Add comprehensive test suite for service token authentication by jctanner · Pull Request #2853 · red-hat-data-services/ods-ci

jctanner · 2026-02-10T18:26:52Z

http://issues.redhat.com/browse/RHOAIENG-47496

This commit adds a complete Robot Framework test suite to validate service account token authentication through the OpenShift AI Gateway.

Test Coverage:

Infrastructure validation (gateway flags, RBAC, dedicated ServiceAccount)
End-to-end authentication flow with bearer tokens
Token validation via Kubernetes TokenReview API
User identity extraction and header forwarding
Security tests (invalid tokens, missing tokens)

Architecture:

Echo service with kube-rbac-proxy sidecar pattern
HTTPRoute acceptance wait to ensure proper Envoy configuration
Proper RBAC scoping for test service accounts
Cleanup on teardown

All 7 test cases pass successfully validating the service token auth feature.

This commit adds a complete Robot Framework test suite to validate service account token authentication through the OpenShift AI Gateway. Test Coverage: - Infrastructure validation (gateway flags, RBAC, dedicated ServiceAccount) - End-to-end authentication flow with bearer tokens - Token validation via Kubernetes TokenReview API - User identity extraction and header forwarding - Security tests (invalid tokens, missing tokens) Architecture: - Echo service with kube-rbac-proxy sidecar pattern - HTTPRoute acceptance wait to ensure proper Envoy configuration - Proper RBAC scoping for test service accounts - Cleanup on teardown All 7 test cases pass successfully validating the service token auth feature. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

openshift-ci · 2026-02-10T18:27:02Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: jctanner

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

sonarqubecloud · 2026-02-10T18:27:27Z

Quality Gate passed

Issues
3 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

ods_ci/tests/Resources/CLI/EchoService.resource

+Create Test Service Account
+    [Documentation]    Creates a test service account for token authentication with RBAC permissions
+    [Arguments]    ${namespace}=opendatahub
+    ${rc}    ${out}=    Run And Return Rc And Output


...sts/0100__platform/0101__deploy/0102__auth_providers_and_rbac/0104__service_token_auth.robot

+
+    Log    message=Invalid token was correctly rejected
+
+Verify No Token Results In Auth Challenge


...sts/0100__platform/0101__deploy/0102__auth_providers_and_rbac/0104__service_token_auth.robot

+
+    Log    message=Invalid token was correctly rejected
+
+Verify No Token Results In Auth Challenge


ods_ci/tests/Resources/CLI/EchoService.resource

+    [Documentation]    Checks if HTTPRoute has Accepted condition set to True
+    [Arguments]    ${route_name}    ${namespace}
+    ${rc}    ${status}=    Run And Return Rc And Output
+    ...    oc get httproute ${route_name} -n ${namespace} -o jsonpath='{.status.parents[0].conditions[?(@.type=="Accepted")].status}'


ods_ci/tests/Resources/CLI/EchoService.resource

+    [Documentation]    Removes echo service deployment and related resources
+    [Arguments]    ${namespace}=opendatahub
+    Log    message=Removing echo service resources from ${namespace}
+    ${rc}    ${out}=    Run And Return Rc And Output


ods_ci/tests/Resources/CLI/EchoService.resource

+    ...    oc delete -f ${ECHO_DEPLOYMENT_FILEPATH} -n ${namespace} --ignore-not-found=true
+    ${rc}    ${out}=    Run And Return Rc And Output
+    ...    oc delete -f ${ECHO_SA_RBAC_FILEPATH} -n ${namespace} --ignore-not-found=true
+    ${rc}    ${out}=    Run And Return Rc And Output


ods_ci/tests/Resources/CLI/EchoService.resource

+    ...    oc delete -f ${ECHO_DEPLOYMENT_FILEPATH} -n ${namespace} --ignore-not-found=true
+    ${rc}    ${out}=    Run And Return Rc And Output
+    ...    oc delete -f ${ECHO_SA_RBAC_FILEPATH} -n ${namespace} --ignore-not-found=true
+    ${rc}    ${out}=    Run And Return Rc And Output


ods_ci/tests/Resources/CLI/EchoService.resource

+    [Documentation]    Creates Gateway API HTTPRoute to expose echo service through gateway
+    [Arguments]    ${namespace}=opendatahub
+    Log    message=Creating HTTPRoute for echo service
+    ${rc}    ${out}=    Run And Return Rc And Output


ods_ci/tests/Resources/CLI/EchoService.resource

+    ${rc}    ${out}=    Run And Return Rc And Output
+    ...    oc apply -f ${ECHO_SA_FILEPATH} -n ${namespace}
+    Should Be Equal As Integers    ${rc}    0
+    ${rc}    ${out}=    Run And Return Rc And Output


ods_ci/tests/Resources/CLI/EchoService.resource

+    [Documentation]    Deploys echo service pod and service for testing
+    [Arguments]    ${namespace}=opendatahub
+    Log    message=Deploying echo service in ${namespace} namespace
+    ${rc}    ${out}=    Run And Return Rc And Output


CFSNM · 2026-02-11T11:55:22Z

...sts/0100__platform/0101__deploy/0102__auth_providers_and_rbac/0104__service_token_auth.robot

+*** Test Cases ***
+Verify Service Token Auth Is Enabled On Gateway
+    [Documentation]    Verifies that kube-auth-proxy deployment has service token validation enabled
+    [Tags]    Smoke    Tier1    RHOAIENG-XXXXX


if we want to run the tests as part of the Operator testing, we need to add the tag "Operator". The Smoke one can be removed

CFSNM · 2026-02-11T11:55:30Z

...sts/0100__platform/0101__deploy/0102__auth_providers_and_rbac/0104__service_token_auth.robot

+
+Verify Dedicated ServiceAccount For Kube Auth Proxy
+    [Documentation]    Verifies that kube-auth-proxy uses a dedicated ServiceAccount instead of default
+    [Tags]    Security    Tier1    RHOAIENG-XXXXX


if we want to run the tests as part of the Operator testing, we need to add the tag "Operator".

CFSNM · 2026-02-11T11:55:38Z

...sts/0100__platform/0101__deploy/0102__auth_providers_and_rbac/0104__service_token_auth.robot

+
+Verify ClusterRoleBinding For TokenReview
+    [Documentation]    Verifies that the ClusterRoleBinding for TokenReview API exists and is correctly configured
+    [Tags]    Tier1    RHOAIENG-XXXXX


if we want to run the tests as part of the Operator testing, we need to add the tag "Operator".

CFSNM · 2026-02-11T11:55:46Z

...sts/0100__platform/0101__deploy/0102__auth_providers_and_rbac/0104__service_token_auth.robot

+
+Verify Service Account Can Authenticate Via Token
+    [Documentation]    End-to-end test: service account authenticates through gateway using bearer token
+    [Tags]    Tier1    E2E    RHOAIENG-XXXXX


if we want to run the tests as part of the Operator testing, we need to add the tag "Operator".

CFSNM · 2026-02-11T11:55:53Z

...sts/0100__platform/0101__deploy/0102__auth_providers_and_rbac/0104__service_token_auth.robot

+
+Verify Service Account Token Has User Identity
+    [Documentation]    Verifies that the authenticated token contains proper user identity information
+    [Tags]    Tier1    RHOAIENG-XXXXX


if we want to run the tests as part of the Operator testing, we need to add the tag "Operator".

asmigala · 2026-02-12T15:26:42Z

...sts/0100__platform/0101__deploy/0102__auth_providers_and_rbac/0104__service_token_auth.robot

+
+
+*** Variables ***
+${TEST_NAMESPACE}=    opendatahub


this should be removed and all references to it replaced with ${APPLICATIONS_NAMESPACE} to enable testing both on odh and rhoai

asmigala · 2026-02-12T15:30:00Z

ods_ci/tests/Resources/Files/echo-service/echo-deployment.yaml

+subjects:
+- kind: ServiceAccount
+  name: echo-service
+  namespace: opendatahub


Replace with ${APPLICATIONS_NAMESPACE} and process the file with Create File From Template before deploying

asmigala · 2026-02-12T15:30:07Z

ods_ci/tests/Resources/Files/echo-service/echo-deployment.yaml

+  config-file.yaml: |
+    authorization:
+      resourceAttributes:
+        namespace: opendatahub


asmigala · 2026-02-12T15:31:40Z

...sts/0100__platform/0101__deploy/0102__auth_providers_and_rbac/0104__service_token_auth.robot

+
+Verify ClusterRoleBinding For TokenReview
+    [Documentation]    Verifies that the ClusterRoleBinding for TokenReview API exists and is correctly configured
+    [Tags]    Tier1    RHOAIENG-XXXXX


The tag should probably reference a real jira issue.

asmigala · 2026-02-12T15:35:58Z

ods_ci/tests/Resources/Files/echo-service/echo-deployment.yaml

+      containers:
+      # kube-rbac-proxy sidecar
+      - name: kube-rbac-proxy
+        image: quay.io/brancz/kube-rbac-proxy:v0.18.1


We should use our rbac proxy build (this likely won't be mirrored on disconnected)

asmigala · 2026-02-12T15:36:11Z

ods_ci/tests/Resources/Files/echo-service/echo-deployment.yaml

+            - ALL
+      # echo application
+      - name: echo
+        image: ealen/echo-server:latest


This won't be mirrored on disconnected

asmigala · 2026-02-12T15:40:33Z

@jctanner one thing I dislike about this approach is that it relies on kube-rbac-proxy config stored in this repo, not deployed by our operator. Is there any chance the operator-deployed config ever changes in a way that could break the functionality (you probably know much better than me)?

Would it be possible to run this against real workload rather than a custom echo service?

asmigala · 2026-02-12T15:44:49Z

ods_ci/tests/Resources/CLI/ServiceTokenAuth.resource

+    Log    message=Gateway response (HTTP ${http_code}): ${response}
+    RETURN    ${response}
+
+Get Gateway URL From Route


This will only work with OcpRoute ingressMode, right? We already have ${ODH_DASHBOARD_URL} which should be usable, or we could get the hostname from the gateway, not the route

There's also Get Gateway URL in the EchoService.resource file, but that seems unused

github-advanced-security bot found potential problems Feb 10, 2026

View reviewed changes

CFSNM requested changes Feb 11, 2026

View reviewed changes

openshift-ci bot assigned CFSNM Feb 11, 2026

asmigala requested changes Feb 12, 2026

View reviewed changes

openshift-ci bot assigned asmigala Feb 12, 2026

asmigala requested changes Feb 12, 2026

View reviewed changes


		Log message=Invalid token was correctly rejected

		Verify No Token Results In Auth Challenge

Conversation

jctanner commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci bot commented Feb 10, 2026

Uh oh!

sonarqubecloud bot commented Feb 10, 2026

Quality Gate passed

Uh oh!

Check warning

Check warning

Check warning

Check warning

Check warning

Check notice

Check notice

Check notice

Check notice

Check notice

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

asmigala commented Feb 12, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jctanner commented Feb 10, 2026 •

edited

Loading