@@ -1027,3 +1027,129 @@ var _______ = describe("Ingress tests simple NLB", func() {
10271027 Expect (resp .Header .Get ("Request-Host" )).To (Equal (hostName ))
10281028 })
10291029})
1030+
1031+ var ________ = describe ("Ingress tests for OPA filters" , func () {
1032+ f := framework .NewDefaultFramework ("skipper-ingress-with-opa" )
1033+ f .NamespacePodSecurityEnforceLevel = admissionapi .LevelBaseline
1034+ var (
1035+ cs kubernetes.Interface
1036+ jig * ingress.TestJig
1037+ )
1038+
1039+ It ("Should activate OPA filter without issue [Ingress] [Zalando]" , func () {
1040+ jig = ingress .NewIngressTestJig (f .ClientSet )
1041+ cs = f .ClientSet
1042+ serviceName := "styra-smoketest"
1043+ ns := f .Namespace .Name
1044+ hostName := fmt .Sprintf ("%s-%d.%s" , serviceName , time .Now ().UTC ().Unix (), E2EHostedZone ())
1045+ labels := map [string ]string {
1046+ "app" : serviceName ,
1047+ }
1048+ port := 8080
1049+ replicas := int32 (3 )
1050+ targetPort := 9090
1051+ backendContent := "mytest"
1052+ route := fmt .Sprintf (`* -> inlineContent("%s") -> <shunt>` , backendContent )
1053+ waitTime := 10 * time .Minute
1054+
1055+ // CREATE setup
1056+ // backend deployment
1057+ By ("Creating a deployment with " + serviceName + " in namespace " + ns )
1058+ depl := createSkipperBackendDeployment (serviceName , ns , route , labels , int32 (targetPort ), replicas )
1059+ _ , err := cs .AppsV1 ().Deployments (ns ).Create (context .TODO (), depl , metav1.CreateOptions {})
1060+ framework .ExpectNoError (err )
1061+
1062+ By ("Creating service " + serviceName + " in namespace " + ns )
1063+ service := createServiceTypeClusterIP (serviceName , labels , port , targetPort )
1064+ _ , err = cs .CoreV1 ().Services (ns ).Create (context .TODO (), service , metav1.CreateOptions {})
1065+ framework .ExpectNoError (err )
1066+
1067+ ing := createIngress (serviceName , hostName , ns , "/" , netv1 .PathTypeImplementationSpecific , labels , nil , port )
1068+ ingressCreate , err := cs .NetworkingV1 ().Ingresses (ns ).Create (context .TODO (), ing , metav1.CreateOptions {})
1069+ framework .ExpectNoError (err )
1070+
1071+ addr , err := jig .WaitForIngressAddress (context .TODO (), cs , ns , ingressCreate .Name , waitTime )
1072+ framework .ExpectNoError (err )
1073+
1074+ _ , err = cs .NetworkingV1 ().Ingresses (ns ).Get (context .TODO (), ing .Name , metav1.GetOptions {ResourceVersion : "0" })
1075+ framework .ExpectNoError (err )
1076+
1077+ // skipper http -> https redirect
1078+ By ("Waiting for skipper route to default redirect from http to https, to see that our ingress-controller and skipper works" )
1079+ err = waitForResponse (addr , "http" , waitTime , isRedirect , true )
1080+ framework .ExpectNoError (err )
1081+
1082+ // LB ready
1083+ By ("Waiting for ALB to create endpoint " + addr + " and skipper route, to see that our ingress-controller and skipper works" )
1084+ err = waitForResponse (addr , "https" , waitTime , isNotFound , true )
1085+ framework .ExpectNoError (err )
1086+
1087+ // DNS ready
1088+ By ("Waiting for DNS to see that external-dns and skipper route to service and pod works" )
1089+ err = waitForResponse (hostName , "https" , waitTime , isSuccess , false )
1090+ framework .ExpectNoError (err )
1091+
1092+ // Test that we get content from the default ingress
1093+ By ("By checking the content of the reply we see that the ingress stack works" )
1094+ rt , quit := createHTTPRoundTripper ()
1095+ defer func () {
1096+ quit <- struct {}{}
1097+ }()
1098+ url := "https://" + hostName + "/"
1099+ req , err := http .NewRequest ("GET" , url , nil )
1100+ framework .ExpectNoError (err )
1101+ resp , err := rt .RoundTrip (req )
1102+ framework .ExpectNoError (err )
1103+ s , err := getBody (resp )
1104+ framework .ExpectNoError (err )
1105+ Expect (s ).To (Equal (backendContent ))
1106+
1107+ // Start actual ingress tests
1108+ // Test ingress Filters: opaAuthorizeRequest
1109+
1110+ /**
1111+ ## The Rule looks like below.
1112+ ## Reference https://github.bus.zalan.do/corporate-iam/styra-smoketest-policies/blob/main/bundle/policy/ingress/rules.rego
1113+ default allow := false
1114+
1115+ allow if {
1116+ input.attributes.request.http.method == "GET"
1117+ auth_header_val := input.attributes.request.http.headers.authorization
1118+ startswith(auth_header_val, "Basic ")
1119+ token := substring(auth_header_val, count("Basic "), -1)
1120+ token == "valid_token"
1121+ }
1122+ */
1123+ path := "/"
1124+ opaPolicyName := "styra-smoketest"
1125+ updatedIng := updateIngress (ingressCreate .ObjectMeta .Name ,
1126+ ingressCreate .ObjectMeta .Namespace ,
1127+ hostName ,
1128+ serviceName ,
1129+ path ,
1130+ netv1 .PathTypeImplementationSpecific ,
1131+ ingressCreate .ObjectMeta .Labels ,
1132+ map [string ]string {
1133+ "zalando.org/skipper-filter" : fmt .Sprintf (`opaAuthorizeRequest("%s")` , opaPolicyName ),
1134+ },
1135+ port ,
1136+ )
1137+ ingressUpdate , err := cs .NetworkingV1 ().Ingresses (ingressCreate .ObjectMeta .Namespace ).Update (context .TODO (), updatedIng , metav1.UpdateOptions {})
1138+ framework .ExpectNoError (err )
1139+ time .Sleep (20 * time .Second ) // wait for routing change propagation
1140+
1141+ By (fmt .Sprintf ("Calling ingress %s/%s we wait to get a 403 with opaAuthorizeRequest %s policy" , ingressUpdate .Namespace , ingressUpdate .Name , opaPolicyName ))
1142+ resp , err = getAndWaitResponse (rt , req , 10 * time .Second , http .StatusForbidden )
1143+ framework .ExpectNoError (err )
1144+ Expect (resp .StatusCode ).To (Equal (http .StatusForbidden ))
1145+
1146+ By (fmt .Sprintf ("Calling ingress %s/%s we wait to get a 200 with opaAuthorizeRequest %s policy" , ingressUpdate .Namespace , ingressUpdate .Name , opaPolicyName ))
1147+ req .Header .Set ("Authorization" , "Basic valid_token" ) //Authorized request
1148+ resp , err = getAndWaitResponse (rt , req , 10 * time .Second , http .StatusOK )
1149+ framework .ExpectNoError (err )
1150+ Expect (resp .StatusCode ).To (Equal (http .StatusOK ))
1151+ s , err = getBody (resp )
1152+ framework .ExpectNoError (err )
1153+ Expect (s ).To (Equal (backendContent ))
1154+ })
1155+ })
0 commit comments