Skip to content

Commit c15b792

Browse files
snorwinsnorwin
authored
BackendTLSPolicy conformance tests for ResolvedRefs status condition (#4010)
* BackendTLSPolicy conformance tests for ResolvedRefs status condition Signed-off-by: Norwin Schnyder <[email protected]> * Apply PR feedback Signed-off-by: Norwin Schnyder <[email protected]> * deprecate StatusCode of the excpected response in favor of StatusCodes Signed-off-by: Norwin Schnyder <[email protected]> --------- Signed-off-by: Norwin Schnyder <[email protected]>
1 parent d008cde commit c15b792

7 files changed

+390
-20
lines changed

‎conformance/tests/backendtlspolicy-invalid-ca-certificate-ref.go

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package tests
18+
19+
import (
20+
"testing"
21+
22+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
23+
"k8s.io/apimachinery/pkg/types"
24+
25+
gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
26+
gatewayv1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
27+
gatewayv1alpha3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
28+
h "sigs.k8s.io/gateway-api/conformance/utils/http"
29+
"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
30+
"sigs.k8s.io/gateway-api/conformance/utils/suite"
31+
"sigs.k8s.io/gateway-api/pkg/features"
32+
)
33+
34+
func init() {
35+
ConformanceTests = append(ConformanceTests, BackendTLSPolicyInvalidCACertificateRef)
36+
}
37+
38+
var BackendTLSPolicyInvalidCACertificateRef = suite.ConformanceTest{
39+
ShortName: "BackendTLSPolicyInvalidCACertificateRef",
40+
Description: "A BackendTLSPolicy that specifies a single invalid CACertificateRef should have the Accepted and ResolvedRefs status condition set False with appropriate reasons, and HTTP requests to a backend targeted by this policy should fail with a 5xx response.",
41+
Features: []features.FeatureName{
42+
features.SupportGateway,
43+
features.SupportHTTPRoute,
44+
features.SupportBackendTLSPolicy,
45+
},
46+
Manifests: []string{"tests/backendtlspolicy-invalid-ca-certificate-ref.yaml"},
47+
Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
48+
ns := "gateway-conformance-infra"
49+
routeNN := types.NamespacedName{Name: "backendtlspolicy-invalid-ca-certificate-ref", Namespace: ns}
50+
gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ns}
51+
52+
serverStr := "abc.example.com"
53+
54+
kubernetes.NamespacesMustBeReady(t, suite.Client, suite.TimeoutConfig, []string{ns})
55+
gwAddr := kubernetes.GatewayAndRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), &gatewayv1.HTTPRoute{}, false, routeNN)
56+
57+
for _, policyNN := range []types.NamespacedName{
58+
{Name: "nonexistent-ca-certificate-ref", Namespace: ns},
59+
{Name: "malformed-ca-certificate-ref", Namespace: ns},
60+
} {
61+
t.Run("BackendTLSPolicy_"+policyNN.Name, func(t *testing.T) {
62+
t.Run("BackendTLSPolicy with a single invalid CACertificateRef has a Accepted Condition with status False and Reason NoValidCACertificate", func(t *testing.T) {
63+
acceptedCond := metav1.Condition{
64+
Type: string(gatewayv1alpha2.PolicyConditionAccepted),
65+
Status: metav1.ConditionFalse,
66+
Reason: string(gatewayv1alpha3.BackendTLSPolicyReasonNoValidCACertificate),
67+
}
68+
69+
kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, acceptedCond)
70+
})
71+
72+
t.Run("BackendTLSPolicy with a single invalid CACertificateRef has a ResolvedRefs Condition with status False and Reason InvalidCACertificateRef", func(t *testing.T) {
73+
resolvedRefsCond := metav1.Condition{
74+
Type: string(gatewayv1alpha3.BackendTLSPolicyConditionResolvedRefs),
75+
Status: metav1.ConditionFalse,
76+
Reason: string(gatewayv1alpha3.BackendTLSPolicyReasonInvalidCACertificateRef),
77+
}
78+
79+
kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, resolvedRefsCond)
80+
})
81+
82+
t.Run("HTTP Request to backend targeted by an invalid BackendTLSPolicy receive a 5xx", func(t *testing.T) {
83+
h.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
84+
h.ExpectedResponse{
85+
Namespace: ns,
86+
Request: h.Request{
87+
Host: serverStr,
88+
Path: "/backendtlspolicy-" + policyNN.Name,
89+
},
90+
Response: h.Response{
91+
StatusCodes: []int{500, 502, 503},
92+
},
93+
})
94+
})
95+
})
96+
}
97+
},
98+
}

‎conformance/tests/backendtlspolicy-invalid-ca-certificate-ref.yaml

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
apiVersion: gateway.networking.k8s.io/v1
2+
kind: HTTPRoute
3+
metadata:
4+
name: backendtlspolicy-invalid-ca-certificate-ref
5+
namespace: gateway-conformance-infra
6+
spec:
7+
parentRefs:
8+
- name: same-namespace
9+
namespace: gateway-conformance-infra
10+
hostnames:
11+
- abc.example.com
12+
rules:
13+
- backendRefs:
14+
- name: backendtlspolicy-nonexistent-ca-certificate-ref-test
15+
port: 443
16+
matches:
17+
- path:
18+
type: Exact
19+
value: /backendtlspolicy-nonexistent-ca-certificate-ref
20+
- backendRefs:
21+
- name: backendtlspolicy-malformed-ca-certificate-ref-test
22+
port: 443
23+
matches:
24+
- path:
25+
type: Exact
26+
value: /backendtlspolicy-malformed-ca-certificate-ref
27+
---
28+
apiVersion: v1
29+
kind: Service
30+
metadata:
31+
name: backendtlspolicy-nonexistent-ca-certificate-ref-test
32+
namespace: gateway-conformance-infra
33+
spec:
34+
selector:
35+
app: tls-backend
36+
ports:
37+
- name: "https"
38+
protocol: TCP
39+
appProtocol: HTTPS
40+
port: 443
41+
targetPort: 8443
42+
---
43+
apiVersion: v1
44+
kind: Service
45+
metadata:
46+
name: backendtlspolicy-malformed-ca-certificate-ref-test
47+
namespace: gateway-conformance-infra
48+
spec:
49+
selector:
50+
app: tls-backend
51+
ports:
52+
- name: "https"
53+
protocol: TCP
54+
appProtocol: HTTPS
55+
port: 443
56+
targetPort: 8443
57+
---
58+
apiVersion: gateway.networking.k8s.io/v1alpha3
59+
kind: BackendTLSPolicy
60+
metadata:
61+
name: nonexistent-ca-certificate-ref
62+
namespace: gateway-conformance-infra
63+
spec:
64+
targetRefs:
65+
- group: ""
66+
kind: Service
67+
name: "backendtlspolicy-nonexistent-ca-certificate-ref-test"
68+
validation:
69+
caCertificateRefs:
70+
- group: ""
71+
kind: ConfigMap
72+
name: "nonexistent-ca-certificate"
73+
hostname: "abc.example.com"
74+
---
75+
apiVersion: gateway.networking.k8s.io/v1alpha3
76+
kind: BackendTLSPolicy
77+
metadata:
78+
name: malformed-ca-certificate-ref
79+
namespace: gateway-conformance-infra
80+
spec:
81+
targetRefs:
82+
- group: ""
83+
kind: Service
84+
name: "backendtlspolicy-malformed-ca-certificate-ref-test"
85+
validation:
86+
caCertificateRefs:
87+
- group: ""
88+
kind: ConfigMap
89+
name: "malformed-ca-certificate"
90+
hostname: "abc.example.com"
91+
---
92+
apiVersion: v1
93+
kind: ConfigMap
94+
metadata:
95+
name: malformed-ca-certificate
96+
namespace: gateway-conformance-infra
97+
data: {}

‎conformance/tests/backendtlspolicy-invalid-kind.go

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package tests
18+
19+
import (
20+
"testing"
21+
22+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
23+
"k8s.io/apimachinery/pkg/types"
24+
25+
gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
26+
gatewayv1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
27+
gatewayv1alpha3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
28+
h "sigs.k8s.io/gateway-api/conformance/utils/http"
29+
"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
30+
"sigs.k8s.io/gateway-api/conformance/utils/suite"
31+
"sigs.k8s.io/gateway-api/pkg/features"
32+
)
33+
34+
func init() {
35+
ConformanceTests = append(ConformanceTests, BackendTLSPolicyInvalidKind)
36+
}
37+
38+
var BackendTLSPolicyInvalidKind = suite.ConformanceTest{
39+
ShortName: "BackendTLSPolicyInvalidKind",
40+
Description: "A BackendTLSPolicy that specifies a single CACertificateRef with an invalid kind should have the Accepted and ResolvedRefs status condition set False with appropriate reasons, and HTTP requests to a backend targeted by this policy should fail with a 5xx response.",
41+
Features: []features.FeatureName{
42+
features.SupportGateway,
43+
features.SupportHTTPRoute,
44+
features.SupportBackendTLSPolicy,
45+
},
46+
Manifests: []string{"tests/backendtlspolicy-invalid-kind.yaml"},
47+
Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
48+
ns := "gateway-conformance-infra"
49+
routeNN := types.NamespacedName{Name: "backendtlspolicy-invalid-kind-test", Namespace: ns}
50+
gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ns}
51+
52+
serverStr := "abc.example.com"
53+
54+
kubernetes.NamespacesMustBeReady(t, suite.Client, suite.TimeoutConfig, []string{ns})
55+
gwAddr := kubernetes.GatewayAndRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), &gatewayv1.HTTPRoute{}, false, routeNN)
56+
57+
policyNN := types.NamespacedName{Name: "invalid-kind", Namespace: ns}
58+
59+
t.Run("BackendTLSPolicy with a single invalid CACertificateRef has a Accepted Condition with status False and Reason NoValidCACertificate", func(t *testing.T) {
60+
acceptedCond := metav1.Condition{
61+
Type: string(gatewayv1alpha2.PolicyConditionAccepted),
62+
Status: metav1.ConditionFalse,
63+
Reason: string(gatewayv1alpha3.BackendTLSPolicyReasonNoValidCACertificate),
64+
}
65+
66+
kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, acceptedCond)
67+
})
68+
69+
t.Run("BackendTLSPolicy with a single invalid CACertificateRef has a ResolvedRefs Condition with status False and Reason InvalidKind", func(t *testing.T) {
70+
resolvedRefsCond := metav1.Condition{
71+
Type: string(gatewayv1alpha3.BackendTLSPolicyConditionResolvedRefs),
72+
Status: metav1.ConditionFalse,
73+
Reason: string(gatewayv1alpha3.BackendTLSPolicyReasonInvalidKind),
74+
}
75+
76+
kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, resolvedRefsCond)
77+
})
78+
79+
t.Run("HTTP Request to backend targeted by an invalid BackendTLSPolicy receive a 5xx", func(t *testing.T) {
80+
h.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
81+
h.ExpectedResponse{
82+
Namespace: ns,
83+
Request: h.Request{
84+
Host: serverStr,
85+
Path: "/backendtlspolicy-" + policyNN.Name,
86+
},
87+
Response: h.Response{
88+
StatusCodes: []int{500, 502, 503},
89+
},
90+
})
91+
})
92+
},
93+
}

‎conformance/tests/backendtlspolicy-invalid-kind.yaml

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
apiVersion: gateway.networking.k8s.io/v1
2+
kind: HTTPRoute
3+
metadata:
4+
name: backendtlspolicy-invalid-kind-test
5+
namespace: gateway-conformance-infra
6+
spec:
7+
parentRefs:
8+
- name: same-namespace
9+
namespace: gateway-conformance-infra
10+
hostnames:
11+
- abc.example.com
12+
rules:
13+
- backendRefs:
14+
- name: backendtlspolicy-invalid-kind-test
15+
port: 443
16+
matches:
17+
- path:
18+
type: Exact
19+
value: /backendtlspolicy-invalid-kind
20+
---
21+
apiVersion: v1
22+
kind: Service
23+
metadata:
24+
name: backendtlspolicy-invalid-kind-test
25+
namespace: gateway-conformance-infra
26+
spec:
27+
selector:
28+
app: tls-backend
29+
ports:
30+
- name: "https"
31+
protocol: TCP
32+
appProtocol: HTTPS
33+
port: 443
34+
targetPort: 8443
35+
---
36+
apiVersion: gateway.networking.k8s.io/v1alpha3
37+
kind: BackendTLSPolicy
38+
metadata:
39+
name: invalid-kind
40+
namespace: gateway-conformance-infra
41+
spec:
42+
targetRefs:
43+
- group: ""
44+
kind: Service
45+
name: "backendtlspolicy-invalid-kind-test"
46+
validation:
47+
caCertificateRefs:
48+
- group: invalid.io
49+
kind: InvalidKind
50+
name: "invalid-kind"
51+
hostname: "abc.example.com"

0 commit comments

Comments
 (0)