Skip to content

Commit 570d80d

Browse files
committed
move basic auth policy validation to CRD
1 parent 3f73934 commit 570d80d

File tree

5 files changed

+21
-32
lines changed

5 files changed

+21
-32
lines changed

config/crd/bases/k8s.nginx.org_policies.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,9 +90,16 @@ spec:
9090
description: BasicAuth holds HTTP Basic authentication configuration
9191
properties:
9292
realm:
93+
description: The realm for basic authentication
94+
pattern: ^([^"$\\]|\\[^$])*$
9395
type: string
9496
secret:
97+
description: The name of the Kubernetes secret that stores the
98+
Htpasswd configuration
99+
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
95100
type: string
101+
required:
102+
- secret
96103
type: object
97104
egressMTLS:
98105
description: EgressMTLS defines an Egress MTLS policy.

deploy/crds.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -252,9 +252,16 @@ spec:
252252
description: BasicAuth holds HTTP Basic authentication configuration
253253
properties:
254254
realm:
255+
description: The realm for basic authentication
256+
pattern: ^([^"$\\]|\\[^$])*$
255257
type: string
256258
secret:
259+
description: The name of the Kubernetes secret that stores the
260+
Htpasswd configuration
261+
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
257262
type: string
263+
required:
264+
- secret
258265
type: object
259266
egressMTLS:
260267
description: EgressMTLS defines an Egress MTLS policy.

pkg/apis/configuration/v1/types.go

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -623,7 +623,13 @@ type JWTAuth struct {
623623

624624
// BasicAuth holds HTTP Basic authentication configuration
625625
type BasicAuth struct {
626-
Realm string `json:"realm"`
626+
// +kubebuilder:validation:Optional
627+
// +kubebuilder:validation:Pattern=`^([^"$\\]|\\[^$])*$`
628+
// The realm for basic authentication
629+
Realm string `json:"realm,omitempty"`
630+
// +kubebuilder:validation:Required
631+
// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
632+
// The name of the Kubernetes secret that stores the Htpasswd configuration
627633
Secret string `json:"secret"`
628634
}
629635

pkg/apis/configuration/validation/policy.go

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,6 @@ func validatePolicySpec(spec *v1.PolicySpec, fieldPath *field.Path, isPlus, enab
4545
}
4646

4747
if spec.BasicAuth != nil {
48-
allErrs = append(allErrs, validateBasic(spec.BasicAuth, fieldPath.Child("basicAuth"))...)
4948
fieldCount++
5049
}
5150

@@ -206,18 +205,6 @@ func validateJWT(jwt *v1.JWTAuth, fieldPath *field.Path) field.ErrorList {
206205
return allErrs
207206
}
208207

209-
func validateBasic(basic *v1.BasicAuth, fieldPath *field.Path) field.ErrorList {
210-
if basic.Secret == "" {
211-
return field.ErrorList{field.Required(fieldPath.Child("secret"), "")}
212-
}
213-
214-
allErrs := field.ErrorList{}
215-
if basic.Realm != "" {
216-
allErrs = append(allErrs, validateRealm(basic.Realm, fieldPath.Child("realm"))...)
217-
}
218-
return append(allErrs, validateSecretName(basic.Secret, fieldPath.Child("secret"))...)
219-
}
220-
221208
func validateIngressMTLS(ingressMTLS *v1.IngressMTLS, fieldPath *field.Path) field.ErrorList {
222209
if ingressMTLS.ClientCertSecret == "" {
223210
return field.ErrorList{field.Required(fieldPath.Child("clientCertSecret"), "")}

pkg/apis/configuration/validation/policy_test.go

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1982,24 +1982,6 @@ func TestValidateWAF_FailsOnInvalidApPolicy(t *testing.T) {
19821982
}
19831983
}
19841984

1985-
func TestValidateBasic_PassesOnNotEmptySecret(t *testing.T) {
1986-
t.Parallel()
1987-
1988-
errList := validateBasic(&v1.BasicAuth{Realm: "", Secret: "secret"}, field.NewPath("secret"))
1989-
if len(errList) != 0 {
1990-
t.Errorf("want no errors, got %v", errList)
1991-
}
1992-
}
1993-
1994-
func TestValidateBasic_FailsOnMissingSecret(t *testing.T) {
1995-
t.Parallel()
1996-
1997-
errList := validateBasic(&v1.BasicAuth{Realm: "realm", Secret: ""}, field.NewPath("secret"))
1998-
if len(errList) == 0 {
1999-
t.Error("want error on invalid input")
2000-
}
2001-
}
2002-
20031985
func TestValidateWAF_FailsOnPresentBothApLogBundleAndApLogConf(t *testing.T) {
20041986
t.Parallel()
20051987

0 commit comments

Comments
 (0)