Skip to content

Commit a6c17e9

Browse files
snorwinsnorwin
committed
BackendTLSPolicy conformance tests for ResolvedRefs status condition
Signed-off-by: Norwin Schnyder <[email protected]>
1 parent 8fe8316 commit a6c17e9

5 files changed

+353
-9
lines changed

‎conformance/tests/backendtlspolicy-invalid-ca-certificate-ref.go

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package tests
18+
19+
import (
20+
"testing"
21+
22+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
23+
"k8s.io/apimachinery/pkg/types"
24+
25+
gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
26+
gatewayv1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
27+
gatewayv1alpha3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
28+
h "sigs.k8s.io/gateway-api/conformance/utils/http"
29+
"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
30+
"sigs.k8s.io/gateway-api/conformance/utils/suite"
31+
"sigs.k8s.io/gateway-api/pkg/features"
32+
)
33+
34+
func init() {
35+
ConformanceTests = append(ConformanceTests, BackendTLSPolicyCACertificateRefInvalidCACertificateRef)
36+
}
37+
38+
var BackendTLSPolicyCACertificateRefInvalidCACertificateRef = suite.ConformanceTest{
39+
ShortName: "BackendTLSPolicyCACertificateRefInvalidCACertificateRef",
40+
Description: "A BackendTLSPolicy that specifies a single invalid CACertificateRef should have the Accepted and ResolvedRefs status condition set False with appropriate reasons, and HTTP requests to a backend targeted by this policy should fail with a 5xx response.",
41+
Features: []features.FeatureName{
42+
features.SupportGateway,
43+
features.SupportHTTPRoute,
44+
features.SupportBackendTLSPolicy,
45+
},
46+
Manifests: []string{"tests/backendtlspolicy-invalid-ca-certificate-ref.yaml"},
47+
Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
48+
ns := "gateway-conformance-infra"
49+
routeNN := types.NamespacedName{Name: "backendtlspolicy-invalid-ca-certificate-ref", Namespace: ns}
50+
gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ns}
51+
52+
serverStr := "abc.example.com"
53+
54+
kubernetes.NamespacesMustBeReady(t, suite.Client, suite.TimeoutConfig, []string{ns})
55+
gwAddr := kubernetes.GatewayAndRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), &gatewayv1.HTTPRoute{}, false, routeNN)
56+
kubernetes.HTTPRouteMustHaveResolvedRefsConditionsTrue(t, suite.Client, suite.TimeoutConfig, routeNN, gwNN)
57+
58+
for _, policyNN := range []types.NamespacedName{
59+
{Name: "nonexistent-ca-certificate-ref", Namespace: ns},
60+
{Name: "malformed-ca-certificate-ref", Namespace: ns},
61+
} {
62+
t.Run("BackendTLSPolicy_"+policyNN.Name, func(t *testing.T) {
63+
t.Run("BackendTLSPolicy with a single invalid CACertificateRef has a Accepted Condition with status False and Reason NoValidCACertificate", func(t *testing.T) {
64+
acceptedCond := metav1.Condition{
65+
Type: string(gatewayv1alpha2.PolicyConditionAccepted),
66+
Status: metav1.ConditionFalse,
67+
Reason: string(gatewayv1alpha3.BackendTLSPolicyReasonNoValidCACertificate),
68+
}
69+
70+
kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, acceptedCond)
71+
})
72+
73+
t.Run("BackendTLSPolicy with a single invalid CACertificateRef has a ResolvedRefs Condition with status False and Reason InvalidCACertificateRef", func(t *testing.T) {
74+
resolvedRefsCond := metav1.Condition{
75+
Type: string(gatewayv1alpha3.BackendTLSPolicyConditionResolvedRefs),
76+
Status: metav1.ConditionFalse,
77+
Reason: string(gatewayv1alpha3.BackendTLSPolicyReasonInvalidCACertificateRef),
78+
}
79+
80+
kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, resolvedRefsCond)
81+
})
82+
83+
t.Run("HTTP Request to backend targeted by an invalid BackendTLSPolicy receive a 5xx", func(t *testing.T) {
84+
h.MakeRequestAndExpectFailure(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
85+
h.ExpectedResponse{
86+
Namespace: ns,
87+
Request: h.Request{
88+
Host: serverStr,
89+
Path: "/backendtlspolicy-" + policyNN.Name,
90+
},
91+
})
92+
})
93+
})
94+
}
95+
},
96+
}

‎conformance/tests/backendtlspolicy-invalid-ca-certificate-ref.yaml

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
apiVersion: gateway.networking.k8s.io/v1
2+
kind: HTTPRoute
3+
metadata:
4+
name: backendtlspolicy-invalid-ca-certificate-ref
5+
namespace: gateway-conformance-infra
6+
spec:
7+
parentRefs:
8+
- name: same-namespace
9+
namespace: gateway-conformance-infra
10+
hostnames:
11+
- abc.example.com
12+
rules:
13+
- backendRefs:
14+
- name: backendtlspolicy-nonexistent-ca-certificate-ref-test
15+
port: 443
16+
matches:
17+
- path:
18+
type: Exact
19+
value: /backendtlspolicy-nonexistent-ca-certificate-ref
20+
- backendRefs:
21+
- name: backendtlspolicy-malformed-ca-certificate-ref-test
22+
port: 443
23+
matches:
24+
- path:
25+
type: Exact
26+
value: /backendtlspolicy-malformed-ca-certificate-ref
27+
---
28+
apiVersion: v1
29+
kind: Service
30+
metadata:
31+
name: backendtlspolicy-nonexistent-ca-certificate-ref-test
32+
namespace: gateway-conformance-infra
33+
spec:
34+
selector:
35+
app: tls-backend
36+
ports:
37+
- name: "https"
38+
protocol: TCP
39+
appProtocol: HTTPS
40+
port: 443
41+
targetPort: 8443
42+
---
43+
apiVersion: v1
44+
kind: Service
45+
metadata:
46+
name: backendtlspolicy-malformed-ca-certificate-ref-test
47+
namespace: gateway-conformance-infra
48+
spec:
49+
selector:
50+
app: tls-backend
51+
ports:
52+
- name: "https"
53+
protocol: TCP
54+
appProtocol: HTTPS
55+
port: 443
56+
targetPort: 8443
57+
---
58+
apiVersion: gateway.networking.k8s.io/v1alpha3
59+
kind: BackendTLSPolicy
60+
metadata:
61+
name: nonexistent-ca-certificate-ref
62+
namespace: gateway-conformance-infra
63+
spec:
64+
targetRefs:
65+
- group: ""
66+
kind: Service
67+
name: "backendtlspolicy-nonexistent-ca-certificate-ref-test"
68+
validation:
69+
caCertificateRefs:
70+
- group: ""
71+
kind: ConfigMap
72+
name: "nonexistent-ca-certificate"
73+
hostname: "abc.example.com"
74+
---
75+
apiVersion: gateway.networking.k8s.io/v1alpha3
76+
kind: BackendTLSPolicy
77+
metadata:
78+
name: malformed-ca-certificate-ref
79+
namespace: gateway-conformance-infra
80+
spec:
81+
targetRefs:
82+
- group: ""
83+
kind: Service
84+
name: "backendtlspolicy-malformed-ca-certificate-ref-test"
85+
validation:
86+
caCertificateRefs:
87+
- group: ""
88+
kind: ConfigMap
89+
name: "malformed-ca-certificate"
90+
hostname: "abc.example.com"
91+
---
92+
apiVersion: v1
93+
kind: ConfigMap
94+
metadata:
95+
name: malformed-ca-certificate
96+
namespace: gateway-conformance-infra
97+
data: {}

‎conformance/tests/backendtlspolicy-invalid-kind.go

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package tests
18+
19+
import (
20+
"testing"
21+
22+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
23+
"k8s.io/apimachinery/pkg/types"
24+
25+
gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
26+
gatewayv1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
27+
gatewayv1alpha3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
28+
h "sigs.k8s.io/gateway-api/conformance/utils/http"
29+
"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
30+
"sigs.k8s.io/gateway-api/conformance/utils/suite"
31+
"sigs.k8s.io/gateway-api/pkg/features"
32+
)
33+
34+
func init() {
35+
ConformanceTests = append(ConformanceTests, BackendTLSPolicyCACertificateRefInvalidKind)
36+
}
37+
38+
var BackendTLSPolicyCACertificateRefInvalidKind = suite.ConformanceTest{
39+
ShortName: "BackendTLSPolicyCACertificateRefInvalidKind",
40+
Description: "A BackendTLSPolicy that specifies a single CACertificateRef with an invalid kind should have the Accepted and ResolvedRefs status condition set False with appropriate reasons, and HTTP requests to a backend targeted by this policy should fail with a 5xx response.",
41+
Features: []features.FeatureName{
42+
features.SupportGateway,
43+
features.SupportHTTPRoute,
44+
features.SupportBackendTLSPolicy,
45+
},
46+
Manifests: []string{"tests/backendtlspolicy-invalid-kind.yaml"},
47+
Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
48+
ns := "gateway-conformance-infra"
49+
routeNN := types.NamespacedName{Name: "backendtlspolicy-invalid-kind-test", Namespace: ns}
50+
gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ns}
51+
52+
serverStr := "abc.example.com"
53+
54+
kubernetes.NamespacesMustBeReady(t, suite.Client, suite.TimeoutConfig, []string{ns})
55+
gwAddr := kubernetes.GatewayAndRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), &gatewayv1.HTTPRoute{}, false, routeNN)
56+
kubernetes.HTTPRouteMustHaveResolvedRefsConditionsTrue(t, suite.Client, suite.TimeoutConfig, routeNN, gwNN)
57+
58+
policyNN := types.NamespacedName{Name: "invalid-kind", Namespace: ns}
59+
60+
t.Run("BackendTLSPolicy with a single invalid CACertificateRef has a Accepted Condition with status False and Reason NoValidCACertificate", func(t *testing.T) {
61+
acceptedCond := metav1.Condition{
62+
Type: string(gatewayv1alpha2.PolicyConditionAccepted),
63+
Status: metav1.ConditionFalse,
64+
Reason: string(gatewayv1alpha3.BackendTLSPolicyReasonNoValidCACertificate),
65+
}
66+
67+
kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, acceptedCond)
68+
})
69+
70+
t.Run("BackendTLSPolicy with a single invalid CACertificateRef has a ResolvedRefs Condition with status False and Reason InvalidKind", func(t *testing.T) {
71+
resolvedRefsCond := metav1.Condition{
72+
Type: string(gatewayv1alpha3.BackendTLSPolicyConditionResolvedRefs),
73+
Status: metav1.ConditionFalse,
74+
Reason: string(gatewayv1alpha3.BackendTLSPolicyReasonInvalidKind),
75+
}
76+
77+
kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, resolvedRefsCond)
78+
})
79+
80+
t.Run("HTTP Request to backend targeted by an invalid BackendTLSPolicy receive a 5xx", func(t *testing.T) {
81+
h.MakeRequestAndExpectFailure(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
82+
h.ExpectedResponse{
83+
Namespace: ns,
84+
Request: h.Request{
85+
Host: serverStr,
86+
Path: "/backendtlspolicy-" + policyNN.Name,
87+
},
88+
})
89+
})
90+
91+
},
92+
}

‎conformance/tests/backendtlspolicy-invalid-kind.yaml

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
apiVersion: gateway.networking.k8s.io/v1
2+
kind: HTTPRoute
3+
metadata:
4+
name: backendtlspolicy-invalid-kind-test
5+
namespace: gateway-conformance-infra
6+
spec:
7+
parentRefs:
8+
- name: same-namespace
9+
namespace: gateway-conformance-infra
10+
hostnames:
11+
- abc.example.com
12+
rules:
13+
- backendRefs:
14+
- name: backendtlspolicy-invalid-kind-test
15+
port: 443
16+
matches:
17+
- path:
18+
type: Exact
19+
value: /backendtlspolicy-invalid-kind
20+
---
21+
apiVersion: v1
22+
kind: Service
23+
metadata:
24+
name: backendtlspolicy-invalid-kind-test
25+
namespace: gateway-conformance-infra
26+
spec:
27+
selector:
28+
app: tls-backend
29+
ports:
30+
- name: "https"
31+
protocol: TCP
32+
appProtocol: HTTPS
33+
port: 443
34+
targetPort: 8443
35+
---
36+
apiVersion: gateway.networking.k8s.io/v1alpha3
37+
kind: BackendTLSPolicy
38+
metadata:
39+
name: invalid-kind
40+
namespace: gateway-conformance-infra
41+
spec:
42+
targetRefs:
43+
- group: ""
44+
kind: Service
45+
name: "backendtlspolicy-invalid-kind-test"
46+
validation:
47+
caCertificateRefs:
48+
- group: invalid.io
49+
kind: InvalidKind
50+
name: "invalid-kind"
51+
hostname: "abc.example.com"

0 commit comments

Comments
 (0)