Skip to content

Commit d8d72eb

Browse files
charanm08charanm08
committed
feat: support bigip object verification in ingressLink and tlsProfile
1 parent b962cee commit d8d72eb

File tree

8 files changed

+59
-29
lines changed

8 files changed

+59
-29
lines changed

‎pkg/bigiphandler/bigiphandler.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,7 @@ type BigIPHandlerInterface interface {
122122
GetHTMLProfile(name string) (any, error)
123123
GetFTPProfile(name string) (any, error)
124124
GetHTTPCompressionProfile(name string) (any, error)
125+
GetMonitor(name string) (*bigip.Monitor, error)
125126
// Add more methods as needed for other BIG-IP resources
126127
}
127128

@@ -555,6 +556,7 @@ func (handler *BigIPHandler) GetMonitor(name string) (*bigip.Monitor, error) {
555556
default:
556557
monitor, err := handler.Bigip.GetMonitor(name, mType)
557558
if err == nil {
559+
log.Debugf("Found monitor %s of type %s,monitor: %v", name, mType, monitor)
558560
// Found a valid monitor, send result and cancel others
559561
resultCh <- result{monitor, nil}
560562
cancel()

‎pkg/bigiphandler/bigiphandler_test.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -296,6 +296,11 @@ type MockBigIPClientForPersistence struct {
296296
errorMsg string
297297
}
298298

299+
func (m *MockBigIPClientForPersistence) GetMonitor(name string, parent string) (*bigip.Monitor, error) {
300+
//TODO implement me
301+
return nil, nil
302+
}
303+
299304
func NewMockBigIPClientForPersistence(successfulProfile string, shouldError bool, errorMsg string) *MockBigIPClientForPersistence {
300305
return &MockBigIPClientForPersistence{
301306
successfulProfile: successfulProfile,
@@ -417,6 +422,10 @@ func (m *MockBigIPClientForPersistence) GetAnalyticsProfile(name string) (*bigip
417422
return &bigip.AnalyticsProfile{Name: name}, nil
418423
}
419424

425+
func (m *MockBigIPClient) GetMonitor(name, parent string) (*bigip.Monitor, error) {
426+
return &bigip.Monitor{Name: name}, nil
427+
}
428+
420429
// Persistence profile methods that control the test behavior
421430
func (m *MockBigIPClientForPersistence) GetCookiePersistenceProfile(name string) (*bigip.CookiePersistenceProfile, error) {
422431
if m.successfulProfile == "cookie" && !m.shouldError {

‎pkg/controller/controller_suit_test.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,10 @@ type (
5454
}
5555
)
5656

57+
func (m *mockBigIPHandler) GetMonitor(name string) (*bigip.Monitor, error) {
58+
return nil, nil
59+
}
60+
5761
func newMockController() *mockController {
5862
return &mockController{
5963
Controller: &Controller{

‎pkg/controller/informers.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -962,7 +962,7 @@ func (ctlr *Controller) enqueueTLSProfile(obj interface{}, event string) {
962962
tlsKey := tls.ObjectMeta.Namespace + "/" + tls.ObjectMeta.Name
963963
valid, errMsg := ctlr.checkValidTLSProfile(tls)
964964
if !valid {
965-
log.Errorf("IngressLink %s is not valid: %s", tlsKey, errMsg)
965+
log.Errorf("TLSProfile %s is not valid: %s", tlsKey, errMsg)
966966
ctlr.updateTLSProfileStatus(tls, StatusError, errors.New(errMsg))
967967
return
968968
}

‎pkg/controller/resourceConfig.go‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1746,36 +1746,37 @@ func (ctlr *Controller) handleVirtualServerTLS(
17461746

17471747
// validate TLSProfile
17481748
// validation includes valid parameters for the type of termination(edge, re-encrypt and Pass-through)
1749-
func validateTLSProfile(tls *cisapiv1.TLSProfile) bool {
1749+
func validateTLSProfile(tls *cisapiv1.TLSProfile) (bool, error) {
17501750
// validation for re-encrypt termination
1751+
var err error
17511752
if tls.Spec.TLS.Termination == "reencrypt" {
17521753
// Should contain both client and server SSL profiles
17531754
if (tls.Spec.TLS.ClientSSL == "" || tls.Spec.TLS.ServerSSL == "") && (len(tls.Spec.TLS.ClientSSLs) == 0 || len(tls.Spec.TLS.ServerSSLs) == 0) {
1754-
log.Errorf("TLSProfile %s of type re-encrypt termination should contain both "+
1755+
err = fmt.Errorf("TLSProfile %s of type re-encrypt termination should contain both "+
17551756
"ClientSSLs and ServerSSLs", tls.ObjectMeta.Name)
1756-
return false
1757+
return false, err
17571758
}
17581759
} else if tls.Spec.TLS.Termination == "edge" {
17591760
// Should contain only client SSL
17601761
if tls.Spec.TLS.ClientSSL == "" && len(tls.Spec.TLS.ClientSSLs) == 0 {
1761-
log.Errorf("TLSProfile %s of type edge termination should contain ClientSSLs",
1762+
err = fmt.Errorf("TLSProfile %s of type edge termination should contain ClientSSLs",
17621763
tls.ObjectMeta.Name)
1763-
return false
1764+
return false, err
17641765
}
17651766
if tls.Spec.TLS.ServerSSL != "" || len(tls.Spec.TLS.ServerSSLs) != 0 {
1766-
log.Errorf("TLSProfile %s of type edge termination should NOT contain ServerSSLs",
1767+
err = fmt.Errorf("TLSProfile %s of type edge termination should NOT contain ServerSSLs",
17671768
tls.ObjectMeta.Name)
1768-
return false
1769+
return false, err
17691770
}
17701771
} else {
17711772
// Pass-through
17721773
if (tls.Spec.TLS.ClientSSL != "") || (tls.Spec.TLS.ServerSSL != "") || len(tls.Spec.TLS.ClientSSLs) != 0 || len(tls.Spec.TLS.ServerSSLs) != 0 {
1773-
log.Errorf("TLSProfile %s of type Pass-through termination should NOT contain either "+
1774+
err = fmt.Errorf("TLSProfile %s of type Pass-through termination should NOT contain either "+
17741775
"ClientSSLs or ServerSSLs", tls.ObjectMeta.Name)
1775-
return false
1776+
return false, err
17761777
}
17771778
}
1778-
return true
1779+
return true, nil
17791780
}
17801781

17811782
// ConvertStringToProfileRef converts strings to profile references

‎pkg/controller/resourceConfig_test.go‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1017,31 +1017,31 @@ var _ = Describe("Resource Config Tests", func() {
10171017
},
10181018
)
10191019

1020-
ok := validateTLSProfile(tlsRenc)
1020+
ok, _ := validateTLSProfile(tlsRenc)
10211021
Expect(ok).To(BeTrue(), "TLS Re-encryption Validation Failed")
10221022

1023-
ok = validateTLSProfile(tlsEdge)
1023+
ok, _ = validateTLSProfile(tlsEdge)
10241024
Expect(ok).To(BeTrue(), "TLS Edge Validation Failed")
10251025

1026-
ok = validateTLSProfile(tlsPst)
1026+
ok, _ = validateTLSProfile(tlsPst)
10271027
Expect(ok).To(BeTrue(), "TLS Passthrough Validation Failed")
10281028

10291029
// Negative cases
10301030
tlsPst.Spec.TLS.Termination = TLSEdge
10311031
tlsEdge.Spec.TLS.Termination = TLSReencrypt
10321032
tlsRenc.Spec.TLS.Termination = TLSPassthrough
10331033

1034-
ok = validateTLSProfile(tlsRenc)
1034+
ok, _ = validateTLSProfile(tlsRenc)
10351035
Expect(ok).To(BeFalse(), "TLS Re-encryption Validation Failed")
10361036

1037-
ok = validateTLSProfile(tlsEdge)
1037+
ok, _ = validateTLSProfile(tlsEdge)
10381038
Expect(ok).To(BeFalse(), "TLS Edge Validation Failed")
10391039

1040-
ok = validateTLSProfile(tlsPst)
1040+
ok, _ = validateTLSProfile(tlsPst)
10411041
Expect(ok).To(BeFalse(), "TLS Passthrough Validation Failed")
10421042

10431043
tlsRenc.Spec.TLS.Termination = TLSEdge
1044-
ok = validateTLSProfile(tlsRenc)
1044+
ok, _ = validateTLSProfile(tlsRenc)
10451045
Expect(ok).To(BeFalse(), "TLS Edge Validation Failed")
10461046
})
10471047

@@ -1095,34 +1095,34 @@ var _ = Describe("Resource Config Tests", func() {
10951095
},
10961096
)
10971097

1098-
ok := validateTLSProfile(tlsRenc)
1098+
ok, _ := validateTLSProfile(tlsRenc)
10991099
Expect(ok).To(BeTrue(), "TLS Re-encryption Validation Failed")
11001100

1101-
ok = validateTLSProfile(tlsRencComb)
1101+
ok, _ = validateTLSProfile(tlsRencComb)
11021102
Expect(ok).To(BeFalse(), "TLS Re-encryption Validation Failed")
11031103

1104-
ok = validateTLSProfile(tlsEdge)
1104+
ok, _ = validateTLSProfile(tlsEdge)
11051105
Expect(ok).To(BeTrue(), "TLS Edge Validation Failed")
11061106

1107-
ok = validateTLSProfile(tlsPst)
1107+
ok, _ = validateTLSProfile(tlsPst)
11081108
Expect(ok).To(BeTrue(), "TLS Passthrough Validation Failed")
11091109

11101110
// Negative cases
11111111
tlsPst.Spec.TLS.Termination = TLSEdge
11121112
tlsEdge.Spec.TLS.Termination = TLSReencrypt
11131113
tlsRenc.Spec.TLS.Termination = TLSPassthrough
11141114

1115-
ok = validateTLSProfile(tlsRenc)
1115+
ok, _ = validateTLSProfile(tlsRenc)
11161116
Expect(ok).To(BeFalse(), "TLS Re-encryption Validation Failed")
11171117

1118-
ok = validateTLSProfile(tlsEdge)
1118+
ok, _ = validateTLSProfile(tlsEdge)
11191119
Expect(ok).To(BeFalse(), "TLS Edge Validation Failed")
11201120

1121-
ok = validateTLSProfile(tlsPst)
1121+
ok, _ = validateTLSProfile(tlsPst)
11221122
Expect(ok).To(BeFalse(), "TLS Passthrough Validation Failed")
11231123

11241124
tlsRenc.Spec.TLS.Termination = TLSEdge
1125-
ok = validateTLSProfile(tlsRenc)
1125+
ok, _ = validateTLSProfile(tlsRenc)
11261126
Expect(ok).To(BeFalse(), "TLS Edge Validation Failed")
11271127
})
11281128

‎pkg/controller/validate.go‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,16 @@ func (ctlr *Controller) validateResource(req *admissionv1.AdmissionRequest) *adm
111111
}
112112
allowed, errMsg = ctlr.checkValidIngressLink(il)
113113
case TLSProfile:
114-
allowed = true
114+
tlsProf := &cisapiv1.TLSProfile{}
115+
if _, _, err := deserializer.Decode(req.Object.Raw, nil, tlsProf); err != nil {
116+
return &admissionv1.AdmissionResponse{
117+
Allowed: false,
118+
Result: &metav1.Status{
119+
Message: fmt.Sprintf("could not decode object: %v", err),
120+
},
121+
}
122+
}
123+
allowed, errMsg = ctlr.checkValidTLSProfile(tlsProf)
115124

116125
case CustomPolicy:
117126
pl := &cisapiv1.Policy{}
@@ -536,7 +545,7 @@ func (ctlr *Controller) checkValidIngressLink(
536545

537546
// Validate monitors
538547
for _, monitor := range il.Spec.Monitors {
539-
if monitor.Type != BIGIP {
548+
if monitor.Reference != BIGIP {
540549
continue
541550
}
542551
wg.Add(1)
@@ -566,6 +575,11 @@ func (ctlr *Controller) checkValidIngressLink(
566575
}
567576

568577
func (ctlr *Controller) checkValidTLSProfile(tlsProfile *cisapiv1.TLSProfile) (bool, string) {
578+
isValid, err := validateTLSProfile(tlsProfile)
579+
if !isValid {
580+
return false, err.Error()
581+
}
582+
569583
if tlsProfile.Spec.TLS.Reference == Secret {
570584
return true, ""
571585
}

‎pkg/controller/worker.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1250,7 +1250,7 @@ func (ctlr *Controller) getTLSProfileForVirtualServer(vs *cisapiv1.VirtualServer
12501250
}
12511251

12521252
// validate TLSProfile
1253-
validation := validateTLSProfile(tlsProfile)
1253+
validation, _ := validateTLSProfile(tlsProfile)
12541254
if validation == false {
12551255
return nil
12561256
}

0 commit comments

Comments
 (0)