Add OIDC test using keycloak as idp (#7242)

Author: vepatel

.github/data/matrix-smoke-plus.json

@@ -76,6 +76,13 @@
       "type": "plus",
       "marker": "'policies_ac or policies_jwt or policies_mtls'",
       "platforms": "linux/arm64, linux/amd64, linux/s390x"
+    },
+    {
+      "label": "OIDC-UI 1/1",
+      "image": "debian-plus",
+      "type": "plus",
+      "marker": "oidc",
+      "platforms": "linux/arm64, linux/amd64"
     }
   ],
   "k8s": []

pyproject.toml

@@ -45,6 +45,7 @@ markers =[
     "hsts",
     "ingresses",
     "multi_ns",
+    "oidc",
     "policies",
     "policies_rl",
     "policies_jwt",

tests/Dockerfile

@@ -15,6 +15,7 @@ WORKDIR /workspace/tests
 
 COPY --link tests/requirements.txt /workspace/tests/
 RUN pip install --require-hashes -r requirements.txt --no-deps
+RUN playwright install --with-deps chromium
 
 COPY --link deployments /workspace/deployments
 COPY --link config /workspace/config

tests/data/common/app/keycloak/app.yaml

@@ -0,0 +1,50 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: keycloak
+  labels:
+    app: keycloak
+spec:
+  ports:
+  - name: http
+    port: 8080
+    targetPort: 8080
+  selector:
+    app: keycloak
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: keycloak
+  labels:
+    app: keycloak
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: keycloak
+  template:
+    metadata:
+      labels:
+        app: keycloak
+    spec:
+      containers:
+      - name: keycloak
+        image: quay.io/keycloak/keycloak:25.0.2
+        args: ["start-dev"]
+        env:
+        - name: KEYCLOAK_ADMIN
+          value: "admin"
+        - name: KEYCLOAK_ADMIN_PASSWORD
+          value: "admin"
+        - name: KC_PROXY
+          value: "edge"
+        ports:
+        - name: http
+          containerPort: 8080
+        - name: https
+          containerPort: 8443
+        readinessProbe:
+          httpGet:
+            path: /realms/master
+            port: 8080

tests/data/oidc/client-secret.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: oidc-secret
+type: nginx.org/oidc
+data:
+  client-secret:

tests/data/oidc/nginx-config.yaml

@@ -0,0 +1,15 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: nginx-config
+  namespace: nginx-ingress
+data:
+  stream-snippets: |
+    server {
+        listen 12345;
+        listen [::]:12345;
+        zone_sync;
+        zone_sync_server nginx-ingress-headless.nginx-ingress.svc.cluster.local:12345 resolve;
+    }
+  resolver-addresses: kube-dns.kube-system.svc.cluster.local
+  resolver-valid: 5s

tests/data/oidc/nginx-ingress-headless.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nginx-ingress-headless
+spec:
+  clusterIP: None
+  selector:
+    app: nginx-ingress

tests/data/oidc/oidc.yaml

@@ -0,0 +1,14 @@
+apiVersion: k8s.nginx.org/v1
+kind: Policy
+metadata:
+  name: oidc-policy
+spec:
+  oidc:
+    clientID: nginx-plus
+    clientSecret: oidc-secret
+    authEndpoint: https://keycloak.example.com/realms/master/protocol/openid-connect/auth
+    tokenEndpoint: http://keycloak.default.svc.cluster.local:8080/realms/master/protocol/openid-connect/token
+    jwksURI: http://keycloak.default.svc.cluster.local:8080/realms/master/protocol/openid-connect/certs
+    endSessionEndpoint: https://keycloak.example.com/realms/master/protocol/openid-connect/logout
+    scope: openid+profile+email
+    accessTokenEnable: true

tests/data/oidc/virtual-server-idp.yaml

@@ -0,0 +1,18 @@
+apiVersion: k8s.nginx.org/v1
+kind: VirtualServer
+metadata:
+  name: keycloak
+spec:
+  host: keycloak.example.com
+  tls:
+    secret: tls-secret
+    redirect:
+      enable: true
+  upstreams:
+    - name: keycloak
+      service: keycloak
+      port: 8080
+  routes:
+    - path: /
+      action:
+        pass: keycloak

tests/data/oidc/virtual-server.yaml

@@ -0,0 +1,18 @@
+apiVersion: k8s.nginx.org/v1
+kind: VirtualServer
+metadata:
+  name: virtual-server-tls
+spec:
+  host: virtual-server-tls.example.com
+  tls:
+    secret: tls-secret
+  upstreams:
+  - name: backend1
+    service: backend1-svc
+    port: 80
+  routes:
+  - path: /
+    policies:
+    - name: oidc-policy
+    action:
+      pass: backend1