8000 Add appprotect unit tests for Ingress cfg gen · nginx/kubernetes-ingress@3d7a891 · GitHub
[go: up one dir, main page]
Skip to content

Commit 3d7a891

Browse files
pleshakovpleshakov
committed
Add appprotect unit tests for Ingress cfg gen
1 parent 5c1ca9c commit 3d7a891

File tree

1 file changed

+157
-14
lines changed

1 file changed

+157
-14
lines changed

‎internal/configs/ingress_test.go‎

Lines changed: 157 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111
v1 "k8s.io/api/core/v1"
1212
networking "k8s.io/api/networking/v1beta1"
1313
meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
14+
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
1415
"k8s.io/apimachinery/pkg/util/intstr"
1516

1617
"github.com/nginxinc/kubernetes-ingress/internal/configs/version1"
@@ -20,10 +21,11 @@ func TestGenerateNginxCfg(t *testing.T) {
2021
cafeIngressEx := createCafeIngressEx()
2122
configParams := NewDefaultConfigParams()
2223

23-
expected := createExpectedConfigForCafeIngressEx()
24+
isPlus := false
25+
expected := createExpectedConfigForCafeIngressEx(isPlus)
2426

2527
apRes := make(map[string]string)
26-
result, warnings := generateNginxCfg(&cafeIngressEx, apRes, false, configParams, false, false, &StaticConfigParams{}, false)
28+
result, warnings := generateNginxCfg(&cafeIngressEx, apRes, false, configParams, isPlus, false, &StaticConfigParams{}, false)
2729

2830
if diff := cmp.Diff(expected, result); diff != "" {
2931
t.Errorf("generateNginxCfg() returned unexpected result (-want +got):\n%s", diff)
@@ -48,7 +50,9 @@ func TestGenerateNginxCfgForJWT(t *testing.T) {
4850

4951
configParams := NewDefaultConfigParams()
5052

51-
expected := createExpectedConfigForCafeIngressEx()
53+
isPlus := true
54+
55+
expected := createExpectedConfigForCafeIngressEx(isPlus)
5256
expected.Servers[0].JWTAuth = &version1.JWTAuth{
5357
Key: "/etc/nginx/secrets/default-cafe-jwk",
5458
Realm: "Cafe App",
@@ -63,7 +67,7 @@ func TestGenerateNginxCfgForJWT(t *testing.T) {
6367
}
6468

6569
apRes := make(map[string]string)
66-
result, warnings := generateNginxCfg(&cafeIngressEx, apRes, false, configParams, true, false, &StaticConfigParams{}, false)
70+
result, warnings := generateNginxCfg(&cafeIngressEx, apRes, false, configParams, isPlus, false, &StaticConfigParams{}, false)
6771

6872
if !reflect.DeepEqual(result.Servers[0].JWTAuth, expected.Servers[0].JWTAuth) {
6973
t.Errorf("generateNginxCfg returned \n%v, but expected \n%v", result.Servers[0].JWTAuth, expected.Servers[0].JWTAuth)
@@ -173,7 +177,7 @@ func TestGenerateIngressPath(t *testing.T) {
173177
}
174178
}
175179

176-
func createExpectedConfigForCafeIngressEx() version1.IngressNginxConfig {
180+
func createExpectedConfigForCafeIngressEx(isPlus bool) version1.IngressNginxConfig {
177181
coffeeUpstream := version1.Upstream{
178182
Name: "default-cafe-ingress-cafe.example.com-coffee-svc-80",
179183
LBMethod: "random two least_conn",
@@ -188,6 +192,15 @@ func createExpectedConfigForCafeIngressEx() version1.IngressNginxConfig {
188192
},
189193
},
190194
}
195+
if isPlus {
196+
coffeeUpstream.UpstreamLabels = version1.UpstreamLabels{
197+
Service: "coffee-svc",
198+
ResourceType: "ingress",
199+
ResourceName: "cafe-ingress",
200+
ResourceNamespace: "default",
201+
}
202+
}
203+
191204
teaUpstream := version1.Upstream{
192205
Name: "default-cafe-ingress-cafe.example.com-tea-svc-80",
193206
LBMethod: "random two least_conn",
@@ -202,6 +215,15 @@ func createExpectedConfigForCafeIngressEx() version1.IngressNginxConfig {
202215
},
203216
},
204217
}
218+
if isPlus {
219+
teaUpstream.UpstreamLabels = version1.UpstreamLabels{
220+
Service: "tea-svc",
221+
ResourceType: "ingress",
222+
ResourceName: "cafe-ingress",
223+
ResourceNamespace: "default",
224+
}
225+
}
226+
205227
expected := version1.IngressNginxConfig{
206228
Upstreams: []version1.Upstream{
207229
coffeeUpstream,
@@ -324,12 +346,14 @@ func createCafeIngressEx() IngressEx {
324346

325347
func TestGenerateNginxCfgForMergeableIngresses(t *testing.T) {
326348
mergeableIngresses := createMergeableCafeIngress()
327-
expected := createExpectedConfigForMergeableCafeIngress()
349+
350+
isPlus := false
351+
expected := createExpectedConfigForMergeableCafeIngress(isPlus)
328352

329353
configParams := NewDefaultConfigParams()
330354

331355
masterApRes := make(map[string]string)
332-
result, warnings := generateNginxCfgForMergeableIngresses(mergeableIngresses, masterApRes, configParams, false, false, &StaticConfigParams{}, false)
356+
result, warnings := generateNginxCfgForMergeableIngresses(mergeableIngresses, masterApRes, configParams, isPlus, false, &StaticConfigParams{}, false)
333357

334358
if diff := cmp.Diff(expected, result); diff != "" {
335359
t.Errorf("generateNginxCfgForMergeableIngresses() returned unexpected result (-want +got):\n%s", diff)
@@ -388,7 +412,9 @@ func TestGenerateNginxCfgForMergeableIngressesForJWT(t *testing.T) {
388412
Path: "/etc/nginx/secrets/default-coffee-jwk",
389413
}
390414

391-
expected := createExpectedConfigForMergeableCafeIngress()
415+
isPlus := true
416+
417+
expected := createExpectedConfigForMergeableCafeIngress(isPlus)
392418
expected.Servers[0].JWTAuth = &version1.JWTAuth{
393419
Key: "/etc/nginx/secrets/default-cafe-jwk",
394420
Realm: "Cafe",
@@ -415,7 +441,6 @@ func TestGenerateNginxCfgForMergeableIngressesForJWT(t *testing.T) {
415441
minionJwtKeyFileNames := make(map[string]string)
416442
minionJwtKeyFileNames[objectMetaToFileName(&mergeableIngresses.Minions[0].Ingress.ObjectMeta)] = "/etc/nginx/secrets/default-coffee-jwk"
417443
configParams := NewDefaultConfigParams()
418-
isPlus := true
419444

420445
masterApRes := make(map[string]string)
421446
result, warnings := generateNginxCfgForMergeableIngresses(mergeableIngresses, masterApRes, configParams, isPlus, false, &StaticConfigParams{}, false)
@@ -578,7 +603,7 @@ func createMergeableCafeIngress() *MergeableIngresses {
578603
return mergeableIngresses
579604
}
580605

581-
func createExpectedConfigForMergeableCafeIngress() version1.IngressNginxConfig {
606+
func createExpectedConfigForMergeableCafeIngress(isPlus bool) version1.IngressNginxConfig {
582607
coffeeUpstream := version1.Upstream{
583608
9E72 Name: "default-cafe-ingress-coffee-minion-cafe.example.com-coffee-svc-80",
584609
LBMethod: "random two least_conn",
@@ -593,6 +618,15 @@ func createExpectedConfigForMergeableCafeIngress() version1.IngressNginxConfig {
593618
},
594619
},
595620
}
621+
if isPlus {
622+
coffeeUpstream.UpstreamLabels = version1.UpstreamLabels{
623+
Service: "coffee-svc",
624+
ResourceType: "ingress",
625+
ResourceName: "cafe-ingress-coffee-minion",
626+
ResourceNamespace: "default",
627+
}
628+
}
629+
596630
teaUpstream := version1.Upstream{
597631
Name: "default-cafe-ingress-tea-minion-cafe.example.com-tea-svc-80",
598632
LBMethod: "random two least_conn",
@@ -607,6 +641,15 @@ func createExpectedConfigForMergeableCafeIngress() version1.IngressNginxConfig {
607641
},
608642
},
609643
}
644+
if isPlus {
645+
teaUpstream.UpstreamLabels = version1.UpstreamLabels{
646+
Service: "tea-svc",
647+
ResourceType: "ingress",
648+
ResourceName: "cafe-ingress-tea-minion",
649+
ResourceNamespace: "default",
650+
}
651+
}
652+
610653
expected := version1.IngressNginxConfig{
611654
Upstreams: []version1.Upstream{
612655
coffeeUpstream,
@@ -786,14 +829,16 @@ func TestGenerateNginxCfgForSpiffe(t *testing.T) {
786829
cafeIngressEx := createCafeIngressEx()
787830
configParams := NewDefaultConfigParams()
788831

789-
expected := createExpectedConfigForCafeIngressEx()
832+
isPlus := false
833+
834+
expected := createExpectedConfigForCafeIngressEx(isPlus)
790835
expected.SpiffeClientCerts = true
791836
for i := range expected.Servers[0].Locations {
792837
expected.Servers[0].Locations[i].SSL = true
793838
}
794839

795840
apResources := make(map[string]string)
796-
result, warnings := generateNginxCfg(&cafeIngressEx, apResources, false, configParams, false, false,
841+
result, warnings := generateNginxCfg(&cafeIngressEx, apResources, false, configParams, isPlus, false,
797842
&StaticConfigParams{NginxServiceMesh: true}, false)
798843

799844
if diff := cmp.Diff(expected, result); diff != "" {
@@ -810,12 +855,14 @@ func TestGenerateNginxCfgForInternalRoute(t *testing.T) {
810855
cafeIngressEx.Ingress.Annotations[internalRouteAnnotation] = "true"
811856
configParams := NewDefaultConfigParams()
812857

813-
expected := createExpectedConfigForCafeIngressEx()
858+
isPlus := false
859+
860+
expected := createExpectedConfigForCafeIngressEx(isPlus)
814861
expected.Servers[0].SpiffeCerts = true
815862
expected.Ingress.Annotations[internalRouteAnnotation] = "true"
816863

817864
apResources := make(map[string]string)
818-
result, warnings := generateNginxCfg(&cafeIngressEx, apResources, false, configParams, false, false,
865+
result, warnings := generateNginxCfg(&cafeIngressEx, apResources, false, configParams, isPlus, false,
819866
&StaticConfigParams{NginxServiceMesh: true, EnableInternalRoutes: true}, false)
820867

821868
if diff := cmp.Diff(expected, result); diff != "" {
@@ -1251,3 +1298,99 @@ func TestGenerateJWTConfig(t *testing.T) {
12511298
}
12521299
}
12531300
}
1301+
1302+
func TestGenerateNginxCfgForAppProtect(t *testing.T) {
1303+
cafeIngressEx := createCafeIngressEx()
1304+
cafeIngressEx.Ingress.Annotations["appprotect.f5.com/app-protect-enable"] = "True"
1305+
cafeIngressEx.Ingress.Annotations["appprotect.f5.com/app-protect-security-log-enable"] = "True"
1306+
cafeIngressEx.AppProtectPolicy = &unstructured.Unstructured{
1307+
Object: map[string]interface{}{
1308+
"metadata": map[string]interface{}{
1309+
"namespace": "default",
1310+
"name": "dataguard-alarm",
1311+
},
1312+
},
1313+
}
1314+
cafeIngressEx.AppProtectLogConf = &unstructured.Unstructured{
1315+
Object: map[string]interface{}{
1316+
"metadata": map[string]interface{}{
1317+
"namespace": "default",
1318+
"name": "logconf",
1319+
},
1320+
},
1321+
}
1322+
1323+
configParams := NewDefaultConfigParams()
1324+
apRes := map[string]string{
1325+
appProtectPolicyKey: "/etc/nginx/waf/nac-policies/default_dataguard-alarm",
1326+
appProtectLogConfKey: "/etc/nginx/waf/nac-logconfs/default_logconf syslog:server=127.0.0.1:514",
1327+
}
1328+
staticCfgParams := &StaticConfigParams{
1329+
MainAppProtectLoadModule: true,
1330+
}
1331+
1332+
isPlus := true
1333+
1334+
expected := createExpectedConfigForCafeIngressEx(isPlus)
1335+
expected.Servers[0].AppProtectEnable = "on"
1336+
expected.Servers[0].AppProtectPolicy = "/etc/nginx/waf/nac-policies/default_dataguard-alarm"
1337+
expected.Servers[0].AppProtectLogConf = "/etc/nginx/waf/nac-logconfs/default_logconf syslog:server=127.0.0.1:514"
1338+
expected.Servers[0].AppProtectLogEnable = "on"
1339+
expected.Ingress.Annotations = cafeIngressEx.Ingress.Annotations
1340+
1341+
result, warnings := generateNginxCfg(&cafeIngressEx, apRes, false, configParams, isPlus, false, staticCfgParams, false)
1342+
if diff := cmp.Diff(expected, result); diff != "" {
1343+
t.Errorf("generateNginxCfg() returned unexpected result (-want +got):\n%s", diff)
1344+
}
1345+
if len(warnings) != 0 {
1346+
t.Errorf("generateNginxCfg() returned warnings: %v", warnings)
1347+
}
1348+
}
1349+
1350+
func TestGenerateNginxCfgForMergeableIngressesForAppProtect(t *testing.T) {
1351+
mergeableIngresses := createMergeableCafeIngress()
1352+
mergeableIngresses.Master.Ingress.Annotations["appprotect.f5.com/app-protect-enable"] = "True"
1353+
mergeableIngresses.Master.Ingress.Annotations["appprotect.f5.com/app-protect-security-log-enable"] = "True"
1354+
mergeableIngresses.Master.AppProtectPolicy = &unstructured.Unstructured{
1355+
Object: map[string]interface{}{
1356+
"metadata": map[string]interface{}{
1357+
"namespace": "default",
1358+
"name": "dataguard-alarm",
1359+
},
1360+
},
1361+
}
1362+
mergeableIngresses.Master.AppProtectLogConf = &unstructured.Unstructured{
1363+
Object: map[string]interface{}{
1364+
"metadata": map[string]interface{}{
1365+
"namespace": "default",
1366+
"name": "logconf",
1367+
},
1368+
},
1369+
}
1370+
1371+
configParams := NewDefaultConfigParams()
1372+
apRes := map[string]string{
1373+
appProtectPolicyKey: "/etc/nginx/waf/nac-policies/default_dataguard-alarm",
1374+
appProtectLogConfKey: "/etc/nginx/waf/nac-logconfs/default_logconf syslog:server=127.0.0.1:514",
1375+
}
1376+
staticCfgParams := &StaticConfigParams{
1377+
MainAppProtectLoadModule: true,
1378+
}
1379+
1380+
isPlus := true
1381+
1382+
expected := createExpectedConfigForMergeableCafeIngress(isPlus)
1383+
expected.Servers[0].AppProtectEnable = "on"
1384+
expected.Servers[0].AppProtectPolicy = "/etc/nginx/waf/nac-policies/default_dataguard-alarm"
1385+
expected.Servers[0].AppProtectLogConf = "/etc/nginx/waf/nac-logconfs/default_logconf syslog:server=127.0.0.1:514"
1386+
expected.Servers[0].AppProtectLogEnable = "on"
1387+
expected.Ingress.Annotations = mergeableIngresses.Master.Ingress.Annotations
1388+
1389+
result, warnings := generateNginxCfgForMergeableIngresses(mergeableIngresses, apRes, configParams, isPlus, false, staticCfgParams, false)
1390+
if diff := cmp.Diff(expected, result); diff != "" {
1391+
t.Errorf("generateNginxCfgForMergeableIngresses() returned unexpected result (-want +got):\n%s", diff)
1392+
}
1393+
if len(warnings) != 0 {
1394+
t.Errorf("generateNginxCfgForMergeableIngresses() returned warnings: %v", warnings)
1395+
}
1396+
}

0 commit comments

Comments
 (0)
0