Merge branch 'main' into tests/wafv5-read-only

Author: jjngx

.github/actions/smoke-tests/action.yaml

@@ -82,6 +82,7 @@ runs:
         -v "/var/run/docker.sock:/var/run/docker.sock" \
         -v ~/.docker:/root/.docker \
         -v ${{ github.workspace }}/tests:/workspace/tests \
+        -v ${{ github.workspace }}/examples/common-secrets:/workspace/examples/common-secrets \
         -v ${{ github.workspace }}/deployments:/workspace/deployments \
         -v ${{ github.workspace }}/charts:/workspace/charts \
         -v ${{ github.workspace }}/config:/workspace/config \

examples/common-secrets/virtual-server-tls-grpc-secret-virtual-server.example.com.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: virtual-server-tls-grpc-secret
+type: kubernetes.io/tls
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZ4RENDQTZ5Z0F3SUJBZ0lVR1FZUGZpZnA3QkV4aTloNWg4c3lUd2ozSjNJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1lURUxNQWtHQTFVRUJoTUNTVVV4RFRBTEJnTlZCQWdNQkVOdmNtc3hEakFNQmdOVkJBb01CVTVIU1U1WQpNUTR3REFZRFZRUUxEQVZPUjBsT1dERWpNQ0VHQTFVRUF3d2FkbWx5ZEhWaGJDMXpaWEoyWlhJdVpYaGhiWEJzClpTNWpiMjB3SGhjTk1qUXhNREk1TVRVeE9UTXpXaGNOTXpReE1ESTNNVFV4T1RNeldqQmhNUXN3Q1FZRFZRUUcKRXdKSlJURU5NQXNHQTFVRUNBd0VRMjl5YXpFT01Bd0dBMVVFQ2d3RlRrZEpUbGd4RGpBTUJnTlZCQXNNQlU1SApTVTVZTVNNd0lRWURWUVFEREJwMmFYSjBkV0ZzTFhObGNuWmxjaTVsZUdGdGNHeGxMbU52YlRDQ0FpSXdEUVlKCktvWklodmNOQVFFQkJRQURnZ0lQQURDQ0Fnb0NnZ0lCQUtxdDNhUWJxN0NuelhOcC9CQW8wajZsbTB5SFQ3cngKRERjZWNnZ2FSd2owWjAwc1FlMC9NckJTVnc2SytEcWlXSS9YYjNDMmFSOHVUc1UrRzNIWDlLdENsb2V4VWJqbApQK1pPNys2cENVcVlkN1I4eHZQcU1rOXFCdXp6Q01nYVBJZVV2d1RhTCswdGFTNHJtYmY2YU5UUmQ2ZXRuK1pOCmhqK3dMWmZuM0EyWlA1YktpditMb25CKzdsUGdKS2JJenFKTUJFNEl2V3VYK3krU2pSd1JMUnlvZDNTbklkcVoKUlFtQ1ZPdktIbHFFM1QzTkJyMW4xcFRxZ3U2SDNhVkJmd3R1ekN0dmZJWUU3Rk15d2xMazZza3ovbVhxS2tJVQpzQ1ZDQmJvdGlUM1ZiV2l3aWswSE5mSGw4VUVlT2Y3bnd5ZWVSbEdjenRWaDk0dC9TbXdxTHNVQzB0b2l4VWprCnQ4NEYxa3FCRjFkMDZXSUdjSEJRSWwzS0FHK3RaWnV4SVNrSytURSsvYURLTjRiWGU0Uzd2bzZqTUQ1R2FVYUwKSnB5UXhrZy8vU2I3a3Q4VHg1RDA5cnZhUWtKZnR0cEtjZ1hlNERtTHNQWVNaY2ZoZkxmaFFjZjNtTXk1UjVPVgpOWFA0MnBhTG9Xa0dtVWtnUmhtRTg0TjljalZkUmNvOEd2RklyaWEyU0p2WmNTYmRFUnhVYmMyT0l4ZXBNRGs3CmVaRlJ6dXU2aGhpL3hScVQ0bTBGNjBnMzdyb1QzR2x4N09PNkd0TFZZNlEzbGNRSGdxRVUrUDdmaHNWVmVlQU4KWVQycDZYRWFlZEVqUTRSUHpUOS9KOCtuU1c4Z1p2TGFhYXdYTm1KWDV3NndUNmZHSWxZb1hHeHlNNWZSTmRXRQpRdEZQL0JIUGQ1bjFBZ01CQUFHamREQnlNQjBHQTFVZERnUVdCQlNrUG5sSGcvUmVEOVJZczdkZHQ5dURyRzVlCnNEQWZCZ05WSFNNRUdEQVdnQlNrUG5sSGcvUmVEOVJZczdkZHQ5dURyRzVlc0RBbEJnTlZIUkVFSGpBY2docDIKYVhKMGRXRnNMWE5sY25abGNpNWxlR0Z0Y0d4bExtTnZiVEFKQmdOVkhSTUVBakFBTUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQ0FRQTZjUUVzZ0VhY2trUmJHTUFBeXpJUlVDSDhmbW9mT1VjS1Zpcy9iem1NUnRLWnRpTVVDTjR5CmVmQlhINkxzcVk3VXRYU1VmR2hOeldVQjNKdnAyU2FPSlE0RTg3ZVc2Q1hWOUZ6NE4wTG1uYmtQN015TmhwaHcKSVVXRGJGN0Nib1hTczNGZXVieTFOaDJJdUdQQmFSdVlBRjJnMkhINlUyS0FDZ3lXWlR2ZEJteHNSREIyaERCZwpaQ2pkM0h2RHdVYmJZaW5ud2ZqSi9EMkMzVC9rZzB4UHNqU1BqWU0zS0xZNVBNMEg1SVgvTllVMW9YQU1STVh4ClBBZUEvQS9DdTU4UDFGdy93Q2xVSVFXQk1KNjB2a08vWHVSZUExenRITG1lZ2JaRldZTENtUmJuOWNlRzIybkIKVzQ2enRaVWlzdDVaRHo4RU1XTWVWNzRrUzVsNlhsak55YkVIRVFkTHlOdC9PWHVuMjZCZHRTdzRqekJ4QS9Vcgp2WlZ4YUhQTVlNaWNOWHlqUHZkdGhuTlVZYUgwVEVSbE9DOXdSL25QQnJjOFpJK2tKOVYwS3hrMFM0VGVJRGJvCjZJOUw1ekNvM1dNbWVGWGt1UUt6UmVqM2p0bkpLMHB1bXhsUC9jQUlIeXdhOEppOCtiNXBTWkdJeVhzdjhOemQKbTJkRDR0dTBNeFh5ZENxemNHdXNJaFlwYzE3cC9pSFFtVkxYcE5QVm0zMEdWUFlnRFBIVUtaUmwrVTBEa3FhMApCcGVtYmpqMUR1RjVkN2wrQml1TXB4R0VQQmpncDk4VW9IcEw1R1BFRU1XZFFVbHZmVzJ5SW1OdUd2WW5UVTJFCitlSTVwM0dUOVZEWG0vbE04WUpsUTltWElQa2xLbndwU3VYd3R0MXMzU0k1UTRQc0ZWbnlUUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUpRd0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQ1Mwd2dna3BBZ0VBQW9JQ0FRQ3FyZDJrRzZ1d3A4MXoKYWZ3UUtOSStwWnRNaDArNjhRdzNIbklJR2tjSTlHZE5MRUh0UHpLd1VsY09pdmc2b2xpUDEyOXd0bWtmTGs3RgpQaHR4MS9TclFwYUhzVkc0NVQvbVR1L3VxUWxLbUhlMGZNYno2akpQYWdiczh3aklHanlIbEw4RTJpL3RMV2t1Cks1bTMrbWpVMFhlbnJaL21UWVkvc0MyWDU5d05tVCtXeW9yL2k2SndmdTVUNENTbXlNNmlUQVJPQ0wxcmwvc3YKa28wY0VTMGNxSGQwcHlIYW1VVUpnbFRyeWg1YWhOMDl6UWE5WjlhVTZvTHVoOTJsUVg4TGJzd3JiM3lHQk94VApNc0pTNU9ySk0vNWw2aXBDRkxBbFFnVzZMWWs5MVcxb3NJcE5Celh4NWZGQkhqbis1OE1ubmtaUm5NN1ZZZmVMCmYwcHNLaTdGQXRMYUlzVkk1TGZPQmRaS2dSZFhkT2xpQm5Cd1VDSmR5Z0J2cldXYnNTRXBDdmt4UHYyZ3lqZUcKMTN1RXU3Nk9vekErUm1sR2l5YWNrTVpJUC8wbSs1TGZFOGVROVBhNzJrSkNYN2JhU25JRjN1QTVpN0QyRW1YSAo0WHkzNFVISDk1ak11VWVUbFRWeitOcVdpNkZwQnBsSklFWVpoUE9EZlhJMVhVWEtQQnJ4U0s0bXRraWIyWEVtCjNSRWNWRzNOamlNWHFUQTVPM21SVWM3cnVvWVl2OFVhaytKdEJldElOKzY2RTl4cGNlemp1aHJTMVdPa041WEUKQjRLaEZQaiszNGJGVlhuZ0RXRTlxZWx4R25uUkkwT0VUODAvZnlmUHAwbHZJR2J5Mm1tc0Z6WmlWK2NPc0Urbgp4aUpXS0Z4c2NqT1gwVFhWaEVMUlQvd1J6M2VaOVFJREFRQUJBb0lDQUVUWnNEQVVMWFVzcTdja0NOZG44Qy92ClZDOVI0anJTSkJCVUNzSHovN1hBQ2EvYTY1bE54aC9VaDJQSmNZc05sRllxSEwxR0NDL1kyVk85MHdwZ2lFVlIKcmpGOHVTK3g0czRBQjgrcGhxTDkwRVFSbFp3dFhEQW00RFpUYjdad3h2d1daOXdJUEE4Y0kzTEppYy9xaHNGYQo0ajdVemt6ejl2VFlGL3hRUHJlSm0xb3p5RkIvdm41TTVjMFYvUkwrckVSU0QrWitwaEt5RTFURWRJSGU5K2k0Cm1MK0k4Q0lqYy9MN0RWQzBqdndLM3NpZ1hWaW9lNnBFMDU1dlZsemtoK0JQeUxLNDNXMmVyTXAvRGw2c0UzNG8KcURYcWVUT0E3dkdJcVpESjc3UHUxWnpHb25PaU5nT25zMk9HVXZUZC94NkxQV2lNcmU3ci94VFp1MmJZdVZaOQpRQU5tZVM2UFdpSDhzT1dTeWRQWDVvbHJYVVpUcWRPZzY5VDcwNjdzaFVkT1ptQVRDMGJ6RVR2cEloUFZuNmlsCisrTzFlU3BTWFpjdzVqV2d5T1V6TFR0RkY0MkllS1p2YzRmMkJlbUJMNWNJRm1jYzFXSnhTNk9DWjJaVVg1ZTYKcjczT21YWjNXRHQ0ckNHYlIxVjRVWnhZUlZUY2paQWRMeUJLckNSK0VFT1krWVhyeTBmZzlTQUwzVDNxTlR0ZwpZWmRWdVhUMU9kU1d1YVNBN0cxbHJvcXoyL3UrQi9EZ3N6em50OXNDRFdHOGJQT1F1RzNrS3VaSGxRRldJTHpVClBmL2Ruc2U5Q1AvNmI2QklxSk5MMTFmMmVhQkd1T0t3dVNpQ0RiRHhWcy9GdXlKdG5WYjlVWm1mTk9uMis0WWcKbGR4OURpeDZzdWwwWjBJSEdENTlBb0lCQVFEU2duT1hkNUdvMkF3MGM0VUgyR3VKQmU5aHQwdzNER2o1OFJzTQpiaFVyKzNIMXNiWWVIV0dJNmkwbXlOeTkrSGxHaGxCT2VxTU13RGZHdXNXeExmeXFGSUhqZXpudkFjSVYySUVsCnh6Nk84ZmRLTmpJblZ3VEY3M2hkdU1qZDhmbkxlakJXeXZNQVF5TkQ4NVlxa3pZaVVrNjkxZWZ0M2RpdXdURHoKVTdqMk5zeVdVcmRlTldRcmRSUHNNY0NWcVhybGh4dTVwZU8yanBOSlc0bTJHRTBzZ2dJeXBETHRSblh0cWVoTApNbW5xdnZjMlo2OSs1cURXRDJnMWtIRFZJMlFkQmRvY1NkRzhjcTBwYjNOM25kRlU1NTdzaCt0UVFwK00veFQvClNvYzN1VHJCaWlzRisrY2tNWmpreHpzWDBPOTQrVFhVZGlncCtGT1hObE9yQ0ZQbkFvSUJBUURQai9jOUMrREYKUHVjanNpSkt3dmZMd1ZsM3NzZ3hobklNOGRPQkE5RHM1SzdpWjk0S1Qyd1lkeW5aeG1Rcjh2a1pmcGx0ekxxNApGYmRIQVYzS1FDUkQrSzR0YndLWDdyRW8vckR1OStSbnh0STFOZkUrYUM4bVR3dmJQSU9POTJvUUN2Zlp6WlJ3CjBobXlPVkU5d0JoTjhSUjBFSzlnN2xPb3hOcWFWc2hzUFdPS0pva1pTNjgvZDg3ME1PeDgvdTVMUUlILzBmY1oKZHB2K0x4OVUrZDlGTFA1MmxDSFpVVVlpMWoraCt5KzVKRmJnOXE0SlRWRUpPVlVrd1haZ0QxM05rRTRCNWlFZgpncWNNM3NtNGdNMHE1YUoxTjllZlRIQWZtVEVxb0x3RVlMTG54dGdKckVpMDQzUnNHcWEvcDV1U2NGdDRuejRHCkhueitFZEl1L0tmREFvSUJBRzdWOUpxSmdBM1FRd3pTemZaRmdza1FjT3VZSU83Uy8rcXBnYjVYcjVvS3VBUE8KMzc2WFphVTY5eTcyanhNTzRudTVlRXI1MHlPQmlWeC9ObHVGaFFUZjYwdWtzK29kbU56N3MzUDZwZnVKZHRTQwpHSUlTRlJkS2NLdVlBVnFxYndVdGZvb1VMVUcwRjd0Tlk0RmpKUnVKRHFCeEliNWlFaFpnN2E4UUk5Q3ZKYVQ0ClJFZThBTlBJdndhYlkzVHBXU1hFcjFwZDk3bEU5Rk9wZUthQndSQndHMHdpbkJYR0JZMXU2am05ZjNyenRTSFcKRWRiVkExWHhvc0toSEdkOFROZmpIdVhLRUQ0U2V3M1grb20rZEZzcDRNbFUveGF4SFdTVllhN1F4TVVZSjlHRApPQWZjaStUSW9HSEViRjZyeVlwK1hGTlRLdTUrS3pUd2k3ai9sMzBDZ2dFQkFJcnhwYURnOWFzMGk0Z1NzKy8yCkNla0UybjVOV01RR2F3eU5TWGRnOVpmUEVkOFBoc3pDRSt0Z3djdzlpVXIrVUpBbmRrL1JMK0VROEdxQTJLY08KUHZpZFhRT2UvMDV6ZzNhYzRCWm9MU2JuS2twaWZNYTQrVzhjbFNSQ294S3VQdnJVVE13cFdVZ1k3UWlvWStFQgpXWU83Y1dTczBxb0JnRkZHemN0cGNxczZnUXEyOXluT3gxYW1QZ3lyUDNRQk44VjZQa3ZnNHhmUmxXVVhhRkw3CkhlSHgxN25MT2NsL0pZTW1odHhKQ001WUxDeFdGWFMycEJ1WG5JNkpUMVBJbFpPSkdSOGVUV2dKandnSGoyT0sKSFUydEFRNlV2aXV1QUpTMmVQby9OUDE5T2VYNzd4eXlqczFBUWV3bi94M205amFXTGpWVjdEQXVjcCtsa0Z6UgoxdjhDZ2dFQkFJY1M4VEtQZDY4eTdXSWJRaHljSWdMRW4vUHZPTENtd3VaSUxCRWFhUVRFZGRONjlHRkdtTnRuClE3bFBhMEFTMUlSSnZHaFhYWGt6KzlJczVhTE5nazZpYWlGY3ZwMEhyQTRBVU50SGZWVmc2ZTMvbGhNY1pSOWoKNG1KY1lqdEtpL0RGR3FEaFQvUEtuditFK2hiQno2dTBYZVFFeDBPWC8xUnhXc1NFWFNEYzdZcUw4eDlBSXBZdQpkdE5rWlp2ZHRDck0xSDRFNjdKb1VtQWJDMHJ4Q2xLYS9kendTOXVNNXRjRHBkb2lLTExqb2xWc3B6cGszTXZRClhGeXoycTl5dE9mcCtIeUtnd2d6OW81RXB2OEZGTTNvaWpxeFBOYk1ETFZGdzcxMkpWeHVET091cU1pVVlta3oKMVZ4eHhpL2UrQytSUEMyMmg4SGdkVC8wQnQ4MU01OD0KLS0tLS1FTkQgUFJJVkFURSBLRVktLS0tLQo=

pkg/apis/configuration/validation/policy.go

@@ -294,9 +294,20 @@ func validateOIDC(oidc *v1.OIDC, fieldPath *field.Path) field.ErrorList {
 
 func validateAPIKey(apiKey *v1.APIKey, fieldPath *field.Path) field.ErrorList {
 	allErrs := field.ErrorList{}
+
+	if apiKey == nil {
+		allErrs = append(allErrs, field.Required(fieldPath, "apiKey cannot be nil"))
+		return allErrs
+	}
+
+	if apiKey.SuppliedIn == nil {
+		allErrs = append(allErrs, field.Required(fieldPath.Child("suppliedIn"), "suppliedIn cannot be nil"))
+		return allErrs
+	}
+
 	if apiKey.SuppliedIn.Query == nil && apiKey.SuppliedIn.Header == nil {
 		msg := "at least one query or header name must be provided"
-		allErrs = append(allErrs, field.Required(fieldPath.Child("SuppliedIn"), msg))
+		allErrs = append(allErrs, field.Required(fieldPath.Child("suppliedIn"), msg))
 	}
 
 	if apiKey.SuppliedIn.Header != nil {
@@ -316,11 +327,11 @@ func validateAPIKey(apiKey *v1.APIKey, fieldPath *field.Path) field.ErrorList {
 	}
 
 	if apiKey.ClientSecret == "" {
-		allErrs = append(allErrs, field.Required(fieldPath.Child("clientSecret"), ""))
+		allErrs = append(allErrs, field.Required(fieldPath.Child("clientSecret"), "clientSecret cannot be empty"))
+	} else {
+		allErrs = append(allErrs, validateSecretName(apiKey.ClientSecret, fieldPath.Child("clientSecret"))...)
 	}
 
-	allErrs = append(allErrs, validateSecretName(apiKey.ClientSecret, fieldPath.Child("clientSecret"))...)
-
 	return allErrs
 }
 

pkg/apis/configuration/validation/policy_test.go

@@ -1680,6 +1680,16 @@ func TestValidateAPIKeyPolicy_FailsOnInvalidInput(t *testing.T) {
 			},
 			msg: "invalid secret name",
 		},
+		{
+			apiKey: &v1.APIKey{
+				ClientSecret: "secret_1",
+			},
+			msg: "no suppliedIn provided",
+		},
+
+		{
+			apiKey: nil, msg: "no apikey provided",
+		},
 	}
 
 	for _, test := range tests {

tests/Makefile

@@ -55,6 +55,7 @@ run-tests-in-kind: ## Run tests in Kind
 	docker run --network=kind --rm \
 		-v $(KIND_KUBE_CONFIG_FOLDER):/root/.kube \
 		-v $(ROOT_DIR)/tests:/workspace/tests \
+		-v $(ROOT_DIR)/examples/common-secrets:/workspace/examples/common-secrets \
 		-v $(ROOT_DIR)/deployments:/workspace/deployments \
 		-v $(ROOT_DIR)/config:/workspace/config \
 		-v $(ROOT_DIR)/pyproject.toml:/workspace/pyproject.toml \

tests/data/ap-waf-grpc/tls-secret.yaml

@@ -0,0 +1 @@
+../../../examples/common-secrets/virtual-server-tls-grpc-secret-virtual-server.example.com.yaml

tests/data/ap-waf-grpc/tls-secret.yaml

@@ -0,0 +1 @@
+../../../examples/common-secrets/virtual-server-tls-grpc-secret-virtual-server.example.com.yaml