf) + err := t.tmpl.Execute(tmplBuf, *conf) if err != nil { return nil, err } @@ -211,78 +217,76 @@ func (t *Template) Write(conf config.TemplateConfig) ([]byte, error) { return res, nil } -var ( - funcMap = text_template.FuncMap{ - "empty": func(input interface{}) bool { - check, ok := input.(string) - if ok { - return len(check) == 0 - } - return true - }, - "escapeLiteralDollar": escapeLiteralDollar, - "buildLuaSharedDictionaries": buildLuaSharedDictionaries, - "luaConfigurationRequestBodySize": luaConfigurationRequestBodySize, - "buildLocation": buildLocation, - "buildAuthLocation": buildAuthLocation, - "shouldApplyGlobalAuth": shouldApplyGlobalAuth, - "buildAuthResponseHeaders": buildAuthResponseHeaders, - "buildAuthUpstreamLuaHeaders": buildAuthUpstreamLuaHeaders, - "buildAuthProxySetHeaders": buildAuthProxySetHeaders, - "buildAuthUpstreamName": buildAuthUpstreamName, - "shouldApplyAuthUpstream": shouldApplyAuthUpstream, - "extractHostPort": extractHostPort, - "changeHostPort": changeHostPort, - "buildProxyPass": buildProxyPass, - "filterRateLimits": filterRateLimits, - "buildRateLimitZones": buildRateLimitZones, - "buildRateLimit": buildRateLimit, - "configForLua": configForLua, - "locationConfigForLua": locationConfigForLua, - "buildResolvers": buildResolvers, - "buildUpstreamName": buildUpstreamName, - "isLocationInLocationList": isLocationInLocationList, - "isLocationAllowed": isLocationAllowed, - "buildDenyVariable": buildDenyVariable, - "getenv": os.Getenv, - "contains": strings.Contains, - "split": strings.Split, - "hasPrefix": strings.HasPrefix, - "hasSuffix": strings.HasSuffix, - "trimSpace": strings.TrimSpace, - "toUpper": strings.ToUpper, - "toLower": strings.ToLower, - "formatIP": formatIP, - "quote": quote, - "buildNextUpstream": buildNextUpstream, - "getIngressInformation": getIngressInformation, - "serverConfig": func(all config.TemplateConfig, server *ingress.Server) interface{} { - return struct{ First, Second interface{} }{all, server} - }, - "isValidByteSize": isValidByteSize, - "buildForwardedFor": buildForwardedFor, - "buildAuthSignURL": buildAuthSignURL, - "buildAuthSignURLLocation": buildAuthSignURLLocation, - "buildOpentracing": buildOpentracing, - "buildOpentelemetry": buildOpentelemetry, - "proxySetHeader": proxySetHeader, - "enforceRegexModifier": enforceRegexModifier, - "buildCustomErrorDeps": buildCustomErrorDeps, - "buildCustomErrorLocationsPerServer": buildCustomErrorLocationsPerServer, - "shouldLoadModSecurityModule": shouldLoadModSecurityModule, - "buildHTTPListener": buildHTTPListener, - "buildHTTPSListener": buildHTTPSListener, - "buildOpentracingForLocation": buildOpentracingForLocation, - "buildOpentelemetryForLocation": buildOpentelemetryForLocation, - "shouldLoadOpentracingModule": shouldLoadOpentracingModule, - "shouldLoadOpentelemetryModule": shouldLoadOpentelemetryModule, - "buildModSecurityForLocation": buildModSecurityForLocation, - "buildMirrorLocations": buildMirrorLocations, - "shouldLoadAuthDigestModule": shouldLoadAuthDigestModule, - "buildServerName": buildServerName, - "buildCorsOriginRegex": buildCorsOriginRegex, - } -) +var funcMap = text_template.FuncMap{ + "empty": func(input interface{}) bool { + check, ok := input.(string) + if ok { + return check == "" + } + return true + }, + "escapeLiteralDollar": escapeLiteralDollar, + "buildLuaSharedDictionaries": buildLuaSharedDictionaries, + "luaConfigurationRequestBodySize": luaConfigurationRequestBodySize, + "buildLocation": buildLocation, + "buildAuthLocation": buildAuthLocation, + "shouldApplyGlobalAuth": shouldApplyGlobalAuth, + "buildAuthResponseHeaders": buildAuthResponseHeaders, + "buildAuthUpstreamLuaHeaders": buildAuthUpstreamLuaHeaders, + "buildAuthProxySetHeaders": buildAuthProxySetHeaders, + "buildAuthUpstreamName": buildAuthUpstreamName, + "shouldApplyAuthUpstream": shouldApplyAuthUpstream, + "extractHostPort": extractHostPort, + "changeHostPort": changeHostPort, + "buildProxyPass": buildProxyPass, + "filterRateLimits": filterRateLimits, + "buildRateLimitZones": buildRateLimitZones, + "buildRateLimit": buildRateLimit, + "configForLua": configForLua, + "locationConfigForLua": locationConfigForLua, + "buildResolvers": buildResolvers, + "buildUpstreamName": buildUpstreamName, + "isLocationInLocationList": isLocationInLocationList, + "isLocationAllowed": isLocationAllowed, + "buildDenyVariable": buildDenyVariable, + "getenv": os.Getenv, + "contains": strings.Contains, + "split": strings.Split, + "hasPrefix": strings.HasPrefix, + "hasSuffix": strings.HasSuffix, + "trimSpace": strings.TrimSpace, + "toUpper": strings.ToUpper, + "toLower": strings.ToLower, + "formatIP": formatIP, + "quote": quote, + "buildNextUpstream": buildNextUpstream, + "getIngressInformation": getIngressInformation, + "serverConfig": func(all config.TemplateConfig, server *ingress.Server) interface{} { + return struct{ First, Second interface{} }{all, server} + }, + "isValidByteSize": isValidByteSize, + "buildForwardedFor": buildForwardedFor, + "buildAuthSignURL": buildAuthSignURL, + "buildAuthSignURLLocation": buildAuthSignURLLocation, + "buildOpentracing": buildOpentracing, + "buildOpentelemetry": buildOpentelemetry, + "proxySetHeader": proxySetHeader, + "enforceRegexModifier": enforceRegexModifier, + "buildCustomErrorDeps": buildCustomErrorDeps, + "buildCustomErrorLocationsPerServer": buildCustomErrorLocationsPerServer, + "shouldLoadModSecurityModule": shouldLoadModSecurityModule, + "buildHTTPListener": buildHTTPListener, + "buildHTTPSListener": buildHTTPSListener, + "buildOpentracingForLocation": buildOpentracingForLocation, + "buildOpentelemetryForLocation": buildOpentelemetryForLocation, + "shouldLoadOpentracingModule": shouldLoadOpentracingModule, + "shouldLoadOpentelemetryModule": shouldLoadOpentelemetryModule, + "buildModSecurityForLocation": buildModSecurityForLocation, + "buildMirrorLocations": buildMirrorLocations, + "shouldLoadAuthDigestModule": shouldLoadAuthDigestModule, + "buildServerName": buildServerName, + "buildCorsOriginRegex": buildCorsOriginRegex, +} // escapeLiteralDollar will replace the $ character with ${literal_dollar} // which is made to work via the following configuration in the http section of @@ -296,7 +300,7 @@ func escapeLiteralDollar(input interface{}) string { if !ok { return "" } - return strings.Replace(inputStr, `$`, `${literal_dollar}`, -1) + return strings.ReplaceAll(inputStr, `$`, `${literal_dollar}`) } // formatIP will wrap IPv6 addresses in [] and return IPv4 addresses @@ -328,9 +332,7 @@ func quote(input interface{}) string { return fmt.Sprintf("%q", inputStr) } -func buildLuaSharedDictionaries(c interface{}, s interface{}) string { - var out []string - +func buildLuaSharedDictionaries(c, s interface{}) string { cfg, ok := c.(config.Configuration) if !ok { klog.Errorf("expected a 'config.Configuration' type but %T was returned", c) @@ -343,6 +345,7 @@ func buildLuaSharedDictionaries(c interface{}, s interface{}) string { return "" } + out := make([]string, 0, len(cfg.LuaSharedDicts)) for name, size := range cfg.LuaSharedDicts { sizeStr := dictKbToStr(size) out = append(out, fmt.Sprintf("lua_shared_dict %s %s", name, sizeStr)) @@ -364,7 +367,7 @@ func luaConfigurationRequestBodySize(c interface{}) string { if size < cfg.LuaSharedDicts["certificate_data"] { size = cfg.LuaSharedDicts["certificate_data"] } - size = size + 1024 + size += 1024 return dictKbToStr(size) } @@ -418,7 +421,7 @@ func configForLua(input interface{}) string { } // locationConfigForLua formats some location specific configuration into Lua table represented as string -func locationConfigForLua(l interface{}, a interface{}) string { +func locationConfigForLua(l, a interface{}) string { location, ok := l.(*ingress.Location) if !ok { klog.Errorf("expected an '*ingress.Location' type but %T was given", l) @@ -459,7 +462,7 @@ func locationConfigForLua(l interface{}, a interface{}) string { } // buildResolvers returns the resolvers reading the /etc/resolv.conf file -func buildResolvers(res interface{}, disableIpv6 interface{}) string { +func buildResolvers(res, disableIpv6 interface{}) string { // NGINX need IPV6 addresses to be surrounded by brackets nss, ok := res.([]net.IP) if !ok { @@ -484,7 +487,7 @@ func buildResolvers(res interface{}, disableIpv6 interface{}) string { } r = append(r, fmt.Sprintf("[%v]", ns)) } else { - r = append(r, fmt.Sprintf("%v", ns)) + r = append(r, ns.String()) } } r = append(r, "valid=30s") @@ -554,7 +557,7 @@ func buildAuthLocation(input interface{}, globalExternalAuthURL string) string { str := base64.URLEncoding.EncodeToString([]byte(location.Path)) // removes "=" after encoding - str = strings.Replace(str, "=", "", -1) + str = strings.ReplaceAll(str, "=", "") pathType := "default" if location.PathType != nil { @@ -644,7 +647,7 @@ func buildAuthUpstreamName(input interface{}, host string) string { // shouldApplyAuthUpstream returns true only in case when ExternalAuth.URL and // ExternalAuth.KeepaliveConnections are all set -func shouldApplyAuthUpstream(l interface{}, c interface{}) bool { +func shouldApplyAuthUpstream(l, c interface{}) bool { location, ok := l.(*ingress.Location) if !ok { klog.Errorf("expected an '*ingress.Location' type but %T was returned", l) @@ -672,14 +675,14 @@ func shouldApplyAuthUpstream(l interface{}, c interface{}) bool { } // extractHostPort will extract the host:port part from the URL specified by url -func extractHostPort(url string) string { - if url == "" { +func extractHostPort(newURL string) string { + if newURL == "" { return "" } - authURL, err := parser.StringToURL(url) + authURL, err := parser.StringToURL(newURL) if err != nil { - klog.Errorf("expected a valid URL but %s was returned", url) + klog.Errorf("expected a valid URL but %s was returned", newURL) return "" } @@ -687,14 +690,14 @@ func extractHostPort(url string) string { } // changeHostPort will change the host:port part of the url to value -func changeHostPort(url string, value string) string { - if url == "" { +func changeHostPort(newURL, value string) string { + if newURL == "" { return "" } - authURL, err := parser.StringToURL(url) + authURL, err := parser.StringToURL(newURL) if err != nil { - klog.Errorf("expected a valid URL but %s was returned", url) + klog.Errorf("expected a valid URL but %s was returned", newURL) return "" } @@ -707,7 +710,7 @@ func changeHostPort(url string, value string) string { // (specified through the nginx.ingress.kubernetes.io/rewrite-target annotation) // If the annotation nginx.ingress.kubernetes.io/add-base-url:"true" is specified it will // add a base tag in the head of the response from the service -func buildProxyPass(host string, b interface{}, loc interface{}) string { +func buildProxyPass(_ string, b, loc interface{}) string { backends, ok := b.([]*ingress.Backend) if !ok { klog.Errorf("expected an '[]*ingress.Backend' type but %T was returned", b) @@ -726,17 +729,17 @@ func buildProxyPass(host string, b interface{}, loc interface{}) string { proxyPass := "proxy_pass" switch location.BackendProtocol { - case "AUTO_HTTP": + case autoHTTPProtocol: proto = "$scheme://" - case "HTTPS": + case httpsProtocol: proto = "https://" - case "GRPC": + case grpcProtocol: proto = "grpc://" proxyPass = "grpc_pass" - case "GRPCS": + case grpcsProtocol: proto = "grpcs://" proxyPass = "grpc_pass" - case "FCGI": + case fcgiProtocol: proto = "" proxyPass = "fastcgi_pass" } @@ -748,7 +751,7 @@ func buildProxyPass(host string, b interface{}, loc interface{}) string { if backend.SSLPassthrough { proto = "https://" - if location.BackendProtocol == "GRPCS" { + if location.BackendProtocol == grpcsProtocol { proto = "grpcs://" } } @@ -775,7 +778,7 @@ func buildProxyPass(host string, b interface{}, loc interface{}) string { var xForwardedPrefix string if len(location.XForwardedPrefix) > 0 { - xForwardedPrefix = fmt.Sprintf("%s X-Forwarded-Prefix \"%s\";\n", proxySetHeader(location), location.XForwardedPrefix) + xForwardedPrefix = fmt.Sprintf("%s X-Forwarded-Prefix %q;\n", proxySetHeader(location), location.XForwardedPrefix) } return fmt.Sprintf(` @@ -935,9 +938,7 @@ func isLocationAllowed(input interface{}) bool { return loc.Denied == nil } -var ( - denyPathSlugMap = map[string]string{} -) +var denyPathSlugMap = map[string]string{} // buildDenyVariable returns a nginx variable for a location in a // server to be used in the whitelist check @@ -977,7 +978,11 @@ func buildNextUpstream(i, r interface{}) string { return "" } - retryNonIdempotent := r.(bool) + retryNonIdempotent, ok := r.(bool) + if !ok { + klog.Errorf("expected a 'bool' type but %T was returned", i) + return "" + } parts := strings.Split(nextUpstream, " ") @@ -1002,8 +1007,10 @@ func buildNextUpstream(i, r interface{}) string { // refer to http://nginx.org/en/docs/syntax.html // Nginx differentiates between size and offset // offset directives support gigabytes in addition -var nginxSizeRegex = regexp.MustCompile("^[0-9]+[kKmM]{0,1}$") -var nginxOffsetRegex = regexp.MustCompile("^[0-9]+[kKmMgG]{0,1}$") +var ( + nginxSizeRegex = regexp.MustCompile(`^\d+[kKmM]?$`) + nginxOffsetRegex = regexp.MustCompile(`^\d+[kKmMgG]?$`) +) // isValidByteSize validates size units valid in nginx // http://nginx.org/en/docs/syntax.html @@ -1153,13 +1160,17 @@ func buildForwardedFor(input interface{}) string { return "" } - ffh := strings.Replace(s, "-", "_", -1) + ffh := strings.ReplaceAll(s, "-", "_") ffh = strings.ToLower(ffh) return fmt.Sprintf("$http_%v", ffh) } func buildAuthSignURL(authSignURL, authRedirectParam string) string { - u, _ := url.Parse(authSignURL) + u, err := url.Parse(authSignURL) + if err != nil { + klog.Errorf("error parsing authSignURL: %v", err) + return "" + } q := u.Query() if authRedirectParam == "" { authRedirectParam = defaultGlobalAuthRedirectParam @@ -1198,7 +1209,7 @@ func randomString() string { return string(b) } -func buildOpentracing(c interface{}, s interface{}) string { +func buildOpentracing(c, s interface{}) string { cfg, ok := c.(config.Configuration) if !ok { klog.Errorf("expected a 'config.Configuration' type but %T was returned", c) @@ -1217,6 +1228,7 @@ func buildOpentracing(c interface{}, s interface{}) string { buf := bytes.NewBufferString("") + //nolint:gocritic // rewriting if-else to switch statement is not more readable if cfg.DatadogCollectorHost != "" { buf.WriteString("opentracing_load_tracer /usr/local/lib/libdd_opentracing.so /etc/nginx/opentracing.json;") } else if cfg.ZipkinCollectorHost != "" { @@ -1228,16 +1240,16 @@ func buildOpentracing(c interface{}, s interface{}) string { buf.WriteString("\r\n") if cfg.OpentracingOperationName != "" { - buf.WriteString(fmt.Sprintf("opentracing_operation_name \"%s\";\n", cfg.OpentracingOperationName)) + fmt.Fprintf(buf, "opentracing_operation_name \"%s\";\n", cfg.OpentracingOperationName) } if cfg.OpentracingLocationOperationName != "" { - buf.WriteString(fmt.Sprintf("opentracing_location_operation_name \"%s\";\n", cfg.OpentracingLocationOperationName)) + fmt.Fprintf(buf, "opentracing_location_operation_name \"%s\";\n", cfg.OpentracingLocationOperationName) } return buf.String() } -func buildOpentelemetry(c interface{}, s interface{}) string { +func buildOpentelemetry(c, s interface{}) string { cfg, ok := c.(config.Configuration) if !ok { klog.Errorf("expected a 'config.Configuration' type but %T was returned", c) @@ -1259,7 +1271,7 @@ func buildOpentelemetry(c interface{}, s interface{}) string { buf.WriteString("\r\n") if cfg.OpentelemetryOperationName != "" { - buf.WriteString(fmt.Sprintf("opentelemetry_operation_name \"%s\";\n", cfg.OpentelemetryOperationName)) + fmt.Fprintf(buf, "opentelemetry_operation_name \"%s\";\n", cfg.OpentelemetryOperationName) } return buf.String() } @@ -1271,7 +1283,7 @@ func proxySetHeader(loc interface{}) string { return "proxy_set_header" } - if location.BackendProtocol == "GRPC" || location.BackendProtocol == "GRPCS" { + if location.BackendProtocol == grpcProtocol || location.BackendProtocol == grpcsProtocol { return "grpc_set_header" } @@ -1280,7 +1292,7 @@ func proxySetHeader(loc interface{}) string { // buildCustomErrorDeps is a utility function returning a struct wrapper with // the data required to build the 'CUSTOM_ERRORS' template -func buildCustomErrorDeps(upstreamName string, errorCodes []int, enableMetrics bool, modsecurityEnabled bool) interface{} { +func buildCustomErrorDeps(upstreamName string, errorCodes []int, enableMetrics, modsecurityEnabled bool) interface{} { return struct { UpstreamName string ErrorCodes []int @@ -1355,7 +1367,7 @@ func opentracingPropagateContext(location *ingress.Location) string { return "" } - if location.BackendProtocol == "GRPC" || location.BackendProtocol == "GRPCS" { + if location.BackendProtocol == grpcProtocol || location.BackendProtocol == grpcsProtocol { return "opentracing_grpc_propagate_context;" } @@ -1372,7 +1384,7 @@ func opentelemetryPropagateContext(location *ingress.Location) string { // shouldLoadModSecurityModule determines whether or not the ModSecurity module needs to be loaded. // First, it checks if `enable-modsecurity` is set in the ConfigMap. If it is not, it iterates over all locations to // check if ModSecurity is enabled by the annotation `nginx.ingress.kubernetes.io/enable-modsecurity`. -func shouldLoadModSecurityModule(c interface{}, s interface{}) bool { +func shouldLoadModSecurityModule(c, s interface{}) bool { cfg, ok := c.(config.Configuration) if !ok { klog.Errorf("expected a 'config.Configuration' type but %T was returned", c) @@ -1403,7 +1415,7 @@ func shouldLoadModSecurityModule(c interface{}, s interface{}) bool { return false } -func buildHTTPListener(t interface{}, s interface{}) string { +func buildHTTPListener(t, s interface{}) string { var out []string tc, ok := t.(config.TemplateConfig) @@ -1423,9 +1435,9 @@ func buildHTTPListener(t interface{}, s interface{}) string { addrV4 = tc.Cfg.BindAddressIpv4 } - co := commonListenOptions(tc, hostname) + co := commonListenOptions(&tc, hostname) - out = append(out, httpListener(addrV4, co, tc)...) + out = append(out, httpListener(addrV4, co, &tc)...) if !tc.IsIPV6Enabled { return strings.Join(out, "\n") @@ -1436,12 +1448,12 @@ func buildHTTPListener(t interface{}, s interface{}) string { addrV6 = tc.Cfg.BindAddressIpv6 } - out = append(out, httpListener(addrV6, co, tc)...) + out = append(out, httpListener(addrV6, co, &tc)...) return strings.Join(out, "\n") } -func buildHTTPSListener(t interface{}, s interface{}) string { +func buildHTTPSListener(t, s interface{}) string { var out []string tc, ok := t.(config.TemplateConfig) @@ -1456,14 +1468,14 @@ func buildHTTPSListener(t interface{}, s interface{}) string { return "" } - co := commonListenOptions(tc, hostname) + co := commonListenOptions(&tc, hostname) addrV4 := []string{""} if len(tc.Cfg.BindAddressIpv4) > 0 { addrV4 = tc.Cfg.BindAddressIpv4 } - out = append(out, httpsListener(addrV4, co, tc)...) + out = append(out, httpsListener(addrV4, co, &tc)...) if !tc.IsIPV6Enabled { return strings.Join(out, "\n") @@ -1474,12 +1486,12 @@ func buildHTTPSListener(t interface{}, s interface{}) string { addrV6 = tc.Cfg.BindAddressIpv6 } - out = append(out, httpsListener(addrV6, co, tc)...) + out = append(out, httpsListener(addrV6, co, &tc)...) return strings.Join(out, "\n") } -func commonListenOptions(template config.TemplateConfig, hostname string) string { +func commonListenOptions(template *config.TemplateConfig, hostname string) string { var out []string if template.Cfg.UseProxyProtocol { @@ -1503,7 +1515,7 @@ func commonListenOptions(template config.TemplateConfig, hostname string) string return strings.Join(out, " ") } -func httpListener(addresses []string, co string, tc config.TemplateConfig) []string { +func httpListener(addresses []string, co string, tc *config.TemplateConfig) []string { out := make([]string, 0) for _, address := range addresses { lo := []string{"listen"} @@ -1514,15 +1526,14 @@ func httpListener(addresses []string, co string, tc config.TemplateConfig) []str lo = append(lo, fmt.Sprintf("%v:%v", address, tc.ListenPorts.HTTP)) } - lo = append(lo, co) - lo = append(lo, ";") + lo = append(lo, co, ";") out = append(out, strings.Join(lo, " ")) } return out } -func httpsListener(addresses []string, co string, tc config.TemplateConfig) []string { +func httpsListener(addresses []string, co string, tc *config.TemplateConfig) []string { out := make([]string, 0) for _, address := range addresses { lo := []string{"listen"} @@ -1545,8 +1556,7 @@ func httpsListener(addresses []string, co string, tc config.TemplateConfig) []st } } - lo = append(lo, co) - lo = append(lo, "ssl") + lo = append(lo, co, "ssl") if tc.Cfg.UseHTTP2 { lo = append(lo, "http2") @@ -1559,7 +1569,7 @@ func httpsListener(addresses []string, co string, tc config.TemplateConfig) []st return out } -func buildOpentracingForLocation(isOTEnabled bool, isOTTrustSet bool, location *ingress.Location) string { +func buildOpentracingForLocation(isOTEnabled, isOTTrustSet bool, location *ingress.Location) string { isOTEnabledInLoc := location.Opentracing.Enabled isOTSetInLoc := location.Opentracing.Set @@ -1578,13 +1588,13 @@ func buildOpentracingForLocation(isOTEnabled bool, isOTTrustSet bool, location * if (!isOTTrustSet && !location.Opentracing.TrustSet) || (location.Opentracing.TrustSet && !location.Opentracing.TrustEnabled) { - opc = opc + "\nopentracing_trust_incoming_span off;" + opc += "\nopentracing_trust_incoming_span off;" } return opc } -func buildOpentelemetryForLocation(isOTEnabled bool, isOTTrustSet bool, location *ingress.Location) string { +func buildOpentelemetryForLocation(isOTEnabled, isOTTrustSet bool, location *ingress.Location) string { isOTEnabledInLoc := location.Opentelemetry.Enabled isOTSetInLoc := location.Opentelemetry.Set @@ -1602,14 +1612,14 @@ func buildOpentelemetryForLocation(isOTEnabled bool, isOTTrustSet bool, location } if location.Opentelemetry.OperationName != "" { - opc = opc + "\nopentelemetry_operation_name " + location.Opentelemetry.OperationName + ";" + opc += "\nopentelemetry_operation_name " + location.Opentelemetry.OperationName + ";" } if (!isOTTrustSet && !location.Opentelemetry.TrustSet) || (location.Opentelemetry.TrustSet && !location.Opentelemetry.TrustEnabled) { - opc = opc + "\nopentelemetry_trust_incoming_spans off;" + opc += "\nopentelemetry_trust_incoming_spans off;" } else { - opc = opc + "\nopentelemetry_trust_incoming_spans on;" + opc += "\nopentelemetry_trust_incoming_spans on;" } return opc } @@ -1617,7 +1627,7 @@ func buildOpentelemetryForLocation(isOTEnabled bool, isOTTrustSet bool, location // shouldLoadOpentracingModule determines whether or not the Opentracing module needs to be loaded. // First, it checks if `enable-opentracing` is set in the ConfigMap. If it is not, it iterates over all locations to // check if Opentracing is enabled by the annotation `nginx.ingress.kubernetes.io/enable-opentracing`. -func shouldLoadOpentracingModule(c interface{}, s interface{}) bool { +func shouldLoadOpentracingModule(c, s interface{}) bool { cfg, ok := c.(config.Configuration) if !ok { klog.Errorf("expected a 'config.Configuration' type but %T was returned", c) @@ -1647,7 +1657,7 @@ func shouldLoadOpentracingModule(c interface{}, s interface{}) bool { // shouldLoadOpentelemetryModule determines whether or not the Opentelemetry module needs to be loaded. // It checks if `enable-opentelemetry` is set in the ConfigMap. -func shouldLoadOpentelemetryModule(c interface{}, s interface{}) bool { +func shouldLoadOpentelemetryModule(c, s interface{}) bool { cfg, ok := c.(config.Configuration) if !ok { klog.Errorf("expected a 'config.Configuration' type but %T was returned", c) @@ -1674,6 +1684,7 @@ func shouldLoadOpentelemetryModule(c interface{}, s interface{}) bool { return false } +//nolint:gocritic // Ignore passing cfg by pointer error func buildModSecurityForLocation(cfg config.Configuration, location *ingress.Location) string { isMSEnabledInLoc := location.ModSecurity.Enable isMSEnableSetInLoc := location.ModSecurity.EnableSet @@ -1807,7 +1818,7 @@ func convertGoSliceIntoLuaTable(goSliceInterface interface{}, emptyStringAsNil b switch kind { case reflect.String: - if emptyStringAsNil && len(goSlice.Interface().(string)) == 0 { + if emptyStringAsNil && goSlice.Interface().(string) == "" { return "nil", nil } return fmt.Sprintf(`"%v"`, goSlice.Interface()), nil @@ -1840,17 +1851,17 @@ func buildCorsOriginRegex(corsOrigins []string) string { return "set $http_origin *;\nset $cors 'true';" } - var originsRegex string = "if ($http_origin ~* (" + originsRegex := "if ($http_origin ~* (" for i, origin := range corsOrigins { originTrimmed := strings.TrimSpace(origin) if len(originTrimmed) > 0 { builtOrigin := buildOriginRegex(originTrimmed) originsRegex += builtOrigin if i != len(corsOrigins)-1 { - originsRegex = originsRegex + "|" + originsRegex += "|" } } } - originsRegex = originsRegex + ")$ ) { set $cors 'true'; }" + originsRegex += ")$ ) { set $cors 'true'; }" return originsRegex } diff --git a/internal/ingress/controller/template/template_test.go b/internal/ingress/controller/template/template_test.go index a2c3b8299f..1109677112 100644 --- a/internal/ingress/controller/template/template_test.go +++ b/internal/ingress/controller/template/template_test.go @@ -48,9 +48,9 @@ import ( func init() { // the default value of nginx.TemplatePath assumes the template exists in // the root filesystem and not in the rootfs directory - path, err := filepath.Abs(filepath.Join("../../../../rootfs/", nginx.TemplatePath)) + absPath, err := filepath.Abs(filepath.Join("..", "..", "..", "..", "rootfs", nginx.TemplatePath)) if err == nil { - nginx.TemplatePath = path + nginx.TemplatePath = absPath } } @@ -63,7 +63,7 @@ var ( Target string Location string ProxyPass string - AutoHttpProxyPass string + AutoHTTPProxyPass string Sticky bool XForwardedPrefix string SecureBackend bool @@ -200,6 +200,12 @@ proxy_pass $scheme://upstream_balancer;`, } ) +const ( + defaultBackend = "upstream-name" + defaultHost = "example.com" + fooAuthHost = "foo.com/auth" +) + func getTestDataDir() (string, error) { pwd, err := os.Getwd() if err != nil { @@ -326,9 +332,6 @@ func TestBuildLocation(t *testing.T) { } func TestBuildProxyPass(t *testing.T) { - defaultBackend := "upstream-name" - defaultHost := "example.com" - for k, tc := range tmplFuncTestcases { loc := &ingress.Location{ Path: tc.Path, @@ -339,7 +342,7 @@ func TestBuildProxyPass(t *testing.T) { } if tc.SecureBackend { - loc.BackendProtocol = "HTTPS" + loc.BackendProtocol = httpsProtocol } backend := &ingress.Backend{ @@ -367,9 +370,6 @@ func TestBuildProxyPass(t *testing.T) { } func TestBuildProxyPassAutoHttp(t *testing.T) { - defaultBackend := "upstream-name" - defaultHost := "example.com" - for k, tc := range tmplFuncTestcases { loc := &ingress.Location{ Path: tc.Path, @@ -379,9 +379,9 @@ func TestBuildProxyPassAutoHttp(t *testing.T) { } if tc.SecureBackend { - loc.BackendProtocol = "HTTPS" + loc.BackendProtocol = httpsProtocol } else { - loc.BackendProtocol = "AUTO_HTTP" + loc.BackendProtocol = autoHTTPProtocol } backend := &ingress.Backend{ @@ -402,7 +402,7 @@ func TestBuildProxyPassAutoHttp(t *testing.T) { backends := []*ingress.Backend{backend} pp := buildProxyPass(defaultHost, backends, loc) - if !strings.EqualFold(tc.AutoHttpProxyPass, pp) { + if !strings.EqualFold(tc.AutoHTTPProxyPass, pp) { t.Errorf("%s: expected \n'%v'\nbut returned \n'%v'", k, tc.ProxyPass, pp) } } @@ -417,7 +417,7 @@ func TestBuildAuthLocation(t *testing.T) { t.Errorf("Expected '%v' but returned '%v'", expected, actual) } - authURL := "foo.com/auth" + authURL := fooAuthHost globalAuthURL := "foo.com/global-auth" loc := &ingress.Location{ @@ -428,7 +428,7 @@ func TestBuildAuthLocation(t *testing.T) { EnableGlobalAuth: true, } - encodedAuthURL := strings.Replace(base64.URLEncoding.EncodeToString([]byte(loc.Path)), "=", "", -1) + encodedAuthURL := strings.ReplaceAll(base64.URLEncoding.EncodeToString([]byte(loc.Path)), "=", "") externalAuthPath := fmt.Sprintf("/_external-auth-%v-default", encodedAuthURL) testCases := []struct { @@ -460,8 +460,7 @@ func TestBuildAuthLocation(t *testing.T) { } func TestShouldApplyGlobalAuth(t *testing.T) { - - authURL := "foo.com/auth" + authURL := fooAuthHost globalAuthURL := "foo.com/global-auth" loc := &ingress.Location{ @@ -579,12 +578,12 @@ func TestBuildAuthUpstreamName(t *testing.T) { loc := &ingress.Location{ ExternalAuth: authreq.Config{ - URL: "foo.com/auth", + URL: fooAuthHost, }, Path: "/cat", } - encodedAuthURL := strings.Replace(base64.URLEncoding.EncodeToString([]byte(loc.Path)), "=", "", -1) + encodedAuthURL := strings.ReplaceAll(base64.URLEncoding.EncodeToString([]byte(loc.Path)), "=", "") externalAuthPath := fmt.Sprintf("external-auth-%v-default", encodedAuthURL) testCases := []struct { @@ -606,7 +605,7 @@ func TestBuildAuthUpstreamName(t *testing.T) { } func TestShouldApplyAuthUpstream(t *testing.T) { - authURL := "foo.com/auth" + authURL := fooAuthHost loc := &ingress.Location{ ExternalAuth: authreq.Config{ @@ -702,7 +701,10 @@ func TestChangeHostPort(t *testing.T) { } func TestTemplateWithData(t *testing.T) { - pwd, _ := os.Getwd() + pwd, err := os.Getwd() + if err != nil { + t.Errorf("unexpected error: %v", err) + } f, err := os.Open(path.Join(pwd, "../../../../test/data/config.json")) if err != nil { t.Errorf("unexpected error reading json file: %v", err) @@ -727,7 +729,7 @@ func TestTemplateWithData(t *testing.T) { dat.Cfg.DefaultSSLCertificate = &ingress.SSLCert{} - rt, err := ngxTpl.Write(dat) + rt, err := ngxTpl.Write(&dat) if err != nil { t.Errorf("invalid NGINX template: %v", err) } @@ -746,7 +748,10 @@ func TestTemplateWithData(t *testing.T) { } func BenchmarkTemplateWithData(b *testing.B) { - pwd, _ := os.Getwd() + pwd, err := os.Getwd() + if err != nil { + b.Errorf("unexpected error: %v", err) + } f, err := os.Open(path.Join(pwd, "../../../../test/data/config.json")) if err != nil { b.Errorf("unexpected error reading json file: %v", err) @@ -767,7 +772,7 @@ func BenchmarkTemplateWithData(b *testing.B) { } for i := 0; i < b.N; i++ { - if _, err := ngxTpl.Write(dat); err != nil { + if _, err := ngxTpl.Write(&dat); err != nil { b.Errorf("unexpected error writing template: %v", err) } } @@ -1066,9 +1071,6 @@ func TestBuildUpstreamName(t *testing.T) { t.Errorf("Expected '%v' but returned '%v'", expected, actual) } - defaultBackend := "upstream-name" - defaultHost := "example.com" - for k, tc := range tmplFuncTestcases { loc := &ingress.Location{ Path: tc.Path, @@ -1079,7 +1081,7 @@ func TestBuildUpstreamName(t *testing.T) { } if tc.SecureBackend { - loc.BackendProtocol = "HTTPS" + loc.BackendProtocol = httpsProtocol } backend := &ingress.Backend{ @@ -1134,13 +1136,13 @@ func TestEscapeLiteralDollar(t *testing.T) { func TestOpentracingPropagateContext(t *testing.T) { tests := map[*ingress.Location]string{ - {BackendProtocol: "HTTP"}: "opentracing_propagate_context;", - {BackendProtocol: "HTTPS"}: "opentracing_propagate_context;", - {BackendProtocol: "AUTO_HTTP"}: "opentracing_propagate_context;", - {BackendProtocol: "GRPC"}: "opentracing_grpc_propagate_context;", - {BackendProtocol: "GRPCS"}: "opentracing_grpc_propagate_context;", - {BackendProtocol: "FCGI"}: "opentracing_propagate_context;", - nil: "", + {BackendProtocol: httpProtocol}: "opentracing_propagate_context;", + {BackendProtocol: httpsProtocol}: "opentracing_propagate_context;", + {BackendProtocol: autoHTTPProtocol}: "opentracing_propagate_context;", + {BackendProtocol: grpcProtocol}: "opentracing_grpc_propagate_context;", + {BackendProtocol: grpcsProtocol}: "opentracing_grpc_propagate_context;", + {BackendProtocol: fcgiProtocol}: "opentracing_propagate_context;", + nil: "", } for loc, expectedDirective := range tests { @@ -1153,13 +1155,13 @@ func TestOpentracingPropagateContext(t *testing.T) { func TestOpentelemetryPropagateContext(t *testing.T) { tests := map[*ingress.Location]string{ - {BackendProtocol: "HTTP"}: "opentelemetry_propagate;", - {BackendProtocol: "HTTPS"}: "opentelemetry_propagate;", - {BackendProtocol: "AUTO_HTTP"}: "opentelemetry_propagate;", - {BackendProtocol: "GRPC"}: "opentelemetry_propagate;", - {BackendProtocol: "GRPCS"}: "opentelemetry_propagate;", - {BackendProtocol: "FCGI"}: "opentelemetry_propagate;", - nil: "", + {BackendProtocol: httpProtocol}: "opentelemetry_propagate;", + {BackendProtocol: httpsProtocol}: "opentelemetry_propagate;", + {BackendProtocol: autoHTTPProtocol}: "opentelemetry_propagate;", + {BackendProtocol: grpcProtocol}: "opentelemetry_propagate;", + {BackendProtocol: grpcsProtocol}: "opentelemetry_propagate;", + {BackendProtocol: fcgiProtocol}: "opentelemetry_propagate;", + nil: "", } for loc, expectedDirective := range tests { @@ -1171,7 +1173,6 @@ func TestOpentelemetryPropagateContext(t *testing.T) { } func TestGetIngressInformation(t *testing.T) { - testcases := map[string]struct { Ingress interface{} Host string @@ -1625,7 +1626,7 @@ func TestProxySetHeader(t *testing.T) { { name: "gRPC backend", loc: &ingress.Location{ - BackendProtocol: "GRPC", + BackendProtocol: grpcProtocol, }, expected: "grpc_set_header", }, @@ -1716,7 +1717,6 @@ func TestBuildOpenTracing(t *testing.T) { if expected != actual { t.Errorf("Expected '%v' but returned '%v'", expected, actual) } - } func TestBuildOpenTelemetry(t *testing.T) { @@ -1777,6 +1777,7 @@ func TestEnforceRegexModifier(t *testing.T) { } } +//nolint:dupl // Ignore dupl errors for similar test case func TestShouldLoadModSecurityModule(t *testing.T) { // ### Invalid argument type tests ### // The first tests should return false. @@ -1877,6 +1878,7 @@ opentracing_trust_incoming_span off;` } } +//nolint:dupl // Ignore dupl errors for similar test case func TestShouldLoadOpentracingModule(t *testing.T) { // ### Invalid argument type tests ### // The first tests should return false. @@ -1978,6 +1980,7 @@ opentelemetry_trust_incoming_spans off;` } } +//nolint:dupl // Ignore dupl errors for similar test case func TestShouldLoadOpentelemetryModule(t *testing.T) { // ### Invalid argument type tests ### // The first tests should return false. @@ -2104,7 +2107,6 @@ func TestModSecurityForLocation(t *testing.T) { } func TestBuildServerName(t *testing.T) { - testCases := []struct { title string hostname string diff --git a/internal/ingress/controller/util.go b/internal/ingress/controller/util.go index 6562dd17cb..8851f323f7 100644 --- a/internal/ingress/controller/util.go +++ b/internal/ingress/controller/util.go @@ -135,11 +135,13 @@ func (nc NginxCommand) ExecCommand(args ...string) *exec.Cmd { cmdArgs = append(cmdArgs, "-c", cfgPath) cmdArgs = append(cmdArgs, args...) + //nolint:gosec // Ignore G204 error return exec.Command(nc.Binary, cmdArgs...) } // Test checks if config file is a syntax valid nginx configuration func (nc NginxCommand) Test(cfg string) ([]byte, error) { + //nolint:gosec // Ignore G204 error return exec.Command(nc.Binary, "-c", cfg, "-t").CombinedOutput() } diff --git a/internal/ingress/defaults/main.go b/internal/ingress/defaults/main.go index 8cd0e8ba5b..0526d443e6 100644 --- a/internal/ingress/defaults/main.go +++ b/internal/ingress/defaults/main.go @@ -100,7 +100,7 @@ type Backend struct { // Name server/s used to resolve names of upstream servers into IP addresses. // The file /etc/resolv.conf is used as DNS resolution configuration. - Resolver []net.IP + Resolver []net.IP `json:"Resolver"` // SkipAccessLogURLs sets a list of URLs that should not appear in the NGINX access log // This is useful with urls like `/health` or `health-check` that make "complex" reading the logs diff --git a/internal/ingress/errors/errors.go b/internal/ingress/errors/errors.go index e6f7fb52cf..d702183346 100644 --- a/internal/ingress/errors/errors.go +++ b/internal/ingress/errors/errors.go @@ -33,57 +33,57 @@ var ( // NewInvalidAnnotationConfiguration returns a new InvalidConfiguration error for use when // annotations are not correctly configured -func NewInvalidAnnotationConfiguration(name string, reason string) error { - return InvalidConfiguration{ +func NewInvalidAnnotationConfiguration(name, reason string) error { + return InvalidConfigurationError{ Name: fmt.Sprintf("the annotation %v does not contain a valid configuration: %v", name, reason), } } // NewInvalidAnnotationContent returns a new InvalidContent error func NewInvalidAnnotationContent(name string, val interface{}) error { - return InvalidContent{ + return InvalidContentError{ Name: fmt.Sprintf("the annotation %v does not contain a valid value (%v)", name, val), } } // NewLocationDenied returns a new LocationDenied error func NewLocationDenied(reason string) error { - return LocationDenied{ - Reason: fmt.Errorf("Location denied, reason: %v", reason), + return LocationDeniedError{ + Reason: fmt.Errorf("location denied, reason: %v", reason), } } -// InvalidConfiguration Error -type InvalidConfiguration struct { +// InvalidConfigurationError +type InvalidConfigurationError struct { Name string } -func (e InvalidConfiguration) Error() string { +func (e InvalidConfigurationError) Error() string { return e.Name } -// InvalidContent error -type InvalidContent struct { +// InvalidContentError +type InvalidContentError struct { Name string } -func (e InvalidContent) Error() string { +func (e InvalidContentError) Error() string { return e.Name } -// LocationDenied error -type LocationDenied struct { +// LocationDeniedError +type LocationDeniedError struct { Reason error } -func (e LocationDenied) Error() string { +func (e LocationDeniedError) Error() string { return e.Reason.Error() } // IsLocationDenied checks if the err is an error which // indicates a location should return HTTP code 503 func IsLocationDenied(e error) bool { - _, ok := e.(LocationDenied) + _, ok := e.(LocationDeniedError) return ok } @@ -96,7 +96,7 @@ func IsMissingAnnotations(e error) bool { // IsInvalidContent checks if the err is an error which // indicates an annotations value is not valid func IsInvalidContent(e error) bool { - _, ok := e.(InvalidContent) + _, ok := e.(InvalidContentError) return ok } diff --git a/internal/ingress/inspector/ingress_test.go b/internal/ingress/inspector/ingress_test.go index bfd9f6b93c..52ad8d4315 100644 --- a/internal/ingress/inspector/ingress_test.go +++ b/internal/ingress/inspector/ingress_test.go @@ -24,7 +24,6 @@ import ( ) func makeSimpleIngress(hostname string, paths ...string) *networking.Ingress { - newIngress := networking.Ingress{ ObjectMeta: v1.ObjectMeta{ Name: "test1", diff --git a/internal/ingress/inspector/inspector.go b/internal/ingress/inspector/inspector.go index 23b57e538f..b41e18d9ed 100644 --- a/internal/ingress/inspector/inspector.go +++ b/internal/ingress/inspector/inspector.go @@ -40,9 +40,7 @@ func DeepInspect(obj interface{}) error { } } -var ( - implSpecific = networking.PathTypeImplementationSpecific -) +var implSpecific = networking.PathTypeImplementationSpecific func ValidatePathType(ing *networking.Ingress) error { if ing == nil { diff --git a/internal/ingress/inspector/rules.go b/internal/ingress/inspector/rules.go index c9714e6806..8388efdd5b 100644 --- a/internal/ingress/inspector/rules.go +++ b/internal/ingress/inspector/rules.go @@ -34,7 +34,7 @@ var ( // the group [[:alnum:]\_\-\/]* says that any amount of characters (A-Za-z0-9), _, - and / // are accepted until the end of the line // Nothing else is accepted. - validPathType = regexp.MustCompile(`(?i)^/[[:alnum:]\_\-\/]*$`) + validPathType = regexp.MustCompile(`(?i)^/[[:alnum:]\_\-/]*$`) invalidRegex = []regexp.Regexp{} ) @@ -52,8 +52,8 @@ func init() { // CheckRegex receives a value/configuration and validates if it matches with one of the // forbidden regexes. func CheckRegex(value string) error { - for _, regex := range invalidRegex { - if regex.MatchString(value) { + for i := range invalidRegex { + if invalidRegex[i].MatchString(value) { return fmt.Errorf("invalid value found: %s", value) } } diff --git a/internal/ingress/inspector/rules_test.go b/internal/ingress/inspector/rules_test.go index 6ed6dbe87a..3945a3bd49 100644 --- a/internal/ingress/inspector/rules_test.go +++ b/internal/ingress/inspector/rules_test.go @@ -19,7 +19,6 @@ package inspector import "testing" func TestCheckRegex(t *testing.T) { - tests := []struct { name string value string diff --git a/internal/ingress/inspector/service.go b/internal/ingress/inspector/service.go index 27ed27a8c6..8be08490be 100644 --- a/internal/ingress/inspector/service.go +++ b/internal/ingress/inspector/service.go @@ -21,6 +21,6 @@ import ( ) // InspectService will be used to inspect service objects for possible invalid configurations -func InspectService(svc *corev1.Service) error { +func InspectService(_ *corev1.Service) error { return nil } diff --git a/internal/ingress/metric/collectors/admission.go b/internal/ingress/metric/collectors/admission.go index cf42fbaa13..7b84325c0a 100644 --- a/internal/ingress/metric/collectors/admission.go +++ b/internal/ingress/metric/collectors/admission.go @@ -104,7 +104,7 @@ func NewAdmissionCollector(pod, namespace, class string) *AdmissionCollector { } // Describe implements prometheus.Collector -func (am AdmissionCollector) Describe(ch chan<- *prometheus.Desc) { +func (am *AdmissionCollector) Describe(ch chan<- *prometheus.Desc) { am.testedIngressLength.Describe(ch) am.testedIngressTime.Describe(ch) am.renderingIngressLength.Describe(ch) @@ -114,7 +114,7 @@ func (am AdmissionCollector) Describe(ch chan<- *prometheus.Desc) { } // Collect implements the prometheus.Collector interface. -func (am AdmissionCollector) Collect(ch chan<- prometheus.Metric) { +func (am *AdmissionCollector) Collect(ch chan<- prometheus.Metric) { am.testedIngressLength.Collect(ch) am.testedIngressTime.Collect(ch) am.renderingIngressLength.Collect(ch) @@ -139,7 +139,7 @@ func ByteFormat(bytes int64) string { } // SetAdmissionMetrics sets the values for AdmissionMetrics that can be called externally -func (am *AdmissionCollector) SetAdmissionMetrics(testedIngressLength float64, testedIngressTime float64, renderingIngressLength float64, renderingIngressTime float64, testedConfigurationSize float64, admissionTime float64) { +func (am *AdmissionCollector) SetAdmissionMetrics(testedIngressLength, testedIngressTime, renderingIngressLength, renderingIngressTime, testedConfigurationSize, admissionTime float64) { am.testedIngressLength.Set(testedIngressLength) am.testedIngressTime.Set(testedIngressTime) am.renderingIngressLength.Set(renderingIngressLength) diff --git a/internal/ingress/metric/collectors/controller.go b/internal/ingress/metric/collectors/controller.go index 3a65a1a993..e1d6789bbf 100644 --- a/internal/ingress/metric/collectors/controller.go +++ b/internal/ingress/metric/collectors/controller.go @@ -226,7 +226,7 @@ func (cm *Controller) IncCheckErrorCount(namespace, name string) { } // IncOrphanIngress sets the the orphaned ingress gauge to one -func (cm *Controller) IncOrphanIngress(namespace string, name string, orphanityType string) { +func (cm *Controller) IncOrphanIngress(namespace, name, orphanityType string) { labels := prometheus.Labels{ "namespace": namespace, "ingress": name, @@ -236,7 +236,7 @@ func (cm *Controller) IncOrphanIngress(namespace string, name string, orphanityT } // DecOrphanIngress sets the the orphaned ingress gauge to zero (all services has their endpoints) -func (cm *Controller) DecOrphanIngress(namespace string, name string, orphanityType string) { +func (cm *Controller) DecOrphanIngress(namespace, name, orphanityType string) { labels := prometheus.Labels{ "namespace": namespace, "ingress": name, @@ -261,7 +261,7 @@ func (cm *Controller) ConfigSuccess(hash uint64, success bool) { } // Describe implements prometheus.Collector -func (cm Controller) Describe(ch chan<- *prometheus.Desc) { +func (cm *Controller) Describe(ch chan<- *prometheus.Desc) { cm.configHash.Describe(ch) cm.configSuccess.Describe(ch) cm.configSuccessTime.Describe(ch) @@ -277,7 +277,7 @@ func (cm Controller) Describe(ch chan<- *prometheus.Desc) { } // Collect implements the prometheus.Collector interface. -func (cm Controller) Collect(ch chan<- prometheus.Metric) { +func (cm *Controller) Collect(ch chan<- prometheus.Metric) { cm.configHash.Collect(ch) cm.configSuccess.Collect(ch) cm.configSuccessTime.Collect(ch) @@ -295,41 +295,45 @@ func (cm Controller) Collect(ch chan<- prometheus.Metric) { // SetSSLExpireTime sets the expiration time of SSL Certificates func (cm *Controller) SetSSLExpireTime(servers []*ingress.Server) { for _, s := range servers { - if s.Hostname != "" && s.SSLCert != nil && s.SSLCert.ExpireTime.Unix() > 0 { - labels := make(prometheus.Labels, len(cm.labels)+1) - for k, v := range cm.labels { - labels[k] = v - } - labels["host"] = s.Hostname - labels["secret_name"] = s.SSLCert.Name + if !(s.Hostname != "" && s.SSLCert != nil && s.SSLCert.ExpireTime.Unix() > 0) { + continue + } - cm.sslExpireTime.With(labels).Set(float64(s.SSLCert.ExpireTime.Unix())) + labels := make(prometheus.Labels, len(cm.labels)+1) + for k, v := range cm.labels { + labels[k] = v } + labels["host"] = s.Hostname + labels["secret_name"] = s.SSLCert.Name + + cm.sslExpireTime.With(labels).Set(float64(s.SSLCert.ExpireTime.Unix())) } } // SetSSLInfo creates a metric with all certificates informations func (cm *Controller) SetSSLInfo(servers []*ingress.Server) { for _, s := range servers { - if s.SSLCert != nil && s.SSLCert.Certificate != nil && s.SSLCert.Certificate.SerialNumber != nil { - labels := make(prometheus.Labels, len(cm.labels)+1) - for k, v := range cm.labels { - labels[k] = v - } - labels["identifier"] = s.SSLCert.Identifier() - labels["host"] = s.Hostname - labels["secret_name"] = s.SSLCert.Name - labels["namespace"] = s.SSLCert.Namespace - labels["issuer_common_name"] = s.SSLCert.Certificate.Issuer.CommonName - labels["issuer_organization"] = "" - if len(s.SSLCert.Certificate.Issuer.Organization) > 0 { - labels["issuer_organization"] = s.SSLCert.Certificate.Issuer.Organization[0] - } - labels["serial_number"] = s.SSLCert.Certificate.SerialNumber.String() - labels["public_key_algorithm"] = s.SSLCert.Certificate.PublicKeyAlgorithm.String() + if s.SSLCert == nil || s.SSLCert.Certificate == nil || s.SSLCert.Certificate.SerialNumber == nil { + continue + } - cm.sslInfo.With(labels).Set(1) + labels := make(prometheus.Labels, len(cm.labels)+1) + for k, v := range cm.labels { + labels[k] = v } + labels["identifier"] = s.SSLCert.Identifier() + labels["host"] = s.Hostname + labels["secret_name"] = s.SSLCert.Name + labels["namespace"] = s.SSLCert.Namespace + labels["issuer_common_name"] = s.SSLCert.Certificate.Issuer.CommonName + labels["issuer_organization"] = "" + if len(s.SSLCert.Certificate.Issuer.Organization) > 0 { + labels["issuer_organization"] = s.SSLCert.Certificate.Issuer.Organization[0] + } + labels["serial_number"] = s.SSLCert.Certificate.SerialNumber.String() + labels["public_key_algorithm"] = s.SSLCert.Certificate.PublicKeyAlgorithm.String() + + cm.sslInfo.With(labels).Set(1) } } diff --git a/internal/ingress/metric/collectors/controller_test.go b/internal/ingress/metric/collectors/controller_test.go index ef80bc96a9..15735df426 100644 --- a/internal/ingress/metric/collectors/controller_test.go +++ b/internal/ingress/metric/collectors/controller_test.go @@ -76,9 +76,12 @@ func TestControllerCounters(t *testing.T) { { name: "should set SSL certificates metrics", test: func(cm *Controller) { - t1, _ := time.Parse( + t1, err := time.Parse( time.RFC3339, "2012-11-01T22:08:41+00:00") + if err != nil { + t.Errorf("unexpected error: %v", err) + } servers := []*ingress.Server{ { @@ -106,7 +109,6 @@ func TestControllerCounters(t *testing.T) { { name: "should set SSL certificates infos metrics", test: func(cm *Controller) { - servers := []*ingress.Server{ { Hostname: "demo", @@ -143,7 +145,6 @@ func TestControllerCounters(t *testing.T) { { name: "should ignore certificates without serial number", test: func(cm *Controller) { - servers := []*ingress.Server{ { Hostname: "demo", @@ -168,7 +169,6 @@ func TestControllerCounters(t *testing.T) { { name: "should ignore certificates with nil x509 pointer", test: func(cm *Controller) { - servers := []*ingress.Server{ { Hostname: "demo", @@ -193,7 +193,6 @@ func TestControllerCounters(t *testing.T) { { name: "should ignore servers without certificates", test: func(cm *Controller) { - servers := []*ingress.Server{ { Hostname: "demo", @@ -232,9 +231,12 @@ func TestRemoveMetrics(t *testing.T) { t.Errorf("registering collector failed: %s", err) } - t1, _ := time.Parse( + t1, err := time.Parse( time.RFC3339, "2012-11-01T22:08:41+00:00") + if err != nil { + t.Errorf("Unexpected error: %v", err) + } servers := []*ingress.Server{ { @@ -279,10 +281,12 @@ func TestRemoveAllSSLMetrics(t *testing.T) { t.Errorf("registering collector failed: %s", err) } - t1, _ := time.Parse( + t1, err := time.Parse( time.RFC3339, "2012-11-01T22:08:41+00:00") - + if err != nil { + t.Errorf("unexpected error: %v", err) + } servers := []*ingress.Server{ { Hostname: "demo", diff --git a/internal/ingress/metric/collectors/nginx_status.go b/internal/ingress/metric/collectors/nginx_status.go index 5aaa787de7..f3afdc334d 100644 --- a/internal/ingress/metric/collectors/nginx_status.go +++ b/internal/ingress/metric/collectors/nginx_status.go @@ -75,7 +75,6 @@ type NGINXStatusCollector interface { // NewNGINXStatus returns a new prometheus collector the default nginx status module func NewNGINXStatus(podName, namespace, ingressClass string) (NGINXStatusCollector, error) { - p := nginxStatusCollector{ scrapeChan: make(chan scrapeRequest), } diff --git a/internal/ingress/metric/collectors/nginx_status_test.go b/internal/ingress/metric/collectors/nginx_status_test.go index 4dc67c4252..ec535745d4 100644 --- a/internal/ingress/metric/collectors/nginx_status_test.go +++ b/internal/ingress/metric/collectors/nginx_status_test.go @@ -106,7 +106,7 @@ func TestStatusCollector(t *testing.T) { server := &httptest.Server{ Listener: listener, - Config: &http.Server{Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + Config: &http.Server{Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { //nolint:gosec // Ignore the gosec error in testing w.WriteHeader(http.StatusOK) if r.URL.Path == "/nginx_status" { diff --git a/internal/ingress/metric/collectors/process.go b/internal/ingress/metric/collectors/process.go index 23f533876a..3803a47aef 100644 --- a/internal/ingress/metric/collectors/process.go +++ b/internal/ingress/metric/collectors/process.go @@ -53,6 +53,8 @@ type BinaryNameMatcher struct { // MatchAndName returns false if the match failed, otherwise // true and the resulting name. +// +//nolint:gocritic // nacl param cannot be a pointer since it's to implement common.MatchNamer interface func (em BinaryNameMatcher) MatchAndName(nacl common.ProcAttributes) (bool, string) { if len(nacl.Cmdline) == 0 { return false, "" @@ -94,8 +96,10 @@ type NGINXProcessCollector interface { Stop() } -var name = "nginx" -var binary = "/usr/bin/nginx" +var ( + name = "nginx" + binary = "/usr/bin/nginx" +) // NewNGINXProcess returns a new prometheus collector for the nginx process func NewNGINXProcess(pod, namespace, ingressClass string) (NGINXProcessCollector, error) { @@ -106,7 +110,7 @@ func NewNGINXProcess(pod, namespace, ingressClass string) (NGINXProcessCollector nm := newBinaryNameMatcher(name, binary) - p := namedProcess{ + p := &namedProcess{ scrapeChan: make(chan scrapeRequest), Grouper: proc.NewGrouper(nm, true, false, false, false), fs: fs, @@ -164,7 +168,7 @@ func NewNGINXProcess(pod, namespace, ingressClass string) (NGINXProcessCollector } // Describe implements prometheus.Collector. -func (p namedProcess) Describe(ch chan<- *prometheus.Desc) { +func (p *namedProcess) Describe(ch chan<- *prometheus.Desc) { ch <- p.data.cpuSecs ch <- p.data.numProcs ch <- p.data.readBytes @@ -175,13 +179,13 @@ func (p namedProcess) Describe(ch chan<- *prometheus.Desc) { } // Collect implements prometheus.Collector. -func (p namedProcess) Collect(ch chan<- prometheus.Metric) { +func (p *namedProcess) Collect(ch chan<- prometheus.Metric) { req := scrapeRequest{results: ch, done: make(chan struct{})} p.scrapeChan <- req <-req.done } -func (p namedProcess) Start() { +func (p *namedProcess) Start() { for req := range p.scrapeChan { ch := req.results p.scrape(ch) @@ -189,18 +193,19 @@ func (p namedProcess) Start() { } } -func (p namedProcess) Stop() { +func (p *namedProcess) Stop() { close(p.scrapeChan) } -func (p namedProcess) scrape(ch chan<- prometheus.Metric) { +func (p *namedProcess) scrape(ch chan<- prometheus.Metric) { _, groups, err := p.Update(p.fs.AllProcs()) if err != nil { klog.Warningf("unexpected error obtaining nginx process info: %v", err) return } - for _, gcounts := range groups { + for i := range groups { + gcounts := groups[i] ch <- prometheus.MustNewConstMetric(p.data.numProcs, prometheus.GaugeValue, float64(gcounts.Procs)) ch <- prometheus.MustNewConstMetric(p.data.memResidentbytes, diff --git a/internal/ingress/metric/collectors/process_test.go b/internal/ingress/metric/collectors/process_test.go index b21d954967..588cbafef2 100644 --- a/internal/ingress/metric/collectors/process_test.go +++ b/internal/ingress/metric/collectors/process_test.go @@ -48,8 +48,11 @@ func TestProcessCollector(t *testing.T) { done := make(chan struct{}) go func() { - cmd.Wait() //nolint:errcheck - status := cmd.ProcessState.Sys().(syscall.WaitStatus) + cmd.Wait() //nolint:errcheck // Ignore the error + status, ok := cmd.ProcessState.Sys().(syscall.WaitStatus) + if !ok { + t.Errorf("unexpected type: %T", cmd.ProcessState.Sys()) + } if status.Signaled() { t.Logf("Signal: %v", status.Signal()) } else { @@ -69,7 +72,7 @@ func TestProcessCollector(t *testing.T) { defer func() { cm.Stop() - cmd.Process.Kill() //nolint:errcheck + cmd.Process.Kill() //nolint:errcheck // Ignore the error <-done close(done) }() diff --git a/internal/ingress/metric/collectors/socket.go b/internal/ingress/metric/collectors/socket.go index 508cc6bc86..a70024c57d 100644 --- a/internal/ingress/metric/collectors/socket.go +++ b/internal/ingress/metric/collectors/socket.go @@ -44,14 +44,11 @@ type socketData struct { Latency float64 `json:"upstreamLatency"` HeaderTime float64 `json:"upstreamHeaderTime"` ResponseTime float64 `json:"upstreamResponseTime"` - //ResponseLength float64 `json:"upstreamResponseLength"` - //Status string `json:"upstreamStatus"` - - Namespace string `json:"namespace"` - Ingress string `json:"ingress"` - Service string `json:"service"` - Canary string `json:"canary"` - Path string `json:"path"` + Namespace string `json:"namespace"` + Ingress string `json:"ingress"` + Service string `json:"service"` + Canary string `json:"canary"` + Path string `json:"path"` } // HistogramBuckets allow customizing prometheus histogram buckets values @@ -89,19 +86,17 @@ type SocketCollector struct { reportStatusClasses bool } -var ( - requestTags = []string{ - "status", +var requestTags = []string{ + "status", - "method", - "path", + "method", + "path", - "namespace", - "ingress", - "service", - "canary", - } -) + "namespace", + "ingress", + "service", + "canary", +} // DefObjectives was removed in https://github.com/prometheus/client_golang/pull/262 // updating the library to latest version changed the output of the metrics @@ -112,6 +107,7 @@ var defObjectives = map[float64]float64{0.5: 0.05, 0.9: 0.01, 0.99: 0.001} func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStatusClasses bool, buckets HistogramBuckets, excludeMetrics []string) (*SocketCollector, error) { socket := "/tmp/nginx/prometheus-nginx.socket" // unix sockets must be unlink()ed before being used + //nolint:errcheck // Ignore unlink error _ = syscall.Unlink(socket) listener, err := net.Listen("unix", socket) @@ -119,7 +115,7 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat return nil, err } - err = os.Chmod(socket, 0777) // #nosec + err = os.Chmod(socket, 0o777) // #nosec if err != nil { return nil, err } @@ -152,7 +148,7 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat reportStatusClasses: reportStatusClasses, connectTime: histogramMetric( - prometheus.HistogramOpts{ + &prometheus.HistogramOpts{ Name: "connect_duration_seconds", Help: "The time spent on establishing a connection with the upstream server", Namespace: PrometheusNamespace, @@ -165,7 +161,7 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat ), headerTime: histogramMetric( - prometheus.HistogramOpts{ + &prometheus.HistogramOpts{ Name: "header_duration_seconds", Help: "The time spent on receiving first header from the upstream server", Namespace: PrometheusNamespace, @@ -177,7 +173,7 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat mm, ), responseTime: histogramMetric( - prometheus.HistogramOpts{ + &prometheus.HistogramOpts{ Name: "response_duration_seconds", Help: "The time spent on receiving the response from the upstream server", Namespace: PrometheusNamespace, @@ -190,7 +186,7 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat ), requestTime: histogramMetric( - prometheus.HistogramOpts{ + &prometheus.HistogramOpts{ Name: "request_duration_seconds", Help: "The request processing time in milliseconds", Namespace: PrometheusNamespace, @@ -203,7 +199,7 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat ), responseLength: histogramMetric( - prometheus.HistogramOpts{ + &prometheus.HistogramOpts{ Name: "response_size", Help: "The response length (including request line, header, and request body)", Namespace: PrometheusNamespace, @@ -216,7 +212,7 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat ), requestLength: histogramMetric( - prometheus.HistogramOpts{ + &prometheus.HistogramOpts{ Name: "request_size", Help: "The request length (including request line, header, and request body)", Namespace: PrometheusNamespace, @@ -229,7 +225,7 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat ), requests: counterMetric( - prometheus.CounterOpts{ + &prometheus.CounterOpts{ Name: "requests", Help: "The total number of client requests", Namespace: PrometheusNamespace, @@ -241,7 +237,7 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat ), bytesSent: histogramMetric( - prometheus.HistogramOpts{ + &prometheus.HistogramOpts{ Name: "bytes_sent", Help: "DEPRECATED The number of bytes sent to a client", Namespace: PrometheusNamespace, @@ -254,7 +250,7 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat ), upstreamLatency: summaryMetric( - prometheus.SummaryOpts{ + &prometheus.SummaryOpts{ Name: "ingress_upstream_latency_seconds", Help: "DEPRECATED Upstream service latency per Ingress", Namespace: PrometheusNamespace, @@ -279,36 +275,36 @@ func containsMetric(excludeMetrics map[string]struct{}, name string) bool { return false } -func summaryMetric(opts prometheus.SummaryOpts, requestTags []string, excludeMetrics map[string]struct{}, metricMapping metricMapping) *prometheus.SummaryVec { +func summaryMetric(opts *prometheus.SummaryOpts, requestTags []string, excludeMetrics map[string]struct{}, metricMapping metricMapping) *prometheus.SummaryVec { if containsMetric(excludeMetrics, opts.Name) { return nil } m := prometheus.NewSummaryVec( - opts, + *opts, requestTags, ) metricMapping[prometheus.BuildFQName(PrometheusNamespace, "", opts.Name)] = m return m } -func counterMetric(opts prometheus.CounterOpts, requestTags []string, excludeMetrics map[string]struct{}, metricMapping metricMapping) *prometheus.CounterVec { +func counterMetric(opts *prometheus.CounterOpts, requestTags []string, excludeMetrics map[string]struct{}, metricMapping metricMapping) *prometheus.CounterVec { if containsMetric(excludeMetrics, opts.Name) { return nil } m := prometheus.NewCounterVec( - opts, + *opts, requestTags, ) metricMapping[prometheus.BuildFQName(PrometheusNamespace, "", opts.Name)] = m return m } -func histogramMetric(opts prometheus.HistogramOpts, requestTags []string, excludeMetrics map[string]struct{}, metricMapping metricMapping) *prometheus.HistogramVec { +func histogramMetric(opts *prometheus.HistogramOpts, requestTags []string, excludeMetrics map[string]struct{}, metricMapping metricMapping) *prometheus.HistogramVec { if containsMetric(excludeMetrics, opts.Name) { return nil } m := prometheus.NewHistogramVec( - opts, + *opts, requestTags, ) metricMapping[prometheus.BuildFQName(PrometheusNamespace, "", opts.Name)] = m @@ -326,7 +322,8 @@ func (sc *SocketCollector) handleMessage(msg []byte) { return } - for _, stats := range statsBatch { + for i := range statsBatch { + stats := &statsBatch[i] if sc.metricsPerHost && !sc.hosts.Has(stats.Host) { klog.V(3).InfoS("Skipping metric for host not being served", "host", stats.Host) continue @@ -543,14 +540,14 @@ func (sc *SocketCollector) RemoveMetrics(ingresses []string, registry prometheus } // Describe implements prometheus.Collector -func (sc SocketCollector) Describe(ch chan<- *prometheus.Desc) { +func (sc *SocketCollector) Describe(ch chan<- *prometheus.Desc) { for _, metric := range sc.metricMapping { metric.Describe(ch) } } // Collect implements the prometheus.Collector interface. -func (sc SocketCollector) Collect(ch chan<- prometheus.Metric) { +func (sc *SocketCollector) Collect(ch chan<- prometheus.Metric) { for _, metric := range sc.metricMapping { metric.Collect(ch) } diff --git a/internal/ingress/metric/collectors/socket_test.go b/internal/ingress/metric/collectors/socket_test.go index 6000f2685b..71e9097c94 100644 --- a/internal/ingress/metric/collectors/socket_test.go +++ b/internal/ingress/metric/collectors/socket_test.go @@ -30,6 +30,7 @@ import ( func TestNewUDPLogListener(t *testing.T) { var count uint64 + //nolint:unparam // Unused `message` param is required by the handleMessages function fn := func(message []byte) { atomic.AddUint64(&count, 1) } @@ -57,7 +58,10 @@ func TestNewUDPLogListener(t *testing.T) { } }() - conn, _ := net.Dial("unix", tmpFile) + conn, err := net.Dial("unix", tmpFile) + if err != nil { + t.Errorf("unexpected error connecting to unix socket: %v", err) + } if _, err := conn.Write([]byte("message")); err != nil { t.Errorf("unexpected error writing to unix socket: %v", err) } @@ -70,7 +74,6 @@ func TestNewUDPLogListener(t *testing.T) { } func TestCollector(t *testing.T) { - buckets := struct { TimeBuckets []float64 LengthBuckets []float64 diff --git a/internal/ingress/metric/collectors/testutils.go b/internal/ingress/metric/collectors/testutils.go index 8c5c27b627..669e89e171 100644 --- a/internal/ingress/metric/collectors/testutils.go +++ b/internal/ingress/metric/collectors/testutils.go @@ -31,7 +31,7 @@ import ( // GatherAndCompare retrieves all metrics exposed by a collector and compares it // to an expected output in the Prometheus text exposition format. // metricNames allows only comparing the given metrics. All are compared if it's nil. -func GatherAndCompare(c prometheus.Collector, expected string, metricNames []string, reg prometheus.Gatherer) error { +func GatherAndCompare(_ prometheus.Collector, expected string, metricNames []string, reg prometheus.Gatherer) error { expected = removeUnusedWhitespace(expected) metrics, err := reg.Gather() @@ -77,9 +77,7 @@ metric output does not match expectation; want: got: -'%s' - -`, buf2.String(), buf1.String()) +'%s'`, buf2.String(), buf1.String()) } return nil } diff --git a/internal/ingress/metric/dummy.go b/internal/ingress/metric/dummy.go index d8ae0155a2..a619ccbd81 100644 --- a/internal/ingress/metric/dummy.go +++ b/internal/ingress/metric/dummy.go @@ -29,50 +29,50 @@ func NewDummyCollector() Collector { // DummyCollector dummy implementation for mocks in tests type DummyCollector struct{} -// ConfigSuccess ... +// ConfigSuccess dummy implementation func (dc DummyCollector) ConfigSuccess(uint64, bool) {} -// SetAdmissionMetrics ... +// SetAdmissionMetrics dummy implementation func (dc DummyCollector) SetAdmissionMetrics(float64, float64, float64, float64, float64, float64) {} -// IncReloadCount ... +// IncReloadCount dummy implementation func (dc DummyCollector) IncReloadCount() {} -// IncReloadErrorCount ... +// IncReloadErrorCount dummy implementation func (dc DummyCollector) IncReloadErrorCount() {} -// IncOrphanIngress ... +// IncOrphanIngress dummy implementation func (dc DummyCollector) IncOrphanIngress(string, string, string) {} -// DecOrphanIngress ... +// DecOrphanIngress dummy implementation func (dc DummyCollector) DecOrphanIngress(string, string, string) {} -// IncCheckCount ... +// IncCheckCount dummy implementation func (dc DummyCollector) IncCheckCount(string, string) {} -// IncCheckErrorCount ... +// IncCheckErrorCount dummy implementation func (dc DummyCollector) IncCheckErrorCount(string, string) {} -// RemoveMetrics ... -func (dc DummyCollector) RemoveMetrics(ingresses, endpoints, certificates []string) {} +// RemoveMetrics dummy implementation +func (dc DummyCollector) RemoveMetrics(_, _, _ []string) {} -// Start ... -func (dc DummyCollector) Start(admissionStatus string) {} +// Start dummy implementation +func (dc DummyCollector) Start(_ string) {} -// Stop ... -func (dc DummyCollector) Stop(admissionStatus string) {} +// Stop dummy implementation +func (dc DummyCollector) Stop(_ string) {} -// SetSSLInfo ... +// SetSSLInfo dummy implementation func (dc DummyCollector) SetSSLInfo([]*ingress.Server) {} -// SetSSLExpireTime ... +// SetSSLExpireTime dummy implementation func (dc DummyCollector) SetSSLExpireTime([]*ingress.Server) {} -// SetHosts ... -func (dc DummyCollector) SetHosts(hosts sets.Set[string]) {} +// SetHosts dummy implementation +func (dc DummyCollector) SetHosts(_ sets.Set[string]) {} // OnStartedLeading indicates the pod is not the current leader -func (dc DummyCollector) OnStartedLeading(electionID string) {} +func (dc DummyCollector) OnStartedLeading(_ string) {} // OnStoppedLeading indicates the pod is not the current leader -func (dc DummyCollector) OnStoppedLeading(electionID string) {} +func (dc DummyCollector) OnStoppedLeading(_ string) {} diff --git a/internal/ingress/metric/main.go b/internal/ingress/metric/main.go index b2f721f626..aa35a5c517 100644 --- a/internal/ingress/metric/main.go +++ b/internal/ingress/metric/main.go @@ -115,11 +115,11 @@ func (c *collector) ConfigSuccess(hash uint64, success bool) { c.ingressController.ConfigSuccess(hash, success) } -func (c *collector) IncCheckCount(namespace string, name string) { +func (c *collector) IncCheckCount(namespace, name string) { c.ingressController.IncCheckCount(namespace, name) } -func (c *collector) IncCheckErrorCount(namespace string, name string) { +func (c *collector) IncCheckErrorCount(namespace, name string) { c.ingressController.IncCheckErrorCount(namespace, name) } @@ -183,11 +183,11 @@ func (c *collector) SetSSLInfo(servers []*ingress.Server) { c.ingressController.SetSSLInfo(servers) } -func (c *collector) IncOrphanIngress(namespace string, name string, orphanityType string) { +func (c *collector) IncOrphanIngress(namespace, name, orphanityType string) { c.ingressController.IncOrphanIngress(namespace, name, orphanityType) } -func (c *collector) DecOrphanIngress(namespace string, name string, orphanityType string) { +func (c *collector) DecOrphanIngress(namespace, name, orphanityType string) { c.ingressController.DecOrphanIngress(namespace, name, orphanityType) } @@ -195,7 +195,7 @@ func (c *collector) SetHosts(hosts sets.Set[string]) { c.socket.SetHosts(hosts) } -func (c *collector) SetAdmissionMetrics(testedIngressLength float64, testedIngressTime float64, renderingIngressLength float64, renderingIngressTime float64, testedConfigurationSize float64, admissionTime float64) { +func (c *collector) SetAdmissionMetrics(testedIngressLength, testedIngressTime, renderingIngressLength, renderingIngressTime, testedConfigurationSize, admissionTime float64) { c.admissionController.SetAdmissionMetrics( testedIngressLength, testedIngressTime, @@ -219,9 +219,7 @@ func (c *collector) OnStoppedLeading(electionID string) { c.ingressController.RemoveAllSSLMetrics(c.registry) } -var ( - currentLeader uint32 -) +var currentLeader uint32 func setLeader(leader bool) { var i uint32 diff --git a/internal/ingress/status/status.go b/internal/ingress/status/status.go index 62b88da167..81fb9044a4 100644 --- a/internal/ingress/status/status.go +++ b/internal/ingress/status/status.go @@ -44,7 +44,7 @@ import ( // which the status should check if an update is required. var UpdateInterval = 60 -// Syncer ... +// Syncer is an interface that implements syncer type Syncer interface { Run(chan struct{}) @@ -56,7 +56,7 @@ type ingressLister interface { ListIngresses() []*ingress.Ingress } -// Config ... +// Config is a structure that implements Client interfaces type Config struct { Client clientset.Interface @@ -87,7 +87,7 @@ type statusSync struct { } // Start starts the loop to keep the status in sync -func (s statusSync) Run(stopCh chan struct{}) { +func (s *statusSync) Run(stopCh chan struct{}) { go s.syncQueue.Run(time.Second, stopCh) // trigger initial sync @@ -95,6 +95,7 @@ func (s statusSync) Run(stopCh chan struct{}) { // when this instance is the leader we need to enqueue // an item to trigger the update of the Ingress status. + //nolint:staticcheck // TODO: will replace it since wait.PollUntil is deprecated err := wait.PollUntil(time.Duration(UpdateInterval)*time.Second, func() (bool, error) { s.syncQueue.EnqueueTask(task.GetDummyObject("sync status")) return false, nil @@ -106,7 +107,7 @@ func (s statusSync) Run(stopCh chan struct{}) { // Shutdown stops the sync. In case the instance is the leader it will remove the current IP // if there is no other instances running. -func (s statusSync) Shutdown() { +func (s *statusSync) Shutdown() { go s.syncQueue.Shutdown() if !s.UpdateStatusOnShutdown { @@ -135,7 +136,7 @@ func (s statusSync) Shutdown() { s.updateStatus([]v1.IngressLoadBalancerIngress{}) } -func (s *statusSync) sync(key interface{}) error { +func (s *statusSync) sync(_ interface{}) error { if s.syncQueue.IsShuttingDown() { klog.V(2).InfoS("skipping Ingress status update (shutting down in progress)") return nil @@ -150,13 +151,13 @@ func (s *statusSync) sync(key interface{}) error { return nil } -func (s statusSync) keyfunc(input interface{}) (interface{}, error) { +func (s *statusSync) keyfunc(input interface{}) (interface{}, error) { return input, nil } // NewStatusSyncer returns a new Syncer instance func NewStatusSyncer(config Config) Syncer { - st := statusSync{ + st := &statusSync{ Config: config, } st.syncQueue = task.NewCustomTaskQueue(st.sync, st.keyfunc) @@ -229,7 +230,6 @@ func (s *statusSync) runningAddresses() ([]v1.IngressLoadBalancerIngress, error) } func (s *statusSync) isRunningMultiplePods() bool { - // As a standard, app.kubernetes.io are "reserved well-known" labels. // In our case, we add those labels as identifiers of the Ingress // deployment in this namespace, so we can select it as a set of Ingress instances. @@ -288,7 +288,8 @@ func (s *statusSync) updateStatus(newIngressPoint []v1.IngressLoadBalancerIngres } func runUpdate(ing *ingress.Ingress, status []v1.IngressLoadBalancerIngress, - client clientset.Interface) pool.WorkFunc { + client clientset.Interface, +) pool.WorkFunc { return func(wu pool.WorkUnit) (interface{}, error) { if wu.IsCancelled() { return nil, nil @@ -341,7 +342,10 @@ func ingressSliceEqual(lhs, rhs []v1.IngressLoadBalancerIngress) bool { } func statusAddressFromService(service string, kubeClient clientset.Interface) ([]v1.IngressLoadBalancerIngress, error) { - ns, name, _ := k8s.ParseNameNS(service) + ns, name, err := k8s.ParseNameNS(service) + if err != nil { + return nil, err + } svc, err := kubeClient.CoreV1().Services(ns).Get(context.TODO(), name, metav1.GetOptions{}) if err != nil { return nil, err @@ -362,15 +366,15 @@ func statusAddressFromService(service string, kubeClient clientset.Interface) ([ IP: svc.Spec.ClusterIP, }}, nil } - addrs := make([]v1.IngressLoadBalancerIngress, len(svc.Spec.ExternalIPs)) - for i, ip := range svc.Spec.ExternalIPs { - addrs[i] = v1.IngressLoadBalancerIngress{IP: ip} + addrs := make([]v1.IngressLoadBalancerIngress, 0, len(svc.Spec.ExternalIPs)) + for _, ip := range svc.Spec.ExternalIPs { + addrs = append(addrs, v1.IngressLoadBalancerIngress{IP: ip}) } return addrs, nil case apiv1.ServiceTypeLoadBalancer: - addrs := make([]v1.IngressLoadBalancerIngress, len(svc.Status.LoadBalancer.Ingress)) + addrs := make([]v1.IngressLoadBalancerIngress, 0, len(svc.Status.LoadBalancer.Ingress)) for i, ingress := range svc.Status.LoadBalancer.Ingress { - addrs[i] = v1.IngressLoadBalancerIngress{} + addrs = append(addrs, v1.IngressLoadBalancerIngress{}) if ingress.Hostname != "" { addrs[i].Hostname = ingress.Hostname } diff --git a/internal/ingress/status/status_test.go b/internal/ingress/status/status_test.go index ce6b6a0bf9..01419708b3 100644 --- a/internal/ingress/status/status_test.go +++ b/internal/ingress/status/status_test.go @@ -18,7 +18,6 @@ package status import ( "context" - "os" "reflect" "testing" "time" @@ -34,6 +33,8 @@ import ( "k8s.io/ingress-nginx/pkg/apis/ingress" ) +const localhost = "127.0.0.1" + func buildLoadBalancerIngressByIP() []networking.IngressLoadBalancerIngress { return []networking.IngressLoadBalancerIngress{ { @@ -126,17 +127,6 @@ func buildSimpleClientSet() *testclient.Clientset { // This is commented out as the ServiceStatus.LoadBalancer field expects a LoadBalancerStatus object // which is incompatible with the current Ingress struct which expects a IngressLoadBalancerStatus object // TODO: update this service when the ServiceStatus struct gets updated - //{ - // ObjectMeta: metav1.ObjectMeta{ - // Name: "foo", - // Namespace: apiv1.NamespaceDefault, - // }, - // Status: apiv1.ServiceStatus{ - // LoadBalancer: apiv1.LoadBalancerStatus{ - // Ingress: buildLoadBalancerIngressByIP(), - // }, - // }, - //}, { ObjectMeta: metav1.ObjectMeta{ Name: "foo_non_exist", @@ -185,7 +175,8 @@ func buildSimpleClientSet() *testclient.Clientset { Name: "ingress-controller-leader", Namespace: apiv1.NamespaceDefault, }, - }}}, + }, + }}, &networking.IngressList{Items: buildExtensionsIngresses()}, ) } @@ -245,30 +236,33 @@ func buildExtensionsIngresses() []networking.Ingress { } } -type testIngressLister struct { -} +type testIngressLister struct{} func (til *testIngressLister) ListIngresses() []*ingress.Ingress { var ingresses []*ingress.Ingress - ingresses = append(ingresses, &ingress.Ingress{ - Ingress: networking.Ingress{ - ObjectMeta: metav1.ObjectMeta{ - Name: "foo_ingress_non_01", - Namespace: apiv1.NamespaceDefault, - }}}) - - ingresses = append(ingresses, &ingress.Ingress{ - Ingress: networking.Ingress{ - ObjectMeta: metav1.ObjectMeta{ - Name: "foo_ingress_1", - Namespace: apiv1.NamespaceDefault, + ingresses = append(ingresses, + &ingress.Ingress{ + Ingress: networking.Ingress{ + ObjectMeta: metav1.ObjectMeta{ + Name: "foo_ingress_non_01", + Namespace: apiv1.NamespaceDefault, + }, }, - Status: networking.IngressStatus{ - LoadBalancer: networking.IngressLoadBalancerStatus{ - Ingress: buildLoadBalancerIngressByIP(), + }, + &ingress.Ingress{ + Ingress: networking.Ingress{ + ObjectMeta: metav1.ObjectMeta{ + Name: "foo_ingress_1", + Namespace: apiv1.NamespaceDefault, + }, + Status: networking.IngressStatus{ + LoadBalancer: networking.IngressLoadBalancerStatus{ + Ingress: buildLoadBalancerIngressByIP(), + }, }, }, - }}) + }, + ) return ingresses } @@ -290,8 +284,8 @@ func buildStatusSync() statusSync { func TestStatusActions(t *testing.T) { // make sure election can be created - os.Setenv("POD_NAME", "foo1") - os.Setenv("POD_NAMESPACE", apiv1.NamespaceDefault) + t.Setenv("POD_NAME", "foo1") + t.Setenv("POD_NAMESPACE", apiv1.NamespaceDefault) c := Config{ Client: buildSimpleClientSet(), PublishService: "", @@ -315,7 +309,10 @@ func TestStatusActions(t *testing.T) { t.Fatalf("expected a valid Sync") } - fk := fkSync.(statusSync) + fk, ok := fkSync.(*statusSync) + if !ok { + t.Errorf("unexpected type: %T", fkSync) + } // start it and wait for the election and syn actions stopCh := make(chan struct{}) @@ -366,7 +363,7 @@ func TestStatusActions(t *testing.T) { } } -func TestCallback(t *testing.T) { +func TestCallback(_ *testing.T) { buildStatusSync() } @@ -375,7 +372,6 @@ func TestKeyfunc(t *testing.T) { i := "foo_base_pod" r, err := fk.keyfunc(i) - if err != nil { t.Fatalf("unexpected error") } @@ -392,34 +388,36 @@ func TestRunningAddressesWithPublishService(t *testing.T) { }{ "service type ClusterIP": { testclient.NewSimpleClientset( - &apiv1.PodList{Items: []apiv1.Pod{ - { - ObjectMeta: metav1.ObjectMeta{ - Name: "foo", - Namespace: apiv1.NamespaceDefault, - }, - Spec: apiv1.PodSpec{ - NodeName: "foo_node", - }, - Status: apiv1.PodStatus{ - Phase: apiv1.PodRunning, + &apiv1.PodList{ + Items: []apiv1.Pod{ + { + ObjectMeta: metav1.ObjectMeta{ + Name: "foo", + Namespace: apiv1.NamespaceDefault, + }, + Spec: apiv1.PodSpec{ + NodeName: "foo_node", + }, + Status: apiv1.PodStatus{ + Phase: apiv1.PodRunning, + }, }, }, }, - }, - &apiv1.ServiceList{Items: []apiv1.Service{ - { - ObjectMeta: metav1.ObjectMeta{ - Name: "foo", - Namespace: apiv1.NamespaceDefault, - }, - Spec: apiv1.ServiceSpec{ - Type: apiv1.ServiceTypeClusterIP, - ClusterIP: "1.1.1.1", + &apiv1.ServiceList{ + Items: []apiv1.Service{ + { + ObjectMeta: metav1.ObjectMeta{ + Name: "foo", + Namespace: apiv1.NamespaceDefault, + }, + Spec: apiv1.ServiceSpec{ + Type: apiv1.ServiceTypeClusterIP, + ClusterIP: "1.1.1.1", + }, }, }, }, - }, ), []networking.IngressLoadBalancerIngress{ {IP: "1.1.1.1"}, @@ -428,19 +426,20 @@ func TestRunningAddressesWithPublishService(t *testing.T) { }, "service type NodePort": { testclient.NewSimpleClientset( - &apiv1.ServiceList{Items: []apiv1.Service{ - { - ObjectMeta: metav1.ObjectMeta{ - Name: "foo", - Namespace: apiv1.NamespaceDefault, - }, - Spec: apiv1.ServiceSpec{ - Type: apiv1.ServiceTypeNodePort, - ClusterIP: "1.1.1.1", + &apiv1.ServiceList{ + Items: []apiv1.Service{ + { + ObjectMeta: metav1.ObjectMeta{ + Name: "foo", + Namespace: apiv1.NamespaceDefault, + }, + Spec: apiv1.ServiceSpec{ + Type: apiv1.ServiceTypeNodePort, + ClusterIP: "1.1.1.1", + }, }, }, }, - }, ), []networking.IngressLoadBalancerIngress{ {IP: "1.1.1.1"}, @@ -449,19 +448,20 @@ func TestRunningAddressesWithPublishService(t *testing.T) { }, "service type ExternalName": { testclient.NewSimpleClientset( - &apiv1.ServiceList{Items: []apiv1.Service{ - { - ObjectMeta: metav1.ObjectMeta{ - Name: "foo", - Namespace: apiv1.NamespaceDefault, - }, - Spec: apiv1.ServiceSpec{ - Type: apiv1.ServiceTypeExternalName, - ExternalName: "foo.bar", + &apiv1.ServiceList{ + Items: []apiv1.Service{ + { + ObjectMeta: metav1.ObjectMeta{ + Name: "foo", + Namespace: apiv1.NamespaceDefault, + }, + Spec: apiv1.ServiceSpec{ + Type: apiv1.ServiceTypeExternalName, + ExternalName: "foo.bar", + }, }, }, }, - }, ), []networking.IngressLoadBalancerIngress{ {Hostname: "foo.bar"}, @@ -470,35 +470,36 @@ func TestRunningAddressesWithPublishService(t *testing.T) { }, "service type LoadBalancer": { testclient.NewSimpleClientset( - &apiv1.ServiceList{Items: []apiv1.Service{ - { - ObjectMeta: metav1.ObjectMeta{ - Name: "foo", - Namespace: apiv1.NamespaceDefault, - }, - Spec: apiv1.ServiceSpec{ - Type: apiv1.ServiceTypeLoadBalancer, - }, - Status: apiv1.ServiceStatus{ - LoadBalancer: apiv1.LoadBalancerStatus{ - Ingress: []apiv1.LoadBalancerIngress{ - { - IP: "10.0.0.1", - }, - { - IP: "", - Hostname: "foo", - }, - { - IP: "10.0.0.2", - Hostname: "10-0-0-2.cloudprovider.example.net", + &apiv1.ServiceList{ + Items: []apiv1.Service{ + { + ObjectMeta: metav1.ObjectMeta{ + Name: "foo", + Namespace: apiv1.NamespaceDefault, + }, + Spec: apiv1.ServiceSpec{ + Type: apiv1.ServiceTypeLoadBalancer, + }, + Status: apiv1.ServiceStatus{ + LoadBalancer: apiv1.LoadBalancerStatus{ + Ingress: []apiv1.LoadBalancerIngress{ + { + IP: "10.0.0.1", + }, + { + IP: "", + Hostname: "foo", + }, + { + IP: "10.0.0.2", + Hostname: "10-0-0-2.cloudprovider.example.net", + }, }, }, }, }, }, }, - }, ), []networking.IngressLoadBalancerIngress{ {IP: "10.0.0.1"}, @@ -512,28 +513,29 @@ func TestRunningAddressesWithPublishService(t *testing.T) { }, "service type LoadBalancer with same externalIP and ingress IP": { testclient.NewSimpleClientset( - &apiv1.ServiceList{Items: []apiv1.Service{ - { - ObjectMeta: metav1.ObjectMeta{ - Name: "foo", - Namespace: apiv1.NamespaceDefault, - }, - Spec: apiv1.ServiceSpec{ - Type: apiv1.ServiceTypeLoadBalancer, - ExternalIPs: []string{"10.0.0.1"}, - }, - Status: apiv1.ServiceStatus{ - LoadBalancer: apiv1.LoadBalancerStatus{ - Ingress: []apiv1.LoadBalancerIngress{ - { - IP: "10.0.0.1", + &apiv1.ServiceList{ + Items: []apiv1.Service{ + { + ObjectMeta: metav1.ObjectMeta{ + Name: "foo", + Namespace: apiv1.NamespaceDefault, + }, + Spec: apiv1.ServiceSpec{ + Type: apiv1.ServiceTypeLoadBalancer, + ExternalIPs: []string{"10.0.0.1"}, + }, + Status: apiv1.ServiceStatus{ + LoadBalancer: apiv1.LoadBalancerStatus{ + Ingress: []apiv1.LoadBalancerIngress{ + { + IP: "10.0.0.1", + }, }, }, }, }, }, }, - }, ), []networking.IngressLoadBalancerIngress{ {IP: "10.0.0.1"}, @@ -542,15 +544,16 @@ func TestRunningAddressesWithPublishService(t *testing.T) { }, "invalid service type": { testclient.NewSimpleClientset( - &apiv1.ServiceList{Items: []apiv1.Service{ - { - ObjectMeta: metav1.ObjectMeta{ - Name: "foo", - Namespace: apiv1.NamespaceDefault, + &apiv1.ServiceList{ + Items: []apiv1.Service{ + { + ObjectMeta: metav1.ObjectMeta{ + Name: "foo", + Namespace: apiv1.NamespaceDefault, + }, }, }, }, - }, ), nil, true, @@ -559,7 +562,6 @@ func TestRunningAddressesWithPublishService(t *testing.T) { for title, tc := range testCases { t.Run(title, func(t *testing.T) { - fk := buildStatusSync() fk.Config.Client = tc.fakeClient @@ -587,7 +589,11 @@ func TestRunningAddressesWithPods(t *testing.T) { fk := buildStatusSync() fk.PublishService = "" - r, _ := fk.runningAddresses() + r, err := fk.runningAddresses() + if err != nil { + t.Errorf("unexpected error: %v", err) + } + if r == nil { t.Fatalf("returned nil but expected valid []networking.IngressLoadBalancerIngress") } @@ -603,9 +609,12 @@ func TestRunningAddressesWithPods(t *testing.T) { func TestRunningAddressesWithPublishStatusAddress(t *testing.T) { fk := buildStatusSync() - fk.PublishStatusAddress = "127.0.0.1" + fk.PublishStatusAddress = localhost - ra, _ := fk.runningAddresses() + ra, err := fk.runningAddresses() + if err != nil { + t.Errorf("unexpected error: %v", err) + } if ra == nil { t.Fatalf("returned nil but expected valid []networking.IngressLoadBalancerIngress") } @@ -614,8 +623,8 @@ func TestRunningAddressesWithPublishStatusAddress(t *testing.T) { t.Errorf("returned %v but expected %v", rl, 1) } rv := ra[0] - if rv.IP != "127.0.0.1" { - t.Errorf("returned %v but expected %v", rv, networking.IngressLoadBalancerIngress{IP: "127.0.0.1"}) + if rv.IP != localhost { + t.Errorf("returned %v but expected %v", rv, networking.IngressLoadBalancerIngress{IP: localhost}) } } @@ -623,7 +632,10 @@ func TestRunningAddressesWithPublishStatusAddresses(t *testing.T) { fk := buildStatusSync() fk.PublishStatusAddress = "127.0.0.1,1.1.1.1" - ra, _ := fk.runningAddresses() + ra, err := fk.runningAddresses() + if err != nil { + t.Errorf("unexpected error: %v", err) + } if ra == nil { t.Fatalf("returned nil but expected valid []networking.IngressLoadBalancerIngress") } @@ -633,8 +645,8 @@ func TestRunningAddressesWithPublishStatusAddresses(t *testing.T) { } rv := ra[0] rv2 := ra[1] - if rv.IP != "127.0.0.1" { - t.Errorf("returned %v but expected %v", rv, networking.IngressLoadBalancerIngress{IP: "127.0.0.1"}) + if rv.IP != localhost { + t.Errorf("returned %v but expected %v", rv, networking.IngressLoadBalancerIngress{IP: localhost}) } if rv2.IP != "1.1.1.1" { t.Errorf("returned %v but expected %v", rv2, networking.IngressLoadBalancerIngress{IP: "1.1.1.1"}) @@ -645,7 +657,10 @@ func TestRunningAddressesWithPublishStatusAddressesAndSpaces(t *testing.T) { fk := buildStatusSync() fk.PublishStatusAddress = "127.0.0.1, 1.1.1.1" - ra, _ := fk.runningAddresses() + ra, err := fk.runningAddresses() + if err != nil { + t.Errorf("unexpected error: %v", err) + } if ra == nil { t.Fatalf("returned nil but expected valid []networking.IngressLoadBalancerIngresst") } @@ -655,8 +670,8 @@ func TestRunningAddressesWithPublishStatusAddressesAndSpaces(t *testing.T) { } rv := ra[0] rv2 := ra[1] - if rv.IP != "127.0.0.1" { - t.Errorf("returned %v but expected %v", rv, networking.IngressLoadBalancerIngress{IP: "127.0.0.1"}) + if rv.IP != localhost { + t.Errorf("returned %v but expected %v", rv, networking.IngressLoadBalancerIngress{IP: localhost}) } if rv2.IP != "1.1.1.1" { t.Errorf("returned %v but expected %v", rv2, networking.IngressLoadBalancerIngress{IP: "1.1.1.1"}) diff --git a/internal/k8s/main.go b/internal/k8s/main.go index d61013a9f0..5e93e560d6 100644 --- a/internal/k8s/main.go +++ b/internal/k8s/main.go @@ -33,7 +33,7 @@ import ( ) // ParseNameNS parses a string searching a namespace and name -func ParseNameNS(input string) (string, string, error) { +func ParseNameNS(input string) (ns, name string, err error) { nsName := strings.Split(input, "/") if len(nsName) != 2 { return "", "", fmt.Errorf("invalid format (namespace/name) found in '%v'", input) @@ -148,7 +148,10 @@ const IngressNGINXController = "k8s.io/ingress-nginx" // NetworkingIngressAvailable checks if the package "k8s.io/api/networking/v1" // is available or not and if Ingress V1 is supported (k8s >= v1.19.0) func NetworkingIngressAvailable(client clientset.Interface) bool { - version119, _ := version.ParseGeneric("v1.19.0") + version119, err := version.ParseGeneric("v1.19.0") + if err != nil { + return false + } serverVersion, err := client.Discovery().ServerVersion() if err != nil { diff --git a/internal/k8s/main_test.go b/internal/k8s/main_test.go index f3f8b652e5..1721c1fb29 100644 --- a/internal/k8s/main_test.go +++ b/internal/k8s/main_test.go @@ -17,7 +17,6 @@ limitations under the License. package k8s import ( - "os" "testing" apiv1 "k8s.io/api/core/v1" @@ -203,7 +202,8 @@ func TestGetNodeIP(t *testing.T) { }, }, }}}), - "demo", "10.0.0.2", true}, + "demo", "10.0.0.2", true, + }, } for _, fk := range fKNodes { @@ -216,32 +216,32 @@ func TestGetNodeIP(t *testing.T) { func TestGetIngressPod(t *testing.T) { // POD_NAME & POD_NAMESPACE not exist - os.Setenv("POD_NAME", "") - os.Setenv("POD_NAMESPACE", "") + t.Setenv("POD_NAME", "") + t.Setenv("POD_NAMESPACE", "") err := GetIngressPod(testclient.NewSimpleClientset()) if err == nil { t.Errorf("expected an error but returned nil") } // POD_NAME not exist - os.Setenv("POD_NAME", "") - os.Setenv("POD_NAMESPACE", apiv1.NamespaceDefault) + t.Setenv("POD_NAME", "") + t.Setenv("POD_NAMESPACE", apiv1.NamespaceDefault) err = GetIngressPod(testclient.NewSimpleClientset()) if err == nil { t.Errorf("expected an error but returned nil") } // POD_NAMESPACE not exist - os.Setenv("POD_NAME", "testpod") - os.Setenv("POD_NAMESPACE", "") + t.Setenv("POD_NAME", "testpod") + t.Setenv("POD_NAMESPACE", "") err = GetIngressPod(testclient.NewSimpleClientset()) if err == nil { t.Errorf("expected an error but returned nil") } // POD not exist - os.Setenv("POD_NAME", "testpod") - os.Setenv("POD_NAMESPACE", apiv1.NamespaceDefault) + t.Setenv("POD_NAME", "testpod") + t.Setenv("POD_NAMESPACE", apiv1.NamespaceDefault) err = GetIngressPod(testclient.NewSimpleClientset()) if err == nil { t.Errorf("expected an error but returned nil") diff --git a/internal/net/dns/dns.go b/internal/net/dns/dns.go index 7dfbbd177e..6b250e8cb1 100644 --- a/internal/net/dns/dns.go +++ b/internal/net/dns/dns.go @@ -38,7 +38,7 @@ func GetSystemNameServers() ([]net.IP, error) { lines := strings.Split(string(file), "\n") for l := range lines { trimmed := strings.TrimSpace(lines[l]) - if len(trimmed) == 0 || trimmed[0] == '#' || trimmed[0] == ';' { + if trimmed == "" || trimmed[0] == '#' || trimmed[0] == ';' { continue } fields := strings.Fields(trimmed) diff --git a/internal/net/ipnet_test.go b/internal/net/ipnet_test.go index 95e6b9c325..8e460aae91 100644 --- a/internal/net/ipnet_test.go +++ b/internal/net/ipnet_test.go @@ -36,13 +36,17 @@ func TestNewIPSet(t *testing.T) { } func TestParseCIDRs(t *testing.T) { - cidr, _ := ParseCIDRs("invalid.com") + cidr, err := ParseCIDRs("invalid.com") + if err == nil { + t.Errorf("expected error but got nil") + } + if cidr != nil { t.Errorf("expected %v but got %v", nil, cidr) } expected := []string{"192.0.0.1", "192.0.1.0/24"} - cidr, err := ParseCIDRs("192.0.0.1, 192.0.1.0/24") + cidr, err = ParseCIDRs("192.0.0.1, 192.0.1.0/24") if err != nil { t.Errorf("unexpected error %v", err) } diff --git a/internal/net/net.go b/internal/net/net.go index 712262f3a4..b0952d9cc1 100644 --- a/internal/net/net.go +++ b/internal/net/net.go @@ -30,11 +30,12 @@ func IsIPV6(ip _net.IP) bool { // IsPortAvailable checks if a TCP port is available or not func IsPortAvailable(p int) bool { ln, err := _net.Listen("tcp", fmt.Sprintf(":%v", p)) - if err != nil { - return false - } - defer ln.Close() - return true + defer func() { + if ln != nil { + ln.Close() + } + }() + return err == nil } // IsIPv6Enabled checks if IPV6 is enabled or not and we have @@ -51,7 +52,10 @@ func IsIPv6Enabled() bool { } for _, addr := range addrs { - ip, _, _ := _net.ParseCIDR(addr.String()) + ip, _, err := _net.ParseCIDR(addr.String()) + if err != nil { + return false + } if IsIPV6(ip) { return true } diff --git a/internal/net/net_test.go b/internal/net/net_test.go index f2f37a8386..f7a4f52e10 100644 --- a/internal/net/net_test.go +++ b/internal/net/net_test.go @@ -47,7 +47,7 @@ func TestIsPortAvailable(t *testing.T) { t.Fatal("expected port 0 to be available (random port) but returned false") } - ln, err := net.Listen("tcp", ":0") + ln, err := net.Listen("tcp", ":0") //nolint:gosec // Ignore the gosec error in testing if err != nil { t.Fatalf("unexpected error: %v", err) } diff --git a/internal/net/ssl/ssl.go b/internal/net/ssl/ssl.go index c74537fe99..516b1ec9ce 100644 --- a/internal/net/ssl/ssl.go +++ b/internal/net/ssl/ssl.go @@ -52,17 +52,15 @@ import ( // certificate generated by the ingress controller var FakeSSLCertificateUID = "00000000-0000-0000-0000-000000000000" -var ( - oidExtensionSubjectAltName = asn1.ObjectIdentifier{2, 5, 29, 17} -) +var oidExtensionSubjectAltName = asn1.ObjectIdentifier{2, 5, 29, 17} const ( fakeCertificateName = "default-fake-certificate" ) // getPemFileName returns absolute file path and file name of pem cert related to given fullSecretName -func getPemFileName(fullSecretName string) (string, string) { - pemName := fmt.Sprintf("%v.pem", fullSecretName) +func getPemFileName(fullSecretName string) (filePath, pemName string) { + pemName = fmt.Sprintf("%v.pem", fullSecretName) return fmt.Sprintf("%v/%v", file.DefaultSSLDirectory, pemName), pemName } @@ -192,7 +190,7 @@ func StoreSSLCertOnDisk(name string, sslCert *ingress.SSLCert) (string, error) { // ConfigureCACertWithCertAndKey appends ca into existing PEM file consisting of cert and key // and sets relevant fields in sslCert object -func ConfigureCACertWithCertAndKey(name string, ca []byte, sslCert *ingress.SSLCert) error { +func ConfigureCACertWithCertAndKey(_ string, ca []byte, sslCert *ingress.SSLCert) error { var buffer bytes.Buffer _, err := buffer.WriteString(sslCert.PemCertKey) @@ -210,12 +208,12 @@ func ConfigureCACertWithCertAndKey(name string, ca []byte, sslCert *ingress.SSLC return fmt.Errorf("could not write ca data to cert file %v: %v", sslCert.CAFileName, err) } - return os.WriteFile(sslCert.CAFileName, buffer.Bytes(), 0644) + //nolint:gosec // Not change permission to avoid possible issues + return os.WriteFile(sslCert.CAFileName, buffer.Bytes(), 0o644) } // ConfigureCRL creates a CRL file and append it into the SSLCert func ConfigureCRL(name string, crl []byte, sslCert *ingress.SSLCert) error { - crlName := fmt.Sprintf("crl-%v.pem", name) crlFileName := fmt.Sprintf("%v/%v", file.DefaultSSLDirectory, crlName) @@ -230,10 +228,11 @@ func ConfigureCRL(name string, crl []byte, sslCert *ingress.SSLCert) error { _, err := x509.ParseRevocationList(pemCRLBlock.Bytes) if err != nil { - return fmt.Errorf(err.Error()) + return err } - err = os.WriteFile(crlFileName, crl, 0644) + //nolint:gosec // Not change permission to avoid possible issues + err = os.WriteFile(crlFileName, crl, 0o644) if err != nil { return fmt.Errorf("could not write CRL file %v: %v", crlFileName, err) } @@ -242,7 +241,6 @@ func ConfigureCRL(name string, crl []byte, sslCert *ingress.SSLCert) error { sslCert.CRLSHA = file.SHA1(crlFileName) return nil - } // ConfigureCACert is similar to ConfigureCACertWithCertAndKey but it creates a separate file @@ -251,7 +249,8 @@ func ConfigureCACert(name string, ca []byte, sslCert *ingress.SSLCert) error { caName := fmt.Sprintf("ca-%v.pem", name) fileName := fmt.Sprintf("%v/%v", file.DefaultSSLDirectory, caName) - err := os.WriteFile(fileName, ca, 0644) + //nolint:gosec // Not change permission to avoid possible issues + err := os.WriteFile(fileName, ca, 0o644) if err != nil { return fmt.Errorf("could not write CA file %v: %v", fileName, err) } @@ -293,14 +292,14 @@ func parseSANExtension(value []byte) (dnsNames, emailAddresses []string, ipAddre var seq asn1.RawValue var rest []byte if rest, err = asn1.Unmarshal(value, &seq); err != nil { - return + return dnsNames, emailAddresses, ipAddresses, err } else if len(rest) != 0 { err = errors.New("x509: trailing data after X.509 extension") - return + return dnsNames, emailAddresses, ipAddresses, err } if !seq.IsCompound || seq.Tag != 16 || seq.Class != 0 { err = asn1.StructuralError{Msg: "bad SAN sequence"} - return + return dnsNames, emailAddresses, ipAddresses, err } rest = seq.Bytes @@ -308,7 +307,7 @@ func parseSANExtension(value []byte) (dnsNames, emailAddresses []string, ipAddre var v asn1.RawValue rest, err = asn1.Unmarshal(rest, &v) if err != nil { - return + return dnsNames, emailAddresses, ipAddresses, err } switch v.Tag { case 1: @@ -321,12 +320,12 @@ func parseSANExtension(value []byte) (dnsNames, emailAddresses []string, ipAddre ipAddresses = append(ipAddresses, v.Bytes) default: err = errors.New("x509: certificate contained IP address of length " + strconv.Itoa(len(v.Bytes))) - return + return dnsNames, emailAddresses, ipAddresses, err } } } - return + return dnsNames, emailAddresses, ipAddresses, err } // AddOrUpdateDHParam creates a dh parameters file with the specified name @@ -396,7 +395,7 @@ func GetFakeSSLCert() *ingress.SSLCert { return sslCert } -func getFakeHostSSLCert(host string) ([]byte, []byte) { +func getFakeHostSSLCert(host string) (cert, key []byte) { var priv interface{} var err error @@ -412,7 +411,6 @@ func getFakeHostSSLCert(host string) ([]byte, []byte) { serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128) serialNumber, err := rand.Int(rand.Reader, serialNumberLimit) - if err != nil { klog.Fatalf("failed to generate fake serial number: %v", err) } @@ -436,9 +434,9 @@ func getFakeHostSSLCert(host string) ([]byte, []byte) { klog.Fatalf("Failed to create fake certificate: %v", err) } - cert := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: derBytes}) + cert = pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: derBytes}) - key := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(priv.(*rsa.PrivateKey))}) + key = pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(priv.(*rsa.PrivateKey))}) return cert, key } @@ -508,9 +506,14 @@ func NewTLSListener(certificate, key string) *TLSListener { l.load() - _, _ = file.NewFileWatcher(certificate, l.load) - _, _ = file.NewFileWatcher(key, l.load) - + _, err := file.NewFileWatcher(certificate, l.load) + if err != nil { + klog.Errorf("unexpected error: %v", err) + } + _, err = file.NewFileWatcher(key, l.load) + if err != nil { + klog.Errorf("unexpected error: %v", err) + } return &l } diff --git a/internal/net/ssl/ssl_test.go b/internal/net/ssl/ssl_test.go index a86ecb87ad..9f8c5eeae6 100644 --- a/internal/net/ssl/ssl_test.go +++ b/internal/net/ssl/ssl_test.go @@ -42,7 +42,7 @@ import ( ) // generateRSACerts generates a self signed certificate using a self generated ca -func generateRSACerts(host string) (*keyPair, *keyPair, error) { +func generateRSACerts(host string) (newCert, newCa *keyPair, err error) { ca, err := newCA("self-sign-ca") if err != nil { return nil, nil, err @@ -57,7 +57,7 @@ func generateRSACerts(host string) (*keyPair, *keyPair, error) { CommonName: host, Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageAny}, } - cert, err := newSignedCert(config, key, ca.Cert, ca.Key) + cert, err := newSignedCert(&config, key, ca.Cert, ca.Key) if err != nil { return nil, nil, fmt.Errorf("unable to sign the server certificate: %v", err) } @@ -139,11 +139,11 @@ func TestCACert(t *testing.T) { func TestGetFakeSSLCert(t *testing.T) { sslCert := GetFakeSSLCert() - if len(sslCert.PemCertKey) == 0 { + if sslCert.PemCertKey == "" { t.Fatalf("expected PemCertKey to not be empty") } - if len(sslCert.PemFileName) == 0 { + if sslCert.PemFileName == "" { t.Fatalf("expected PemFileName to not be empty") } @@ -195,7 +195,7 @@ func TestConfigureCRL(t *testing.T) { // Demo CRL from https://csrc.nist.gov/projects/pki-testing/sample-certificates-and-crls // Converted to PEM to be tested // SHA: ef21f9c97ec2ef84ba3b2ab007c858a6f760d813 - var crl = []byte(`-----BEGIN X509 CRL----- + crl := []byte(`-----BEGIN X509 CRL----- MIIBYDCBygIBATANBgkqhkiG9w0BAQUFADBDMRMwEQYKCZImiZPyLGQBGRYDY29t MRcwFQYKCZImiZPyLGQBGRYHZXhhbXBsZTETMBEGA1UEAxMKRXhhbXBsZSBDQRcN MDUwMjA1MTIwMDAwWhcNMDUwMjA2MTIwMDAwWjAiMCACARIXDTA0MTExOTE1NTcw @@ -237,6 +237,7 @@ fUNCdMGmr8FVF6IzTNYGmCuk/C4= t.Fatalf("the expected CRL SHA wasn't found") } } + func TestCreateSSLCert(t *testing.T) { cert, _, err := generateRSACerts("echoheaders") if err != nil { @@ -339,12 +340,12 @@ func newPrivateKey() (*rsa.PrivateKey, error) { } // newSignedCert creates a signed certificate using the given CA certificate and key -func newSignedCert(cfg certutil.Config, key crypto.Signer, caCert *x509.Certificate, caKey crypto.Signer) (*x509.Certificate, error) { +func newSignedCert(cfg *certutil.Config, key crypto.Signer, caCert *x509.Certificate, caKey crypto.Signer) (*x509.Certificate, error) { serial, err := rand.Int(rand.Reader, new(big.Int).SetInt64(math.MaxInt64)) if err != nil { return nil, err } - if len(cfg.CommonName) == 0 { + if cfg.CommonName == "" { return nil, errors.New("must specify a CommonName") } if len(cfg.Usages) == 0 { @@ -389,7 +390,7 @@ func encodeCertPEM(cert *x509.Certificate) []byte { return pem.EncodeToMemory(&block) } -func newFakeCertificate(t *testing.T) ([]byte, string, string) { +func newFakeCertificate(t *testing.T) (sslCert []byte, certFileName, keyFileName string) { cert, key := getFakeHostSSLCert("localhost") certFile, err := os.CreateTemp("", "crt-") @@ -423,10 +424,9 @@ func dialTestServer(port string, rootCertificates ...[]byte) error { return fmt.Errorf("failed to add root certificate") } } - resp, err := tls.Dial("tcp", "localhost:"+port, &tls.Config{ + resp, err := tls.Dial("tcp", "localhost:"+port, &tls.Config{ //nolint:gosec // Ignore the gosec error in testing RootCAs: roots, }) - if err != nil { return err } @@ -473,15 +473,14 @@ func TestTLSKeyReloader(t *testing.T) { } }) - //TODO: fix - /* - // simulate watch.NewFileWatcher to call the load function - watcher.load() - t.Run("when the certificate is reloaded", func(t *testing.T) { - if err := dialTestServer(port, cert); err != nil { - t.Errorf("TLS dial should succeed, got error: %v", err) - } - }) + /*TODO: fix + // simulate watch.NewFileWatcher to call the load function + watcher.load() + t.Run("when the certificate is reloaded", func(t *testing.T) { + if err := dialTestServer(port, cert); err != nil { + t.Errorf("TLS dial should succeed, got error: %v", err) + } + }) */ }) } diff --git a/internal/nginx/main.go b/internal/nginx/main.go index ae319fe1f4..fc586e9e83 100644 --- a/internal/nginx/main.go +++ b/internal/nginx/main.go @@ -62,7 +62,7 @@ var StatusPath = "/nginx_status" var StreamPort = 10247 // NewGetStatusRequest creates a new GET request to the internal NGINX status server -func NewGetStatusRequest(path string) (int, []byte, error) { +func NewGetStatusRequest(path string) (statusCode int, data []byte, err error) { url := fmt.Sprintf("http://127.0.0.1:%v%v", StatusPort, path) client := http.Client{} @@ -72,7 +72,7 @@ func NewGetStatusRequest(path string) (int, []byte, error) { } defer res.Body.Close() - data, err := io.ReadAll(res.Body) + data, err = io.ReadAll(res.Body) if err != nil { return 0, nil, err } @@ -81,7 +81,7 @@ func NewGetStatusRequest(path string) (int, []byte, error) { } // NewPostStatusRequest creates a new POST request to the internal NGINX status server -func NewPostStatusRequest(path, contentType string, data interface{}) (int, []byte, error) { +func NewPostStatusRequest(path, contentType string, data interface{}) (statusCode int, body []byte, err error) { url := fmt.Sprintf("http://127.0.0.1:%v%v", StatusPort, path) buf, err := json.Marshal(data) @@ -96,7 +96,7 @@ func NewPostStatusRequest(path, contentType string, data interface{}) (int, []by } defer res.Body.Close() - body, err := io.ReadAll(res.Body) + body, err = io.ReadAll(res.Body) if err != nil { return 0, nil, err } @@ -105,7 +105,7 @@ func NewPostStatusRequest(path, contentType string, data interface{}) (int, []by } // GetServerBlock takes an nginx.conf file and a host and tries to find the server block for that host -func GetServerBlock(conf string, host string) (string, error) { +func GetServerBlock(conf, host string) (string, error) { startMsg := fmt.Sprintf("## start server %v\n", host) endMsg := fmt.Sprintf("## end server %v", host) @@ -113,7 +113,7 @@ func GetServerBlock(conf string, host string) (string, error) { if blockStart < 0 { return "", fmt.Errorf("host %v was not found in the controller's nginx.conf", host) } - blockStart = blockStart + len(startMsg) + blockStart += len(startMsg) blockEnd := strings.Index(conf, endMsg) if blockEnd < 0 { @@ -163,7 +163,10 @@ func Version() string { // IsRunning returns true if a process with the name 'nginx' is found func IsRunning() bool { - processes, _ := ps.Processes() + processes, err := ps.Processes() + if err != nil { + klog.ErrorS(err, "unexpected error obtaining process list") + } for _, p := range processes { if p.Executable() == "nginx" { return true diff --git a/internal/nginx/maxmind.go b/internal/nginx/maxmind.go index 5aee414cdc..bd6bc10489 100644 --- a/internal/nginx/maxmind.go +++ b/internal/nginx/maxmind.go @@ -101,7 +101,7 @@ func DownloadGeoLite2DB(attempts int, period time.Duration) error { var lastErr error retries := 0 - _ = wait.ExponentialBackoff(defaultRetry, func() (bool, error) { + lastErr = wait.ExponentialBackoff(defaultRetry, func() (bool, error) { var dlError error for _, dbName := range strings.Split(MaxmindEditionIDs, ",") { dlError = downloadDatabase(dbName) @@ -139,8 +139,8 @@ func createURL(mirror, licenseKey, dbName string) string { } func downloadDatabase(dbName string) error { - url := createURL(MaxmindMirror, MaxmindLicenseKey, dbName) - req, err := http.NewRequest(http.MethodGet, url, nil) + newURL := createURL(MaxmindMirror, MaxmindLicenseKey, dbName) + req, err := http.NewRequest(http.MethodGet, newURL, http.NoBody) if err != nil { return err } @@ -175,8 +175,7 @@ func downloadDatabase(dbName string) error { return err } - switch header.Typeflag { - case tar.TypeReg: + if header.Typeflag == tar.TypeReg { if !strings.HasSuffix(header.Name, mmdbFile) { continue } @@ -186,6 +185,7 @@ func downloadDatabase(dbName string) error { return err } + //nolint:gocritic // TODO: will fix it on a followup PR defer outFile.Close() if _, err := io.CopyN(outFile, tarReader, header.Size); err != nil { diff --git a/internal/task/queue.go b/internal/task/queue.go index ff6b20f627..f92f2a501f 100644 --- a/internal/task/queue.go +++ b/internal/task/queue.go @@ -28,9 +28,7 @@ import ( "k8s.io/client-go/util/workqueue" ) -var ( - keyFunc = cache.DeletionHandlingMetaNamespaceKeyFunc -) +var keyFunc = cache.DeletionHandlingMetaNamespaceKeyFunc // Queue manages a time work queue through an independent worker that invokes the // given sync function for every work item inserted. @@ -117,7 +115,10 @@ func (t *Queue) worker() { } ts := time.Now().UnixNano() - item := key.(Element) + item, ok := key.(Element) + if !ok { + klog.ErrorS(nil, "invalid item type", "key", key) + } if item.Timestamp != 0 && t.lastSync > item.Timestamp { klog.V(3).InfoS("skipping sync", "key", item.Key, "last", t.lastSync, "now", item.Timestamp) t.queue.Forget(key) @@ -168,7 +169,7 @@ func NewTaskQueue(syncFn func(interface{}) error) *Queue { return NewCustomTaskQueue(syncFn, nil) } -// NewCustomTaskQueue ... +// NewCustomTaskQueue creates a new custom task queue with the given sync function. func NewCustomTaskQueue(syncFn func(interface{}) error, fn func(interface{}) (interface{}, error)) *Queue { q := &Queue{ queue: workqueue.NewRateLimitingQueue(workqueue.DefaultControllerRateLimiter()), diff --git a/pkg/apis/ingress/sslcert.go b/pkg/apis/ingress/sslcert.go index 7dee3880d2..b340b2d9a7 100644 --- a/pkg/apis/ingress/sslcert.go +++ b/pkg/apis/ingress/sslcert.go @@ -66,12 +66,12 @@ type SSLCert struct { } // GetObjectKind implements the ObjectKind interface as a noop -func (s SSLCert) GetObjectKind() schema.ObjectKind { +func (s *SSLCert) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind } // Identifier returns a the couple issuer / serial number if they both exist, an empty string otherwise -func (s SSLCert) Identifier() string { +func (s *SSLCert) Identifier() string { if s.Certificate != nil { if s.Certificate.SerialNumber != nil { return fmt.Sprintf("%s-%s", s.Certificate.Issuer.SerialNumber, s.Certificate.SerialNumber.String()) @@ -81,7 +81,7 @@ func (s SSLCert) Identifier() string { } // HashInclude defines if a field should be used or not to calculate the hash -func (s SSLCert) HashInclude(field string, v interface{}) (bool, error) { +func (s *SSLCert) HashInclude(field string, _ interface{}) (bool, error) { switch field { case "PemSHA", "CASHA", "ExpireTime": return true, nil diff --git a/pkg/apis/ingress/types.go b/pkg/apis/ingress/types.go index 284e9b427f..0742e9f3b9 100644 --- a/pkg/apis/ingress/types.go +++ b/pkg/apis/ingress/types.go @@ -73,7 +73,7 @@ type Configuration struct { DefaultSSLCertificate *SSLCert `json:"-"` - StreamSnippets []string + StreamSnippets []string `json:"StreamSnippets"` } // Backend describes one or more remote server/s (endpoints) associated with a service @@ -129,7 +129,7 @@ type TrafficShapingPolicy struct { } // HashInclude defines if a field should be used or not to calculate the hash -func (s Backend) HashInclude(field string, v interface{}) (bool, error) { +func (b *Backend) HashInclude(field string, _ interface{}) (bool, error) { switch field { case "Endpoints": return false, nil @@ -410,5 +410,4 @@ type Ingress struct { } // GeneralConfig holds the definition of lua general configuration data -type GeneralConfig struct { -} +type GeneralConfig struct{} diff --git a/pkg/apis/ingress/types_equals.go b/pkg/apis/ingress/types_equals.go index c87f5ba3ef..45f0eedba6 100644 --- a/pkg/apis/ingress/types_equals.go +++ b/pkg/apis/ingress/types_equals.go @@ -80,58 +80,58 @@ func (c1 *Configuration) Equal(c2 *Configuration) bool { } // Equal tests for equality between two Backend types -func (b1 *Backend) Equal(b2 *Backend) bool { - if b1 == b2 { +func (b *Backend) Equal(newB *Backend) bool { + if b == newB { return true } - if b1 == nil || b2 == nil { + if b == nil || newB == nil { return false } - if b1.Name != b2.Name { + if b.Name != newB.Name { return false } - if b1.NoServer != b2.NoServer { + if b.NoServer != newB.NoServer { return false } - if b1.Service != b2.Service { - if b1.Service == nil || b2.Service == nil { + if b.Service != newB.Service { + if b.Service == nil || newB.Service == nil { return false } - if b1.Service.GetNamespace() != b2.Service.GetNamespace() { + if b.Service.GetNamespace() != newB.Service.GetNamespace() { return false } - if b1.Service.GetName() != b2.Service.GetName() { + if b.Service.GetName() != newB.Service.GetName() { return false } } - if b1.Port != b2.Port { + if b.Port != newB.Port { return false } - if b1.SSLPassthrough != b2.SSLPassthrough { + if b.SSLPassthrough != newB.SSLPassthrough { return false } - if !(&b1.SessionAffinity).Equal(&b2.SessionAffinity) { + if !(&b.SessionAffinity).Equal(&newB.SessionAffinity) { return false } - if b1.UpstreamHashBy != b2.UpstreamHashBy { + if b.UpstreamHashBy != newB.UpstreamHashBy { return false } - if b1.LoadBalancing != b2.LoadBalancing { + if b.LoadBalancing != newB.LoadBalancing { return false } - match := compareEndpoints(b1.Endpoints, b2.Endpoints) + match := compareEndpoints(b.Endpoints, newB.Endpoints) if !match { return false } - if !b1.TrafficShapingPolicy.Equal(b2.TrafficShapingPolicy) { + if !b.TrafficShapingPolicy.Equal(&newB.TrafficShapingPolicy) { return false } - return sets.StringElementsMatch(b1.AlternativeBackends, b2.AlternativeBackends) + return sets.StringElementsMatch(b.AlternativeBackends, newB.AlternativeBackends) } // Equal tests for equality between two SessionAffinityConfig types @@ -243,7 +243,7 @@ func (e1 *Endpoint) Equal(e2 *Endpoint) bool { } // Equal checks for equality between two TrafficShapingPolicies -func (tsp1 TrafficShapingPolicy) Equal(tsp2 TrafficShapingPolicy) bool { +func (tsp1 *TrafficShapingPolicy) Equal(tsp2 *TrafficShapingPolicy) bool { if tsp1.Weight != tsp2.Weight { return false } @@ -335,6 +335,8 @@ func (s1 *Server) Equal(s2 *Server) bool { } // Equal tests for equality between two Location types +// +//nolint:gocyclo // Ignore function complexity error func (l1 *Location) Equal(l2 *Location) bool { if l1 == l2 { return true @@ -550,39 +552,39 @@ func (l4b1 *L4Backend) Equal(l4b2 *L4Backend) bool { } // Equal tests for equality between two SSLCert types -func (s1 *SSLCert) Equal(s2 *SSLCert) bool { - if s1 == s2 { +func (s *SSLCert) Equal(newS *SSLCert) bool { + if s == newS { return true } - if s1 == nil || s2 == nil { + if s == nil || newS == nil { return false } - if s1.CASHA != s2.CASHA { + if s.CASHA != newS.CASHA { return false } - if s1.CRLSHA != s2.CRLSHA { + if s.CRLSHA != newS.CRLSHA { return false } - if s1.PemSHA != s2.PemSHA { + if s.PemSHA != newS.PemSHA { return false } - if s1.CAFileName != s2.CAFileName { + if s.CAFileName != newS.CAFileName { return false } - if s1.CRLFileName != s2.CRLFileName { + if s.CRLFileName != newS.CRLFileName { return false } - if !s1.ExpireTime.Equal(s2.ExpireTime) { + if !s.ExpireTime.Equal(newS.ExpireTime) { return false } - if s1.PemCertKey != s2.PemCertKey { + if s.PemCertKey != newS.PemCertKey { return false } - if s1.UID != s2.UID { + if s.UID != newS.UID { return false } - return sets.StringElementsMatch(s1.CN, s2.CN) + return sets.StringElementsMatch(s.CN, newS.CN) } var compareEndpointsFunc = func(e1, e2 interface{}) bool { diff --git a/pkg/apis/ingress/types_equals_test.go b/pkg/apis/ingress/types_equals_test.go index 78d29d46c8..53643f9125 100644 --- a/pkg/apis/ingress/types_equals_test.go +++ b/pkg/apis/ingress/types_equals_test.go @@ -25,19 +25,29 @@ import ( ) func TestEqualConfiguration(t *testing.T) { - ap, _ := filepath.Abs("../../../test/manifests/configuration-a.json") + ap, err := filepath.Abs("../../../test/manifests/configuration-a.json") + if err != nil { + t.Errorf("unexpected error: %v", err) + } a, err := readJSON(ap) if err != nil { t.Errorf("unexpected error reading JSON file: %v", err) } - bp, _ := filepath.Abs("../../../test/manifests/configuration-b.json") + bp, err := filepath.Abs("../../../test/manifests/configuration-b.json") + if err != nil { + t.Errorf("unexpected error: %v", err) + } + b, err := readJSON(bp) if err != nil { t.Errorf("unexpected error reading JSON file: %v", err) } - cp, _ := filepath.Abs("../../../test/manifests/configuration-c.json") + cp, err := filepath.Abs("../../../test/manifests/configuration-c.json") + if err != nil { + t.Errorf("unexpected error: %v", err) + } c, err := readJSON(cp) if err != nil { t.Errorf("unexpected error reading JSON file: %v", err) @@ -84,15 +94,18 @@ func TestL4ServiceElementsMatch(t *testing.T) { {[]L4Service{{Port: 80}}, []L4Service{{Port: 80}}, true}, { []L4Service{ - {Port: 80, Endpoints: []Endpoint{{Address: "1.1.1.1"}}}}, + {Port: 80, Endpoints: []Endpoint{{Address: "1.1.1.1"}}}, + }, []L4Service{{Port: 80}}, false, }, { []L4Service{ - {Port: 80, Endpoints: []Endpoint{{Address: "1.1.1.1"}, {Address: "1.1.1.2"}}}}, + {Port: 80, Endpoints: []Endpoint{{Address: "1.1.1.1"}, {Address: "1.1.1.2"}}}, + }, []L4Service{ - {Port: 80, Endpoints: []Endpoint{{Address: "1.1.1.2"}, {Address: "1.1.1.1"}}}}, + {Port: 80, Endpoints: []Endpoint{{Address: "1.1.1.2"}, {Address: "1.1.1.1"}}}, + }, true, }, { diff --git a/pkg/flags/flags.go b/pkg/flags/flags.go index 55d24f690a..d3bc4ee867 100644 --- a/pkg/flags/flags.go +++ b/pkg/flags/flags.go @@ -298,12 +298,12 @@ https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-g nginx.HealthCheckTimeout = time.Duration(*defHealthCheckTimeout) * time.Second } - if len(*watchNamespace) != 0 && len(*watchNamespaceSelector) != 0 { + if *watchNamespace != "" && *watchNamespaceSelector != "" { return false, nil, fmt.Errorf("flags --watch-namespace and --watch-namespace-selector are mutually exclusive") } var namespaceSelector labels.Selector - if len(*watchNamespaceSelector) != 0 { + if *watchNamespaceSelector != "" { var err error namespaceSelector, err = labels.Parse(*watchNamespaceSelector) if err != nil { @@ -311,7 +311,7 @@ https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-g } } - var histogramBuckets = &collectors.HistogramBuckets{ + histogramBuckets := &collectors.HistogramBuckets{ TimeBuckets: *timeBuckets, LengthBuckets: *lengthBuckets, SizeBuckets: *sizeBuckets, @@ -360,7 +360,7 @@ https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-g HTTPS: *httpsPort, SSLProxy: *sslProxyPort, }, - IngressClassConfiguration: &ingressclass.IngressClassConfiguration{ + IngressClassConfiguration: &ingressclass.Configuration{ Controller: *ingressClassController, AnnotationValue: *ingressClassAnnotation, WatchWithoutClass: *watchWithoutClass, @@ -380,7 +380,7 @@ https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-g var err error if nginx.MaxmindEditionIDs != "" { - if err = nginx.ValidateGeoLite2DBEditions(); err != nil { + if err := nginx.ValidateGeoLite2DBEditions(); err != nil { return false, nil, err } if nginx.MaxmindLicenseKey != "" || nginx.MaxmindMirror != "" { diff --git a/pkg/flags/flags_test.go b/pkg/flags/flags_test.go index 2a33d73dde..bffe2b16d6 100644 --- a/pkg/flags/flags_test.go +++ b/pkg/flags/flags_test.go @@ -33,7 +33,8 @@ func TestDefaults(t *testing.T) { oldArgs := os.Args defer func() { os.Args = oldArgs }() - os.Args = []string{"cmd", + os.Args = []string{ + "cmd", "--default-backend-service", "namespace/test", "--http-port", "0", "--https-port", "0", @@ -53,8 +54,8 @@ func TestDefaults(t *testing.T) { } } -func TestSetupSSLProxy(t *testing.T) { - // TODO +func TestSetupSSLProxy(_ *testing.T) { + // TODO TestSetupSSLProxy } func TestFlagConflict(t *testing.T) { diff --git a/pkg/metrics/handler.go b/pkg/metrics/handler.go index c37c1760c8..73c7d328ff 100644 --- a/pkg/metrics/handler.go +++ b/pkg/metrics/handler.go @@ -29,7 +29,6 @@ import ( ) func RegisterHealthz(healthPath string, mux *http.ServeMux, checks ...healthz.HealthChecker) { - healthCheck := []healthz.HealthChecker{healthz.PingHealthz} if len(checks) > 0 { healthCheck = append(healthCheck, checks...) @@ -67,7 +66,7 @@ func RegisterProfiler(host string, port int) { server := &http.Server{ Addr: fmt.Sprintf("%s:%d", host, port), - //G112 (CWE-400): Potential Slowloris Attack + // G112 (CWE-400): Potential Slowloris Attack ReadHeaderTimeout: 10 * time.Second, Handler: mux, } diff --git a/pkg/tcpproxy/tcp.go b/pkg/tcpproxy/tcp.go index 25cc39ee41..eda4a27467 100644 --- a/pkg/tcpproxy/tcp.go +++ b/pkg/tcpproxy/tcp.go @@ -69,7 +69,7 @@ func (p *TCPProxy) Handle(conn net.Conn) { } proxy := p.Default - hostname, err := parser.GetHostname(data[:]) + hostname, err := parser.GetHostname(data) if err == nil { klog.V(4).InfoS("TLS Client Hello", "host", hostname) proxy = p.Get(hostname) @@ -91,8 +91,14 @@ func (p *TCPProxy) Handle(conn net.Conn) { if proxy.ProxyProtocol { // write out the Proxy Protocol header - localAddr := conn.LocalAddr().(*net.TCPAddr) - remoteAddr := conn.RemoteAddr().(*net.TCPAddr) + localAddr, ok := conn.LocalAddr().(*net.TCPAddr) + if !ok { + klog.Errorf("unexpected type: %T", conn.LocalAddr()) + } + remoteAddr, ok := conn.RemoteAddr().(*net.TCPAddr) + if !ok { + klog.Errorf("unexpected type: %T", conn.RemoteAddr()) + } protocol := "UNKNOWN" if remoteAddr.IP.To4() != nil { protocol = "TCP4" diff --git a/pkg/util/file/file_watcher.go b/pkg/util/file/file_watcher.go index daf955e520..3899e41f84 100644 --- a/pkg/util/file/file_watcher.go +++ b/pkg/util/file/file_watcher.go @@ -26,8 +26,8 @@ import ( "github.com/fsnotify/fsnotify" ) -// FileWatcher is an interface we use to watch changes in files -type FileWatcher interface { +// Watcher is an interface we use to watch changes in files +type Watcher interface { Close() error } @@ -40,7 +40,7 @@ type OSFileWatcher struct { } // NewFileWatcher creates a new FileWatcher -func NewFileWatcher(file string, onEvent func()) (FileWatcher, error) { +func NewFileWatcher(file string, onEvent func()) (Watcher, error) { fw := OSFileWatcher{ file: file, onEvent: onEvent, diff --git a/pkg/util/file/filesystem.go b/pkg/util/file/filesystem.go index 7c0db9f12f..ccb93ed06b 100644 --- a/pkg/util/file/filesystem.go +++ b/pkg/util/file/filesystem.go @@ -17,4 +17,4 @@ limitations under the License. package file // ReadWriteByUser defines linux permission to read and write files for the owner user -const ReadWriteByUser = 0700 +const ReadWriteByUser = 0o700 diff --git a/pkg/util/file/structure.go b/pkg/util/file/structure.go index d109e8c03c..7d4f26da95 100644 --- a/pkg/util/file/structure.go +++ b/pkg/util/file/structure.go @@ -33,12 +33,10 @@ const ( DefaultSSLDirectory = "/etc/ingress-controller/ssl" ) -var ( - directories = []string{ - DefaultSSLDirectory, - AuthDirectory, - } -) +var directories = []string{ + DefaultSSLDirectory, + AuthDirectory, +} // CreateRequiredDirectories verifies if the required directories to // start the ingress controller exist and creates the missing ones. diff --git a/pkg/util/ingress/ingress.go b/pkg/util/ingress/ingress.go index e69ca7b29d..881d5a0016 100644 --- a/pkg/util/ingress/ingress.go +++ b/pkg/util/ingress/ingress.go @@ -114,7 +114,7 @@ func GetRemovedIngresses(rucfg, newcfg *ingress.Configuration) []string { // IsDynamicConfigurationEnough returns whether a Configuration can be // dynamically applied, without reloading the backend. -func IsDynamicConfigurationEnough(newcfg *ingress.Configuration, oldcfg *ingress.Configuration) bool { +func IsDynamicConfigurationEnough(newcfg, oldcfg *ingress.Configuration) bool { copyOfRunningConfig := *oldcfg copyOfPcfg := *newcfg @@ -133,21 +133,21 @@ func IsDynamicConfigurationEnough(newcfg *ingress.Configuration, oldcfg *ingress // clearL4serviceEndpoints is a helper function to clear endpoints from the ingress configuration since they should be ignored when // checking if the new configuration changes can be applied dynamically. func clearL4serviceEndpoints(config *ingress.Configuration) { - var clearedTCPL4Services []ingress.L4Service - var clearedUDPL4Services []ingress.L4Service - for _, service := range config.TCPEndpoints { + clearedTCPL4Services := make([]ingress.L4Service, 0, len(config.TCPEndpoints)) + clearedUDPL4Services := make([]ingress.L4Service, 0, len(config.UDPEndpoints)) + for i := range config.TCPEndpoints { copyofService := ingress.L4Service{ - Port: service.Port, - Backend: service.Backend, + Port: config.TCPEndpoints[i].Port, + Backend: config.TCPEndpoints[i].Backend, Endpoints: []ingress.Endpoint{}, Service: nil, } clearedTCPL4Services = append(clearedTCPL4Services, copyofService) } - for _, service := range config.UDPEndpoints { + for i := range config.UDPEndpoints { copyofService := ingress.L4Service{ - Port: service.Port, - Backend: service.Backend, + Port: config.UDPEndpoints[i].Port, + Backend: config.UDPEndpoints[i].Backend, Endpoints: []ingress.Endpoint{}, Service: nil, } @@ -160,7 +160,7 @@ func clearL4serviceEndpoints(config *ingress.Configuration) { // clearCertificates is a helper function to clear Certificates from the ingress configuration since they should be ignored when // checking if the new configuration changes can be applied dynamically if dynamic certificates is on func clearCertificates(config *ingress.Configuration) { - var clearedServers []*ingress.Server + clearedServers := make([]*ingress.Server, 0, len(config.Servers)) for _, server := range config.Servers { copyOfServer := *server copyOfServer.SSLCert = nil @@ -169,16 +169,16 @@ func clearCertificates(config *ingress.Configuration) { config.Servers = clearedServers } -type redirect struct { +type Redirect struct { From string To string SSLCert *ingress.SSLCert } // BuildRedirects build the redirects of servers based on configurations and certificates -func BuildRedirects(servers []*ingress.Server) []*redirect { +func BuildRedirects(servers []*ingress.Server) []*Redirect { names := sets.Set[string]{} - redirectServers := make([]*redirect, 0) + redirectServers := make([]*Redirect, 0) for _, srv := range servers { if !srv.RedirectFromToWWW { @@ -212,7 +212,7 @@ func BuildRedirects(servers []*ingress.Server) []*redirect { continue } - r := &redirect{ + r := &Redirect{ From: from, To: to, } diff --git a/pkg/util/process/controller.go b/pkg/util/process/controller.go index ae9bc93564..a73e819349 100644 --- a/pkg/util/process/controller.go +++ b/pkg/util/process/controller.go @@ -16,9 +16,9 @@ limitations under the License. package process -// ProcessController defines a common interface for a process to be controlled, +// Controller defines a common interface for a process to be controlled, // like the configurer, the webhook or the proper ingress controller -type ProcessController interface { +type Controller interface { Start() Stop() error } diff --git a/pkg/util/process/sigterm.go b/pkg/util/process/sigterm.go index 77c0ad58c8..1c0d729c12 100644 --- a/pkg/util/process/sigterm.go +++ b/pkg/util/process/sigterm.go @@ -29,7 +29,7 @@ type exiter func(code int) // HandleSigterm receives a ProcessController interface and deals with // the graceful shutdown -func HandleSigterm(ngx ProcessController, delay int, exit exiter) { +func HandleSigterm(ngx Controller, delay int, exit exiter) { signalChan := make(chan os.Signal, 1) signal.Notify(signalChan, syscall.SIGTERM) <-signalChan diff --git a/pkg/util/process/sigterm_test.go b/pkg/util/process/sigterm_test.go index b7413bed49..08c8275c39 100644 --- a/pkg/util/process/sigterm_test.go +++ b/pkg/util/process/sigterm_test.go @@ -43,7 +43,7 @@ func (f *FakeProcess) exiterFunc(code int) { } func sendDelayedSignal(delay time.Duration) error { - time.Sleep(delay * time.Second) + time.Sleep(delay) return syscall.Kill(syscall.Getpid(), syscall.SIGTERM) } @@ -67,7 +67,7 @@ func TestHandleSigterm(t *testing.T) { process := &FakeProcess{shouldError: tt.shouldError} t.Run(tt.name, func(t *testing.T) { go func() { - err := sendDelayedSignal(2) // Send a signal after 2 seconds + err := sendDelayedSignal(2 * time.Second) // Send a signal after 2 seconds if err != nil { t.Errorf("error sending delayed signal: %v", err) } diff --git a/pkg/util/runtime/cpu_notlinux.go b/pkg/util/runtime/cpu_notlinux.go index 2a1b482527..97c72cd5ae 100644 --- a/pkg/util/runtime/cpu_notlinux.go +++ b/pkg/util/runtime/cpu_notlinux.go @@ -23,7 +23,7 @@ import ( "runtime" ) -// NumCPU ... +// NumCPU returns the number of logical CPUs usable by the current process. func NumCPU() int { return runtime.NumCPU() } diff --git a/pkg/util/sets/match_test.go b/pkg/util/sets/match_test.go index e2366d2c7d..a65c5a05f0 100644 --- a/pkg/util/sets/match_test.go +++ b/pkg/util/sets/match_test.go @@ -20,23 +20,20 @@ import ( "testing" ) -var ( - testCasesElementMatch = []struct { - listA []string - listB []string - expected bool - }{ - {nil, nil, true}, - {[]string{"1"}, nil, false}, - {[]string{"1"}, []string{"1"}, true}, - {[]string{"1", "2", "1"}, []string{"1", "1", "2"}, true}, - {[]string{"1", "3", "1"}, []string{"1", "1", "2"}, false}, - {[]string{"1", "1"}, []string{"1", "2"}, false}, - } -) +var testCasesElementMatch = []struct { + listA []string + listB []string + expected bool +}{ + {nil, nil, true}, + {[]string{"1"}, nil, false}, + {[]string{"1"}, []string{"1"}, true}, + {[]string{"1", "2", "1"}, []string{"1", "1", "2"}, true}, + {[]string{"1", "3", "1"}, []string{"1", "1", "2"}, false}, + {[]string{"1", "1"}, []string{"1", "2"}, false}, +} func TestElementsMatch(t *testing.T) { - for _, testCase := range testCasesElementMatch { result := StringElementsMatch(testCase.listA, testCase.listB) if result != testCase.expected { diff --git a/rootfs/etc/nginx/template/nginx.tmpl b/rootfs/etc/nginx/template/nginx.tmpl index 3d7235bccb..ccd7b44110 100644 --- a/rootfs/etc/nginx/template/nginx.tmpl +++ b/rootfs/etc/nginx/template/nginx.tmpl @@ -140,7 +140,7 @@ http { {{/* Enable the real_ip module only if we use either X-Forwarded headers or Proxy Protocol. */}} {{/* we use the value of the real IP for the geo_ip module */}} - {{ if or (or $cfg.UseForwardedHeaders $cfg.UseProxyProtocol) $cfg.EnableRealIp }} + {{ if or (or $cfg.UseForwardedHeaders $cfg.UseProxyProtocol) $cfg.EnableRealIP }} {{ if $cfg.UseProxyProtocol }} real_ip_header proxy_protocol; {{ else }} @@ -406,7 +406,7 @@ http { {{ if $cfg.EnableSyslog }} access_log syslog:server={{ $cfg.SyslogHost }}:{{ $cfg.SyslogPort }} upstreaminfo if=$loggable; {{ else }} - access_log {{ or $cfg.HttpAccessLogPath $cfg.AccessLogPath }} upstreaminfo {{ $cfg.AccessLogParams }} if=$loggable; + access_log {{ or $cfg.HTTPAccessLogPath $cfg.AccessLogPath }} upstreaminfo {{ $cfg.AccessLogParams }} if=$loggable; {{ end }} {{ end }} @@ -822,7 +822,7 @@ stream { error_log {{ $cfg.ErrorLogPath }} {{ $cfg.ErrorLogLevel }}; - {{ if $cfg.EnableRealIp }} + {{ if $cfg.EnableRealIP }} {{ range $trusted_ip := $cfg.ProxyRealIPCIDR }} set_real_ip_from {{ $trusted_ip }}; {{ end }} diff --git a/test/e2e/admission/admission.go b/test/e2e/admission/admission.go index 0ee8248b0c..726e16f0b6 100644 --- a/test/e2e/admission/admission.go +++ b/test/e2e/admission/admission.go @@ -34,6 +34,8 @@ import ( networking "k8s.io/api/networking/v1" ) +const admissionTestHost = "admission-test" + var _ = framework.IngressNginxDescribeSerial("[Admission] admission controller", func() { f := framework.NewDefaultFramework("admission") @@ -43,7 +45,7 @@ var _ = framework.IngressNginxDescribeSerial("[Admission] admission controller", }) ginkgo.It("reject ingress with global-rate-limit annotations when memcached is not configured", func() { - host := "admission-test" + host := admissionTestHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/global-rate-limit": "100", @@ -70,7 +72,7 @@ var _ = framework.IngressNginxDescribeSerial("[Admission] admission controller", }) ginkgo.It("should not allow overlaps of host and paths without canary annotations", func() { - host := "admission-test" + host := admissionTestHost firstIngress := framework.NewSingleIngress("first-ingress", "/", host, f.Namespace, framework.EchoService, 80, nil) _, err := f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Create(context.TODO(), firstIngress, metav1.CreateOptions{}) @@ -87,7 +89,7 @@ var _ = framework.IngressNginxDescribeSerial("[Admission] admission controller", }) ginkgo.It("should allow overlaps of host and paths with canary annotation", func() { - host := "admission-test" + host := admissionTestHost firstIngress := framework.NewSingleIngress("first-ingress", "/", host, f.Namespace, framework.EchoService, 80, nil) _, err := f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Create(context.TODO(), firstIngress, metav1.CreateOptions{}) @@ -125,7 +127,7 @@ var _ = framework.IngressNginxDescribeSerial("[Admission] admission controller", }) ginkgo.It("should return an error if there is an error validating the ingress definition", func() { - host := "admission-test" + host := admissionTestHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/configuration-snippet": "something invalid", @@ -136,7 +138,7 @@ var _ = framework.IngressNginxDescribeSerial("[Admission] admission controller", }) ginkgo.It("should return an error if there is an invalid value in some annotation", func() { - host := "admission-test" + host := admissionTestHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/connection-proxy-header": "a;}", @@ -150,7 +152,7 @@ var _ = framework.IngressNginxDescribeSerial("[Admission] admission controller", }) ginkgo.It("should return an error if there is a forbidden value in some annotation", func() { - host := "admission-test" + host := admissionTestHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/connection-proxy-header": "set_by_lua", @@ -195,7 +197,6 @@ var _ = framework.IngressNginxDescribeSerial("[Admission] admission controller", validPath := framework.NewSingleIngress("second-ingress", "/bloblo", host, f.Namespace, framework.EchoService, 80, nil) _, err = f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Create(context.TODO(), validPath, metav1.CreateOptions{}) assert.Nil(ginkgo.GinkgoT(), err, "creating an ingress with valid path should not return an error") - }) ginkgo.It("should not return an error if the Ingress V1 definition is valid with Ingress Class", func() { @@ -346,7 +347,7 @@ func createIngress(namespace, ingressDefinition string) (string, error) { execOut bytes.Buffer execErr bytes.Buffer ) - + //nolint:gosec // Ignore G204 error cmd := exec.Command("/bin/bash", "-c", fmt.Sprintf("%v --warnings-as-errors=false apply --namespace %s -f -", framework.KubectlPath, namespace)) cmd.Stdin = strings.NewReader(ingressDefinition) cmd.Stdout = &execOut diff --git a/test/e2e/annotations/affinity.go b/test/e2e/annotations/affinity.go index 3e1e9e9695..b64581ef62 100644 --- a/test/e2e/annotations/affinity.go +++ b/test/e2e/annotations/affinity.go @@ -32,6 +32,14 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const ( + affinityAnnotation = "cookie" + cookieName = "SERVERID" + enableAnnotation = "true" + disableAnnotation = "false" + defaultHost = "foo.com" +) + var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { f := framework.NewDefaultFramework("affinity") @@ -42,8 +50,8 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { ginkgo.It("should set sticky cookie SERVERID", func() { host := "sticky.foo.com" annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" - annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "SERVERID" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation + annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = cookieName ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) f.EnsureIngress(ing) @@ -64,8 +72,8 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { ginkgo.It("should change cookie name on ingress definition change", func() { host := "change.foo.com" annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" - annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "SERVERID" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation + annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = cookieName ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) f.EnsureIngress(ing) @@ -80,7 +88,7 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { WithHeader("Host", host). Expect(). Status(http.StatusOK). - Header("Set-Cookie").Contains("SERVERID") + Header("Set-Cookie").Contains(cookieName) ing.ObjectMeta.Annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "OTHERCOOKIENAME" @@ -99,8 +107,8 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { ginkgo.It("should set the path to /something on the generated cookie", func() { host := "path.foo.com" annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" - annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "SERVERID" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation + annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = cookieName ing := framework.NewSingleIngress(host, "/something", host, f.Namespace, framework.EchoService, 80, annotations) f.EnsureIngress(ing) @@ -122,8 +130,8 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { pathtype := networking.PathTypePrefix host := "morethanonerule.foo.com" annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" - annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "SERVERID" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation + annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = cookieName f.EnsureIngress(&networking.Ingress{ ObjectMeta: metav1.ObjectMeta{ @@ -194,7 +202,7 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { ginkgo.It("should set cookie with expires", func() { host := "cookieexpires.foo.com" annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "ExpiresCookie" annotations["nginx.ingress.kubernetes.io/session-cookie-expires"] = "172800" annotations["nginx.ingress.kubernetes.io/session-cookie-max-age"] = "259200" @@ -211,7 +219,8 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { assert.Nil(ginkgo.GinkgoT(), err, "loading GMT location") assert.NotNil(ginkgo.GinkgoT(), local, "expected a location but none returned") - duration, _ := time.ParseDuration("48h") + duration, err := time.ParseDuration("48h") + assert.Nil(ginkgo.GinkgoT(), err, "parsing duration") expected := time.Now().In(local).Add(duration).Format("Mon, 02-Jan-06 15:04") f.HTTPTestClient(). @@ -225,7 +234,7 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { ginkgo.It("should set cookie with domain", func() { host := "cookiedomain.foo.com" annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "DomainCookie" annotations["nginx.ingress.kubernetes.io/session-cookie-domain"] = "foo.bar" @@ -248,7 +257,7 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { ginkgo.It("should not set cookie without domain annotation", func() { host := "cookienodomain.foo.com" annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "NoDomainCookie" ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) @@ -270,9 +279,9 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { ginkgo.It("should work with use-regex annotation and session-cookie-path", func() { host := "useregex.foo.com" annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" - annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "SERVERID" - annotations["nginx.ingress.kubernetes.io/use-regex"] = "true" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation + annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = cookieName + annotations["nginx.ingress.kubernetes.io/use-regex"] = enableAnnotation annotations["nginx.ingress.kubernetes.io/session-cookie-path"] = "/foo/bar" ing := framework.NewSingleIngress(host, "/foo/.*", host, f.Namespace, framework.EchoService, 80, annotations) @@ -294,9 +303,9 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { ginkgo.It("should warn user when use-regex is true and session-cookie-path is not set", func() { host := "useregexwarn.foo.com" annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" - annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "SERVERID" - annotations["nginx.ingress.kubernetes.io/use-regex"] = "true" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation + annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = cookieName + annotations["nginx.ingress.kubernetes.io/use-regex"] = enableAnnotation ing := framework.NewSingleIngress(host, "/foo/.*", host, f.Namespace, framework.EchoService, 80, annotations) f.EnsureIngress(ing) @@ -321,7 +330,7 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { host := "separate.foo.com" annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation ing1 := framework.NewSingleIngress("ingress1", "/foo/bar", host, f.Namespace, framework.EchoService, 80, annotations) f.EnsureIngress(ing1) @@ -351,8 +360,8 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { ginkgo.It("should set sticky cookie without host", func() { annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" - annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "SERVERID" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation + annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = cookieName ing := framework.NewSingleIngress("default-no-host", "/", "", f.Namespace, framework.EchoService, 80, annotations) f.EnsureIngress(ing) @@ -370,12 +379,12 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { }) ginkgo.It("should work with server-alias annotation", func() { - host := "foo.com" + host := defaultHost alias1 := "a1.foo.com" alias2 := "a2.foo.com" annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" - annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "SERVERID" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation + annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = cookieName annotations["nginx.ingress.kubernetes.io/server-alias"] = fmt.Sprintf("%s,%s", alias1, alias2) ing := framework.NewSingleIngress(host, "/bar", host, f.Namespace, framework.EchoService, 80, annotations) @@ -383,7 +392,7 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { f.WaitForNginxServer(host, func(server string) bool { - //server alias sort by sort.Strings(), see: internal/ingress/annotations/alias/main.go:60 + // server alias sort by sort.Strings(), see: internal/ingress/annotations/alias/main.go:60 return strings.Contains(server, fmt.Sprintf("server_name %s %s %s ;", host, alias1, alias2)) }) @@ -410,11 +419,11 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { }) ginkgo.It("should set secure in cookie with provided true annotation on http", func() { - host := "foo.com" + host := defaultHost annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" - annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "SERVERID" - annotations["nginx.ingress.kubernetes.io/session-cookie-secure"] = "true" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation + annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = cookieName + annotations["nginx.ingress.kubernetes.io/session-cookie-secure"] = enableAnnotation ing := framework.NewSingleIngress(host, "/bar", host, f.Namespace, framework.EchoService, 80, annotations) f.EnsureIngress(ing) @@ -433,11 +442,11 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { }) ginkgo.It("should not set secure in cookie with provided false annotation on http", func() { - host := "foo.com" + host := defaultHost annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" - annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "SERVERID" - annotations["nginx.ingress.kubernetes.io/session-cookie-secure"] = "false" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation + annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = cookieName + annotations["nginx.ingress.kubernetes.io/session-cookie-secure"] = disableAnnotation ing := framework.NewSingleIngress(host, "/bar", host, f.Namespace, framework.EchoService, 80, annotations) f.EnsureIngress(ing) @@ -456,11 +465,11 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { }) ginkgo.It("should set secure in cookie with provided false annotation on https", func() { - host := "foo.com" + host := defaultHost annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" - annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "SERVERID" - annotations["nginx.ingress.kubernetes.io/session-cookie-secure"] = "false" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation + annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = cookieName + annotations["nginx.ingress.kubernetes.io/session-cookie-secure"] = disableAnnotation f.EnsureIngress(framework.NewSingleIngressWithTLS(host, "/", host, []string{host}, f.Namespace, framework.EchoService, 80, annotations)) @@ -470,6 +479,7 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { strings.Contains(server, "listen 443") }) + //nolint:gosec // Ignore the gosec error in testing f.HTTPTestClientWithTLSConfig(&tls.Config{ServerName: host, InsecureSkipVerify: true}). GET("/"). WithURL(f.GetURL(framework.HTTPS)). diff --git a/test/e2e/annotations/affinitymode.go b/test/e2e/annotations/affinitymode.go index ad210cfa5b..e6253b6ffa 100644 --- a/test/e2e/annotations/affinitymode.go +++ b/test/e2e/annotations/affinitymode.go @@ -28,6 +28,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const sslRedirectValue = "false" + var _ = framework.DescribeAnnotation("affinitymode", func() { f := framework.NewDefaultFramework("affinity") @@ -45,7 +47,7 @@ var _ = framework.DescribeAnnotation("affinitymode", func() { annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "hello-cookie" annotations["nginx.ingress.kubernetes.io/session-cookie-expires"] = "172800" annotations["nginx.ingress.kubernetes.io/session-cookie-max-age"] = "172800" - annotations["nginx.ingress.kubernetes.io/ssl-redirect"] = "false" + annotations["nginx.ingress.kubernetes.io/ssl-redirect"] = sslRedirectValue annotations["nginx.ingress.kubernetes.io/affinity-mode"] = "balanced" annotations["nginx.ingress.kubernetes.io/session-cookie-hash"] = "sha1" @@ -78,7 +80,7 @@ var _ = framework.DescribeAnnotation("affinitymode", func() { annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "hello-cookie" annotations["nginx.ingress.kubernetes.io/session-cookie-expires"] = "172800" annotations["nginx.ingress.kubernetes.io/session-cookie-max-age"] = "172800" - annotations["nginx.ingress.kubernetes.io/ssl-redirect"] = "false" + annotations["nginx.ingress.kubernetes.io/ssl-redirect"] = sslRedirectValue annotations["nginx.ingress.kubernetes.io/affinity-mode"] = "persistent" annotations["nginx.ingress.kubernetes.io/session-cookie-hash"] = "sha1" @@ -106,7 +108,7 @@ var _ = framework.DescribeAnnotation("affinitymode", func() { // Send new requests and add new backends. Check which backend responded to the sent request cookies := getCookiesFromHeader(response.Header("Set-Cookie").Raw()) for sendRequestNumber := 0; sendRequestNumber < 10; sendRequestNumber++ { - replicas = replicas + 1 + replicas++ err := framework.UpdateDeployment(f.KubeClientSet, f.Namespace, deploymentName, replicas, nil) assert.Nil(ginkgo.GinkgoT(), err) framework.Sleep() diff --git a/test/e2e/annotations/alias.go b/test/e2e/annotations/alias.go index de829507db..ca4fe9c317 100644 --- a/test/e2e/annotations/alias.go +++ b/test/e2e/annotations/alias.go @@ -26,6 +26,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const fooHost = "foo" + var _ = framework.DescribeAnnotation("server-alias", func() { f := framework.NewDefaultFramework("alias") @@ -34,7 +36,7 @@ var _ = framework.DescribeAnnotation("server-alias", func() { }) ginkgo.It("should return status code 200 for host 'foo' and 404 for 'bar'", func() { - host := "foo" + host := fooHost ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, nil) f.EnsureIngress(ing) @@ -60,7 +62,7 @@ var _ = framework.DescribeAnnotation("server-alias", func() { }) ginkgo.It("should return status code 200 for host 'foo' and 'bar'", func() { - host := "foo" + host := fooHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/server-alias": "bar", } @@ -73,7 +75,7 @@ var _ = framework.DescribeAnnotation("server-alias", func() { return strings.Contains(server, fmt.Sprintf("server_name %v", host)) }) - hosts := []string{"foo", "bar"} + hosts := []string{fooHost, "bar"} for _, host := range hosts { f.HTTPTestClient(). GET("/"). @@ -85,7 +87,7 @@ var _ = framework.DescribeAnnotation("server-alias", func() { }) ginkgo.It("should return status code 200 for hosts defined in two ingresses, different path with one alias", func() { - host := "foo" + host := fooHost ing := framework.NewSingleIngress("app-a", "/app-a", host, f.Namespace, framework.EchoService, 80, nil) f.EnsureIngress(ing) @@ -101,7 +103,7 @@ var _ = framework.DescribeAnnotation("server-alias", func() { return strings.Contains(server, fmt.Sprintf("server_name %v bar", host)) }) - hosts := []string{"foo", "bar"} + hosts := []string{fooHost, "bar"} for _, host := range hosts { f.HTTPTestClient(). GET("/app-a"). diff --git a/test/e2e/annotations/auth.go b/test/e2e/annotations/auth.go index 56246828ae..be915a7223 100644 --- a/test/e2e/annotations/auth.go +++ b/test/e2e/annotations/auth.go @@ -36,6 +36,12 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const ( + differentHost = "different" + authHost = "auth" + authURL = "http://foo.bar.baz:5000/path" +) + var _ = framework.DescribeAnnotation("auth-*", func() { f := framework.NewDefaultFramework("auth", framework.WithHTTPBunEnabled()) @@ -44,7 +50,7 @@ var _ = framework.DescribeAnnotation("auth-*", func() { }) ginkgo.It("should return status code 200 when no authentication is configured", func() { - host := "auth" + host := authHost ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, nil) f.EnsureIngress(ing) @@ -63,7 +69,7 @@ var _ = framework.DescribeAnnotation("auth-*", func() { }) ginkgo.It("should return status code 503 when authentication is configured with an invalid secret", func() { - host := "auth" + host := authHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/auth-type": "basic", "nginx.ingress.kubernetes.io/auth-secret": "something", @@ -87,9 +93,9 @@ var _ = framework.DescribeAnnotation("auth-*", func() { }) ginkgo.It("should return status code 401 when authentication is configured but Authorization header is not configured", func() { - host := "auth" + host := authHost - s := f.EnsureSecret(buildSecret("foo", "bar", "test", f.Namespace)) + s := f.EnsureSecret(buildSecret(fooHost, "bar", "test", f.Namespace)) annotations := map[string]string{ "nginx.ingress.kubernetes.io/auth-type": "basic", @@ -114,9 +120,9 @@ var _ = framework.DescribeAnnotation("auth-*", func() { }) ginkgo.It("should return status code 401 when authentication is configured and Authorization header is sent with invalid credentials", func() { - host := "auth" + host := authHost - s := f.EnsureSecret(buildSecret("foo", "bar", "test", f.Namespace)) + s := f.EnsureSecret(buildSecret(fooHost, "bar", "test", f.Namespace)) annotations := map[string]string{ "nginx.ingress.kubernetes.io/auth-type": "basic", @@ -142,9 +148,9 @@ var _ = framework.DescribeAnnotation("auth-*", func() { }) ginkgo.It("should return status code 401 and cors headers when authentication and cors is configured but Authorization header is not configured", func() { - host := "auth" + host := authHost - s := f.EnsureSecret(buildSecret("foo", "bar", "test", f.Namespace)) + s := f.EnsureSecret(buildSecret(fooHost, "bar", "test", f.Namespace)) annotations := map[string]string{ "nginx.ingress.kubernetes.io/auth-type": "basic", @@ -170,9 +176,9 @@ var _ = framework.DescribeAnnotation("auth-*", func() { }) ginkgo.It("should return status code 200 when authentication is configured and Authorization header is sent", func() { - host := "auth" + host := authHost - s := f.EnsureSecret(buildSecret("foo", "bar", "test", f.Namespace)) + s := f.EnsureSecret(buildSecret(fooHost, "bar", "test", f.Namespace)) annotations := map[string]string{ "nginx.ingress.kubernetes.io/auth-type": "basic", @@ -191,15 +197,15 @@ var _ = framework.DescribeAnnotation("auth-*", func() { f.HTTPTestClient(). GET("/"). WithHeader("Host", host). - WithBasicAuth("foo", "bar"). + WithBasicAuth(fooHost, "bar"). Expect(). Status(http.StatusOK) }) ginkgo.It("should return status code 200 when authentication is configured with a map and Authorization header is sent", func() { - host := "auth" + host := authHost - s := f.EnsureSecret(buildMapSecret("foo", "bar", "test", f.Namespace)) + s := f.EnsureSecret(buildMapSecret(fooHost, "bar", "test", f.Namespace)) annotations := map[string]string{ "nginx.ingress.kubernetes.io/auth-type": "basic", @@ -219,13 +225,13 @@ var _ = framework.DescribeAnnotation("auth-*", func() { f.HTTPTestClient(). GET("/"). WithHeader("Host", host). - WithBasicAuth("foo", "bar"). + WithBasicAuth(fooHost, "bar"). Expect(). Status(http.StatusOK) }) ginkgo.It("should return status code 401 when authentication is configured with invalid content and Authorization header is sent", func() { - host := "auth" + host := authHost s := f.EnsureSecret( &corev1.Secret{ @@ -258,13 +264,13 @@ var _ = framework.DescribeAnnotation("auth-*", func() { f.HTTPTestClient(). GET("/"). WithHeader("Host", host). - WithBasicAuth("foo", "bar"). + WithBasicAuth(fooHost, "bar"). Expect(). Status(http.StatusUnauthorized) }) ginkgo.It(`should set snippet "proxy_set_header My-Custom-Header 42;" when external auth is configured`, func() { - host := "auth" + host := authHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/auth-url": "http://foo.bar/basic-auth/user/password", @@ -282,7 +288,7 @@ var _ = framework.DescribeAnnotation("auth-*", func() { }) ginkgo.It(`should not set snippet "proxy_set_header My-Custom-Header 42;" when external auth is not configured`, func() { - host := "auth" + host := authHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/auth-snippet": ` @@ -299,7 +305,7 @@ var _ = framework.DescribeAnnotation("auth-*", func() { }) ginkgo.It(`should set "proxy_set_header 'My-Custom-Header' '42';" when auth-headers are set`, func() { - host := "auth" + host := authHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/auth-url": "http://foo.bar/basic-auth/user/password", @@ -320,11 +326,11 @@ var _ = framework.DescribeAnnotation("auth-*", func() { }) ginkgo.It(`should set cache_key when external auth cache is configured`, func() { - host := "auth" + host := authHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/auth-url": "http://foo.bar/basic-auth/user/password", - "nginx.ingress.kubernetes.io/auth-cache-key": "foo", + "nginx.ingress.kubernetes.io/auth-cache-key": fooHost, "nginx.ingress.kubernetes.io/auth-cache-duration": "200 202 401 30m", } @@ -337,7 +343,6 @@ var _ = framework.DescribeAnnotation("auth-*", func() { func(server string) bool { return cacheRegex.MatchString(server) && strings.Contains(server, `proxy_cache_valid 200 202 401 30m;`) - }) }) @@ -405,7 +410,6 @@ http { f.WaitForNginxServer(host, func(server string) bool { return strings.Contains(server, "server_name "+host) }) - }) ginkgo.It("user retains cookie by default", func() { @@ -431,7 +435,7 @@ http { }) ginkgo.It("user with annotated ingress retains cookie if upstream returns error status code", func() { - annotations["nginx.ingress.kubernetes.io/auth-always-set-cookie"] = "true" + annotations["nginx.ingress.kubernetes.io/auth-always-set-cookie"] = enableAnnotation f.UpdateIngress(ing1) f.UpdateIngress(ing2) @@ -451,7 +455,7 @@ http { }) ginkgo.Context("when external authentication is configured", func() { - host := "auth" + host := authHost var annotations map[string]string var ing *networking.Ingress @@ -495,7 +499,7 @@ http { annotations["nginx.ingress.kubernetes.io/auth-realm"] = "test auth" f.UpdateIngress(ing) - anotherHost := "different" + anotherHost := differentHost anotherAnnotations := map[string]string{} anotherIng := framework.NewSingleIngress(anotherHost, "/", anotherHost, f.Namespace, framework.EchoService, 80, anotherAnnotations) @@ -544,12 +548,12 @@ http { // Sleep a while just to guarantee that the configmap is applied framework.Sleep() - annotations["nginx.ingress.kubernetes.io/auth-url"] = "http://foo.bar.baz:5000/path" + annotations["nginx.ingress.kubernetes.io/auth-url"] = authURL f.UpdateIngress(ing) f.WaitForNginxServer("", func(server string) bool { - return strings.Contains(server, "http://foo.bar.baz:5000/path") && + return strings.Contains(server, authURL) && !strings.Contains(server, `upstream auth-external-auth`) }) }) @@ -582,19 +586,19 @@ http { // Sleep a while just to guarantee that the configmap is applied framework.Sleep() - annotations["nginx.ingress.kubernetes.io/auth-url"] = "http://foo.bar.baz:5000/path" + annotations["nginx.ingress.kubernetes.io/auth-url"] = authURL annotations["nginx.ingress.kubernetes.io/auth-keepalive"] = "-1" f.UpdateIngress(ing) f.WaitForNginxServer("", func(server string) bool { - return strings.Contains(server, "http://foo.bar.baz:5000/path") && + return strings.Contains(server, authURL) && !strings.Contains(server, `upstream auth-external-auth`) }) }) ginkgo.It(`should not create additional upstream block when auth-keepalive is set with HTTP/2`, func() { - annotations["nginx.ingress.kubernetes.io/auth-url"] = "http://foo.bar.baz:5000/path" + annotations["nginx.ingress.kubernetes.io/auth-url"] = authURL annotations["nginx.ingress.kubernetes.io/auth-keepalive"] = "123" annotations["nginx.ingress.kubernetes.io/auth-keepalive-requests"] = "456" annotations["nginx.ingress.kubernetes.io/auth-keepalive-timeout"] = "789" @@ -602,7 +606,7 @@ http { f.WaitForNginxServer("", func(server string) bool { - return strings.Contains(server, "http://foo.bar.baz:5000/path") && + return strings.Contains(server, authURL) && !strings.Contains(server, `upstream auth-external-auth`) }) }) @@ -657,7 +661,7 @@ http { framework.Sleep() annotations["nginx.ingress.kubernetes.io/auth-keepalive"] = "10" - annotations["nginx.ingress.kubernetes.io/auth-keepalive-share-vars"] = "true" + annotations["nginx.ingress.kubernetes.io/auth-keepalive-share-vars"] = enableAnnotation f.UpdateIngress(ing) f.WaitForNginxServer("", @@ -670,7 +674,7 @@ http { }) ginkgo.Context("when external authentication is configured with a custom redirect param", func() { - host := "auth" + host := authHost var annotations map[string]string var ing *networking.Ingress @@ -715,7 +719,7 @@ http { annotations["nginx.ingress.kubernetes.io/auth-realm"] = "test auth" f.UpdateIngress(ing) - anotherHost := "different" + anotherHost := differentHost anotherAnnotations := map[string]string{} anotherIng := framework.NewSingleIngress(anotherHost, "/", anotherHost, f.Namespace, framework.EchoService, 80, anotherAnnotations) @@ -735,8 +739,8 @@ http { }) ginkgo.Context("when external authentication with caching is configured", func() { - thisHost := "auth" - thatHost := "different" + thisHost := authHost + thatHost := differentHost fooPath := "/foo" barPath := "/bar" @@ -858,7 +862,7 @@ http { }) ginkgo.Context("with invalid auth-url should deny whole location", func() { - host := "auth" + host := authHost var annotations map[string]string var ing *networking.Ingress @@ -898,7 +902,6 @@ http { // Auth error func buildSecret(username, password, name, namespace string) *corev1.Secret { - //out, err := exec.Command("openssl", "passwd", "-crypt", password).CombinedOutput() out, err := bcrypt.GenerateFromPassword([]byte(password), 14) encpass := fmt.Sprintf("%v:%s\n", username, out) assert.Nil(ginkgo.GinkgoT(), err) @@ -917,7 +920,6 @@ func buildSecret(username, password, name, namespace string) *corev1.Secret { } func buildMapSecret(username, password, name, namespace string) *corev1.Secret { - //out, err := exec.Command("openssl", "passwd", "-crypt", password).CombinedOutput() out, err := bcrypt.GenerateFromPassword([]byte(password), 14) assert.Nil(ginkgo.GinkgoT(), err) @@ -928,7 +930,7 @@ func buildMapSecret(username, password, name, namespace string) *corev1.Secret { DeletionGracePeriodSeconds: framework.NewInt64(1), }, Data: map[string][]byte{ - username: []byte(out), + username: out, }, Type: corev1.SecretTypeOpaque, } diff --git a/test/e2e/annotations/authtls.go b/test/e2e/annotations/authtls.go index e96835aa00..c7a05c053d 100644 --- a/test/e2e/annotations/authtls.go +++ b/test/e2e/annotations/authtls.go @@ -26,6 +26,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const authTLSFooHost = "authtls.foo.com" + var _ = framework.DescribeAnnotation("auth-tls-*", func() { f := framework.NewDefaultFramework("authtls") @@ -34,7 +36,7 @@ var _ = framework.DescribeAnnotation("auth-tls-*", func() { }) ginkgo.It("should set sslClientCertificate, sslVerifyClient and sslVerifyDepth with auth-tls-secret", func() { - host := "authtls.foo.com" + host := authTLSFooHost nameSpace := f.Namespace clientConfig, err := framework.CreateIngressMASecret( @@ -82,7 +84,7 @@ var _ = framework.DescribeAnnotation("auth-tls-*", func() { }) ginkgo.It("should set valid auth-tls-secret, sslVerify to off, and sslVerifyDepth to 2", func() { - host := "authtls.foo.com" + host := authTLSFooHost nameSpace := f.Namespace _, err := framework.CreateIngressMASecret( @@ -112,7 +114,7 @@ var _ = framework.DescribeAnnotation("auth-tls-*", func() { }) ginkgo.It("should 302 redirect to error page instead of 400 when auth-tls-error-page is set", func() { - host := "authtls.foo.com" + host := authTLSFooHost nameSpace := f.Namespace errorPath := "/error" @@ -159,7 +161,7 @@ var _ = framework.DescribeAnnotation("auth-tls-*", func() { }) ginkgo.It("should pass URL-encoded certificate to upstream", func() { - host := "authtls.foo.com" + host := authTLSFooHost nameSpace := f.Namespace clientConfig, err := framework.CreateIngressMASecret( @@ -204,7 +206,7 @@ var _ = framework.DescribeAnnotation("auth-tls-*", func() { }) ginkgo.It("should validate auth-tls-verify-client", func() { - host := "authtls.foo.com" + host := authTLSFooHost nameSpace := f.Namespace clientConfig, err := framework.CreateIngressMASecret( @@ -260,11 +262,10 @@ var _ = framework.DescribeAnnotation("auth-tls-*", func() { WithHeader("Host", host). Expect(). Status(http.StatusOK) - }) ginkgo.It("should return 403 using auth-tls-match-cn with no matching CN from client", func() { - host := "authtls.foo.com" + host := authTLSFooHost nameSpace := f.Namespace clientConfig, err := framework.CreateIngressMASecret( @@ -293,7 +294,7 @@ var _ = framework.DescribeAnnotation("auth-tls-*", func() { }) ginkgo.It("should return 200 using auth-tls-match-cn with matching CN from client", func() { - host := "authtls.foo.com" + host := authTLSFooHost nameSpace := f.Namespace clientConfig, err := framework.CreateIngressMASecret( @@ -322,7 +323,7 @@ var _ = framework.DescribeAnnotation("auth-tls-*", func() { }) ginkgo.It("should return 200 using auth-tls-match-cn where atleast one of the regex options matches CN from client", func() { - host := "authtls.foo.com" + host := authTLSFooHost nameSpace := f.Namespace clientConfig, err := framework.CreateIngressMASecret( @@ -351,7 +352,8 @@ var _ = framework.DescribeAnnotation("auth-tls-*", func() { }) }) -func assertSslClientCertificateConfig(f *framework.Framework, host string, verifyClient string, verifyDepth string) { +//nolint:unparam // Ignore the invariant param: host +func assertSslClientCertificateConfig(f *framework.Framework, host, verifyClient, verifyDepth string) { sslClientCertDirective := fmt.Sprintf("ssl_client_certificate /etc/ingress-controller/ssl/%s-%s.pem;", f.Namespace, host) sslVerify := fmt.Sprintf("ssl_verify_client %s;", verifyClient) sslVerifyDepth := fmt.Sprintf("ssl_verify_depth %s;", verifyDepth) diff --git a/test/e2e/annotations/backendprotocol.go b/test/e2e/annotations/backendprotocol.go index 566a6921e8..d0a08c7670 100644 --- a/test/e2e/annotations/backendprotocol.go +++ b/test/e2e/annotations/backendprotocol.go @@ -24,6 +24,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const backendProtocolHost = "backendprotocol.foo.com" + var _ = framework.DescribeAnnotation("backend-protocol", func() { f := framework.NewDefaultFramework("backendprotocol") @@ -32,7 +34,7 @@ var _ = framework.DescribeAnnotation("backend-protocol", func() { }) ginkgo.It("should set backend protocol to https:// and use proxy_pass", func() { - host := "backendprotocol.foo.com" + host := backendProtocolHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/backend-protocol": "HTTPS", } @@ -47,7 +49,7 @@ var _ = framework.DescribeAnnotation("backend-protocol", func() { }) ginkgo.It("should set backend protocol to $scheme:// and use proxy_pass", func() { - host := "backendprotocol.foo.com" + host := backendProtocolHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/backend-protocol": "AUTO_HTTP", } @@ -62,7 +64,7 @@ var _ = framework.DescribeAnnotation("backend-protocol", func() { }) ginkgo.It("should set backend protocol to grpc:// and use grpc_pass", func() { - host := "backendprotocol.foo.com" + host := backendProtocolHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/backend-protocol": "GRPC", } @@ -77,7 +79,7 @@ var _ = framework.DescribeAnnotation("backend-protocol", func() { }) ginkgo.It("should set backend protocol to grpcs:// and use grpc_pass", func() { - host := "backendprotocol.foo.com" + host := backendProtocolHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/backend-protocol": "GRPCS", } @@ -92,7 +94,7 @@ var _ = framework.DescribeAnnotation("backend-protocol", func() { }) ginkgo.It("should set backend protocol to '' and use fastcgi_pass", func() { - host := "backendprotocol.foo.com" + host := backendProtocolHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/backend-protocol": "FCGI", } diff --git a/test/e2e/annotations/canary.go b/test/e2e/annotations/canary.go index 15cbeffa7a..ea733dbf43 100644 --- a/test/e2e/annotations/canary.go +++ b/test/e2e/annotations/canary.go @@ -43,7 +43,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { ginkgo.Context("when canary is created", func() { ginkgo.It("should response with a 200 status from the mainline upstream when requests are made to the mainline ingress", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -87,7 +87,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { }) ginkgo.It("should return 404 status for requests to the canary if no matching ingress is found", func() { - host := "foo" + host := fooHost canaryAnnotations := map[string]string{ "nginx.ingress.kubernetes.io/canary": "true", @@ -118,7 +118,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { TODO: This test needs improvements made to the e2e framework so that deployment updates work in order to successfully run It("should return the correct status codes when endpoints are unavailable", func() { - host := "foo" + host := fooHost annotations := map[string]string{} ing := framework.NewSingleIngress(host, "/info", host, f.Namespace, framework.HTTPBunService, 80, annotations) @@ -172,7 +172,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { */ ginkgo.It("should route requests to the correct upstream if mainline ingress is created before the canary ingress", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -230,7 +230,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { }) ginkgo.It("should route requests to the correct upstream if mainline ingress is created after the canary ingress", func() { - host := "foo" + host := fooHost canaryAnnotations := map[string]string{ "nginx.ingress.kubernetes.io/canary": "true", @@ -287,7 +287,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { }) ginkgo.It("should route requests to the correct upstream if the mainline ingress is modified", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -321,7 +321,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { canaryAnnotations)) modAnnotations := map[string]string{ - "foo": "bar", + fooHost: "bar", } f.UpdateIngress(framework.NewSingleIngress( @@ -361,7 +361,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { }) ginkgo.It("should route requests to the correct upstream if the canary ingress is modified", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -443,7 +443,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { ginkgo.Context("when canaried by header with no value", func() { ginkgo.It("should route requests to the correct upstream", func() { - host := "foo" + host := fooHost f.EnsureIngress(framework.NewSingleIngress( host, @@ -511,7 +511,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { ginkgo.Context("when canaried by header with value", func() { ginkgo.It("should route requests to the correct upstream", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -592,7 +592,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { ginkgo.Context("when canaried by header with value and pattern", func() { ginkgo.It("should route requests to the correct upstream", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -645,7 +645,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { Body().Contains(framework.HTTPBunService).NotContains(canaryService) }) ginkgo.It("should route requests to the correct upstream", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -690,7 +690,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { Body().Contains(framework.HTTPBunService).NotContains(canaryService) }) ginkgo.It("should routes to mainline upstream when the given Regex causes error", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -739,7 +739,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { ginkgo.Context("when canaried by header with value and cookie", func() { ginkgo.It("should route requests to the correct upstream", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -788,7 +788,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { ginkgo.Context("when canaried by cookie", func() { ginkgo.It("respects always and never values", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -860,7 +860,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { ginkgo.Context("when canaried by weight", func() { ginkgo.It("should route requests only to mainline if canary weight is 0", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -908,7 +908,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { }) ginkgo.It("should route requests only to canary if canary weight is 100", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -950,7 +950,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { }) ginkgo.It("should route requests only to canary if canary weight is equal to canary weight total", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -993,7 +993,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { }) ginkgo.It("should route requests split between mainline and canary if canary weight is 50", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -1029,7 +1029,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { }) ginkgo.It("should route requests split between mainline and canary if canary weight is 100 and weight total is 200", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -1068,7 +1068,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { ginkgo.Context("Single canary Ingress", func() { ginkgo.It("should not use canary as a catch-all server", func() { - host := "foo" + host := fooHost canaryIngName := fmt.Sprintf("%v-canary", host) annotations := map[string]string{ "nginx.ingress.kubernetes.io/canary": "true", @@ -1102,7 +1102,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { }) ginkgo.It("should not use canary with domain as a server", func() { - host := "foo" + host := fooHost canaryIngName := fmt.Sprintf("%v-canary", host) annotations := map[string]string{ "nginx.ingress.kubernetes.io/canary": "true", @@ -1136,7 +1136,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { }) ginkgo.It("does not crash when canary ingress has multiple paths to the same non-matching backend", func() { - host := "foo" + host := fooHost canaryIngName := fmt.Sprintf("%v-canary", host) annotations := map[string]string{ "nginx.ingress.kubernetes.io/canary": "true", @@ -1168,7 +1168,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { }) ginkgo.Context("canary affinity behavior", func() { - host := "foo" + host := fooHost affinityCookieName := "aff" canaryIngName := fmt.Sprintf("%v-canary", host) @@ -1370,7 +1370,6 @@ var _ = framework.DescribeAnnotation("canary-*", func() { TestMainlineCanaryDistribution(f, host) }) }) - }) // This method assumes canary weight being configured at 50%. @@ -1407,12 +1406,12 @@ func TestMainlineCanaryDistribution(f *framework.Framework, host string) { assert.GreaterOrEqual( ginkgo.GinkgoT(), - int(replicaRequestCount[keys[0].String()]), + replicaRequestCount[keys[0].String()], requestsNumberToTest, ) assert.GreaterOrEqual( ginkgo.GinkgoT(), - int(replicaRequestCount[keys[1].String()]), + replicaRequestCount[keys[1].String()], requestsNumberToTest, ) } diff --git a/test/e2e/annotations/clientbodybuffersize.go b/test/e2e/annotations/clientbodybuffersize.go index 4ea1943bd2..15a3530f37 100644 --- a/test/e2e/annotations/clientbodybuffersize.go +++ b/test/e2e/annotations/clientbodybuffersize.go @@ -25,6 +25,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const clientBodyBufferSizeHost = "client-body-buffer-size.com" + var _ = framework.DescribeAnnotation("client-body-buffer-size", func() { f := framework.NewDefaultFramework("clientbodybuffersize") @@ -33,7 +35,7 @@ var _ = framework.DescribeAnnotation("client-body-buffer-size", func() { }) ginkgo.It("should set client_body_buffer_size to 1000", func() { - host := "client-body-buffer-size.com" + host := clientBodyBufferSizeHost clientBodyBufferSize := "1000" annotations := make(map[string]string) @@ -55,7 +57,7 @@ var _ = framework.DescribeAnnotation("client-body-buffer-size", func() { }) ginkgo.It("should set client_body_buffer_size to 1K", func() { - host := "client-body-buffer-size.com" + host := clientBodyBufferSizeHost clientBodyBufferSize := "1K" annotations := make(map[string]string) @@ -77,7 +79,7 @@ var _ = framework.DescribeAnnotation("client-body-buffer-size", func() { }) ginkgo.It("should set client_body_buffer_size to 1k", func() { - host := "client-body-buffer-size.com" + host := clientBodyBufferSizeHost clientBodyBufferSize := "1k" annotations := make(map[string]string) @@ -99,7 +101,7 @@ var _ = framework.DescribeAnnotation("client-body-buffer-size", func() { }) ginkgo.It("should set client_body_buffer_size to 1m", func() { - host := "client-body-buffer-size.com" + host := clientBodyBufferSizeHost clientBodyBufferSize := "1m" annotations := make(map[string]string) @@ -121,7 +123,7 @@ var _ = framework.DescribeAnnotation("client-body-buffer-size", func() { }) ginkgo.It("should set client_body_buffer_size to 1M", func() { - host := "client-body-buffer-size.com" + host := clientBodyBufferSizeHost clientBodyBufferSize := "1M" annotations := make(map[string]string) @@ -143,7 +145,7 @@ var _ = framework.DescribeAnnotation("client-body-buffer-size", func() { }) ginkgo.It("should not set client_body_buffer_size to invalid 1b", func() { - host := "client-body-buffer-size.com" + host := clientBodyBufferSizeHost clientBodyBufferSize := "1b" annotations := make(map[string]string) diff --git a/test/e2e/annotations/cors.go b/test/e2e/annotations/cors.go index f53bd8e9e0..dd28f5dd42 100644 --- a/test/e2e/annotations/cors.go +++ b/test/e2e/annotations/cors.go @@ -25,6 +25,11 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const ( + originHost = "http://origin.com:8080" + corsHost = "cors.foo.com" +) + var _ = framework.DescribeAnnotation("cors-*", func() { f := framework.NewDefaultFramework("cors") @@ -33,7 +38,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should enable cors", func() { - host := "cors.foo.com" + host := corsHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", } @@ -60,7 +65,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should set cors methods to only allow POST, GET", func() { - host := "cors.foo.com" + host := corsHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", "nginx.ingress.kubernetes.io/cors-allow-methods": "POST, GET", @@ -76,7 +81,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should set cors max-age", func() { - host := "cors.foo.com" + host := corsHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", "nginx.ingress.kubernetes.io/cors-max-age": "200", @@ -92,7 +97,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should disable cors allow credentials", func() { - host := "cors.foo.com" + host := corsHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", "nginx.ingress.kubernetes.io/cors-allow-credentials": "false", @@ -108,7 +113,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should allow origin for cors", func() { - host := "cors.foo.com" + host := corsHost origin := "https://origin.cors.com:8080" annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", @@ -135,7 +140,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should allow headers for cors", func() { - host := "cors.foo.com" + host := corsHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", "nginx.ingress.kubernetes.io/cors-allow-headers": "DNT, User-Agent", @@ -151,7 +156,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should expose headers for cors", func() { - host := "cors.foo.com" + host := corsHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", "nginx.ingress.kubernetes.io/cors-expose-headers": "X-CustomResponseHeader, X-CustomSecondHeader", @@ -167,7 +172,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should allow - single origin for multiple cors values", func() { - host := "cors.foo.com" + host := corsHost origin := "https://origin.cors.com:8080" annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", @@ -194,7 +199,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should not allow - single origin for multiple cors values", func() { - host := "cors.foo.com" + host := corsHost origin := "http://no.origin.com" annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", @@ -214,7 +219,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should allow correct origins - single origin for multiple cors values", func() { - host := "cors.foo.com" + host := corsHost badOrigin := "origin.cors.com:8080" origin1 := "https://origin2.cors.com" origin2 := "https://origin.com" @@ -265,7 +270,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should not break functionality", func() { - host := "cors.foo.com" + host := corsHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", "nginx.ingress.kubernetes.io/cors-allow-origin": "*", @@ -289,7 +294,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should not break functionality - without `*`", func() { - host := "cors.foo.com" + host := corsHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", } @@ -312,7 +317,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should not break functionality with extra domain", func() { - host := "cors.foo.com" + host := corsHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", "nginx.ingress.kubernetes.io/cors-allow-origin": "*, foo.bar.com", @@ -336,7 +341,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should not match", func() { - host := "cors.foo.com" + host := corsHost origin := "https://fooxbar.com" annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", @@ -356,8 +361,8 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should allow - single origin with required port", func() { - host := "cors.foo.com" - origin := "http://origin.com:8080" + host := corsHost + origin := originHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", "nginx.ingress.kubernetes.io/cors-allow-origin": "http://origin.cors.com:8080, http://origin.com:8080", @@ -384,8 +389,8 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should not allow - single origin with port and origin without port", func() { - host := "cors.foo.com" - origin := "http://origin.com:8080" + host := corsHost + origin := originHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", "nginx.ingress.kubernetes.io/cors-allow-origin": "https://origin2.cors.com, http://origin.com", @@ -403,7 +408,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should not allow - single origin without port and origin with required port", func() { - host := "cors.foo.com" + host := corsHost origin := "http://origin.com" annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", @@ -423,7 +428,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should allow - matching origin with wildcard origin (2 subdomains)", func() { - host := "cors.foo.com" + host := corsHost origin := "http://foo.origin.cors.com" origin2 := "http://bar-foo.origin.cors.com" annotations := map[string]string{ @@ -466,7 +471,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should not allow - unmatching origin with wildcard origin (2 subdomains)", func() { - host := "cors.foo.com" + host := corsHost origin := "http://bar.foo.origin.cors.com" annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", @@ -486,7 +491,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should allow - matching origin+port with wildcard origin", func() { - host := "cors.foo.com" + host := corsHost origin := "http://abc.origin.com:8080" annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", @@ -513,7 +518,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should not allow - portless origin with wildcard origin", func() { - host := "cors.foo.com" + host := corsHost origin := "http://abc.origin.com" annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", @@ -533,8 +538,8 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should allow correct origins - missing subdomain + origin with wildcard origin and correct origin", func() { - host := "cors.foo.com" - badOrigin := "http://origin.com:8080" + host := corsHost + badOrigin := originHost origin := "http://bar.origin.com:8080" annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", @@ -569,7 +574,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should allow - missing origins (should allow all origins)", func() { - host := "cors.foo.com" + host := corsHost origin := "http://origin.com" origin2 := "http://book.origin.com" origin3 := "test.origin.com" diff --git a/test/e2e/annotations/customhttperrors.go b/test/e2e/annotations/customhttperrors.go index 3862f817b4..37a3e9695f 100644 --- a/test/e2e/annotations/customhttperrors.go +++ b/test/e2e/annotations/customhttperrors.go @@ -27,7 +27,7 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) -func errorBlockName(upstreamName string, errorCode string) string { +func errorBlockName(upstreamName, errorCode string) string { return fmt.Sprintf("@custom_%s_%s", upstreamName, errorCode) } diff --git a/test/e2e/annotations/default_backend.go b/test/e2e/annotations/default_backend.go index 53c98a3078..72ca303b57 100644 --- a/test/e2e/annotations/default_backend.go +++ b/test/e2e/annotations/default_backend.go @@ -48,18 +48,18 @@ var _ = framework.DescribeAnnotation("default-backend", func() { return strings.Contains(server, fmt.Sprintf("server_name %v", host)) }) - requestId := "something-unique" + requestID := "something-unique" f.HTTPTestClient(). GET("/alma/armud"). WithHeader("Host", host). - WithHeader("x-request-id", requestId). + WithHeader("x-request-id", requestID). Expect(). Status(http.StatusOK). Body().Contains("x-code=503"). Contains(fmt.Sprintf("x-ingress-name=%s", host)). Contains("x-service-name=invalid"). - Contains(fmt.Sprintf("x-request-id=%s", requestId)) + Contains(fmt.Sprintf("x-request-id=%s", requestID)) }) }) }) diff --git a/test/e2e/annotations/fromtowwwredirect.go b/test/e2e/annotations/fromtowwwredirect.go index 9201bedb79..4ee3d313cc 100644 --- a/test/e2e/annotations/fromtowwwredirect.go +++ b/test/e2e/annotations/fromtowwwredirect.go @@ -90,7 +90,7 @@ var _ = framework.DescribeAnnotation("from-to-www-redirect", func() { ginkgo.By("sending request to www should redirect to domain") f.HTTPTestClientWithTLSConfig(&tls.Config{ - InsecureSkipVerify: true, + InsecureSkipVerify: true, //nolint:gosec // Ignore the gosec error in testing ServerName: toHost, }). GET("/"). @@ -102,7 +102,7 @@ var _ = framework.DescribeAnnotation("from-to-www-redirect", func() { ginkgo.By("sending request to domain should not redirect to www") f.HTTPTestClientWithTLSConfig(&tls.Config{ - InsecureSkipVerify: true, + InsecureSkipVerify: true, //nolint:gosec // Ignore the gosec error in testing ServerName: fromHost, }). GET("/"). diff --git a/test/e2e/annotations/globalratelimit.go b/test/e2e/annotations/globalratelimit.go index 2efcc3558a..96be467fe0 100644 --- a/test/e2e/annotations/globalratelimit.go +++ b/test/e2e/annotations/globalratelimit.go @@ -47,7 +47,7 @@ var _ = framework.DescribeAnnotation("annotation-global-rate-limit", func() { ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) ing = f.EnsureIngress(ing) - namespace := strings.Replace(string(ing.UID), "-", "", -1) + namespace := strings.ReplaceAll(string(ing.UID), "-", "") serverConfig := "" f.WaitForNginxServer(host, func(server string) bool { diff --git a/test/e2e/annotations/grpc.go b/test/e2e/annotations/grpc.go index 243307df4c..4c121df49b 100644 --- a/test/e2e/annotations/grpc.go +++ b/test/e2e/annotations/grpc.go @@ -17,12 +17,11 @@ limitations under the License. package annotations import ( + "context" "crypto/tls" "fmt" "strings" - "context" - pb "github.com/moul/pb/grpcbin/go-grpc" "github.com/onsi/ginkgo/v2" "github.com/stretchr/testify/assert" @@ -36,6 +35,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const echoHost = "echo" + var _ = framework.DescribeAnnotation("backend-protocol - GRPC", func() { f := framework.NewDefaultFramework("grpc", framework.WithHTTPBunEnabled()) @@ -67,7 +68,7 @@ var _ = framework.DescribeAnnotation("backend-protocol - GRPC", func() { ginkgo.It("should return OK for service with backend protocol GRPC", func() { f.NewGRPCBinDeployment() - host := "echo" + host := echoHost svc := &corev1.Service{ ObjectMeta: metav1.ObjectMeta{ @@ -102,14 +103,15 @@ var _ = framework.DescribeAnnotation("backend-protocol - GRPC", func() { return strings.Contains(server, "grpc_pass grpc://upstream_balancer;") }) - conn, _ := grpc.Dial(f.GetNginxIP()+":443", + conn, err := grpc.Dial(f.GetNginxIP()+":443", grpc.WithTransportCredentials( credentials.NewTLS(&tls.Config{ - ServerName: "echo", - InsecureSkipVerify: true, + ServerName: echoHost, + InsecureSkipVerify: true, //nolint:gosec // Ignore certificate validation in testing }), ), ) + assert.Nil(ginkgo.GinkgoT(), err, "error creating a connection") defer conn.Close() client := pb.NewGRPCBinClient(conn) @@ -125,7 +127,7 @@ var _ = framework.DescribeAnnotation("backend-protocol - GRPC", func() { ginkgo.It("authorization metadata should be overwritten by external auth response headers", func() { f.NewGRPCBinDeployment() - host := "echo" + host := echoHost svc := &corev1.Service{ ObjectMeta: metav1.ObjectMeta{ @@ -162,14 +164,15 @@ var _ = framework.DescribeAnnotation("backend-protocol - GRPC", func() { return strings.Contains(server, "grpc_pass grpc://upstream_balancer;") }) - conn, _ := grpc.Dial(f.GetNginxIP()+":443", + conn, err := grpc.Dial(f.GetNginxIP()+":443", grpc.WithTransportCredentials( credentials.NewTLS(&tls.Config{ - ServerName: "echo", - InsecureSkipVerify: true, + ServerName: echoHost, + InsecureSkipVerify: true, //nolint:gosec // Ignore certificate validation in testing }), ), ) + assert.Nil(ginkgo.GinkgoT(), err) defer conn.Close() client := pb.NewGRPCBinClient(conn) @@ -180,13 +183,13 @@ var _ = framework.DescribeAnnotation("backend-protocol - GRPC", func() { assert.Nil(ginkgo.GinkgoT(), err) metadata := res.GetMetadata() - assert.Equal(ginkgo.GinkgoT(), "foo", metadata["authorization"].Values[0]) + assert.Equal(ginkgo.GinkgoT(), fooHost, metadata["authorization"].Values[0]) }) ginkgo.It("should return OK for service with backend protocol GRPCS", func() { f.NewGRPCBinDeployment() - host := "echo" + host := echoHost svc := &corev1.Service{ ObjectMeta: metav1.ObjectMeta{ @@ -226,14 +229,15 @@ var _ = framework.DescribeAnnotation("backend-protocol - GRPC", func() { return strings.Contains(server, "grpc_pass grpcs://upstream_balancer;") }) - conn, _ := grpc.Dial(f.GetNginxIP()+":443", + conn, err := grpc.Dial(f.GetNginxIP()+":443", grpc.WithTransportCredentials( credentials.NewTLS(&tls.Config{ - ServerName: "echo", - InsecureSkipVerify: true, + ServerName: echoHost, + InsecureSkipVerify: true, //nolint:gosec // Ignore the gosec error in testing }), ), ) + assert.Nil(ginkgo.GinkgoT(), err) defer conn.Close() client := pb.NewGRPCBinClient(conn) diff --git a/test/e2e/annotations/modsecurity/modsecurity.go b/test/e2e/annotations/modsecurity/modsecurity.go index 62c9bc8439..71e8963e3e 100644 --- a/test/e2e/annotations/modsecurity/modsecurity.go +++ b/test/e2e/annotations/modsecurity/modsecurity.go @@ -25,6 +25,17 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const ( + modSecurityFooHost = "modsecurity.foo.com" + defaultSnippet = `SecRuleEngine On + SecRequestBodyAccess On + SecAuditEngine RelevantOnly + SecAuditLogParts ABIJDEFHZ + SecAuditLog /dev/stdout + SecAuditLogType Serial + SecRule REQUEST_HEADERS:User-Agent \"block-ua\" \"log,deny,id:107,status:403,msg:\'UA blocked\'\"` +) + var _ = framework.DescribeAnnotation("modsecurity owasp", func() { f := framework.NewDefaultFramework("modsecuritylocation") @@ -33,7 +44,7 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { }) ginkgo.It("should enable modsecurity", func() { - host := "modsecurity.foo.com" + host := modSecurityFooHost nameSpace := f.Namespace annotations := map[string]string{ @@ -51,7 +62,7 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { }) ginkgo.It("should enable modsecurity with transaction ID and OWASP rules", func() { - host := "modsecurity.foo.com" + host := modSecurityFooHost nameSpace := f.Namespace annotations := map[string]string{ @@ -72,7 +83,7 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { }) ginkgo.It("should disable modsecurity", func() { - host := "modsecurity.foo.com" + host := modSecurityFooHost nameSpace := f.Namespace annotations := map[string]string{ @@ -89,7 +100,7 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { }) ginkgo.It("should enable modsecurity with snippet", func() { - host := "modsecurity.foo.com" + host := modSecurityFooHost nameSpace := f.Namespace annotations := map[string]string{ @@ -109,10 +120,11 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { ginkgo.It("should enable modsecurity without using 'modsecurity on;'", func() { f.SetNginxConfigMapData(map[string]string{ - "enable-modsecurity": "true"}, + "enable-modsecurity": "true", + }, ) - host := "modsecurity.foo.com" + host := modSecurityFooHost nameSpace := f.Namespace annotations := map[string]string{ @@ -131,10 +143,11 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { ginkgo.It("should disable modsecurity using 'modsecurity off;'", func() { f.SetNginxConfigMapData(map[string]string{ - "enable-modsecurity": "true"}, + "enable-modsecurity": "true", + }, ) - host := "modsecurity.foo.com" + host := modSecurityFooHost nameSpace := f.Namespace annotations := map[string]string{ @@ -151,16 +164,10 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { }) ginkgo.It("should enable modsecurity with snippet and block requests", func() { - host := "modsecurity.foo.com" + host := modSecurityFooHost nameSpace := f.Namespace - snippet := `SecRuleEngine On - SecRequestBodyAccess On - SecAuditEngine RelevantOnly - SecAuditLogParts ABIJDEFHZ - SecAuditLog /dev/stdout - SecAuditLogType Serial - SecRule REQUEST_HEADERS:User-Agent \"block-ua\" \"log,deny,id:107,status:403,msg:\'UA blocked\'\"` + snippet := defaultSnippet annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-modsecurity": "true", @@ -187,16 +194,10 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { }) ginkgo.It("should enable modsecurity globally and with modsecurity-snippet block requests", func() { - host := "modsecurity.foo.com" + host := modSecurityFooHost nameSpace := f.Namespace - snippet := `SecRuleEngine On - SecRequestBodyAccess On - SecAuditEngine RelevantOnly - SecAuditLogParts ABIJDEFHZ - SecAuditLog /dev/stdout - SecAuditLogType Serial - SecRule REQUEST_HEADERS:User-Agent \"block-ua\" \"log,deny,id:107,status:403,msg:\'UA blocked\'\"` + snippet := defaultSnippet annotations := map[string]string{ "nginx.ingress.kubernetes.io/modsecurity-snippet": snippet, @@ -223,16 +224,10 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { }) ginkgo.It("should enable modsecurity when enable-owasp-modsecurity-crs is set to true", func() { - host := "modsecurity.foo.com" + host := modSecurityFooHost nameSpace := f.Namespace - snippet := `SecRuleEngine On - SecRequestBodyAccess On - SecAuditEngine RelevantOnly - SecAuditLogParts ABIJDEFHZ - SecAuditLog /dev/stdout - SecAuditLogType Serial - SecRule REQUEST_HEADERS:User-Agent \"block-ua\" \"log,deny,id:107,status:403,msg:\'UA blocked\'\"` + snippet := defaultSnippet annotations := map[string]string{ "nginx.ingress.kubernetes.io/modsecurity-snippet": snippet, @@ -262,7 +257,7 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { }) ginkgo.It("should enable modsecurity through the config map", func() { - host := "modsecurity.foo.com" + host := modSecurityFooHost nameSpace := f.Namespace snippet := `SecRequestBodyAccess On @@ -303,7 +298,7 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { }) ginkgo.It("should enable modsecurity through the config map but ignore snippet as disabled by admin", func() { - host := "modsecurity.foo.com" + host := modSecurityFooHost nameSpace := f.Namespace snippet := `SecRequestBodyAccess On @@ -345,7 +340,7 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { }) ginkgo.It("should disable default modsecurity conf setting when modsecurity-snippet is specified", func() { - host := "modsecurity.foo.com" + host := modSecurityFooHost nameSpace := f.Namespace snippet := `SecRuleEngine On diff --git a/test/e2e/annotations/proxy.go b/test/e2e/annotations/proxy.go index c0c89eb43a..235b828e7a 100644 --- a/test/e2e/annotations/proxy.go +++ b/test/e2e/annotations/proxy.go @@ -25,6 +25,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const proxyRedirectToHost = "goodbye.com" + var _ = framework.DescribeAnnotation("proxy-*", func() { f := framework.NewDefaultFramework("proxy") host := "proxy.foo.com" @@ -38,7 +40,7 @@ var _ = framework.DescribeAnnotation("proxy-*", func() { annotations := make(map[string]string) annotations["nginx.ingress.kubernetes.io/proxy-redirect-from"] = proxyRedirectFrom - annotations["nginx.ingress.kubernetes.io/proxy-redirect-to"] = "goodbye.com" + annotations["nginx.ingress.kubernetes.io/proxy-redirect-to"] = proxyRedirectToHost ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) f.EnsureIngress(ing) @@ -54,7 +56,7 @@ var _ = framework.DescribeAnnotation("proxy-*", func() { annotations := make(map[string]string) annotations["nginx.ingress.kubernetes.io/proxy-redirect-from"] = proxyRedirectFrom - annotations["nginx.ingress.kubernetes.io/proxy-redirect-to"] = "goodbye.com" + annotations["nginx.ingress.kubernetes.io/proxy-redirect-to"] = proxyRedirectToHost ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) f.EnsureIngress(ing) @@ -67,7 +69,7 @@ var _ = framework.DescribeAnnotation("proxy-*", func() { ginkgo.It("should set proxy_redirect to hello.com goodbye.com", func() { proxyRedirectFrom := "hello.com" - proxyRedirectTo := "goodbye.com" + proxyRedirectTo := proxyRedirectToHost annotations := make(map[string]string) annotations["nginx.ingress.kubernetes.io/proxy-redirect-from"] = proxyRedirectFrom @@ -244,5 +246,4 @@ var _ = framework.DescribeAnnotation("proxy-*", func() { return strings.Contains(server, fmt.Sprintf("proxy_http_version %s;", proxyHTTPVersion)) }) }) - }) diff --git a/test/e2e/annotations/proxyssl.go b/test/e2e/annotations/proxyssl.go index 7f14c33932..989d681c1a 100644 --- a/test/e2e/annotations/proxyssl.go +++ b/test/e2e/annotations/proxyssl.go @@ -27,6 +27,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const proxySSLHost = "proxyssl.foo.com" + var _ = framework.DescribeAnnotation("proxy-ssl-*", func() { f := framework.NewDefaultFramework("proxyssl") @@ -35,7 +37,7 @@ var _ = framework.DescribeAnnotation("proxy-ssl-*", func() { }) ginkgo.It("should set valid proxy-ssl-secret", func() { - host := "proxyssl.foo.com" + host := proxySSLHost annotations := make(map[string]string) annotations["nginx.ingress.kubernetes.io/proxy-ssl-secret"] = f.Namespace + "/" + host @@ -62,7 +64,7 @@ var _ = framework.DescribeAnnotation("proxy-ssl-*", func() { }) ginkgo.It("should set valid proxy-ssl-secret, proxy-ssl-verify to on, proxy-ssl-verify-depth to 2, and proxy-ssl-server-name to on", func() { - host := "proxyssl.foo.com" + host := proxySSLHost annotations := make(map[string]string) annotations["nginx.ingress.kubernetes.io/proxy-ssl-secret"] = f.Namespace + "/" + host annotations["nginx.ingress.kubernetes.io/proxy-ssl-verify"] = "on" @@ -90,9 +92,9 @@ var _ = framework.DescribeAnnotation("proxy-ssl-*", func() { Expect(). Status(http.StatusOK) }) - + //nolint:dupl // Ignore dupl errors for similar test case ginkgo.It("should set valid proxy-ssl-secret, proxy-ssl-ciphers to HIGH:!AES", func() { - host := "proxyssl.foo.com" + host := proxySSLHost annotations := make(map[string]string) annotations["nginx.ingress.kubernetes.io/proxy-ssl-secret"] = f.Namespace + "/" + host annotations["nginx.ingress.kubernetes.io/proxy-ssl-ciphers"] = "HIGH:!AES" @@ -118,9 +120,9 @@ var _ = framework.DescribeAnnotation("proxy-ssl-*", func() { Expect(). Status(http.StatusOK) }) - + //nolint:dupl // Ignore dupl errors for similar test case ginkgo.It("should set valid proxy-ssl-secret, proxy-ssl-protocols", func() { - host := "proxyssl.foo.com" + host := proxySSLHost annotations := make(map[string]string) annotations["nginx.ingress.kubernetes.io/proxy-ssl-secret"] = f.Namespace + "/" + host annotations["nginx.ingress.kubernetes.io/proxy-ssl-protocols"] = "TLSv1.2 TLSv1.3" @@ -195,7 +197,6 @@ var _ = framework.DescribeAnnotation("proxy-ssl-*", func() { strings.Contains(server, "proxy_ssl_certificate_key")) }) }) - }) func assertProxySSL(f *framework.Framework, host, sslName, ciphers, protocols, verify string, depth int, proxySSLServerName string) { diff --git a/test/e2e/annotations/rewrite.go b/test/e2e/annotations/rewrite.go index 79738b9840..173df29f00 100644 --- a/test/e2e/annotations/rewrite.go +++ b/test/e2e/annotations/rewrite.go @@ -27,6 +27,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const rewriteHost = "rewrite.bar.com" + var _ = framework.DescribeAnnotation("rewrite-target use-regex enable-rewrite-log", func() { f := framework.NewDefaultFramework("rewrite") @@ -37,7 +39,7 @@ var _ = framework.DescribeAnnotation("rewrite-target use-regex enable-rewrite-lo ginkgo.It("should write rewrite logs", func() { ginkgo.By("setting enable-rewrite-log annotation") - host := "rewrite.bar.com" + host := rewriteHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/rewrite-target": "/", "nginx.ingress.kubernetes.io/enable-rewrite-log": "true", @@ -64,7 +66,7 @@ var _ = framework.DescribeAnnotation("rewrite-target use-regex enable-rewrite-lo }) ginkgo.It("should use correct longest path match", func() { - host := "rewrite.bar.com" + host := rewriteHost ginkgo.By("creating a regular ingress definition") ing := framework.NewSingleIngress("kube-lego", "/.well-known/acme/challenge", host, f.Namespace, framework.EchoService, 80, nil) @@ -109,10 +111,10 @@ var _ = framework.DescribeAnnotation("rewrite-target use-regex enable-rewrite-lo }) ginkgo.It("should use ~* location modifier if regex annotation is present", func() { - host := "rewrite.bar.com" + host := rewriteHost ginkgo.By("creating a regular ingress definition") - ing := framework.NewSingleIngress("foo", "/foo", host, f.Namespace, framework.EchoService, 80, nil) + ing := framework.NewSingleIngress(fooHost, "/foo", host, f.Namespace, framework.EchoService, 80, nil) f.EnsureIngress(ing) f.WaitForNginxServer(host, @@ -156,10 +158,10 @@ var _ = framework.DescribeAnnotation("rewrite-target use-regex enable-rewrite-lo }) ginkgo.It("should fail to use longest match for documented warning", func() { - host := "rewrite.bar.com" + host := rewriteHost ginkgo.By("creating a regular ingress definition") - ing := framework.NewSingleIngress("foo", "/foo/bar/bar", host, f.Namespace, framework.EchoService, 80, nil) + ing := framework.NewSingleIngress(fooHost, "/foo/bar/bar", host, f.Namespace, framework.EchoService, 80, nil) f.EnsureIngress(ing) ginkgo.By(`creating an ingress definition with the use-regex annotation`) @@ -188,7 +190,7 @@ var _ = framework.DescribeAnnotation("rewrite-target use-regex enable-rewrite-lo }) ginkgo.It("should allow for custom rewrite parameters", func() { - host := "rewrite.bar.com" + host := rewriteHost ginkgo.By(`creating an ingress definition with the use-regex annotation`) annotations := map[string]string{ diff --git a/test/e2e/annotations/serversnippet.go b/test/e2e/annotations/serversnippet.go index df1383bdbf..e74fa37f5e 100644 --- a/test/e2e/annotations/serversnippet.go +++ b/test/e2e/annotations/serversnippet.go @@ -89,6 +89,5 @@ var _ = framework.DescribeAnnotation("server-snippet", func() { Status(http.StatusOK).Headers(). NotContainsKey("Foo"). NotContainsKey("Xpto") - }) }) diff --git a/test/e2e/annotations/serviceupstream.go b/test/e2e/annotations/serviceupstream.go index 0606a2d61c..1d80f304a8 100644 --- a/test/e2e/annotations/serviceupstream.go +++ b/test/e2e/annotations/serviceupstream.go @@ -27,6 +27,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const dbgCmd = "/dbg backends all" + var _ = framework.DescribeAnnotation("service-upstream", func() { f := framework.NewDefaultFramework("serviceupstream") host := "serviceupstream" @@ -57,10 +59,9 @@ var _ = framework.DescribeAnnotation("service-upstream", func() { ginkgo.By("checking if the Service Cluster IP and Port are used") s := f.GetService(f.Namespace, framework.EchoService) - dbgCmd := "/dbg backends all" output, err := f.ExecIngressPod(dbgCmd) assert.Nil(ginkgo.GinkgoT(), err) - assert.Contains(ginkgo.GinkgoT(), output, fmt.Sprintf(`"address": "%s"`, s.Spec.ClusterIP)) + assert.Contains(ginkgo.GinkgoT(), output, fmt.Sprintf(`"address": %q`, s.Spec.ClusterIP)) }) }) @@ -86,10 +87,9 @@ var _ = framework.DescribeAnnotation("service-upstream", func() { ginkgo.By("checking if the Service Cluster IP and Port are used") s := f.GetService(f.Namespace, framework.EchoService) - dbgCmd := "/dbg backends all" output, err := f.ExecIngressPod(dbgCmd) assert.Nil(ginkgo.GinkgoT(), err) - assert.Contains(ginkgo.GinkgoT(), output, fmt.Sprintf(`"address": "%s"`, s.Spec.ClusterIP)) + assert.Contains(ginkgo.GinkgoT(), output, fmt.Sprintf(`"address": %q`, s.Spec.ClusterIP)) }) }) @@ -117,10 +117,9 @@ var _ = framework.DescribeAnnotation("service-upstream", func() { ginkgo.By("checking if the Service Cluster IP and Port are not used") s := f.GetService(f.Namespace, framework.EchoService) - dbgCmd := "/dbg backends all" output, err := f.ExecIngressPod(dbgCmd) assert.Nil(ginkgo.GinkgoT(), err) - assert.NotContains(ginkgo.GinkgoT(), output, fmt.Sprintf(`"address": "%s"`, s.Spec.ClusterIP)) + assert.NotContains(ginkgo.GinkgoT(), output, fmt.Sprintf(`"address": %q`, s.Spec.ClusterIP)) }) }) }) diff --git a/test/e2e/annotations/upstreamhashby.go b/test/e2e/annotations/upstreamhashby.go index 023a094aa8..1b81066627 100644 --- a/test/e2e/annotations/upstreamhashby.go +++ b/test/e2e/annotations/upstreamhashby.go @@ -39,12 +39,13 @@ func startIngress(f *framework.Framework, annotations map[string]string) map[str return strings.Contains(server, fmt.Sprintf("server_name %s ;", host)) }) + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated err := wait.Poll(framework.Poll, framework.DefaultTimeout, func() (bool, error) { - resp := f.HTTPTestClient(). GET("/"). WithHeader("Host", host). Expect().Raw() + defer resp.Body.Close() if resp.StatusCode == http.StatusOK { return true, nil @@ -55,7 +56,9 @@ func startIngress(f *framework.Framework, annotations map[string]string) map[str assert.Nil(ginkgo.GinkgoT(), err) - re, _ := regexp.Compile(fmt.Sprintf(`Hostname: %v.*`, framework.EchoService)) + re, err := regexp.Compile(fmt.Sprintf(`Hostname: %v.*`, framework.EchoService)) + assert.Nil(ginkgo.GinkgoT(), err, "error compiling regex") + podMap := map[string]bool{} for i := 0; i < 100; i++ { diff --git a/test/e2e/dbg/main.go b/test/e2e/dbg/main.go index 2df57469db..6c0a22f695 100644 --- a/test/e2e/dbg/main.go +++ b/test/e2e/dbg/main.go @@ -49,7 +49,7 @@ var _ = framework.IngressNginxDescribe("Debug CLI", func() { assert.Nil(ginkgo.GinkgoT(), err) // Should be 2: the default and the echo deployment - numUpstreams := len(strings.Split(strings.Trim(string(output), "\n"), "\n")) + numUpstreams := len(strings.Split(strings.Trim(output, "\n"), "\n")) assert.Equal(ginkgo.GinkgoT(), numUpstreams, 2) }) @@ -67,7 +67,7 @@ var _ = framework.IngressNginxDescribe("Debug CLI", func() { output, err := f.ExecIngressPod(cmd) assert.Nil(ginkgo.GinkgoT(), err) - backends := strings.Split(string(output), "\n") + backends := strings.Split(output, "\n") assert.Greater(ginkgo.GinkgoT(), len(backends), 0) getCmd := "/dbg backends get " + backends[0] diff --git a/test/e2e/e2e.go b/test/e2e/e2e.go index 28adf297d6..25d714f884 100644 --- a/test/e2e/e2e.go +++ b/test/e2e/e2e.go @@ -48,7 +48,6 @@ import ( _ "k8s.io/ingress-nginx/test/e2e/settings/modsecurity" _ "k8s.io/ingress-nginx/test/e2e/settings/ocsp" _ "k8s.io/ingress-nginx/test/e2e/settings/validations" - _ "k8s.io/ingress-nginx/test/e2e/ssl" _ "k8s.io/ingress-nginx/test/e2e/status" _ "k8s.io/ingress-nginx/test/e2e/tcpudp" diff --git a/test/e2e/e2e_test.go b/test/e2e/e2e_test.go index 4a7a48d92b..2e556cf6d4 100644 --- a/test/e2e/e2e_test.go +++ b/test/e2e/e2e_test.go @@ -26,6 +26,7 @@ func init() { testing.Init() framework.RegisterParseFlags() } + func TestE2E(t *testing.T) { RunE2ETests(t) } diff --git a/test/e2e/endpointslices/longname.go b/test/e2e/endpointslices/longname.go index 0adb667671..b2242daacc 100644 --- a/test/e2e/endpointslices/longname.go +++ b/test/e2e/endpointslices/longname.go @@ -36,7 +36,6 @@ var _ = framework.IngressNginxDescribe("[Endpointslices] long service name", fun }) ginkgo.It("should return 200 when service name has max allowed number of characters 63", func() { - annotations := make(map[string]string) ing := framework.NewSingleIngress(host, "/", host, f.Namespace, name, 80, annotations) f.EnsureIngress(ing) diff --git a/test/e2e/endpointslices/topology.go b/test/e2e/endpointslices/topology.go index 2197bcb533..38c5f8b761 100644 --- a/test/e2e/endpointslices/topology.go +++ b/test/e2e/endpointslices/topology.go @@ -40,7 +40,6 @@ var _ = framework.IngressNginxDescribeSerial("[TopologyHints] topology aware rou }) ginkgo.It("should return 200 when service has topology hints", func() { - annotations := make(map[string]string) ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) f.EnsureIngress(ing) @@ -85,7 +84,7 @@ var _ = framework.IngressNginxDescribeSerial("[TopologyHints] topology aware rou } if gotHints { - //we have 2 replics, if there is just one backend it means that we are routing according slices hints to same zone as controller is + // we have 2 replics, if there is just one backend it means that we are routing according slices hints to same zone as controller is assert.Equal(ginkgo.GinkgoT(), 1, gotBackends) } else { // two replicas should have two endpoints without topology hints diff --git a/test/e2e/framework/deployment.go b/test/e2e/framework/deployment.go index 93e1811ecf..7ac150dcfa 100644 --- a/test/e2e/framework/deployment.go +++ b/test/e2e/framework/deployment.go @@ -50,7 +50,7 @@ var HTTPBunImage = os.Getenv("HTTPBUN_IMAGE") const EchoImage = "registry.k8s.io/ingress-nginx/e2e-test-echo@sha256:4938d1d91a2b7d19454460a8c1b010b89f6ff92d2987fd889ac3e8fc3b70d91a" // TODO: change all Deployment functions to use these options -// in order to reduce complexity and have a unified API accross the +// in order to reduce complexity and have a unified API across the // framework type deploymentOptions struct { name string @@ -317,7 +317,7 @@ func (f *Framework) GetNginxBaseImage() string { // NGINXDeployment creates a new simple NGINX Deployment using NGINX base image // and passing the desired configuration -func (f *Framework) NGINXDeployment(name string, cfg string, waitendpoint bool) { +func (f *Framework) NGINXDeployment(name, cfg string, waitendpoint bool) { cfgMap := map[string]string{ "nginx.conf": cfg, } @@ -389,7 +389,7 @@ func (f *Framework) NGINXDeployment(name string, cfg string, waitendpoint bool) } // NGINXWithConfigDeployment creates an NGINX deployment using a configmap containing the nginx.conf configuration -func (f *Framework) NGINXWithConfigDeployment(name string, cfg string) { +func (f *Framework) NGINXWithConfigDeployment(name, cfg string) { f.NGINXDeployment(name, cfg, true) } @@ -487,7 +487,8 @@ func (f *Framework) NewGRPCBinDeployment() { } func newDeployment(name, namespace, image string, port int32, replicas int32, command []string, args []string, env []corev1.EnvVar, - volumeMounts []corev1.VolumeMount, volumes []corev1.Volume, setProbe bool) *appsv1.Deployment { + volumeMounts []corev1.VolumeMount, volumes []corev1.Volume, setProbe bool, +) *appsv1.Deployment { probe := &corev1.Probe{ InitialDelaySeconds: 2, PeriodSeconds: 1, @@ -559,12 +560,12 @@ func newDeployment(name, namespace, image string, port int32, replicas int32, co return d } -func (f *Framework) NewDeployment(name, image string, port int32, replicas int32) { +func (f *Framework) NewDeployment(name, image string, port, replicas int32) { f.NewDeploymentWithOpts(name, image, port, replicas, nil, nil, nil, nil, nil, true) } // NewDeployment creates a new deployment in a particular namespace. -func (f *Framework) NewDeploymentWithOpts(name, image string, port int32, replicas int32, command []string, args []string, env []corev1.EnvVar, volumeMounts []corev1.VolumeMount, volumes []corev1.Volume, setProbe bool) { +func (f *Framework) NewDeploymentWithOpts(name, image string, port, replicas int32, command, args []string, env []corev1.EnvVar, volumeMounts []corev1.VolumeMount, volumes []corev1.Volume, setProbe bool) { deployment := newDeployment(name, f.Namespace, image, port, replicas, command, args, env, volumeMounts, volumes, setProbe) f.EnsureDeployment(deployment) @@ -606,7 +607,7 @@ func (f *Framework) DeleteDeployment(name string) error { }) assert.Nil(ginkgo.GinkgoT(), err, "deleting deployment") - return waitForPodsDeleted(f.KubeClientSet, 2*time.Minute, f.Namespace, metav1.ListOptions{ + return waitForPodsDeleted(f.KubeClientSet, 2*time.Minute, f.Namespace, &metav1.ListOptions{ LabelSelector: labelSelectorToString(d.Spec.Selector.MatchLabels), }) } diff --git a/test/e2e/framework/exec.go b/test/e2e/framework/exec.go index 07bf09be80..9e4b551227 100644 --- a/test/e2e/framework/exec.go +++ b/test/e2e/framework/exec.go @@ -66,6 +66,7 @@ func (f *Framework) ExecCommand(pod *corev1.Pod, command string) (string, error) execErr bytes.Buffer ) + //nolint:gosec // Ignore G204 error cmd := exec.Command("/bin/bash", "-c", fmt.Sprintf("%v exec --namespace %s %s --container controller -- %s", KubectlPath, pod.Namespace, pod.Name, command)) cmd.Stdout = &execOut cmd.Stderr = &execErr @@ -73,7 +74,6 @@ func (f *Framework) ExecCommand(pod *corev1.Pod, command string) (string, error) err := cmd.Run() if err != nil { return "", fmt.Errorf("could not execute '%s %s': %v", cmd.Path, cmd.Args, err) - } if execErr.Len() > 0 { @@ -91,6 +91,7 @@ func (f *Framework) NamespaceContent() (string, error) { execErr bytes.Buffer ) + //nolint:gosec // Ignore G204 error cmd := exec.Command("/bin/bash", "-c", fmt.Sprintf("%v get pods,services,endpoints,deployments --namespace %s", KubectlPath, f.Namespace)) cmd.Stdout = &execOut cmd.Stderr = &execErr @@ -98,7 +99,6 @@ func (f *Framework) NamespaceContent() (string, error) { err := cmd.Run() if err != nil { return "", fmt.Errorf("could not execute '%s %s': %v", cmd.Path, cmd.Args, err) - } eout := strings.TrimSpace(execErr.String()) @@ -110,7 +110,7 @@ func (f *Framework) NamespaceContent() (string, error) { } // newIngressController deploys a new NGINX Ingress controller in a namespace -func (f *Framework) newIngressController(namespace string, namespaceOverlay string) error { +func (f *Framework) newIngressController(namespace, namespaceOverlay string) error { // Creates an nginx deployment isChroot, ok := os.LookupEnv("IS_CHROOT") if !ok { @@ -130,12 +130,11 @@ func (f *Framework) newIngressController(namespace string, namespaceOverlay stri return nil } -var ( - proxyRegexp = regexp.MustCompile("Starting to serve on .*:([0-9]+)") -) +var proxyRegexp = regexp.MustCompile(`Starting to serve on .*:(\d+)`) // KubectlProxy creates a proxy to kubernetes apiserver func (f *Framework) KubectlProxy(port int) (int, *exec.Cmd, error) { + //nolint:gosec // Ignore G204 error cmd := exec.Command("/bin/bash", "-c", fmt.Sprintf("%s proxy --accept-hosts=.* --address=0.0.0.0 --port=%d", KubectlPath, port)) stdout, stderr, err := startCmdAndStreamOutput(cmd) if err != nil { @@ -163,6 +162,7 @@ func (f *Framework) KubectlProxy(port int) (int, *exec.Cmd, error) { } func (f *Framework) UninstallChart() error { + //nolint:gosec //Ignore G204 error cmd := exec.Command("helm", "uninstall", "--namespace", f.Namespace, "nginx-ingress") _, err := cmd.CombinedOutput() if err != nil { diff --git a/test/e2e/framework/fastcgi_helloserver.go b/test/e2e/framework/fastcgi_helloserver.go index 719048c069..73f9ef340b 100644 --- a/test/e2e/framework/fastcgi_helloserver.go +++ b/test/e2e/framework/fastcgi_helloserver.go @@ -14,6 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ +//nolint:dupl // Ignore dupl errors for similar test case package framework import ( @@ -75,7 +76,7 @@ func (f *Framework) NewNewFastCGIHelloServerDeploymentWithReplicas(replicas int3 d := f.EnsureDeployment(deployment) - err := waitForPodsReady(f.KubeClientSet, DefaultTimeout, int(replicas), f.Namespace, metav1.ListOptions{ + err := waitForPodsReady(f.KubeClientSet, DefaultTimeout, int(replicas), f.Namespace, &metav1.ListOptions{ LabelSelector: fields.SelectorFromSet(fields.Set(d.Spec.Template.ObjectMeta.Labels)).String(), }) assert.Nil(ginkgo.GinkgoT(), err, "failed to wait for to become ready") diff --git a/test/e2e/framework/framework.go b/test/e2e/framework/framework.go index 69f6dae78c..b62ad691cc 100644 --- a/test/e2e/framework/framework.go +++ b/test/e2e/framework/framework.go @@ -49,10 +49,8 @@ const ( HTTPS RequestScheme = "https" ) -var ( - // KubectlPath defines the full path of the kubectl binary - KubectlPath = "/usr/local/bin/kubectl" -) +// KubectlPath defines the full path of the kubectl binary +var KubectlPath = "/usr/local/bin/kubectl" // Framework supports common operations used by e2e tests; it will keep a client & a namespace for you. type Framework struct { @@ -131,7 +129,6 @@ func (f *Framework) CreateEnvironment() { f.KubeClientSet, err = kubernetes.NewForConfig(f.KubeConfig) assert.Nil(ginkgo.GinkgoT(), err, "creating a kubernetes client") - } f.Namespace, err = CreateKubeNamespace(f.BaseName, f.KubeClientSet) @@ -250,9 +247,9 @@ func (f *Framework) GetNginxPodIP() string { } // GetURL returns the URL should be used to make a request to NGINX -func (f *Framework) GetURL(scheme RequestScheme) string { +func (f *Framework) GetURL(requestScheme RequestScheme) string { ip := f.GetNginxIP() - return fmt.Sprintf("%v://%v", scheme, ip) + return fmt.Sprintf("%v://%v", requestScheme, ip) } // GetIngressNGINXPod returns the ingress controller running pod @@ -270,6 +267,7 @@ func (f *Framework) updateIngressNGINXPod() error { // WaitForNginxServer waits until the nginx configuration contains a particular server section. // `cfg` passed to matcher is normalized by replacing all tabs and spaces with single space. func (f *Framework) WaitForNginxServer(name string, matcher func(cfg string) bool) { + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated err := wait.Poll(Poll, DefaultTimeout, f.matchNginxConditions(name, matcher)) assert.Nil(ginkgo.GinkgoT(), err, "waiting for nginx server condition/s") Sleep(1 * time.Second) @@ -278,13 +276,15 @@ func (f *Framework) WaitForNginxServer(name string, matcher func(cfg string) boo // WaitForNginxConfiguration waits until the nginx configuration contains a particular configuration // `cfg` passed to matcher is normalized by replacing all tabs and spaces with single space. func (f *Framework) WaitForNginxConfiguration(matcher func(cfg string) bool) { + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated err := wait.Poll(Poll, DefaultTimeout, f.matchNginxConditions("", matcher)) assert.Nil(ginkgo.GinkgoT(), err, "waiting for nginx server condition/s") Sleep(1 * time.Second) } // WaitForNginxCustomConfiguration waits until the nginx configuration given part (from, to) contains a particular configuration -func (f *Framework) WaitForNginxCustomConfiguration(from string, to string, matcher func(cfg string) bool) { +func (f *Framework) WaitForNginxCustomConfiguration(from, to string, matcher func(cfg string) bool) { + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated err := wait.Poll(Poll, DefaultTimeout, f.matchNginxCustomConditions(from, to, matcher)) assert.Nil(ginkgo.GinkgoT(), err, "waiting for nginx server condition/s") } @@ -325,7 +325,7 @@ func (f *Framework) matchNginxConditions(name string, matcher func(cfg string) b } } -func (f *Framework) matchNginxCustomConditions(from string, to string, matcher func(cfg string) bool) wait.ConditionFunc { +func (f *Framework) matchNginxCustomConditions(from, to string, matcher func(cfg string) bool) wait.ConditionFunc { return func() (bool, error) { cmd := fmt.Sprintf("cat /etc/nginx/nginx.conf| awk '/%v/,/%v/'", from, to) @@ -395,7 +395,7 @@ func (f *Framework) CreateConfigMap(name string, data map[string]string) { } // UpdateNginxConfigMapData updates single field in ingress-nginx's nginx-ingress-controller map data -func (f *Framework) UpdateNginxConfigMapData(key string, value string) { +func (f *Framework) UpdateNginxConfigMapData(key, value string) { config, err := f.getConfigMap("nginx-ingress-controller") assert.Nil(ginkgo.GinkgoT(), err) assert.NotNil(ginkgo.GinkgoT(), config, "expected a configmap but none returned") @@ -421,6 +421,7 @@ func (f *Framework) WaitForReload(fn func()) { fn() count := 0 + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated err := wait.Poll(1*time.Second, DefaultTimeout, func() (bool, error) { reloads := getReloadCount(f.pod, f.Namespace, f.KubeClientSet) // most of the cases reload the ingress controller @@ -441,8 +442,8 @@ func getReloadCount(pod *v1.Pod, namespace string, client kubernetes.Interface) assert.Nil(ginkgo.GinkgoT(), err, "obtaining NGINX Pod") reloadCount := 0 - for _, e := range events.Items { - if e.Reason == "RELOAD" && e.Type == v1.EventTypeNormal { + for i := range events.Items { + if events.Items[i].Reason == "RELOAD" && events.Items[i].Type == v1.EventTypeNormal { reloadCount++ } } @@ -457,7 +458,7 @@ func (f *Framework) DeleteNGINXPod(grace int64) { err := f.KubeClientSet.CoreV1().Pods(ns).Delete(context.TODO(), f.pod.GetName(), *metav1.NewDeleteOptions(grace)) assert.Nil(ginkgo.GinkgoT(), err, "deleting ingress nginx pod") - + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated err = wait.Poll(Poll, DefaultTimeout, func() (bool, error) { err := f.updateIngressNGINXPod() if err != nil || f.pod == nil { @@ -487,7 +488,7 @@ func (f *Framework) HTTPTestClientWithTLSConfig(config *tls.Config) *httpexpect. func (f *Framework) newHTTPTestClient(config *tls.Config, setIngressURL bool) *httpexpect.HTTPRequest { if config == nil { config = &tls.Config{ - InsecureSkipVerify: true, + InsecureSkipVerify: true, //nolint:gosec // Ignore the gosec error in testing } } var baseURL string @@ -507,12 +508,13 @@ func (f *Framework) newHTTPTestClient(config *tls.Config, setIngressURL bool) *h // WaitForNginxListening waits until NGINX starts accepting connections on a port func (f *Framework) WaitForNginxListening(port int) { - err := waitForPodsReady(f.KubeClientSet, DefaultTimeout, 1, f.Namespace, metav1.ListOptions{ + err := waitForPodsReady(f.KubeClientSet, DefaultTimeout, 1, f.Namespace, &metav1.ListOptions{ LabelSelector: "app.kubernetes.io/name=ingress-nginx", }) assert.Nil(ginkgo.GinkgoT(), err, "waiting for ingress pods to be ready") podIP := f.GetNginxIP() + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated err = wait.Poll(500*time.Millisecond, DefaultTimeout, func() (bool, error) { hostPort := net.JoinHostPort(podIP, fmt.Sprintf("%v", port)) conn, err := net.Dial("tcp", hostPort) @@ -529,7 +531,7 @@ func (f *Framework) WaitForNginxListening(port int) { // WaitForPod waits for a specific Pod to be ready, using a label selector func (f *Framework) WaitForPod(selector string, timeout time.Duration, shouldFail bool) { - err := waitForPodsReady(f.KubeClientSet, timeout, 1, f.Namespace, metav1.ListOptions{ + err := waitForPodsReady(f.KubeClientSet, timeout, 1, f.Namespace, &metav1.ListOptions{ LabelSelector: selector, }) @@ -541,7 +543,7 @@ func (f *Framework) WaitForPod(selector string, timeout time.Duration, shouldFai } // UpdateDeployment runs the given updateFunc on the deployment and waits for it to be updated -func UpdateDeployment(kubeClientSet kubernetes.Interface, namespace string, name string, replicas int, updateFunc func(d *appsv1.Deployment) error) error { +func UpdateDeployment(kubeClientSet kubernetes.Interface, namespace, name string, replicas int, updateFunc func(d *appsv1.Deployment) error) error { deployment, err := kubeClientSet.AppsV1().Deployments(namespace).Get(context.TODO(), name, metav1.GetOptions{}) if err != nil { return err @@ -571,7 +573,7 @@ func UpdateDeployment(kubeClientSet kubernetes.Interface, namespace string, name } } - err = waitForPodsReady(kubeClientSet, DefaultTimeout, replicas, namespace, metav1.ListOptions{ + err = waitForPodsReady(kubeClientSet, DefaultTimeout, replicas, namespace, &metav1.ListOptions{ LabelSelector: fields.SelectorFromSet(fields.Set(deployment.Spec.Template.ObjectMeta.Labels)).String(), }) if err != nil { @@ -582,6 +584,7 @@ func UpdateDeployment(kubeClientSet kubernetes.Interface, namespace string, name } func waitForDeploymentRollout(kubeClientSet kubernetes.Interface, resource *appsv1.Deployment) error { + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated return wait.Poll(Poll, 5*time.Minute, func() (bool, error) { d, err := kubeClientSet.AppsV1().Deployments(resource.Namespace).Get(context.TODO(), resource.Name, metav1.GetOptions{}) if apierrors.IsNotFound(err) { @@ -605,7 +608,7 @@ func waitForDeploymentRollout(kubeClientSet kubernetes.Interface, resource *apps } // UpdateIngress runs the given updateFunc on the ingress -func UpdateIngress(kubeClientSet kubernetes.Interface, namespace string, name string, updateFunc func(d *networking.Ingress) error) error { +func UpdateIngress(kubeClientSet kubernetes.Interface, namespace, name string, updateFunc func(d *networking.Ingress) error) error { ingress, err := kubeClientSet.NetworkingV1().Ingresses(namespace).Get(context.TODO(), name, metav1.GetOptions{}) if err != nil { return err diff --git a/test/e2e/framework/grpc_fortune_teller.go b/test/e2e/framework/grpc_fortune_teller.go index 02ff3aae28..a7be463274 100644 --- a/test/e2e/framework/grpc_fortune_teller.go +++ b/test/e2e/framework/grpc_fortune_teller.go @@ -14,6 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ +//nolint:dupl // Ignore dupl errors for similar test case package framework import ( @@ -75,7 +76,7 @@ func (f *Framework) NewNewGRPCFortuneTellerDeploymentWithReplicas(replicas int32 d := f.EnsureDeployment(deployment) - err := waitForPodsReady(f.KubeClientSet, DefaultTimeout, int(replicas), f.Namespace, metav1.ListOptions{ + err := waitForPodsReady(f.KubeClientSet, DefaultTimeout, int(replicas), f.Namespace, &metav1.ListOptions{ LabelSelector: fields.SelectorFromSet(fields.Set(d.Spec.Template.ObjectMeta.Labels)).String(), }) assert.Nil(ginkgo.GinkgoT(), err, "failed to wait for to become ready") diff --git a/test/e2e/framework/healthz.go b/test/e2e/framework/healthz.go index b52c3ffde1..3ee297b271 100644 --- a/test/e2e/framework/healthz.go +++ b/test/e2e/framework/healthz.go @@ -26,7 +26,7 @@ func (f *Framework) VerifyHealthz(ip string, statusCode int) error { url := fmt.Sprintf("http://%v:10254/healthz", ip) client := &http.Client{} - req, err := http.NewRequest(http.MethodGet, url, nil) + req, err := http.NewRequest(http.MethodGet, url, http.NoBody) if err != nil { return fmt.Errorf("creating GET request for URL %q failed: %v", url, err) } diff --git a/test/e2e/framework/httpexpect/match.go b/test/e2e/framework/httpexpect/match.go index b031510c47..aad10b02ec 100644 --- a/test/e2e/framework/httpexpect/match.go +++ b/test/e2e/framework/httpexpect/match.go @@ -23,7 +23,7 @@ type Match struct { names map[string]int } -func makeMatch(chain chain, submatches []string, names []string) *Match { +func makeMatch(chain chain, submatches, names []string) *Match { if submatches == nil { submatches = []string{} } diff --git a/test/e2e/framework/httpexpect/object.go b/test/e2e/framework/httpexpect/object.go index f7c27faaf4..49dcf56593 100644 --- a/test/e2e/framework/httpexpect/object.go +++ b/test/e2e/framework/httpexpect/object.go @@ -23,6 +23,8 @@ import ( "github.com/yudai/gojsondiff/formatter" ) +const unavailableMsg = " (unavailable)" + // Object provides methods to inspect attached map[string]interface{} object // (Go representation of JSON object). type Object struct { @@ -81,20 +83,21 @@ func diffValues(expected, actual interface{}) string { var diff gojsondiff.Diff - if ve, ok := expected.(map[string]interface{}); ok { + switch ve := expected.(type) { + case map[string]interface{}: if va, ok := actual.(map[string]interface{}); ok { diff = differ.CompareObjects(ve, va) } else { - return " (unavailable)" + return unavailableMsg } - } else if ve, ok := expected.([]interface{}); ok { + case []interface{}: if va, ok := actual.([]interface{}); ok { diff = differ.CompareArrays(ve, va) } else { - return " (unavailable)" + return unavailableMsg } - } else { - return " (unavailable)" + default: + return unavailableMsg } config := formatter.AsciiFormatterConfig{ @@ -104,7 +107,7 @@ func diffValues(expected, actual interface{}) string { str, err := f.Format(diff) if err != nil { - return " (unavailable)" + return unavailableMsg } return "--- expected\n+++ actual\n" + str diff --git a/test/e2e/framework/httpexpect/request.go b/test/e2e/framework/httpexpect/request.go index d8edb42ceb..0ae85dd793 100644 --- a/test/e2e/framework/httpexpect/request.go +++ b/test/e2e/framework/httpexpect/request.go @@ -65,7 +65,7 @@ func (h *HTTPRequest) DoRequest(method, rpath string) *HTTPRequest { var request *http.Request uri.Path = path.Join(uri.Path, rpath) - if request, err = http.NewRequest(method, uri.String(), nil); err != nil { + if request, err = http.NewRequest(method, uri.String(), http.NoBody); err != nil { h.chain.fail(err.Error()) } @@ -110,6 +110,7 @@ func (h *HTTPRequest) Expect() *HTTPResponse { if err != nil { h.chain.fail(err.Error()) } + defer response.Body.Close() h.HTTPResponse.Response = response // set the HTTP response diff --git a/test/e2e/framework/k8s.go b/test/e2e/framework/k8s.go index fc3e59b086..7c067421d9 100644 --- a/test/e2e/framework/k8s.go +++ b/test/e2e/framework/k8s.go @@ -47,7 +47,7 @@ func (f *Framework) EnsureSecret(secret *core.Secret) *core.Secret { } // GetConfigMap gets a ConfigMap object from the given namespace, name and returns it, throws error if it does not exist. -func (f *Framework) GetConfigMap(namespace string, name string) *core.ConfigMap { +func (f *Framework) GetConfigMap(namespace, name string) *core.ConfigMap { cm, err := f.KubeClientSet.CoreV1().ConfigMaps(namespace).Get(context.TODO(), name, metav1.GetOptions{}) assert.Nil(ginkgo.GinkgoT(), err, "getting configmap") assert.NotNil(ginkgo.GinkgoT(), cm, "expected a configmap but none returned") @@ -73,7 +73,7 @@ func (f *Framework) EnsureConfigMap(configMap *core.ConfigMap) *core.ConfigMap { } // GetIngress gets an Ingress object from the given namespace, name and returns it, throws error if it does not exists. -func (f *Framework) GetIngress(namespace string, name string) *networking.Ingress { +func (f *Framework) GetIngress(namespace, name string) *networking.Ingress { ing, err := f.KubeClientSet.NetworkingV1().Ingresses(namespace).Get(context.TODO(), name, metav1.GetOptions{}) assert.Nil(ginkgo.GinkgoT(), err, "getting ingress") assert.NotNil(ginkgo.GinkgoT(), ing, "expected an ingress but none returned") @@ -114,7 +114,7 @@ func (f *Framework) UpdateIngress(ingress *networking.Ingress) *networking.Ingre } // GetService gets a Service object from the given namespace, name and returns it, throws error if it does not exist. -func (f *Framework) GetService(namespace string, name string) *core.Service { +func (f *Framework) GetService(namespace, name string) *core.Service { s, err := f.KubeClientSet.CoreV1().Services(namespace).Get(context.TODO(), name, metav1.GetOptions{}) assert.Nil(ginkgo.GinkgoT(), err, "getting service") assert.NotNil(ginkgo.GinkgoT(), s, "expected a service but none returned") @@ -143,16 +143,21 @@ func (f *Framework) EnsureDeployment(deployment *appsv1.Deployment) *appsv1.Depl } // waitForPodsReady waits for a given amount of time until a group of Pods is running in the given namespace. -func waitForPodsReady(kubeClientSet kubernetes.Interface, timeout time.Duration, expectedReplicas int, namespace string, opts metav1.ListOptions) error { +func waitForPodsReady(kubeClientSet kubernetes.Interface, timeout time.Duration, expectedReplicas int, namespace string, opts *metav1.ListOptions) error { + //nolint:staticcheck // TODO: will replace it since wait.PollImmediate is deprecated return wait.PollImmediate(1*time.Second, timeout, func() (bool, error) { - pl, err := kubeClientSet.CoreV1().Pods(namespace).List(context.TODO(), opts) + pl, err := kubeClientSet.CoreV1().Pods(namespace).List(context.TODO(), *opts) if err != nil { return false, nil } r := 0 - for _, p := range pl.Items { - if isRunning, _ := podRunningReady(&p); isRunning { + for i := range pl.Items { + isRunning, err := podRunningReady(&pl.Items[i]) + if err != nil { + Logf("error checking if pod is running : %v", err) + } + if isRunning { r++ } } @@ -166,9 +171,10 @@ func waitForPodsReady(kubeClientSet kubernetes.Interface, timeout time.Duration, } // waitForPodsDeleted waits for a given amount of time until a group of Pods are deleted in the given namespace. -func waitForPodsDeleted(kubeClientSet kubernetes.Interface, timeout time.Duration, namespace string, opts metav1.ListOptions) error { +func waitForPodsDeleted(kubeClientSet kubernetes.Interface, timeout time.Duration, namespace string, opts *metav1.ListOptions) error { + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated return wait.Poll(Poll, timeout, func() (bool, error) { - pl, err := kubeClientSet.CoreV1().Pods(namespace).List(context.TODO(), opts) + pl, err := kubeClientSet.CoreV1().Pods(namespace).List(context.TODO(), *opts) if err != nil { return false, nil } @@ -186,7 +192,7 @@ func WaitForEndpoints(kubeClientSet kubernetes.Interface, timeout time.Duration, if expectedEndpoints == 0 { return nil } - + //nolint:staticcheck // TODO: will replace it since wait.PollImmediate is deprecated return wait.PollImmediate(Poll, timeout, func() (bool, error) { endpoint, err := kubeClientSet.CoreV1().Endpoints(ns).Get(context.TODO(), name, metav1.GetOptions{}) if k8sErrors.IsNotFound(err) { @@ -248,6 +254,7 @@ func isPodReady(p *core.Pod) bool { // getIngressNGINXPod returns the ingress controller running pod func getIngressNGINXPod(ns string, kubeClientSet kubernetes.Interface) (*core.Pod, error) { var pod *core.Pod + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated err := wait.Poll(1*time.Second, DefaultTimeout, func() (bool, error) { l, err := kubeClientSet.CoreV1().Pods(ns).List(context.TODO(), metav1.ListOptions{ LabelSelector: "app.kubernetes.io/name=ingress-nginx", @@ -256,15 +263,16 @@ func getIngressNGINXPod(ns string, kubeClientSet kubernetes.Interface) (*core.Po return false, nil } - for _, p := range l.Items { + for i := range l.Items { + p := &l.Items[i] if strings.HasPrefix(p.GetName(), "nginx-ingress-controller") { - isRunning, err := podRunningReady(&p) + isRunning, err := podRunningReady(p) if err != nil { continue } if isRunning { - pod = &p + pod = p return true, nil } } @@ -273,6 +281,7 @@ func getIngressNGINXPod(ns string, kubeClientSet kubernetes.Interface) (*core.Po return false, nil }) if err != nil { + //nolint:staticcheck // TODO: will replace it since wait.ErrWaitTimeout is deprecated if err == wait.ErrWaitTimeout { return nil, fmt.Errorf("timeout waiting at least one ingress-nginx pod running in namespace %v", ns) } @@ -285,7 +294,7 @@ func getIngressNGINXPod(ns string, kubeClientSet kubernetes.Interface) (*core.Po func createDeploymentWithRetries(c kubernetes.Interface, namespace string, obj *appsv1.Deployment) error { if obj == nil { - return fmt.Errorf("Object provided to create is empty") + return fmt.Errorf("object provided to create is empty") } createFunc := func() (bool, error) { _, err := c.AppsV1().Deployments(namespace).Create(context.TODO(), obj, metav1.CreateOptions{}) @@ -298,7 +307,7 @@ func createDeploymentWithRetries(c kubernetes.Interface, namespace string, obj * if isRetryableAPIError(err) { return false, nil } - return false, fmt.Errorf("Failed to create object with non-retriable error: %v", err) + return false, fmt.Errorf("failed to create object with non-retriable error: %v", err) } return retryWithExponentialBackOff(createFunc) @@ -306,7 +315,7 @@ func createDeploymentWithRetries(c kubernetes.Interface, namespace string, obj * func createSecretWithRetries(c kubernetes.Interface, namespace string, obj *core.Secret) error { if obj == nil { - return fmt.Errorf("Object provided to create is empty") + return fmt.Errorf("object provided to create is empty") } createFunc := func() (bool, error) { _, err := c.CoreV1().Secrets(namespace).Create(context.TODO(), obj, metav1.CreateOptions{}) @@ -319,14 +328,14 @@ func createSecretWithRetries(c kubernetes.Interface, namespace string, obj *core if isRetryableAPIError(err) { return false, nil } - return false, fmt.Errorf("Failed to create object with non-retriable error: %v", err) + return false, fmt.Errorf("failed to create object with non-retriable error: %v", err) } return retryWithExponentialBackOff(createFunc) } func createServiceWithRetries(c kubernetes.Interface, namespace string, obj *core.Service) error { if obj == nil { - return fmt.Errorf("Object provided to create is empty") + return fmt.Errorf("object provided to create is empty") } createFunc := func() (bool, error) { _, err := c.CoreV1().Services(namespace).Create(context.TODO(), obj, metav1.CreateOptions{}) @@ -339,7 +348,7 @@ func createServiceWithRetries(c kubernetes.Interface, namespace string, obj *cor if isRetryableAPIError(err) { return false, nil } - return false, fmt.Errorf("Failed to create object with non-retriable error: %v", err) + return false, fmt.Errorf("failed to create object with non-retriable error: %v", err) } return retryWithExponentialBackOff(createFunc) @@ -347,7 +356,7 @@ func createServiceWithRetries(c kubernetes.Interface, namespace string, obj *cor func createIngressWithRetries(c kubernetes.Interface, namespace string, obj *networking.Ingress) error { if obj == nil { - return fmt.Errorf("Object provided to create is empty") + return fmt.Errorf("object provided to create is empty") } createFunc := func() (bool, error) { _, err := c.NetworkingV1().Ingresses(namespace).Create(context.TODO(), obj, metav1.CreateOptions{}) @@ -360,7 +369,7 @@ func createIngressWithRetries(c kubernetes.Interface, namespace string, obj *net if isRetryableAPIError(err) { return false, nil } - return false, fmt.Errorf("Failed to create object with non-retriable error: %v", err) + return false, fmt.Errorf("failed to create object with non-retriable error: %v", err) } return retryWithExponentialBackOff(createFunc) @@ -368,7 +377,7 @@ func createIngressWithRetries(c kubernetes.Interface, namespace string, obj *net func updateIngressWithRetries(c kubernetes.Interface, namespace string, obj *networking.Ingress) error { if obj == nil { - return fmt.Errorf("Object provided to create is empty") + return fmt.Errorf("object provided to create is empty") } updateFunc := func() (bool, error) { _, err := c.NetworkingV1().Ingresses(namespace).Update(context.TODO(), obj, metav1.UpdateOptions{}) @@ -378,7 +387,7 @@ func updateIngressWithRetries(c kubernetes.Interface, namespace string, obj *net if isRetryableAPIError(err) { return false, nil } - return false, fmt.Errorf("Failed to update object with non-retriable error: %v", err) + return false, fmt.Errorf("failed to update object with non-retriable error: %v", err) } return retryWithExponentialBackOff(updateFunc) diff --git a/test/e2e/framework/metrics.go b/test/e2e/framework/metrics.go index 8302375400..774f1bd7e5 100644 --- a/test/e2e/framework/metrics.go +++ b/test/e2e/framework/metrics.go @@ -29,7 +29,7 @@ func (f *Framework) GetMetric(metricName, ip string) (*dto.MetricFamily, error) url := fmt.Sprintf("http://%v:10254/metrics", ip) client := &http.Client{} - req, err := http.NewRequest(http.MethodGet, url, nil) + req, err := http.NewRequest(http.MethodGet, url, http.NoBody) if err != nil { return nil, fmt.Errorf("creating GET request for URL %q failed: %v", url, err) } @@ -44,7 +44,6 @@ func (f *Framework) GetMetric(metricName, ip string) (*dto.MetricFamily, error) var parser expfmt.TextParser metrics, err := parser.TextToMetricFamilies(resp.Body) - if err != nil { return nil, fmt.Errorf("reading text format failed: %v", err) } diff --git a/test/e2e/framework/ssl.go b/test/e2e/framework/ssl.go index 52ceffc574..d6252fe479 100644 --- a/test/e2e/framework/ssl.go +++ b/test/e2e/framework/ssl.go @@ -93,8 +93,8 @@ func CreateIngressTLSSecret(client kubernetes.Interface, hosts []string, secretN // CreateIngressMASecret creates or updates a Secret containing a Mutual Auth // certificate-chain for the given Ingress and returns a TLS configuration suitable // for HTTP clients to use against that particular Ingress. -func CreateIngressMASecret(client kubernetes.Interface, host string, secretName, namespace string) (*tls.Config, error) { - if len(host) == 0 { +func CreateIngressMASecret(client kubernetes.Interface, host, secretName, namespace string) (*tls.Config, error) { + if host == "" { return nil, fmt.Errorf("requires a non-empty host") } @@ -138,12 +138,13 @@ func CreateIngressMASecret(client kubernetes.Interface, host string, secretName, return &tls.Config{ ServerName: host, Certificates: []tls.Certificate{clientPair}, - InsecureSkipVerify: true, + InsecureSkipVerify: true, //nolint:gosec // Ignore the gosec error in testing }, nil } // WaitForTLS waits until the TLS handshake with a given server completes successfully. func WaitForTLS(url string, tlsConfig *tls.Config) { + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated err := wait.Poll(Poll, DefaultTimeout, matchTLSServerName(url, tlsConfig)) assert.Nil(ginkgo.GinkgoT(), err, "waiting for TLS configuration in URL %s", url) } @@ -160,7 +161,6 @@ func generateRSACert(host string, isCA bool, keyOut, certOut io.Writer) error { serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128) serialNumber, err := rand.Int(rand.Reader, serialNumberLimit) - if err != nil { return fmt.Errorf("failed to generate serial number: %s", err) } @@ -329,7 +329,7 @@ func tlsConfig(serverName string, pemCA []byte) (*tls.Config, error) { if !rootCAPool.AppendCertsFromPEM(pemCA) { return nil, fmt.Errorf("error creating CA certificate pool (%s)", serverName) } - return &tls.Config{ + return &tls.Config{ //nolint:gosec // Ignore the gosec error in testing ServerName: serverName, RootCAs: rootCAPool, }, nil diff --git a/test/e2e/framework/test_context.go b/test/e2e/framework/test_context.go index be4cd6e5e0..961357885e 100644 --- a/test/e2e/framework/test_context.go +++ b/test/e2e/framework/test_context.go @@ -23,7 +23,7 @@ import ( // TestContextType describes the client context to use in communications with the Kubernetes API. type TestContextType struct { KubeHost string - //KubeConfig string + // KubeConfig string KubeContext string } @@ -33,7 +33,6 @@ var TestContext TestContextType // registerCommonFlags registers flags common to all e2e test suites. func registerCommonFlags() { flag.StringVar(&TestContext.KubeHost, "kubernetes-host", "http://127.0.0.1:8080", "The kubernetes host, or apiserver, to connect to") - //flag.StringVar(&TestContext.KubeConfig, "kubernetes-config", os.Getenv(clientcmd.RecommendedConfigPathEnvVar), "Path to config containing embedded authinfo for kubernetes. Default value is from environment variable "+clientcmd.RecommendedConfigPathEnvVar) flag.StringVar(&TestContext.KubeContext, "kubernetes-context", "", "config context to use for kubernetes. If unset, will use value from 'current-context'") } diff --git a/test/e2e/framework/util.go b/test/e2e/framework/util.go index 90f15eb1bb..abdb168e1e 100644 --- a/test/e2e/framework/util.go +++ b/test/e2e/framework/util.go @@ -49,24 +49,24 @@ func nowStamp() string { return time.Now().Format(time.StampMilli) } -func log(level string, format string, args ...interface{}) { +func logf(level, format string, args ...interface{}) { fmt.Fprintf(ginkgo.GinkgoWriter, nowStamp()+": "+level+": "+format+"\n", args...) } // Logf logs to the INFO logs. func Logf(format string, args ...interface{}) { - log("INFO", format, args...) + logf("INFO", format, args...) } // Failf logs to the INFO logs and fails the test. func Failf(format string, args ...interface{}) { msg := fmt.Sprintf(format, args...) - log("INFO", msg) + logf("INFO", msg) ginkgo.Fail(nowStamp()+": "+msg, 1) } // RestclientConfig deserializes the contents of a kubeconfig file into a Config object. -func RestclientConfig(config, context string) (*api.Config, error) { +func RestclientConfig(config, newContext string) (*api.Config, error) { Logf(">>> config: %s\n", config) if config == "" { return nil, fmt.Errorf("config file must be specified to load client config") @@ -75,9 +75,9 @@ func RestclientConfig(config, context string) (*api.Config, error) { if err != nil { return nil, fmt.Errorf("error loading config: %v", err.Error()) } - if context != "" { - Logf(">>> context: %s\n", context) - c.CurrentContext = context + if newContext != "" { + Logf(">>> context: %s\n", newContext) + c.CurrentContext = newContext } return c, nil } @@ -98,6 +98,7 @@ func createNamespace(baseName string, labels map[string]string, c kubernetes.Int var got *corev1.Namespace var err error + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated err = wait.Poll(Poll, DefaultTimeout, func() (bool, error) { got, err = c.CoreV1().Namespaces().Create(context.TODO(), ns, metav1.CreateOptions{}) if err != nil { @@ -114,13 +115,11 @@ func createNamespace(baseName string, labels map[string]string, c kubernetes.Int // CreateKubeNamespace creates a new namespace in the cluster func CreateKubeNamespace(baseName string, c kubernetes.Interface) (string, error) { - return createNamespace(baseName, nil, c) } // CreateKubeNamespaceWithLabel creates a new namespace with given labels in the cluster func CreateKubeNamespaceWithLabel(baseName string, labels map[string]string, c kubernetes.Interface) (string, error) { - return createNamespace(baseName, labels, c) } @@ -150,7 +149,7 @@ func CreateIngressClass(namespace string, c kubernetes.Interface) (string, error }, }, metav1.CreateOptions{}) if err != nil { - return "", fmt.Errorf("Unexpected error creating IngressClass %s: %v", icname, err) + return "", fmt.Errorf("unexpected error creating IngressClass %s: %v", icname, err) } _, err = c.RbacV1().ClusterRoles().Create(context.TODO(), &rbacv1.ClusterRole{ @@ -162,7 +161,7 @@ func CreateIngressClass(namespace string, c kubernetes.Interface) (string, error }}, }, metav1.CreateOptions{}) if err != nil { - return "", fmt.Errorf("Unexpected error creating IngressClass ClusterRole %s: %v", icname, err) + return "", fmt.Errorf("unexpected error creating IngressClass ClusterRole %s: %v", icname, err) } _, err = c.RbacV1().ClusterRoleBindings().Create(context.TODO(), &rbacv1.ClusterRoleBinding{ @@ -184,7 +183,7 @@ func CreateIngressClass(namespace string, c kubernetes.Interface) (string, error }, }, metav1.CreateOptions{}) if err != nil { - return "", fmt.Errorf("Unexpected error creating IngressClass ClusterRoleBinding %s: %v", icname, err) + return "", fmt.Errorf("unexpected error creating IngressClass ClusterRoleBinding %s: %v", icname, err) } return ic.Name, nil } @@ -200,16 +199,16 @@ func deleteIngressClass(c kubernetes.Interface, ingressclass string) error { } err = c.NetworkingV1().IngressClasses().Delete(context.TODO(), ingressclass, deleteOptions) if err != nil { - return fmt.Errorf("Unexpected error deleting IngressClass %s: %v", ingressclass, err) + return fmt.Errorf("unexpected error deleting IngressClass %s: %v", ingressclass, err) } err = c.RbacV1().ClusterRoleBindings().Delete(context.TODO(), ingressclass, deleteOptions) if err != nil { - return fmt.Errorf("Unexpected error deleting IngressClass ClusterRoleBinding %s: %v", ingressclass, err) + return fmt.Errorf("unexpected error deleting IngressClass ClusterRoleBinding %s: %v", ingressclass, err) } err = c.RbacV1().ClusterRoles().Delete(context.TODO(), ingressclass, deleteOptions) if err != nil { - return fmt.Errorf("Unexpected error deleting IngressClass ClusterRole %s: %v", ingressclass, err) + return fmt.Errorf("unexpected error deleting IngressClass ClusterRole %s: %v", ingressclass, err) } return nil @@ -223,6 +222,7 @@ func GetIngressClassName(namespace string) *string { // WaitForKubeNamespaceNotExist waits until a namespaces is not present in the cluster func WaitForKubeNamespaceNotExist(c kubernetes.Interface, namespace string) error { + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated return wait.Poll(Poll, DefaultTimeout, namespaceNotExist(c, namespace)) } @@ -241,6 +241,7 @@ func namespaceNotExist(c kubernetes.Interface, namespace string) wait.ConditionF // WaitForNoPodsInNamespace waits until there are no pods running in a namespace func WaitForNoPodsInNamespace(c kubernetes.Interface, namespace string) error { + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated return wait.Poll(Poll, DefaultTimeout, noPodsInNamespace(c, namespace)) } @@ -267,15 +268,17 @@ func WaitForPodRunningInNamespace(c kubernetes.Interface, pod *corev1.Pod) error if pod.Status.Phase == corev1.PodRunning { return nil } - return waitTimeoutForPodRunningInNamespace(c, pod.Name, pod.Namespace, DefaultTimeout) + return waitTimeoutForPodRunningInNamespace(c, pod.Name, pod.Namespace) } -func waitTimeoutForPodRunningInNamespace(c kubernetes.Interface, podName, namespace string, timeout time.Duration) error { +func waitTimeoutForPodRunningInNamespace(c kubernetes.Interface, podName, namespace string) error { + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated return wait.Poll(Poll, DefaultTimeout, podRunning(c, podName, namespace)) } // WaitForSecretInNamespace waits a default amount of time for the specified secret is present in a particular namespace func WaitForSecretInNamespace(c kubernetes.Interface, namespace, name string) error { + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated return wait.Poll(Poll, DefaultTimeout, secretInNamespace(c, namespace, name)) } @@ -298,6 +301,7 @@ func secretInNamespace(c kubernetes.Interface, namespace, name string) wait.Cond // WaitForFileInFS waits a default amount of time for the specified file is present in the filesystem func WaitForFileInFS(file string) error { + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated return wait.Poll(Poll, DefaultTimeout, fileInFS(file)) } @@ -322,6 +326,7 @@ func fileInFS(file string) wait.ConditionFunc { // WaitForNoIngressInNamespace waits until there is no ingress object in a particular namespace func WaitForNoIngressInNamespace(c kubernetes.Interface, namespace, name string) error { + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated return wait.Poll(Poll, DefaultTimeout, noIngressInNamespace(c, namespace, name)) } @@ -344,6 +349,7 @@ func noIngressInNamespace(c kubernetes.Interface, namespace, name string) wait.C // WaitForIngressInNamespace waits until a particular ingress object exists namespace func WaitForIngressInNamespace(c kubernetes.Interface, namespace, name string) error { + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated return wait.Poll(Poll, DefaultTimeout, ingressInNamespace(c, namespace, name)) } diff --git a/test/e2e/gracefulshutdown/grace_period.go b/test/e2e/gracefulshutdown/grace_period.go index 12e2f3d67d..123892f3ac 100644 --- a/test/e2e/gracefulshutdown/grace_period.go +++ b/test/e2e/gracefulshutdown/grace_period.go @@ -33,7 +33,6 @@ var _ = framework.IngressNginxDescribe("[Shutdown] Grace period shutdown", func( f := framework.NewDefaultFramework("shutdown-grace-period") ginkgo.It("/healthz should return status code 500 during shutdown grace period", func() { - f.NewSlowEchoDeployment() err := f.UpdateIngressControllerDeployment(func(deployment *appsv1.Deployment) error { @@ -83,6 +82,5 @@ var _ = framework.IngressNginxDescribe("[Shutdown] Grace period shutdown", func( for _, err := range <-result { assert.Nil(ginkgo.GinkgoT(), err) } - }) }) diff --git a/test/e2e/ingress/pathtype_exact.go b/test/e2e/ingress/pathtype_exact.go index ae2902e9ff..ccc76b5bc6 100644 --- a/test/e2e/ingress/pathtype_exact.go +++ b/test/e2e/ingress/pathtype_exact.go @@ -35,14 +35,13 @@ var _ = framework.IngressNginxDescribe("[Ingress] [PathType] exact", func() { }) ginkgo.It("should choose exact location for /exact", func() { - host := "exact.path" annotations := map[string]string{ "nginx.ingress.kubernetes.io/configuration-snippet": `more_set_input_headers "pathType: exact";`, } - var exactPathType = networking.PathTypeExact + exactPathType := networking.PathTypeExact ing := framework.NewSingleIngress("exact", "/exact", host, f.Namespace, framework.EchoService, 80, annotations) ing.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &exactPathType f.EnsureIngress(ing) diff --git a/test/e2e/ingress/pathtype_mixed.go b/test/e2e/ingress/pathtype_mixed.go index dd183bbb49..c55a2c32a2 100644 --- a/test/e2e/ingress/pathtype_mixed.go +++ b/test/e2e/ingress/pathtype_mixed.go @@ -34,10 +34,9 @@ var _ = framework.IngressNginxDescribe("[Ingress] [PathType] mix Exact and Prefi f.NewEchoDeployment() }) - var exactPathType = networking.PathTypeExact + exactPathType := networking.PathTypeExact ginkgo.It("should choose the correct location", func() { - host := "mixed.path" annotations := map[string]string{ diff --git a/test/e2e/leaks/lua_ssl.go b/test/e2e/leaks/lua_ssl.go index e63a1e353a..88285ba4b6 100644 --- a/test/e2e/leaks/lua_ssl.go +++ b/test/e2e/leaks/lua_ssl.go @@ -87,14 +87,14 @@ func provisionIngress(hostname string, f *framework.Framework) { func checkIngress(hostname string, f *framework.Framework) { resp := f.HTTPTestClientWithTLSConfig(&tls.Config{ ServerName: hostname, - InsecureSkipVerify: true, + InsecureSkipVerify: true, //nolint:gosec // Ignore the gosec error in testing }). GET("/"). WithURL(f.GetURL(framework.HTTPS)). WithHeader("Host", hostname). Expect(). Raw() - + defer resp.Body.Close() assert.Equal(ginkgo.GinkgoT(), resp.StatusCode, http.StatusOK) // check the returned secret is not the fake one diff --git a/test/e2e/loadbalance/configmap.go b/test/e2e/loadbalance/configmap.go index 8cd47286b0..737cd06dd4 100644 --- a/test/e2e/loadbalance/configmap.go +++ b/test/e2e/loadbalance/configmap.go @@ -25,6 +25,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const loadBalanceHost = "load-balance.com" + var _ = framework.DescribeSetting("[Load Balancer] load-balance", func() { f := framework.NewDefaultFramework("lb-configmap") @@ -33,7 +35,7 @@ var _ = framework.DescribeSetting("[Load Balancer] load-balance", func() { }) ginkgo.It("should apply the configmap load-balance setting", func() { - host := "load-balance.com" + host := loadBalanceHost f.UpdateNginxConfigMapData("load-balance", "ewma") diff --git a/test/e2e/loadbalance/ewma.go b/test/e2e/loadbalance/ewma.go index e2750a09a5..f457e63573 100644 --- a/test/e2e/loadbalance/ewma.go +++ b/test/e2e/loadbalance/ewma.go @@ -35,12 +35,13 @@ var _ = framework.DescribeSetting("[Load Balancer] EWMA", func() { f.NewEchoDeployment(framework.WithDeploymentReplicas(3)) f.SetNginxConfigMapData(map[string]string{ "worker-processes": "2", - "load-balance": "ewma"}, + "load-balance": "ewma", + }, ) }) ginkgo.It("does not fail requests", func() { - host := "load-balance.com" + host := loadBalanceHost f.EnsureIngress(framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, nil)) f.WaitForNginxServer(host, @@ -52,7 +53,9 @@ var _ = framework.DescribeSetting("[Load Balancer] EWMA", func() { assert.Nil(ginkgo.GinkgoT(), err) assert.Equal(ginkgo.GinkgoT(), algorithm, "ewma") - re, _ := regexp.Compile(fmt.Sprintf(`%v.*`, framework.EchoService)) + re, err := regexp.Compile(fmt.Sprintf(`%v.*`, framework.EchoService)) + assert.Nil(ginkgo.GinkgoT(), err, "error compiling regex") + replicaRequestCount := map[string]int{} for i := 0; i < 30; i++ { diff --git a/test/e2e/loadbalance/round_robin.go b/test/e2e/loadbalance/round_robin.go index 2d0582e9a1..5f66671434 100644 --- a/test/e2e/loadbalance/round_robin.go +++ b/test/e2e/loadbalance/round_robin.go @@ -37,7 +37,7 @@ var _ = framework.DescribeSetting("[Load Balancer] round-robin", func() { }) ginkgo.It("should evenly distribute requests with round-robin (default algorithm)", func() { - host := "load-balance.com" + host := loadBalanceHost f.EnsureIngress(framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, nil)) f.WaitForNginxServer(host, @@ -45,7 +45,9 @@ var _ = framework.DescribeSetting("[Load Balancer] round-robin", func() { return strings.Contains(server, "server_name load-balance.com") }) - re, _ := regexp.Compile(fmt.Sprintf(`%v.*`, framework.EchoService)) + re, err := regexp.Compile(fmt.Sprintf(`%v.*`, framework.EchoService)) + assert.Nil(ginkgo.GinkgoT(), err, "error compiling regex") + replicaRequestCount := map[string]int{} for i := 0; i < 600; i++ { diff --git a/test/e2e/lua/dynamic_certificates.go b/test/e2e/lua/dynamic_certificates.go index 0160cc9e7f..8c9df5e718 100644 --- a/test/e2e/lua/dynamic_certificates.go +++ b/test/e2e/lua/dynamic_certificates.go @@ -245,7 +245,6 @@ var _ = framework.IngressNginxDescribe("[Lua] dynamic certificates", func() { WithHeader("Host", host). Expect(). Status(http.StatusOK) - }) }) }) @@ -254,7 +253,6 @@ func extractReloadCount(mf *dto.MetricFamily) (float64, error) { vec, err := expfmt.ExtractSamples(&expfmt.DecodeOptions{ Timestamp: model.Now(), }, mf) - if err != nil { return 0, err } diff --git a/test/e2e/lua/dynamic_configuration.go b/test/e2e/lua/dynamic_configuration.go index 8e9804545d..8ec1ef8391 100644 --- a/test/e2e/lua/dynamic_configuration.go +++ b/test/e2e/lua/dynamic_configuration.go @@ -26,7 +26,6 @@ import ( "github.com/onsi/ginkgo/v2" "github.com/stretchr/testify/assert" - networking "k8s.io/api/networking/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/ingress-nginx/test/e2e/framework" @@ -199,20 +198,18 @@ var _ = framework.IngressNginxDescribe("[Lua] dynamic configuration", func() { }) }) -func ensureIngress(f *framework.Framework, host string, deploymentName string) *networking.Ingress { - ing := createIngress(f, host, deploymentName) +func ensureIngress(f *framework.Framework, host, deploymentName string) { + createIngress(f, host, deploymentName) f.HTTPTestClient(). GET("/"). WithHeader("Host", host). Expect(). Status(http.StatusOK) - - return ing } -func createIngress(f *framework.Framework, host string, deploymentName string) *networking.Ingress { - ing := f.EnsureIngress(framework.NewSingleIngress(host, "/", host, f.Namespace, deploymentName, 80, +func createIngress(f *framework.Framework, host, deploymentName string) { + f.EnsureIngress(framework.NewSingleIngress(host, "/", host, f.Namespace, deploymentName, 80, map[string]string{ "nginx.ingress.kubernetes.io/load-balance": "ewma", }, @@ -223,21 +220,19 @@ func createIngress(f *framework.Framework, host string, deploymentName string) * return strings.Contains(server, fmt.Sprintf("server_name %s ;", host)) && strings.Contains(server, "proxy_pass http://upstream_balancer;") }) - - return ing } -func ensureHTTPSRequest(f *framework.Framework, url string, host string, expectedDNSName string) { +func ensureHTTPSRequest(f *framework.Framework, url, host, expectedDNSName string) { resp := f.HTTPTestClientWithTLSConfig(&tls.Config{ ServerName: host, - InsecureSkipVerify: true, + InsecureSkipVerify: true, //nolint:gosec // Ignore the gosec error in testing }). GET("/"). WithURL(url). WithHeader("Host", host). Expect(). Raw() - + defer resp.Body.Close() assert.Equal(ginkgo.GinkgoT(), resp.StatusCode, http.StatusOK) assert.Equal(ginkgo.GinkgoT(), len(resp.TLS.PeerCertificates), 1) assert.Equal(ginkgo.GinkgoT(), resp.TLS.PeerCertificates[0].DNSNames[0], expectedDNSName) diff --git a/test/e2e/nginx/nginx.go b/test/e2e/nginx/nginx.go index cd14a931cc..7e572a9762 100644 --- a/test/e2e/nginx/nginx.go +++ b/test/e2e/nginx/nginx.go @@ -100,7 +100,6 @@ var _ = framework.DescribeSetting("nginx-configuration", func() { f := framework.NewSimpleFramework("nginxconfiguration") ginkgo.It("start nginx with default configuration", func() { - f.NGINXWithConfigDeployment("default-nginx", cfgOK) f.WaitForPod("app=default-nginx", 60*time.Second, false) framework.Sleep(5 * time.Second) @@ -113,20 +112,16 @@ var _ = framework.DescribeSetting("nginx-configuration", func() { }) ginkgo.It("fails when using alias directive", func() { - f.NGINXDeployment("alias-nginx", cfgAlias, false) // This should fail with a crashloopback because our NGINX does not have // alias directive! f.WaitForPod("app=alias-nginx", 60*time.Second, true) - }) ginkgo.It("fails when using root directive", func() { - f.NGINXDeployment("root-nginx", cfgRoot, false) // This should fail with a crashloopback because our NGINX does not have // root directive! f.WaitForPod("app=root-nginx", 60*time.Second, true) - }) }) diff --git a/test/e2e/security/request_smuggling.go b/test/e2e/security/request_smuggling.go index 58b17c4d83..5ede02d4b5 100644 --- a/test/e2e/security/request_smuggling.go +++ b/test/e2e/security/request_smuggling.go @@ -50,9 +50,9 @@ server { f.UpdateNginxConfigMapData("http-snippet", snippet) - //TODO: currently using a self hosted HTTPBun instance results in a 499, we - //should move away from using httpbun.com once we have the httpbun - //deployment as part of the framework + // TODO: currently using a self hosted HTTPBun instance results in a 499, we + // should move away from using httpbun.com once we have the httpbun + // deployment as part of the framework ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, map[string]string{ "nginx.ingress.kubernetes.io/auth-signin": "https://httpbun.com/bearer/d4bcba7a-0def-4a31-91a7-47e420adf44b", "nginx.ingress.kubernetes.io/auth-url": "https://httpbun.com/basic-auth/user/passwd", @@ -91,7 +91,7 @@ func smugglingRequest(host, addr string, port int) (string, error) { // wait for /_hidden/index.html response framework.Sleep() - var buf = make([]byte, 1024) + buf := make([]byte, 1024) r := bufio.NewReader(conn) _, err = r.Read(buf) if err != nil { diff --git a/test/e2e/servicebackend/service_backend.go b/test/e2e/servicebackend/service_backend.go index 44f3d36a51..6ab2f8ad11 100644 --- a/test/e2e/servicebackend/service_backend.go +++ b/test/e2e/servicebackend/service_backend.go @@ -29,48 +29,50 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) -var pathtype = networking.PathTypePrefix -var _ = framework.IngressNginxDescribe("[Service] backend status code 503", func() { - f := framework.NewDefaultFramework("service-backend") - - ginkgo.It("should return 503 when backend service does not exist", func() { - host := "nonexistent.svc.com" - - bi := buildIngressWithNonexistentService(host, f.Namespace, "/") - f.EnsureIngress(bi) - - f.WaitForNginxServer(host, - func(server string) bool { - return strings.Contains(server, "proxy_pass http://upstream_balancer;") - }) - - f.HTTPTestClient(). - GET("/"). - WithHeader("Host", host). - Expect(). - Status(http.StatusServiceUnavailable) +var ( + pathtype = networking.PathTypePrefix + _ = framework.IngressNginxDescribe("[Service] backend status code 503", func() { + f := framework.NewDefaultFramework("service-backend") + + ginkgo.It("should return 503 when backend service does not exist", func() { + host := "nonexistent.svc.com" + + bi := buildIngressWithNonexistentService(host, f.Namespace, "/") + f.EnsureIngress(bi) + + f.WaitForNginxServer(host, + func(server string) bool { + return strings.Contains(server, "proxy_pass http://upstream_balancer;") + }) + + f.HTTPTestClient(). + GET("/"). + WithHeader("Host", host). + Expect(). + Status(http.StatusServiceUnavailable) + }) + + ginkgo.It("should return 503 when all backend service endpoints are unavailable", func() { + host := "unavailable.svc.com" + + bi, bs := buildIngressWithUnavailableServiceEndpoints(host, f.Namespace, "/") + + f.EnsureService(bs) + f.EnsureIngress(bi) + + f.WaitForNginxServer(host, + func(server string) bool { + return strings.Contains(server, "proxy_pass http://upstream_balancer;") + }) + + f.HTTPTestClient(). + GET("/"). + WithHeader("Host", host). + Expect(). + Status(http.StatusServiceUnavailable) + }) }) - - ginkgo.It("should return 503 when all backend service endpoints are unavailable", func() { - host := "unavailable.svc.com" - - bi, bs := buildIngressWithUnavailableServiceEndpoints(host, f.Namespace, "/") - - f.EnsureService(bs) - f.EnsureIngress(bi) - - f.WaitForNginxServer(host, - func(server string) bool { - return strings.Contains(server, "proxy_pass http://upstream_balancer;") - }) - - f.HTTPTestClient(). - GET("/"). - WithHeader("Host", host). - Expect(). - Status(http.StatusServiceUnavailable) - }) -}) +) func buildIngressWithNonexistentService(host, namespace, path string) *networking.Ingress { backendService := "nonexistent-svc" @@ -146,14 +148,15 @@ func buildIngressWithUnavailableServiceEndpoints(host, namespace, path string) ( Name: backendService, Namespace: namespace, }, - Spec: corev1.ServiceSpec{Ports: []corev1.ServicePort{ - { - Name: "tcp", - Port: 80, - TargetPort: intstr.FromInt(80), - Protocol: "TCP", + Spec: corev1.ServiceSpec{ + Ports: []corev1.ServicePort{ + { + Name: "tcp", + Port: 80, + TargetPort: intstr.FromInt(80), + Protocol: "TCP", + }, }, - }, Selector: map[string]string{ "app": backendService, }, diff --git a/test/e2e/servicebackend/service_externalname.go b/test/e2e/servicebackend/service_externalname.go index 429690ff18..fccd1cd194 100644 --- a/test/e2e/servicebackend/service_externalname.go +++ b/test/e2e/servicebackend/service_externalname.go @@ -33,12 +33,14 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const echoHost = "echo" + var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { f := framework.NewDefaultFramework("type-externalname", framework.WithHTTPBunEnabled()) ginkgo.It("works with external name set to incomplete fqdn", func() { f.NewEchoDeployment() - host := "echo" + host := echoHost svc := &corev1.Service{ ObjectMeta: metav1.ObjectMeta{ @@ -74,7 +76,7 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { }) ginkgo.It("should return 200 for service type=ExternalName without a port defined", func() { - host := "echo" + host := echoHost svc := &corev1.Service{ ObjectMeta: metav1.ObjectMeta{ @@ -114,7 +116,7 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { }) ginkgo.It("should return 200 for service type=ExternalName with a port defined", func() { - host := "echo" + host := echoHost svc := framework.BuildNIPExternalNameService(f, f.HTTPBunIP, host) f.EnsureService(svc) @@ -144,7 +146,7 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { }) ginkgo.It("should return status 502 for service type=ExternalName with an invalid host", func() { - host := "echo" + host := echoHost svc := &corev1.Service{ ObjectMeta: metav1.ObjectMeta{ @@ -180,7 +182,7 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { }) ginkgo.It("should return 200 for service type=ExternalName using a port name", func() { - host := "echo" + host := echoHost svc := framework.BuildNIPExternalNameService(f, f.HTTPBunIP, host) f.EnsureService(svc) @@ -221,7 +223,7 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { }) ginkgo.It("should return 200 for service type=ExternalName using FQDN with trailing dot", func() { - host := "echo" + host := echoHost svc := &corev1.Service{ ObjectMeta: metav1.ObjectMeta{ @@ -257,7 +259,7 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { }) ginkgo.It("should update the external name after a service update", func() { - host := "echo" + host := echoHost svc := framework.BuildNIPExternalNameService(f, f.HTTPBunIP, host) f.EnsureService(svc) @@ -306,7 +308,7 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { Get(context.TODO(), framework.NIPService, metav1.GetOptions{}) assert.Nil(ginkgo.GinkgoT(), err, "unexpected error obtaining external service") - //Deploy a new instance to switch routing to + // Deploy a new instance to switch routing to ip := f.NewHttpbunDeployment(framework.WithDeploymentName("eu-server")) svc.Spec.ExternalName = framework.BuildNIPHost(ip) @@ -335,12 +337,12 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { assert.Contains( ginkgo.GinkgoT(), output, - fmt.Sprintf(`"address": "%s"`, framework.BuildNIPHost(ip)), + fmt.Sprintf(`"address": %q`, framework.BuildNIPHost(ip)), ) }) ginkgo.It("should sync ingress on external name service addition/deletion", func() { - host := "echo" + host := echoHost // Create the Ingress first ing := framework.NewSingleIngress(host, diff --git a/test/e2e/servicebackend/service_nil_backend.go b/test/e2e/servicebackend/service_nil_backend.go index c44601c886..9b5b4c7e62 100644 --- a/test/e2e/servicebackend/service_nil_backend.go +++ b/test/e2e/servicebackend/service_nil_backend.go @@ -64,7 +64,6 @@ var _ = framework.IngressNginxDescribe("[Service] Nil Service Backend", func() { WithHeader("Host", invalidHost). Expect(). Status(http.StatusNotFound) - }) }) diff --git a/test/e2e/settings/access_log.go b/test/e2e/settings/access_log.go index 7c7e2b9e3b..65b9dfda4a 100644 --- a/test/e2e/settings/access_log.go +++ b/test/e2e/settings/access_log.go @@ -28,7 +28,6 @@ var _ = framework.DescribeSetting("access-log", func() { f := framework.NewDefaultFramework("access-log") ginkgo.Context("access-log-path", func() { - ginkgo.It("use the default configuration", func() { f.WaitForNginxConfiguration( func(cfg string) bool { @@ -50,7 +49,6 @@ var _ = framework.DescribeSetting("access-log", func() { }) ginkgo.Context("http-access-log-path", func() { - ginkgo.It("use the specified configuration", func() { f.UpdateNginxConfigMapData("http-access-log-path", "/tmp/nginx/http-access.log") f.WaitForNginxConfiguration( @@ -63,7 +61,6 @@ var _ = framework.DescribeSetting("access-log", func() { }) ginkgo.Context("stream-access-log-path", func() { - ginkgo.It("use the specified configuration", func() { f.UpdateNginxConfigMapData("stream-access-log-path", "/tmp/nginx/stream-access.log") f.WaitForNginxConfiguration( @@ -76,7 +73,6 @@ var _ = framework.DescribeSetting("access-log", func() { }) ginkgo.Context("http-access-log-path & stream-access-log-path", func() { - ginkgo.It("use the specified configuration", func() { f.SetNginxConfigMapData(map[string]string{ "http-access-log-path": "/tmp/nginx/http-access.log", diff --git a/test/e2e/settings/badannotationvalues.go b/test/e2e/settings/badannotationvalues.go index b4b6def4a7..68a122e769 100644 --- a/test/e2e/settings/badannotationvalues.go +++ b/test/e2e/settings/badannotationvalues.go @@ -100,7 +100,6 @@ var _ = framework.DescribeAnnotation("Bad annotation values", func() { }) ginkgo.It("[BAD_ANNOTATIONS] should allow an ingress if there is a default blocklist config in place", func() { - hostValid := "custom-allowed-value-test" annotationsValid := map[string]string{ "nginx.ingress.kubernetes.io/configuration-snippet": ` @@ -159,6 +158,5 @@ var _ = framework.DescribeAnnotation("Bad annotation values", func() { WithHeader("Host", host). Expect(). Status(http.StatusNotFound) - }) }) diff --git a/test/e2e/settings/default_ssl_certificate.go b/test/e2e/settings/default_ssl_certificate.go index ea97d48952..c48a1e87f7 100644 --- a/test/e2e/settings/default_ssl_certificate.go +++ b/test/e2e/settings/default_ssl_certificate.go @@ -30,10 +30,12 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const fooHost = "foo" + var _ = framework.IngressNginxDescribe("[SSL] [Flag] default-ssl-certificate", func() { f := framework.NewDefaultFramework("default-ssl-certificate") var tlsConfig *tls.Config - secretName := "my-custom-cert" + secretName := "my-custom-cert" //nolint:gosec // Ignore the gosec error in testing service := framework.EchoService port := 80 @@ -78,7 +80,7 @@ var _ = framework.IngressNginxDescribe("[SSL] [Flag] default-ssl-certificate", f }) ginkgo.It("uses default ssl certificate for host based ingress when configured certificate does not match host", func() { - host := "foo" + host := fooHost ing := f.EnsureIngress(framework.NewSingleIngressWithTLS(host, "/", host, []string{host}, f.Namespace, service, port, nil)) _, err := framework.CreateIngressTLSSecret(f.KubeClientSet, diff --git a/test/e2e/settings/disable_catch_all.go b/test/e2e/settings/disable_catch_all.go index 0d1a144935..4e7a16f4de 100644 --- a/test/e2e/settings/disable_catch_all.go +++ b/test/e2e/settings/disable_catch_all.go @@ -48,7 +48,7 @@ var _ = framework.IngressNginxDescribe("[Flag] disable-catch-all", func() { }) ginkgo.It("should ignore catch all Ingress with backend", func() { - host := "foo" + host := fooHost ing := framework.NewSingleCatchAllIngress("catch-all", f.Namespace, framework.EchoService, 80, nil) f.EnsureIngress(ing) @@ -67,7 +67,7 @@ var _ = framework.IngressNginxDescribe("[Flag] disable-catch-all", func() { }) ginkgo.It("should ignore catch all Ingress with backend and rules", func() { - host := "foo" + host := fooHost ing := framework.NewSingleIngressWithBackendAndRules(host, "/", host, f.Namespace, framework.EchoService, 80, framework.EchoService, 80, nil) f.EnsureIngress(ing) @@ -79,7 +79,7 @@ var _ = framework.IngressNginxDescribe("[Flag] disable-catch-all", func() { }) ginkgo.It("should delete Ingress updated to catch-all", func() { - host := "foo" + host := fooHost ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, nil) f.EnsureIngress(ing) @@ -121,7 +121,7 @@ var _ = framework.IngressNginxDescribe("[Flag] disable-catch-all", func() { }) ginkgo.It("should allow Ingress with rules", func() { - host := "foo" + host := fooHost ing := framework.NewSingleIngress("not-catch-all", "/", host, f.Namespace, framework.EchoService, 80, nil) f.EnsureIngress(ing) diff --git a/test/e2e/settings/disable_service_external_name.go b/test/e2e/settings/disable_service_external_name.go index 4ecf69e819..6028280897 100644 --- a/test/e2e/settings/disable_service_external_name.go +++ b/test/e2e/settings/disable_service_external_name.go @@ -95,6 +95,5 @@ var _ = framework.IngressNginxDescribe("[Flag] disable-service-external-name", f WithHeader("Host", externalhost). Expect(). StatusRange(httpexpect.Status5xx) - }) }) diff --git a/test/e2e/settings/disable_sync_events.go b/test/e2e/settings/disable_sync_events.go index 7d12980874..033fd9194a 100644 --- a/test/e2e/settings/disable_sync_events.go +++ b/test/e2e/settings/disable_sync_events.go @@ -50,6 +50,7 @@ var _ = framework.IngressNginxDescribe("[Flag] disable-sync-events", func() { assert.NotEmpty(ginkgo.GinkgoT(), events.Items, "got events") }) + //nolint:dupl // Ignore dupl errors for similar test case ginkgo.It("should create sync events", func() { host := "disable-sync-events-false" f.NewEchoDeployment(framework.WithDeploymentReplicas(1)) @@ -77,6 +78,7 @@ var _ = framework.IngressNginxDescribe("[Flag] disable-sync-events", func() { assert.NotEmpty(ginkgo.GinkgoT(), events.Items, "got events") }) + //nolint:dupl // Ignore dupl errors for similar test case ginkgo.It("should not create sync events", func() { host := "disable-sync-events-true" f.NewEchoDeployment(framework.WithDeploymentReplicas(1)) @@ -103,5 +105,4 @@ var _ = framework.IngressNginxDescribe("[Flag] disable-sync-events", func() { assert.Empty(ginkgo.GinkgoT(), events.Items, "got events") }) - }) diff --git a/test/e2e/settings/forwarded_headers.go b/test/e2e/settings/forwarded_headers.go index d4ffee5455..44460aca64 100644 --- a/test/e2e/settings/forwarded_headers.go +++ b/test/e2e/settings/forwarded_headers.go @@ -26,6 +26,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const forwardedHeadersHost = "forwarded-headers" + var _ = framework.DescribeSetting("use-forwarded-headers", func() { f := framework.NewDefaultFramework("forwarded-headers") @@ -37,7 +39,7 @@ var _ = framework.DescribeSetting("use-forwarded-headers", func() { }) ginkgo.It("should trust X-Forwarded headers when setting is true", func() { - host := "forwarded-headers" + host := forwardedHeadersHost f.UpdateNginxConfigMapData(setting, "true") @@ -89,7 +91,7 @@ var _ = framework.DescribeSetting("use-forwarded-headers", func() { }) ginkgo.It("should not trust X-Forwarded headers when setting is false", func() { - host := "forwarded-headers" + host := forwardedHeadersHost f.UpdateNginxConfigMapData(setting, "false") diff --git a/test/e2e/settings/geoip2.go b/test/e2e/settings/geoip2.go index 9b2ca86248..6dd48b2ad7 100644 --- a/test/e2e/settings/geoip2.go +++ b/test/e2e/settings/geoip2.go @@ -19,11 +19,10 @@ package settings import ( "context" "fmt" + "net/http" "path/filepath" "strings" - "net/http" - "github.com/onsi/ginkgo/v2" "github.com/stretchr/testify/assert" @@ -72,8 +71,7 @@ var _ = framework.DescribeSetting("Geoip2", func() { f.UpdateNginxConfigMapData("use-geoip2", "true") - httpSnippetAllowingOnlyAustralia := - `map $geoip2_city_country_code $blocked_country { + httpSnippetAllowingOnlyAustralia := `map $geoip2_city_country_code $blocked_country { default 1; AU 0; }` @@ -85,8 +83,7 @@ var _ = framework.DescribeSetting("Geoip2", func() { return strings.Contains(cfg, "map $geoip2_city_country_code $blocked_country") }) - configSnippet := - `if ($blocked_country) { + configSnippet := `if ($blocked_country) { return 403; }` diff --git a/test/e2e/settings/global_external_auth.go b/test/e2e/settings/global_external_auth.go index cc98099aea..741e6f9552 100644 --- a/test/e2e/settings/global_external_auth.go +++ b/test/e2e/settings/global_external_auth.go @@ -31,6 +31,11 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const ( + disable = "false" + noAuthLocaltionSetting = "no-auth-locations" +) + var _ = framework.DescribeSetting("[Security] global-auth-url", func() { f := framework.NewDefaultFramework( "global-external-auth", @@ -46,7 +51,7 @@ var _ = framework.DescribeSetting("[Security] global-auth-url", func() { fooPath := "/foo" barPath := "/bar" - noAuthSetting := "no-auth-locations" + noAuthSetting := noAuthLocaltionSetting noAuthLocations := barPath enableGlobalExternalAuthAnnotation := "nginx.ingress.kubernetes.io/enable-global-auth" @@ -56,7 +61,6 @@ var _ = framework.DescribeSetting("[Security] global-auth-url", func() { }) ginkgo.Context("when global external authentication is configured", func() { - ginkgo.BeforeEach(func() { globalExternalAuthURL := fmt.Sprintf("http://%s.%s.svc.cluster.local:80/status/401", framework.HTTPBunService, f.Namespace) @@ -85,7 +89,6 @@ var _ = framework.DescribeSetting("[Security] global-auth-url", func() { }) ginkgo.It("should return status code 401 when request any protected service", func() { - ginkgo.By("Sending a request to protected service /foo") f.HTTPTestClient(). GET(fooPath). @@ -102,7 +105,6 @@ var _ = framework.DescribeSetting("[Security] global-auth-url", func() { }) ginkgo.It("should return status code 200 when request whitelisted (via no-auth-locations) service and 401 when request protected service", func() { - ginkgo.By("Adding a no-auth-locations for /bar to configMap") f.UpdateNginxConfigMapData(noAuthSetting, noAuthLocations) f.WaitForNginxServer(host, @@ -126,10 +128,9 @@ var _ = framework.DescribeSetting("[Security] global-auth-url", func() { }) ginkgo.It("should return status code 200 when request whitelisted (via ingress annotation) service and 401 when request protected service", func() { - ginkgo.By("Adding an ingress rule for /bar with annotation enable-global-auth = false") err := framework.UpdateIngress(f.KubeClientSet, f.Namespace, "bar-ingress", func(ingress *networking.Ingress) error { - ingress.ObjectMeta.Annotations[enableGlobalExternalAuthAnnotation] = "false" + ingress.ObjectMeta.Annotations[enableGlobalExternalAuthAnnotation] = disable return nil }) assert.Nil(ginkgo.GinkgoT(), err) @@ -155,9 +156,8 @@ var _ = framework.DescribeSetting("[Security] global-auth-url", func() { }) ginkgo.It("should still return status code 200 after auth backend is deleted using cache", func() { - globalExternalAuthCacheKeySetting := "global-auth-cache-key" - globalExternalAuthCacheKey := "foo" + globalExternalAuthCacheKey := fooHost globalExternalAuthCacheDurationSetting := "global-auth-cache-duration" globalExternalAuthCacheDuration := "200 201 401 30m" globalExternalAuthURL := fmt.Sprintf("http://%s.%s.svc.cluster.local:80/status/200", framework.HTTPBunService, f.Namespace) @@ -197,7 +197,6 @@ var _ = framework.DescribeSetting("[Security] global-auth-url", func() { }) ginkgo.It(`should proxy_method method when global-auth-method is configured`, func() { - globalExternalAuthMethodSetting := "global-auth-method" globalExternalAuthMethod := "GET" @@ -210,7 +209,6 @@ var _ = framework.DescribeSetting("[Security] global-auth-url", func() { }) ginkgo.It(`should add custom error page when global-auth-signin url is configured`, func() { - globalExternalAuthSigninSetting := "global-auth-signin" globalExternalAuthSignin := "http://foo.com/global-error-page" @@ -223,7 +221,6 @@ var _ = framework.DescribeSetting("[Security] global-auth-url", func() { }) ginkgo.It(`should add auth headers when global-auth-response-headers is configured`, func() { - globalExternalAuthResponseHeadersSetting := "global-auth-response-headers" globalExternalAuthResponseHeaders := "Foo, Bar" @@ -237,7 +234,6 @@ var _ = framework.DescribeSetting("[Security] global-auth-url", func() { }) ginkgo.It(`should set request-redirect when global-auth-request-redirect is configured`, func() { - globalExternalAuthRequestRedirectSetting := "global-auth-request-redirect" globalExternalAuthRequestRedirect := "Foo-Redirect" @@ -260,7 +256,6 @@ var _ = framework.DescribeSetting("[Security] global-auth-url", func() { return strings.Contains(server, globalExternalAuthSnippet) }) }) - }) ginkgo.Context("cookie set by external authentication server", func() { @@ -322,7 +317,6 @@ http { f.WaitForNginxServer(host, func(server string) bool { return strings.Contains(server, "server_name "+host) }) - }) ginkgo.It("user retains cookie by default", func() { diff --git a/test/e2e/settings/global_options.go b/test/e2e/settings/global_options.go index 117860d598..1f84ef5d78 100644 --- a/test/e2e/settings/global_options.go +++ b/test/e2e/settings/global_options.go @@ -31,7 +31,6 @@ var _ = framework.IngressNginxDescribe("global-options", func() { ginkgo.It("should have worker_rlimit_nofile option", func() { f.WaitForNginxConfiguration(func(server string) bool { return strings.Contains(server, fmt.Sprintf("worker_rlimit_nofile %d;", rlimitMaxNumFiles()-1024)) - }) }) diff --git a/test/e2e/settings/hash-size.go b/test/e2e/settings/hash-size.go index 6e3e0480c4..5aa5f7c952 100644 --- a/test/e2e/settings/hash-size.go +++ b/test/e2e/settings/hash-size.go @@ -36,7 +36,6 @@ var _ = framework.DescribeSetting("hash size", func() { }) ginkgo.Context("Check server names hash size", func() { - ginkgo.It("should set server_names_hash_bucket_size", func() { f.UpdateNginxConfigMapData("server-name-hash-bucket-size", "512") @@ -52,11 +51,9 @@ var _ = framework.DescribeSetting("hash size", func() { return strings.Contains(server, "server_names_hash_max_size 4096;") }) }) - }) ginkgo.Context("Check proxy header hash size", func() { - ginkgo.It("should set proxy-headers-hash-bucket-size", func() { f.UpdateNginxConfigMapData("proxy-headers-hash-bucket-size", "512") @@ -72,11 +69,9 @@ var _ = framework.DescribeSetting("hash size", func() { return strings.Contains(server, "proxy_headers_hash_max_size 4096;") }) }) - }) ginkgo.Context("Check the variable hash size", func() { - ginkgo.It("should set variables-hash-bucket-size", func() { f.UpdateNginxConfigMapData("variables-hash-bucket-size", "512") @@ -92,11 +87,9 @@ var _ = framework.DescribeSetting("hash size", func() { return strings.Contains(server, "variables_hash_max_size 512;") }) }) - }) ginkgo.Context("Check the map hash size", func() { - ginkgo.It("should set vmap-hash-bucket-size", func() { f.UpdateNginxConfigMapData("map-hash-bucket-size", "512") @@ -104,7 +97,5 @@ var _ = framework.DescribeSetting("hash size", func() { return strings.Contains(server, "map_hash_bucket_size 512;") }) }) - }) - }) diff --git a/test/e2e/settings/ingress_class.go b/test/e2e/settings/ingress_class.go index 232045f3a7..80c09f80c3 100644 --- a/test/e2e/settings/ingress_class.go +++ b/test/e2e/settings/ingress_class.go @@ -36,6 +36,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const barHost = "bar" + var _ = framework.IngressNginxDescribe("[Flag] ingress-class", func() { f := framework.NewDefaultFramework("ingress-class") @@ -66,7 +68,7 @@ var _ = framework.IngressNginxDescribe("[Flag] ingress-class", func() { ginkgo.Context("With default ingress class config", func() { ginkgo.It("should ignore Ingress with a different class annotation", func() { - invalidHost := "foo" + invalidHost := fooHost annotations := map[string]string{ ingressclass.IngressKey: "testclass", } @@ -75,7 +77,7 @@ var _ = framework.IngressNginxDescribe("[Flag] ingress-class", func() { ing.Spec.IngressClassName = nil f.EnsureIngress(ing) - validHost := "bar" + validHost := barHost annotationClass := map[string]string{ ingressclass.IngressKey: ingressclass.DefaultAnnotationValue, } @@ -385,7 +387,6 @@ var _ = framework.IngressNginxDescribe("[Flag] ingress-class", func() { Expect(). Status(http.StatusOK) }) - }) ginkgo.Context("With specific ingress-class flags", func() { @@ -411,13 +412,13 @@ var _ = framework.IngressNginxDescribe("[Flag] ingress-class", func() { }) ginkgo.It("should ignore Ingress with no class and accept the correctly configured Ingresses", func() { - invalidHost := "bar" + invalidHost := barHost ing := framework.NewSingleIngress(invalidHost, "/", invalidHost, f.Namespace, framework.EchoService, 80, nil) ing.Spec.IngressClassName = nil f.EnsureIngress(ing) - validHost := "foo" + validHost := fooHost annotations := map[string]string{ ingressclass.IngressKey: "testclass", } @@ -455,7 +456,6 @@ var _ = framework.IngressNginxDescribe("[Flag] ingress-class", func() { Expect(). Status(http.StatusNotFound) }) - }) ginkgo.Context("With watch-ingress-without-class flag", func() { @@ -480,13 +480,13 @@ var _ = framework.IngressNginxDescribe("[Flag] ingress-class", func() { }) ginkgo.It("should watch Ingress with no class and ignore ingress with a different class", func() { - validHost := "bar" + validHost := barHost ing := framework.NewSingleIngress(validHost, "/", validHost, f.Namespace, framework.EchoService, 80, nil) ing.Spec.IngressClassName = nil f.EnsureIngress(ing) - invalidHost := "foo" + invalidHost := fooHost annotations := map[string]string{ ingressclass.IngressKey: "testclass123", } @@ -511,7 +511,6 @@ var _ = framework.IngressNginxDescribe("[Flag] ingress-class", func() { Expect(). Status(http.StatusNotFound) }) - }) ginkgo.Context("With ingress-class-by-name flag", func() { @@ -579,11 +578,9 @@ var _ = framework.IngressNginxDescribe("[Flag] ingress-class", func() { Expect(). Status(http.StatusNotFound) }) - }) ginkgo.Context("Without IngressClass Cluster scoped Permission", func() { - ginkgo.BeforeEach(func() { icname := fmt.Sprintf("ic-%s", f.Namespace) @@ -629,8 +626,7 @@ var _ = framework.IngressNginxDescribe("[Flag] ingress-class", func() { }) ginkgo.It("should watch Ingress with correct annotation", func() { - - validHost := "foo" + validHost := fooHost annotations := map[string]string{ ingressclass.IngressKey: "testclass", } @@ -650,7 +646,6 @@ var _ = framework.IngressNginxDescribe("[Flag] ingress-class", func() { }) ginkgo.It("should ignore Ingress with only IngressClassName", func() { - invalidHost := "noclassforyou" ing := framework.NewSingleIngress(invalidHost, "/", invalidHost, f.Namespace, framework.EchoService, 80, nil) @@ -666,6 +661,5 @@ var _ = framework.IngressNginxDescribe("[Flag] ingress-class", func() { Expect(). Status(http.StatusNotFound) }) - }) }) diff --git a/test/e2e/settings/keep-alive.go b/test/e2e/settings/keep-alive.go index d139f61c05..167f5ac188 100644 --- a/test/e2e/settings/keep-alive.go +++ b/test/e2e/settings/keep-alive.go @@ -21,6 +21,7 @@ import ( "strings" "github.com/onsi/ginkgo/v2" + "github.com/stretchr/testify/assert" "k8s.io/ingress-nginx/test/e2e/framework" ) @@ -50,7 +51,6 @@ var _ = framework.DescribeSetting("keep-alive keep-alive-requests", func() { f.WaitForNginxConfiguration(func(server string) bool { return strings.Contains(server, `keepalive_requests 200;`) }) - }) }) @@ -59,7 +59,8 @@ var _ = framework.DescribeSetting("keep-alive keep-alive-requests", func() { f.UpdateNginxConfigMapData("upstream-keepalive-connections", "128") f.WaitForNginxConfiguration(func(server string) bool { - match, _ := regexp.MatchString(`upstream\supstream_balancer\s\{[\s\S]*keepalive 128;`, server) + match, err := regexp.MatchString(`upstream\supstream_balancer\s\{[\s\S]*keepalive 128;`, server) + assert.Nil(ginkgo.GinkgoT(), err, "unexpected error matching the upstream keepalive time") return match }) }) @@ -68,7 +69,8 @@ var _ = framework.DescribeSetting("keep-alive keep-alive-requests", func() { f.UpdateNginxConfigMapData("upstream-keepalive-timeout", "120") f.WaitForNginxConfiguration(func(server string) bool { - match, _ := regexp.MatchString(`upstream\supstream_balancer\s\{[\s\S]*keepalive_timeout\s*120s;`, server) + match, err := regexp.MatchString(`upstream\supstream_balancer\s\{[\s\S]*keepalive_timeout\s*120s;`, server) + assert.Nil(ginkgo.GinkgoT(), err, "unexpected error matching the upstream keepalive time") return match }) }) @@ -77,7 +79,8 @@ var _ = framework.DescribeSetting("keep-alive keep-alive-requests", func() { f.UpdateNginxConfigMapData("upstream-keepalive-time", "75s") f.WaitForNginxConfiguration(func(server string) bool { - match, _ := regexp.MatchString(`upstream\supstream_balancer\s\{[\s\S]*keepalive_time\s*75s;`, server) + match, err := regexp.MatchString(`upstream\supstream_balancer\s\{[\s\S]*keepalive_time\s*75s;`, server) + assert.Nil(ginkgo.GinkgoT(), err, "unexpected error matching the upstream keepalive time") return match }) }) @@ -86,7 +89,8 @@ var _ = framework.DescribeSetting("keep-alive keep-alive-requests", func() { f.UpdateNginxConfigMapData("upstream-keepalive-requests", "200") f.WaitForNginxConfiguration(func(server string) bool { - match, _ := regexp.MatchString(`upstream\supstream_balancer\s\{[\s\S]*keepalive_requests\s*200;`, server) + match, err := regexp.MatchString(`upstream\supstream_balancer\s\{[\s\S]*keepalive_requests\s*200;`, server) + assert.Nil(ginkgo.GinkgoT(), err, "unexpected error matching the upstream keepalive time") return match }) }) diff --git a/test/e2e/settings/listen_nondefault_ports.go b/test/e2e/settings/listen_nondefault_ports.go index 7e3b11b217..9d3952227d 100644 --- a/test/e2e/settings/listen_nondefault_ports.go +++ b/test/e2e/settings/listen_nondefault_ports.go @@ -28,7 +28,6 @@ import ( ) var _ = framework.IngressNginxDescribe("[Flag] custom HTTP and HTTPS ports", func() { - host := "forwarded-headers" f := framework.NewDefaultFramework("forwarded-port-headers", framework.WithHTTPBunEnabled()) @@ -44,7 +43,6 @@ var _ = framework.IngressNginxDescribe("[Flag] custom HTTP and HTTPS ports", fun ginkgo.Context("with a plain HTTP ingress", func() { ginkgo.It("should set X-Forwarded-Port headers accordingly when listening on a non-default HTTP port", func() { - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, nil) f.EnsureIngress(ing) @@ -64,9 +62,7 @@ var _ = framework.IngressNginxDescribe("[Flag] custom HTTP and HTTPS ports", fun }) ginkgo.Context("with a TLS enabled ingress", func() { - ginkgo.It("should set X-Forwarded-Port header to 443", func() { - ing := framework.NewSingleIngressWithTLS(host, "/", host, []string{host}, f.Namespace, framework.EchoService, 80, nil) f.EnsureIngress(ing) @@ -94,7 +90,6 @@ var _ = framework.IngressNginxDescribe("[Flag] custom HTTP and HTTPS ports", fun }) ginkgo.Context("when external authentication is configured", func() { - ginkgo.It("should set the X-Forwarded-Port header to 443", func() { annotations := map[string]string{ "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/basic-auth/user/password", f.HTTPBunIP), diff --git a/test/e2e/settings/log-format.go b/test/e2e/settings/log-format.go index 24877818d5..18835cb66d 100644 --- a/test/e2e/settings/log-format.go +++ b/test/e2e/settings/log-format.go @@ -36,7 +36,6 @@ var _ = framework.DescribeSetting("log-format-*", func() { }) ginkgo.Context("Check log-format-escape-json and log-format-escape-none", func() { - ginkgo.It("should not configure log-format escape by default", func() { f.WaitForNginxConfiguration( func(cfg string) bool { @@ -78,7 +77,6 @@ var _ = framework.DescribeSetting("log-format-*", func() { }) ginkgo.Context("Check log-format-upstream with log-format-escape-json and log-format-escape-none", func() { - ginkgo.It("log-format-escape-json enabled", func() { f.SetNginxConfigMapData(map[string]string{ "log-format-escape-json": "true", diff --git a/test/e2e/settings/namespace_selector.go b/test/e2e/settings/namespace_selector.go index 3bf8565668..1da62ee863 100644 --- a/test/e2e/settings/namespace_selector.go +++ b/test/e2e/settings/namespace_selector.go @@ -29,12 +29,12 @@ import ( var _ = framework.IngressNginxDescribeSerial("[Flag] watch namespace selector", func() { f := framework.NewDefaultFramework("namespace-selector") - notMatchedHost, matchedHost := "bar", "foo" + notMatchedHost, matchedHost := barHost, fooHost var notMatchedNs string var matchedNs string // create a test namespace, under which create an ingress and backend deployment - prepareTestIngress := func(baseName string, host string, labels map[string]string) string { + prepareTestIngress := func(host string, labels map[string]string) string { ns, err := framework.CreateKubeNamespaceWithLabel(f.BaseName, labels, f.KubeClientSet) assert.Nil(ginkgo.GinkgoT(), err, "creating test namespace") f.NewEchoDeployment(framework.WithDeploymentNamespace(ns)) @@ -49,8 +49,8 @@ var _ = framework.IngressNginxDescribeSerial("[Flag] watch namespace selector", } ginkgo.BeforeEach(func() { - notMatchedNs = prepareTestIngress(notMatchedHost, notMatchedHost, nil) // create namespace without label "foo=bar" - matchedNs = prepareTestIngress(matchedHost, matchedHost, map[string]string{"foo": "bar"}) + notMatchedNs = prepareTestIngress(notMatchedHost, nil) // create namespace without label "foo=bar" + matchedNs = prepareTestIngress(matchedHost, map[string]string{fooHost: barHost}) }) ginkgo.AfterEach(func() { @@ -59,9 +59,7 @@ var _ = framework.IngressNginxDescribeSerial("[Flag] watch namespace selector", }) ginkgo.Context("With specific watch-namespace-selector flags", func() { - - ginkgo.It("should ingore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar", func() { - + ginkgo.It("should ignore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar", func() { f.WaitForNginxConfiguration(func(cfg string) bool { return !strings.Contains(cfg, "server_name bar") && strings.Contains(cfg, "server_name foo") @@ -86,7 +84,7 @@ var _ = framework.IngressNginxDescribeSerial("[Flag] watch namespace selector", if ns.Labels == nil { ns.Labels = make(map[string]string) } - ns.Labels["foo"] = "bar" + ns.Labels[fooHost] = barHost _, err = f.KubeClientSet.CoreV1().Namespaces().Update(context.TODO(), ns, metav1.UpdateOptions{}) assert.Nil(ginkgo.GinkgoT(), err, "labeling not matched namespace") @@ -97,7 +95,7 @@ var _ = framework.IngressNginxDescribeSerial("[Flag] watch namespace selector", if ing.Labels == nil { ing.Labels = make(map[string]string) } - ing.Labels["foo"] = "bar" + ing.Labels[fooHost] = barHost _, err = f.KubeClientSet.NetworkingV1().Ingresses(notMatchedNs).Update(context.TODO(), ing, metav1.UpdateOptions{}) assert.Nil(ginkgo.GinkgoT(), err, "updating ingress") diff --git a/test/e2e/settings/no_auth_locations.go b/test/e2e/settings/no_auth_locations.go index 2fc4b6455a..103c057d74 100644 --- a/test/e2e/settings/no_auth_locations.go +++ b/test/e2e/settings/no_auth_locations.go @@ -18,12 +18,12 @@ package settings import ( "fmt" - "golang.org/x/crypto/bcrypt" "net/http" "strings" "github.com/onsi/ginkgo/v2" "github.com/stretchr/testify/assert" + "golang.org/x/crypto/bcrypt" corev1 "k8s.io/api/core/v1" networking "k8s.io/api/networking/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" @@ -34,7 +34,7 @@ var _ = framework.DescribeSetting("[Security] no-auth-locations", func() { f := framework.NewDefaultFramework("no-auth-locations") setting := "no-auth-locations" - username := "foo" + username := fooHost password := "bar" secretName := "test-secret" host := "no-auth-locations" @@ -100,7 +100,8 @@ func buildBasicAuthIngressWithSecondPath(host, namespace, secretName, pathName s ObjectMeta: metav1.ObjectMeta{ Name: host, Namespace: namespace, - Annotations: map[string]string{"nginx.ingress.kubernetes.io/auth-type": "basic", + Annotations: map[string]string{ + "nginx.ingress.kubernetes.io/auth-type": "basic", "nginx.ingress.kubernetes.io/auth-secret": secretName, "nginx.ingress.kubernetes.io/auth-realm": "test auth", }, @@ -147,7 +148,6 @@ func buildBasicAuthIngressWithSecondPath(host, namespace, secretName, pathName s } func buildSecret(username, password, name, namespace string) *corev1.Secret { - //out, err := exec.Command("openssl", "passwd", "-crypt", password).CombinedOutput() out, err := bcrypt.GenerateFromPassword([]byte(password), 14) assert.Nil(ginkgo.GinkgoT(), err, "creating password") diff --git a/test/e2e/settings/no_tls_redirect_locations.go b/test/e2e/settings/no_tls_redirect_locations.go index 332d764d69..8339eb23ed 100644 --- a/test/e2e/settings/no_tls_redirect_locations.go +++ b/test/e2e/settings/no_tls_redirect_locations.go @@ -44,6 +44,5 @@ var _ = framework.DescribeSetting("Add no tls redirect locations", func() { f.WaitForNginxConfiguration(func(server string) bool { return strings.Contains(server, "force_no_ssl_redirect = true,") }) - }) }) diff --git a/test/e2e/settings/ocsp/ocsp.go b/test/e2e/settings/ocsp/ocsp.go index 0173f41ac1..0ec15db583 100644 --- a/test/e2e/settings/ocsp/ocsp.go +++ b/test/e2e/settings/ocsp/ocsp.go @@ -112,7 +112,7 @@ var _ = framework.DescribeSetting("OCSP", func() { return strings.Contains(server, fmt.Sprintf(`server_name %v`, host)) }) - tlsConfig := &tls.Config{ServerName: host, InsecureSkipVerify: true} + tlsConfig := &tls.Config{ServerName: host, InsecureSkipVerify: true} //nolint:gosec // Ignore the gosec error in testing f.HTTPTestClientWithTLSConfig(tlsConfig). GET("/"). WithURL(f.GetURL(framework.HTTPS)). @@ -195,7 +195,8 @@ const configTemplate = ` func prepareCertificates(namespace string) error { config := fmt.Sprintf(configTemplate, namespace) - err := os.WriteFile("cfssl_config.json", []byte(config), 0644) + //nolint:gosec // Not change permission to avoid possible issues + err := os.WriteFile("cfssl_config.json", []byte(config), 0o644) if err != nil { return fmt.Errorf("creating cfssl_config.json file: %v", err) } diff --git a/test/e2e/settings/opentelemetry.go b/test/e2e/settings/opentelemetry.go index 92d202cb3d..15b5d165e7 100644 --- a/test/e2e/settings/opentelemetry.go +++ b/test/e2e/settings/opentelemetry.go @@ -32,6 +32,8 @@ const ( opentelemetryLocationOperationName = "opentelemetry-location-operation-name" opentelemetryConfig = "opentelemetry-config" opentelemetryConfigPath = "/etc/nginx/opentelemetry.toml" + + enable = "true" ) var _ = framework.IngressNginxDescribe("Configure Opentelemetry", func() { @@ -46,7 +48,7 @@ var _ = framework.IngressNginxDescribe("Configure Opentelemetry", func() { ginkgo.It("should not exists opentelemetry directive", func() { config := map[string]string{} - config[enableOpentelemetry] = "false" + config[enableOpentelemetry] = disable f.SetNginxConfigMapData(config) f.EnsureIngress(framework.NewSingleIngress(enableOpentelemetry, "/", enableOpentelemetry, f.Namespace, "http-svc", 80, nil)) @@ -59,7 +61,7 @@ var _ = framework.IngressNginxDescribe("Configure Opentelemetry", func() { ginkgo.It("should exists opentelemetry directive when is enabled", func() { config := map[string]string{} - config[enableOpentelemetry] = "true" + config[enableOpentelemetry] = enable config[opentelemetryConfig] = opentelemetryConfigPath f.SetNginxConfigMapData(config) @@ -73,9 +75,9 @@ var _ = framework.IngressNginxDescribe("Configure Opentelemetry", func() { ginkgo.It("should include opentelemetry_trust_incoming_spans on directive when enabled", func() { config := map[string]string{} - config[enableOpentelemetry] = "true" + config[enableOpentelemetry] = enable config[opentelemetryConfig] = opentelemetryConfigPath - config[opentelemetryTrustIncomingSpan] = "true" + config[opentelemetryTrustIncomingSpan] = enable f.SetNginxConfigMapData(config) f.EnsureIngress(framework.NewSingleIngress(enableOpentelemetry, "/", enableOpentelemetry, f.Namespace, "http-svc", 80, nil)) @@ -88,7 +90,7 @@ var _ = framework.IngressNginxDescribe("Configure Opentelemetry", func() { ginkgo.It("should not exists opentelemetry_operation_name directive when is empty", func() { config := map[string]string{} - config[enableOpentelemetry] = "true" + config[enableOpentelemetry] = enable config[opentelemetryConfig] = opentelemetryConfigPath config[opentelemetryOperationName] = "" f.SetNginxConfigMapData(config) @@ -103,7 +105,7 @@ var _ = framework.IngressNginxDescribe("Configure Opentelemetry", func() { ginkgo.It("should exists opentelemetry_operation_name directive when is configured", func() { config := map[string]string{} - config[enableOpentelemetry] = "true" + config[enableOpentelemetry] = enable config[opentelemetryConfig] = opentelemetryConfigPath config[opentelemetryOperationName] = "HTTP $request_method $uri" f.SetNginxConfigMapData(config) @@ -115,5 +117,4 @@ var _ = framework.IngressNginxDescribe("Configure Opentelemetry", func() { return strings.Contains(cfg, `opentelemetry_operation_name "HTTP $request_method $uri"`) }) }) - }) diff --git a/test/e2e/settings/opentracing.go b/test/e2e/settings/opentracing.go index aee01ea60f..76d96498da 100644 --- a/test/e2e/settings/opentracing.go +++ b/test/e2e/settings/opentracing.go @@ -41,8 +41,12 @@ const ( datadogCollectorHost = "datadog-collector-host" - opentracingOperationName = "opentracing-operation-name" + opentracingOperationName = "opentracing-operation-name" + opentracingOperationValue = "HTTP $request_method $uri" + opentracingLocationOperationName = "opentracing-location-operation-name" + + localhost = "127.0.0.1" ) var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { @@ -57,7 +61,7 @@ var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { ginkgo.It("should not exists opentracing directive", func() { config := map[string]string{} - config[enableOpentracing] = "false" + config[enableOpentracing] = disable f.SetNginxConfigMapData(config) f.EnsureIngress(framework.NewSingleIngress(enableOpentracing, "/", enableOpentracing, f.Namespace, "http-svc", 80, nil)) @@ -70,8 +74,8 @@ var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { ginkgo.It("should exists opentracing directive when is enabled", func() { config := map[string]string{} - config[enableOpentracing] = "true" - config[zipkinCollectorHost] = "127.0.0.1" + config[enableOpentracing] = enable + config[zipkinCollectorHost] = localhost f.SetNginxConfigMapData(config) f.EnsureIngress(framework.NewSingleIngress(enableOpentracing, "/", enableOpentracing, f.Namespace, "http-svc", 80, nil)) @@ -84,9 +88,9 @@ var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { ginkgo.It("should include opentracing_trust_incoming_span off directive when disabled", func() { config := map[string]string{} - config[enableOpentracing] = "true" - config[opentracingTrustIncomingSpan] = "false" - config[zipkinCollectorHost] = "127.0.0.1" + config[enableOpentracing] = enable + config[opentracingTrustIncomingSpan] = disable + config[zipkinCollectorHost] = localhost f.SetNginxConfigMapData(config) f.EnsureIngress(framework.NewSingleIngress(enableOpentracing, "/", enableOpentracing, f.Namespace, "http-svc", 80, nil)) @@ -99,8 +103,8 @@ var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { ginkgo.It("should not exists opentracing_operation_name directive when is empty", func() { config := map[string]string{} - config[enableOpentracing] = "true" - config[zipkinCollectorHost] = "127.0.0.1" + config[enableOpentracing] = enable + config[zipkinCollectorHost] = localhost config[opentracingOperationName] = "" f.SetNginxConfigMapData(config) @@ -114,9 +118,9 @@ var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { ginkgo.It("should exists opentracing_operation_name directive when is configured", func() { config := map[string]string{} - config[enableOpentracing] = "true" - config[zipkinCollectorHost] = "127.0.0.1" - config[opentracingOperationName] = "HTTP $request_method $uri" + config[enableOpentracing] = enable + config[zipkinCollectorHost] = localhost + config[opentracingOperationName] = opentracingOperationValue f.SetNginxConfigMapData(config) f.EnsureIngress(framework.NewSingleIngress(enableOpentracing, "/", enableOpentracing, f.Namespace, "http-svc", 80, nil)) @@ -129,8 +133,8 @@ var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { ginkgo.It("should not exists opentracing_location_operation_name directive when is empty", func() { config := map[string]string{} - config[enableOpentracing] = "true" - config[zipkinCollectorHost] = "127.0.0.1" + config[enableOpentracing] = enable + config[zipkinCollectorHost] = localhost config[opentracingLocationOperationName] = "" f.SetNginxConfigMapData(config) @@ -144,9 +148,9 @@ var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { ginkgo.It("should exists opentracing_location_operation_name directive when is configured", func() { config := map[string]string{} - config[enableOpentracing] = "true" - config[zipkinCollectorHost] = "127.0.0.1" - config[opentracingLocationOperationName] = "HTTP $request_method $uri" + config[enableOpentracing] = enable + config[zipkinCollectorHost] = localhost + config[opentracingLocationOperationName] = opentracingOperationValue f.SetNginxConfigMapData(config) f.EnsureIngress(framework.NewSingleIngress(enableOpentracing, "/", enableOpentracing, f.Namespace, "http-svc", 80, nil)) @@ -159,8 +163,8 @@ var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { ginkgo.It("should enable opentracing using zipkin", func() { config := map[string]string{} - config[enableOpentracing] = "true" - config[zipkinCollectorHost] = "127.0.0.1" + config[enableOpentracing] = enable + config[zipkinCollectorHost] = localhost f.SetNginxConfigMapData(config) framework.Sleep(10 * time.Second) @@ -171,8 +175,8 @@ var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { ginkgo.It("should enable opentracing using jaeger", func() { config := map[string]string{} - config[enableOpentracing] = "true" - config[jaegerCollectorHost] = "127.0.0.1" + config[enableOpentracing] = enable + config[jaegerCollectorHost] = localhost f.SetNginxConfigMapData(config) framework.Sleep(10 * time.Second) @@ -183,9 +187,9 @@ var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { ginkgo.It("should enable opentracing using jaeger with sampler host", func() { config := map[string]string{} - config[enableOpentracing] = "true" - config[jaegerCollectorHost] = "127.0.0.1" - config[jaegerSamplerHost] = "127.0.0.1" + config[enableOpentracing] = enable + config[jaegerCollectorHost] = localhost + config[jaegerSamplerHost] = localhost f.SetNginxConfigMapData(config) framework.Sleep(10 * time.Second) @@ -197,8 +201,8 @@ var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { ginkgo.It("should propagate the w3c header when configured with jaeger", func() { host := "jaeger-w3c" config := map[string]string{} - config[enableOpentracing] = "true" - config[jaegerCollectorHost] = "127.0.0.1" + config[enableOpentracing] = enable + config[jaegerCollectorHost] = localhost config[jaegerPropagationFormat] = "w3c" f.SetNginxConfigMapData(config) @@ -227,7 +231,7 @@ var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { /* ginkgo.It("should enable opentracing using jaeger with an HTTP endpoint", func() { config := map[string]string{} - config[enableOpentracing] = "true" + config[enableOpentracing] = TRUE config[jaegerEndpoint] = "http://127.0.0.1/api/traces" f.SetNginxConfigMapData(config) @@ -240,7 +244,7 @@ var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { ginkgo.It("should enable opentracing using datadog", func() { config := map[string]string{} - config[enableOpentracing] = "true" + config[enableOpentracing] = enable config[datadogCollectorHost] = "http://127.0.0.1" f.SetNginxConfigMapData(config) diff --git a/test/e2e/settings/pod_security_policy_volumes.go b/test/e2e/settings/pod_security_policy_volumes.go index dd4df3bd99..f8fc58300b 100644 --- a/test/e2e/settings/pod_security_policy_volumes.go +++ b/test/e2e/settings/pod_security_policy_volumes.go @@ -38,7 +38,6 @@ var _ = framework.IngressNginxDescribe("[Security] Pod Security Policies with vo f := framework.NewDefaultFramework("pod-security-policies-volumes") ginkgo.It("should be running with a Pod Security Policy", func() { - k8sversion, err := f.KubeClientSet.Discovery().ServerVersion() if err != nil { assert.Nil(ginkgo.GinkgoT(), err, "getting version") diff --git a/test/e2e/settings/proxy_connect_timeout.go b/test/e2e/settings/proxy_connect_timeout.go index 1290775a57..185ac1dd19 100644 --- a/test/e2e/settings/proxy_connect_timeout.go +++ b/test/e2e/settings/proxy_connect_timeout.go @@ -14,6 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ +//nolint:dupl // Ignore dupl errors for similar test case package settings import ( @@ -64,5 +65,4 @@ var _ = framework.DescribeSetting("proxy-connect-timeout", func() { return !strings.Contains(server, fmt.Sprintf("proxy_connect_timeout %ss;", proxyConnectTimeout)) }) }) - }) diff --git a/test/e2e/settings/proxy_protocol.go b/test/e2e/settings/proxy_protocol.go index 9939cad9ea..cfce68bf8a 100644 --- a/test/e2e/settings/proxy_protocol.go +++ b/test/e2e/settings/proxy_protocol.go @@ -33,8 +33,10 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const proxyProtocol = "proxy-protocol" + var _ = framework.DescribeSetting("use-proxy-protocol", func() { - f := framework.NewDefaultFramework("proxy-protocol") + f := framework.NewDefaultFramework(proxyProtocol) setting := "use-proxy-protocol" @@ -42,9 +44,9 @@ var _ = framework.DescribeSetting("use-proxy-protocol", func() { f.NewEchoDeployment() f.UpdateNginxConfigMapData(setting, "false") }) - + //nolint:dupl // Ignore dupl errors for similar test case ginkgo.It("should respect port passed by the PROXY Protocol", func() { - host := "proxy-protocol" + host := proxyProtocol f.UpdateNginxConfigMapData(setting, "true") @@ -73,14 +75,15 @@ var _ = framework.DescribeSetting("use-proxy-protocol", func() { assert.Nil(ginkgo.GinkgoT(), err, "unexpected error reading connection data") body := string(data) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("host=%v", "proxy-protocol")) + assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("host=%v", proxyProtocol)) assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-port=1234") assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-proto=http") assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-for=192.168.0.1") }) + //nolint:dupl // Ignore dupl errors for similar test case ginkgo.It("should respect proto passed by the PROXY Protocol server port", func() { - host := "proxy-protocol" + host := proxyProtocol f.UpdateNginxConfigMapData(setting, "true") @@ -109,14 +112,14 @@ var _ = framework.DescribeSetting("use-proxy-protocol", func() { assert.Nil(ginkgo.GinkgoT(), err, "unexpected error reading connection data") body := string(data) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("host=%v", "proxy-protocol")) + assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("host=%v", proxyProtocol)) assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-port=443") assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-proto=https") assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-for=192.168.0.1") }) ginkgo.It("should enable PROXY Protocol for HTTPS", func() { - host := "proxy-protocol" + host := proxyProtocol f.UpdateNginxConfigMapData(setting, "true") @@ -151,7 +154,7 @@ var _ = framework.DescribeSetting("use-proxy-protocol", func() { assert.Nil(ginkgo.GinkgoT(), err, "unexpected error reading connection data") body := string(data) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("host=%v", "proxy-protocol")) + assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("host=%v", proxyProtocol)) assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-port=1234") assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-proto=https") assert.Contains(ginkgo.GinkgoT(), body, "x-scheme=https") diff --git a/test/e2e/settings/proxy_read_timeout.go b/test/e2e/settings/proxy_read_timeout.go index c84956cc91..484b44f241 100644 --- a/test/e2e/settings/proxy_read_timeout.go +++ b/test/e2e/settings/proxy_read_timeout.go @@ -14,6 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ +//nolint:dupl // Ignore dupl errors for similar test case package settings import ( @@ -64,5 +65,4 @@ var _ = framework.DescribeSetting("proxy-read-timeout", func() { return !strings.Contains(server, fmt.Sprintf("proxy_read_timeout %ss;", proxyReadtimeout)) }) }) - }) diff --git a/test/e2e/settings/proxy_send_timeout.go b/test/e2e/settings/proxy_send_timeout.go index 886642bc0a..bdcd46f0f1 100644 --- a/test/e2e/settings/proxy_send_timeout.go +++ b/test/e2e/settings/proxy_send_timeout.go @@ -14,6 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ +//nolint:dupl // Ignore dupl errors for similar test case package settings import ( @@ -64,5 +65,4 @@ var _ = framework.DescribeSetting("proxy-send-timeout", func() { return !strings.Contains(server, fmt.Sprintf("proxy_send_timeout %ss;", proxySendTimeout)) }) }) - }) diff --git a/test/e2e/settings/ssl_passthrough.go b/test/e2e/settings/ssl_passthrough.go index f0859f878a..b10511bde4 100644 --- a/test/e2e/settings/ssl_passthrough.go +++ b/test/e2e/settings/ssl_passthrough.go @@ -19,7 +19,7 @@ package settings import ( "context" "crypto/tls" - "fmt" + "net" "net/http" "strings" @@ -54,7 +54,6 @@ var _ = framework.IngressNginxDescribe("[Flag] enable-ssl-passthrough", func() { ginkgo.Describe("With enable-ssl-passthrough enabled", func() { ginkgo.It("should enable ssl-passthrough-proxy-port on a different port", func() { - err := f.UpdateIngressControllerDeployment(func(deployment *appsv1.Deployment) error { args := deployment.Spec.Template.Spec.Containers[0].Args args = append(args, "--ssl-passthrough-proxy-port=1442") @@ -77,7 +76,6 @@ var _ = framework.IngressNginxDescribe("[Flag] enable-ssl-passthrough", func() { }) ginkgo.It("should pass unknown traffic to default backend and handle known traffic", func() { - host := "testpassthrough.com" echoName := "echopass" @@ -170,20 +168,21 @@ var _ = framework.IngressNginxDescribe("[Flag] enable-ssl-passthrough", func() { return strings.Contains(server, "listen 442") }) + //nolint:gosec // Ignore the gosec error in testing f.HTTPTestClientWithTLSConfig(&tls.Config{ServerName: host, InsecureSkipVerify: true}). GET("/"). - WithURL(fmt.Sprintf("https://%s:443", host)). + WithURL("https://"+net.JoinHostPort(host, "443")). ForceResolve(f.GetNginxIP(), 443). Expect(). Status(http.StatusOK) + //nolint:gosec // Ignore the gosec error in testing f.HTTPTestClientWithTLSConfig(&tls.Config{ServerName: hostBad, InsecureSkipVerify: true}). GET("/"). - WithURL(fmt.Sprintf("https://%s:443", hostBad)). + WithURL("https://"+net.JoinHostPort(hostBad, "443")). ForceResolve(f.GetNginxIP(), 443). Expect(). Status(http.StatusNotFound) - }) }) }) diff --git a/test/e2e/settings/tls.go b/test/e2e/settings/tls.go index 2cead4a945..51f760df8b 100644 --- a/test/e2e/settings/tls.go +++ b/test/e2e/settings/tls.go @@ -87,9 +87,7 @@ var _ = framework.DescribeSetting("[SSL] TLS protocols, ciphers and headers)", f }) ginkgo.Context("should configure HSTS policy header", func() { - var ( - tlsConfig *tls.Config - ) + var tlsConfig *tls.Config const ( hstsMaxAge = "hsts-max-age" @@ -182,7 +180,6 @@ var _ = framework.DescribeSetting("[SSL] TLS protocols, ciphers and headers)", f got := header["Strict-Transport-Security"] assert.Equal(ginkgo.GinkgoT(), 1, len(got)) }) - }) ginkgo.Context("ports or X-Forwarded-Host check during HTTP tp HTTPS redirection", func() { diff --git a/test/e2e/settings/validations/validations.go b/test/e2e/settings/validations/validations.go index 6f1715ada6..19488d2471 100644 --- a/test/e2e/settings/validations/validations.go +++ b/test/e2e/settings/validations/validations.go @@ -29,7 +29,7 @@ import ( var _ = framework.IngressNginxDescribeSerial("annotation validations", func() { f := framework.NewDefaultFramework("validations") - + //nolint:dupl // Ignore dupl errors for similar test case ginkgo.It("should allow ingress based on their risk on webhooks", func() { host := "annotation-validations" @@ -54,9 +54,8 @@ var _ = framework.IngressNginxDescribeSerial("annotation validations", func() { ing = framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) _, err = f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Update(context.TODO(), ing, metav1.UpdateOptions{}) assert.NotNil(ginkgo.GinkgoT(), err, "creating ingress with risky annotations should trigger an error") - }) - + //nolint:dupl // Ignore dupl errors for similar test case ginkgo.It("should allow ingress based on their risk on webhooks", func() { host := "annotation-validations" @@ -81,6 +80,5 @@ var _ = framework.IngressNginxDescribeSerial("annotation validations", func() { ing = framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) _, err = f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Update(context.TODO(), ing, metav1.UpdateOptions{}) assert.NotNil(ginkgo.GinkgoT(), err, "creating ingress with risky annotations should trigger an error") - }) }) diff --git a/test/e2e/ssl/secret_update.go b/test/e2e/ssl/secret_update.go index fe7bfca0c4..8e81f09f9a 100644 --- a/test/e2e/ssl/secret_update.go +++ b/test/e2e/ssl/secret_update.go @@ -98,7 +98,7 @@ var _ = framework.IngressNginxDescribe("[SSL] secret update", func() { return strings.Contains(server, "server_name invalid-ssl") && strings.Contains(server, "listen 443") }) - + //nolint:gosec // Ignore certificate validation in testing resp := f.HTTPTestClientWithTLSConfig(&tls.Config{ServerName: host, InsecureSkipVerify: true}). GET("/"). WithURL(f.GetURL(framework.HTTPS)). diff --git a/test/e2e/status/update.go b/test/e2e/status/update.go index 046752d2b2..c3c48f8d2a 100644 --- a/test/e2e/status/update.go +++ b/test/e2e/status/update.go @@ -108,6 +108,7 @@ var _ = framework.IngressNginxDescribe("[Status] status update", func() { } }() + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated err = wait.Poll(5*time.Second, 4*time.Minute, func() (done bool, err error) { ing, err = f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Get(context.TODO(), host, metav1.GetOptions{}) if err != nil { @@ -134,7 +135,8 @@ func getHostIP() net.IP { } defer conn.Close() - localAddr := conn.LocalAddr().(*net.UDPAddr) + localAddr, ok := conn.LocalAddr().(*net.UDPAddr) + assert.True(ginkgo.GinkgoT(), ok, "unexpected type: %T", conn.LocalAddr()) return localAddr.IP } diff --git a/test/e2e/tcpudp/tcp.go b/test/e2e/tcpudp/tcp.go index 16a633b636..f06d6c9a3e 100644 --- a/test/e2e/tcpudp/tcp.go +++ b/test/e2e/tcpudp/tcp.go @@ -148,18 +148,18 @@ var _ = framework.IngressNginxDescribe("[TCP] tcp-services", func() { } var ips []string - var retryErr error + var errRetry error err = wait.ExponentialBackoff(retry, func() (bool, error) { - ips, retryErr = resolver.LookupHost(context.Background(), "google-public-dns-b.google.com") - if retryErr == nil { + ips, errRetry = resolver.LookupHost(context.Background(), "google-public-dns-b.google.com") + if errRetry == nil { return true, nil } return false, nil }) - + //nolint:staticcheck // TODO: will replace it since wait.ErrWaitTimeout is deprecated if err == wait.ErrWaitTimeout { - err = retryErr + err = errRetry } assert.Nil(ginkgo.GinkgoT(), err, "unexpected error from DNS resolver") @@ -167,7 +167,6 @@ var _ = framework.IngressNginxDescribe("[TCP] tcp-services", func() { }) ginkgo.It("should reload after an update in the configuration", func() { - ginkgo.By("setting up a first deployment") f.NewEchoDeployment(framework.WithDeploymentName("first-service")) @@ -217,5 +216,4 @@ var _ = framework.IngressNginxDescribe("[TCP] tcp-services", func() { assert.Nil(ginkgo.GinkgoT(), err, "obtaining nginx logs") assert.Contains(ginkgo.GinkgoT(), logs, "Backend successfully reloaded") }) - })