Skip to content

Commit 2b1083a

Browse files
vepatelvepatel
committed
add support for rorfs test wafv5
1 parent 98b4159 commit 2b1083a

File tree

3 files changed

+145
-43
lines changed

3 files changed

+145
-43
lines changed

‎tests/suite/fixtures/ic_fixtures.py‎

Lines changed: 20 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -289,14 +289,26 @@ def crd_ingress_controller_with_waf_v5(
289289
ap_uds_crd_name,
290290
f"{CRDS}/appprotect.f5.com_apusersigs.yaml",
291291
)
292-
name = create_ingress_controller_wafv5(
293-
kube_apis.v1,
294-
kube_apis.apps_v1_api,
295-
cli_arguments,
296-
namespace,
297-
"regcred",
298-
request.param.get("extra_args", None),
299-
)
292+
if request.param["type"] == "rorfs": # WAFv5 with readOnlyRootFileSystem
293+
name = create_ingress_controller_wafv5(
294+
kube_apis.v1,
295+
kube_apis.apps_v1_api,
296+
cli_arguments,
297+
namespace,
298+
"regcred",
299+
request.param.get("extra_args", None),
300+
True,
301+
)
302+
else:
303+
name = create_ingress_controller_wafv5(
304+
kube_apis.v1,
305+
kube_apis.apps_v1_api,
306+
cli_arguments,
307+
namespace,
308+
"regcred",
309+
request.param.get("extra_args", None),
310+
)
311+
input("Press Enter to continue...")
300312
try:
301313
with open(f"{dir}/wafv5.tgz", "rb") as f:
302314
file_content = f.read()

‎tests/suite/test_app_protect_wafv5_integration.py‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,18 @@ def waf_setup(kube_apis, test_namespace) -> None:
2323
@pytest.mark.parametrize(
2424
"crd_ingress_controller_with_waf_v5, virtual_server_setup",
2525
[
26+
(
27+
{
28+
"type": "rorfs",
29+
"extra_args": [
30+
f"-enable-app-protect",
31+
],
32+
},
33+
{
34+
"example": "ap-waf-v5",
35+
"app_type": "simple",
36+
},
37+
),
2638
(
2739
{
2840
"type": "complete",
@@ -34,7 +46,7 @@ def waf_setup(kube_apis, test_namespace) -> None:
3446
"example": "ap-waf-v5",
3547
"app_type": "simple",
3648
},
37-
)
49+
),
3850
],
3951
indirect=True,
4052
)

‎tests/suite/utils/resources_utils.py‎

Lines changed: 112 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1206,7 +1206,7 @@ def create_ingress_controller(v1: CoreV1Api, apps_v1_api: AppsV1Api, cli_argumen
12061206

12071207

12081208
def create_ingress_controller_wafv5(
1209-
v1: CoreV1Api, apps_v1_api: AppsV1Api, cli_arguments, namespace, reg_secret, args=None
1209+
v1: CoreV1Api, apps_v1_api: AppsV1Api, cli_arguments, namespace, reg_secret, args=None, rorfs=False
12101210
) -> str:
12111211
"""
12121212
Create an Ingress Controller according to the params.
@@ -1225,6 +1225,9 @@ def create_ingress_controller_wafv5(
12251225
dep["spec"]["replicas"] = int(cli_arguments["replicas"])
12261226
dep["spec"]["template"]["spec"]["containers"][0]["image"] = cli_arguments["image"]
12271227
dep["spec"]["template"]["spec"]["containers"][0]["imagePullPolicy"] = cli_arguments["image-pull-policy"]
1228+
if "readOnlyRootFilesystem" not in dep["spec"]["template"]["spec"]["containers"][0]["securityContext"]:
1229+
dep["spec"]["template"]["spec"]["containers"][0]["securityContext"]["readOnlyRootFilesystem"] = rorfs
1230+
12281231
template_spec = dep["spec"]["template"]["spec"]
12291232
if "imagePullSecrets" not in template_spec:
12301233
template_spec["imagePullSecrets"] = []
@@ -1233,43 +1236,109 @@ def create_ingress_controller_wafv5(
12331236
if "volumes" not in template_spec:
12341237
template_spec["volumes"] = []
12351238

1236-
template_spec["volumes"].extend(
1237-
[
1238-
{
1239-
"name": "app-protect-bd-config",
1240-
"emptyDir": {},
1241-
},
1242-
{
1243-
"name": "app-protect-config",
1244-
"emptyDir": {},
1245-
},
1246-
{
1247-
"name": "app-protect-bundles",
1248-
"emptyDir": {},
1249-
},
1250-
]
1251-
)
1239+
if rorfs and "initContainers" not in template_spec:
1240+
template_spec["initContainers"] = []
1241+
template_spec["initContainers"].extend(
1242+
[
1243+
{
1244+
"name": "init-nginx-ingress",
1245+
"image": cli_arguments["image"],
1246+
"imagePullPolicy": "IfNotPresent",
1247+
"command": ["cp", "-vdR", "/etc/nginx/.", "/mnt/etc"],
1248+
"securityContext": {
1249+
"allowPrivilegeEscalation": False,
1250+
"readOnlyRootFilesystem": True,
1251+
"runAsUser": 101, # nginx
1252+
"runAsNonRoot": True,
1253+
"capabilities": {"drop": ["ALL"]},
1254+
},
1255+
"volumeMounts": [{"mountPath": "/mnt/etc", "name": "nginx-etc"}],
1256+
}
1257+
]
1258+
)
1259+
1260+
if rorfs:
1261+
template_spec["volumes"].extend(
1262+
[
1263+
{
1264+
"name": "app-protect-bd-config",
1265+
"emptyDir": {},
1266+
},
1267+
{
1268+
"name": "app-protect-config",
1269+
"emptyDir": {},
1270+
},
1271+
{
1272+
"name": "app-protect-bundles",
1273+
"emptyDir": {},
1274+
},
1275+
{"name": "nginx-etc", "emptyDir": {}},
1276+
{"name": "nginx-log", "emptyDir": {}},
1277+
{"name": "nginx-cache", "emptyDir": {}},
1278+
{"name": "nginx-lib", "emptyDir": {}},
1279+
]
1280+
)
1281+
else:
1282+
template_spec["volumes"].extend(
1283+
[
1284+
{
1285+
"name": "app-protect-bd-config",
1286+
"emptyDir": {},
1287+
},
1288+
{
1289+
"name": "app-protect-config",
1290+
"emptyDir": {},
1291+
},
1292+
{
1293+
"name": "app-protect-bundles",
1294+
"emptyDir": {},
1295+
},
1296+
]
1297+
)
12521298

12531299
container = dep["spec"]["template"]["spec"]["containers"][0]
12541300
if "volumeMounts" not in container:
12551301
container["volumeMounts"] = []
12561302

1257-
container["volumeMounts"].extend(
1258-
[
1259-
{
1260-
"name": "app-protect-bd-config",
1261-
"mountPath": "/opt/app_protect/bd_config",
1262-
},
1263-
{
1264-
"name": "app-protect-config",
1265-
"mountPath": "/opt/app_protect/config",
1266-
},
1267-
{
1268-
"name": "app-protect-bundles",
1269-
"mountPath": "/etc/app_protect/bundles",
1270-
},
1271-
]
1272-
)
1303+
if rorfs:
1304+
container["volumeMounts"].extend(
1305+
[
1306+
{
1307+
"name": "app-protect-bd-config",
1308+
"mountPath": "/opt/app_protect/bd_config",
1309+
},
1310+
{
1311+
"name": "app-protect-config",
1312+
"mountPath": "/opt/app_protect/config",
1313+
},
1314+
{
1315+
"name": "app-protect-bundles",
1316+
"mountPath": "/etc/app_protect/bundles",
1317+
},
1318+
{"name": "nginx-etc", "mountPath": "/etc/nginx"},
1319+
{"name": "nginx-log", "mountPath": "/var/log/nginx"},
1320+
{"name": "nginx-cache", "mountPath": "/var/cache/nginx"},
1321+
{"name": "nginx-lib", "mountPath": "/var/lib/nginx"},
1322+
]
1323+
)
1324+
else:
1325+
container["volumeMounts"].extend(
1326+
[
1327+
{
1328+
"name": "app-protect-bd-config",
1329+
"mountPath": "/opt/app_protect/bd_config",
1330+
},
1331+
{
1332+
"name": "app-protect-config",
1333+
"mountPath": "/opt/app_protect/config",
1334+
},
1335+
{
1336+
"name": "app-protect-bundles",
1337+
"mountPath": "/etc/app_protect/bundles",
1338+
},
1339+
]
1340+
)
1341+
12731342
dep["spec"]["template"]["spec"]["containers"][0]["args"].extend(
12741343
[
12751344
f"-default-server-tls-secret=$(POD_NAMESPACE)/default-server-secret",
@@ -1281,7 +1350,11 @@ def create_ingress_controller_wafv5(
12811350
"name": "waf-config-mgr",
12821351
"image": f"{NGX_REG}/nap/waf-config-mgr:{WAF_V5_VERSION}",
12831352
"imagePullPolicy": "IfNotPresent",
1284-
"securityContext": {"allowPrivilegeEscalation": False, "capabilities": {"drop": ["all"]}},
1353+
"securityContext": {
1354+
"allowPrivilegeEscalation": False,
1355+
"capabilities": {"drop": ["all"]},
1356+
"readOnlyRootFilesystem": rorfs,
1357+
},
12851358
"volumeMounts": [
12861359
{
12871360
"name": "app-protect-bd-config",
@@ -1301,6 +1374,11 @@ def create_ingress_controller_wafv5(
13011374
"name": "waf-enforcer",
13021375
"image": f"{NGX_REG}/nap/waf-enforcer:{WAF_V5_VERSION}",
13031376
"imagePullPolicy": "IfNotPresent",
1377+
"securityContext": {
1378+
"allowPrivilegeEscalation": False,
1379+
"capabilities": {"drop": ["all"]},
1380+
"readOnlyRootFilesystem": rorfs,
1381+
},
13041382
"env": [{"name": "ENFORCER_PORT", "value": "50000"}],
13051383
"volumeMounts": [
13061384
{

0 commit comments

Comments
 (0)