@@ -34,7 +34,9 @@ import (
3434 "sync/atomic"
3535 "testing"
3636
37+ "github.com/google/go-cmp/cmp"
3738 "k8s.io/apiserver/pkg/audit"
39+ "k8s.io/apiserver/pkg/features"
3840 "k8s.io/apiserver/pkg/server/dynamiccertificates"
3941 "k8s.io/client-go/transport"
4042
@@ -53,8 +55,11 @@ import (
5355 "k8s.io/apiserver/pkg/endpoints/filters"
5456 genericapirequest "k8s.io/apiserver/pkg/endpoints/request"
5557 "k8s.io/apiserver/pkg/server/egressselector"
58+ utilfeature "k8s.io/apiserver/pkg/util/feature"
5659 utilflowcontrol "k8s.io/apiserver/pkg/util/flowcontrol"
5760 apiserverproxyutil "k8s.io/apiserver/pkg/util/proxy"
61+ "k8s.io/component-base/featuregate"
62+ featuregatetesting "k8s.io/component-base/featuregate/testing"
5863 "k8s.io/component-base/metrics"
5964 "k8s.io/component-base/metrics/legacyregistry"
6065 apiregistration "k8s.io/kube-aggregator/pkg/apis/apiregistration/v1"
@@ -130,6 +135,8 @@ func TestProxyHandler(t *testing.T) {
130135 expectedBody string
131136 expectedCalled bool
132137 expectedHeaders map [string ][]string
138+
139+ enableFeatureGates []featuregate.Feature
133140 }{
134141 "no target" : {
135142 expectedStatusCode : http .StatusNotFound ,
@@ -174,6 +181,40 @@ func TestProxyHandler(t *testing.T) {
174181 },
175182 expectedStatusCode : http .StatusOK ,
176183 expectedCalled : true ,
184+ expectedHeaders : map [string ][]string {
185+ "X-Forwarded-Proto" : {"https" },
186+ "X-Forwarded-Uri" : {"/request/path" },
187+ "X-Forwarded-For" : {"127.0.0.1" },
188+ "X-Remote-User" : {"username" },
189+ "User-Agent" : {"Go-http-client/1.1" },
190+ "Accept-Encoding" : {"gzip" },
191+ "X-Remote-Group" : {"one" , "two" },
192+ },
193+ },
194+ "[RemoteRequestHeaderUID] proxy with user, insecure" : {
195+ user : & user.DefaultInfo {
196+ Name : "username" ,
197+ UID : "6b60d791-1af9-4513-92e5-e4252a1e0a78" ,
198+ Groups : []string {"one" , "two" },
199+ },
200+ path : "/request/path" ,
201+ apiService : & apiregistration.APIService {
202+ ObjectMeta : metav1.ObjectMeta {Name : "v1.foo" },
203+ Spec : apiregistration.APIServiceSpec {
204+ Service : & apiregistration.ServiceReference {Port : pointer .Int32Ptr (443 )},
205+ Group : "foo" ,
206+ Version : "v1" ,
207+ InsecureSkipTLSVerify : true ,
208+ },
209+ Status : apiregistration.APIServiceStatus {
210+ Conditions : []apiregistration.APIServiceCondition {
211+ {Type : apiregistration .Available , Status : apiregistration .ConditionTrue },
212+ },
213+ },
214+ },
215+ enableFeatureGates : []featuregate.Feature {features .RemoteRequestHeaderUID },
216+ expectedStatusCode : http .StatusOK ,
217+ expectedCalled : true ,
177218 expectedHeaders : map [string ][]string {
178219 "X-Forwarded-Proto" : {"https" },
179220 "X-Forwarded-Uri" : {"/request/path" },
@@ -208,6 +249,40 @@ func TestProxyHandler(t *testing.T) {
208249 },
209250 expectedStatusCode : http .StatusOK ,
210251 expectedCalled : true ,
252+ expectedHeaders : map [string ][]string {
253+ "X-Forwarded-Proto" : {"https" },
254+ "X-Forwarded-Uri" : {"/request/path" },
255+ "X-Forwarded-For" : {"127.0.0.1" },
256+ "X-Remote-User" : {"username" },
257+ "User-Agent" : {"Go-http-client/1.1" },
258+ "Accept-Encoding" : {"gzip" },
259+ "X-Remote-Group" : {"one" , "two" },
260+ },
261+ },
262+ "[RemoteRequestHeaderUID] proxy with user, cabundle" : {
263+ user : & user.DefaultInfo {
264+ Name : "username" ,
265+ UID : "6b60d791-1af9-4513-92e5-e4252a1e0a78" ,
266+ Groups : []string {"one" , "two" },
267+ },
268+ path : "/request/path" ,
269+ apiService : & apiregistration.APIService {
270+ ObjectMeta : metav1.ObjectMeta {Name : "v1.foo" },
271+ Spec : apiregistration.APIServiceSpec {
272+ Service : & apiregistration.ServiceReference {Name : "test-service" , Namespace : "test-ns" , Port : pointer .Int32Ptr (443 )},
273+ Group : "foo" ,
274+ Version : "v1" ,
275+ CABundle : testCACrt ,
276+ },
277+ Status : apiregistration.APIServiceStatus {
278+ Conditions : []apiregistration.APIServiceCondition {
279+ {Type : apiregistration .Available , Status : apiregistration .ConditionTrue },
280+ },
281+ },
282+ },
283+ enableFeatureGates : []featuregate.Feature {features .RemoteRequestHeaderUID },
284+ expectedStatusCode : http .StatusOK ,
285+ expectedCalled : true ,
211286 expectedHeaders : map [string ][]string {
212287 "X-Forwarded-Proto" : {"https" },
213288 "X-Forwarded-Uri" : {"/request/path" },
@@ -320,7 +395,11 @@ func TestProxyHandler(t *testing.T) {
320395 target .Reset ()
321396 legacyregistry .Reset ()
322397
323- func () {
398+ t .Run (name , func (t * testing.T ) {
399+ for _ , f := range tc .enableFeatureGates {
400+ featuregatetesting .SetFeatureGateDuringTest (t , utilfeature .DefaultFeatureGate , f , true )
401+ }
402+
324403 targetServer := httptest .NewUnstartedServer (target )
325404 serviceCert := tc .serviceCertOverride
326405 if serviceCert == nil {
@@ -354,37 +433,37 @@ func TestProxyHandler(t *testing.T) {
354433
355434 resp , err := http .Get (server .URL + tc .path )
356435 if err != nil {
357- t .Errorf ("%s: %v" , name , err )
436+ t .Errorf ("%v" , err )
358437 return
359438 }
360439 if e , a := tc .expectedStatusCode , resp .StatusCode ; e != a {
361440 body , _ := httputil .DumpResponse (resp , true )
362- t .Logf ("%s: %v" , name , string (body ))
363- t .Errorf ("%s: expected %v, got %v" , name , e , a )
441+ t .Logf ("%v" , string (body ))
442+ t .Errorf ("expected %v, got %v" , e , a )
364443 return
365444 }
366445 bytes , err := io .ReadAll (resp .Body )
367446 if err != nil {
368- t .Errorf ("%s: %v" , name , err )
447+ t .Errorf ("%v" , err )
369448 return
370449 }
371450 if ! strings .Contains (string (bytes ), tc .expectedBody ) {
372- t .Errorf ("%s: expected %q, got %q" , name , tc .expectedBody , string (bytes ))
451+ t .Errorf ("expected %q, got %q" , tc .expectedBody , string (bytes ))
373452 return
374453 }
375454
376455 if e , a := tc .expectedCalled , target .called ; e != a {
377- t .Errorf ("%s: expected %v, got %v" , name , e , a )
456+ t .Errorf ("expected %v, got %v" , e , a )
378457 return
379458 }
380459 // this varies every test
381460 delete (target .headers , "X-Forwarded-Host" )
382461 if e , a := tc .expectedHeaders , target .headers ; ! reflect .DeepEqual (e , a ) {
383- t .Errorf ("%s: expected %v, got %v" , name , e , a )
462+ t .Errorf ("expected != got %v" , cmp . Diff ( e , a ) )
384463 return
385464 }
386465 if e , a := targetServer .Listener .Addr ().String (), target .host ; tc .expectedCalled && ! reflect .DeepEqual (e , a ) {
387- t .Errorf ("%s: expected %v, got %v" , name , e , a )
466+ t .Errorf ("expected %v, got %v" , e , a )
388467 return
389468 }
390469
@@ -397,7 +476,7 @@ func TestProxyHandler(t *testing.T) {
397476 t .Errorf ("expected the x509_missing_san_total to be 1, but it's %d" , errorCounter )
398477 }
399478 }
400- }( )
479+ })
401480 }
402481}
403482
0 commit comments