Add test for ingress-https.

* Add ingress-https test. Rename ssl policy name since it has a naming collision with ingress-grpc recipe. * User needs to have a valid DNS domain and specify the DNS record name when running this test.
GoogleCloudPlatform · Oct 26, 2023 · 6595ea7 · 6595ea7
1 parent 4a19889
commit 6595ea7
Show file tree

Hide file tree

Showing 5 changed files with 158 additions and 4 deletions.
diff --git a/ingress/single-cluster/ingress-https/README.md b/ingress/single-cluster/ingress-https/README.md
@@ -80,7 +80,7 @@ kind: FrontendConfig
 metadata:
   name: ingress-security-config
 spec:
-  sslPolicy: gke-ingress-ssl-policy
+  sslPolicy: gke-ingress-ssl-policy-https
   redirectToHttps:
     enabled: true
 ```
@@ -123,7 +123,7 @@ Created [https://www.googleapis.com/compute/v1/projects/xxx/global/addresses/gke
 4. Create an SSL policy. This policy specifies a broad set of modern ciphers and requires that clients negotiate using TLS 1.2 or higher.
 
 ```
-$ gcloud compute ssl-policies create gke-ingress-ssl-policy \
+$ gcloud compute ssl-policies create gke-ingress-ssl-policy-https \
     --profile MODERN \
     --min-tls-version 1.2
 ```
@@ -203,7 +203,7 @@ You are now ready to serve securely on the internet!
 ```bash
 $ kubectl delete -f secure-ingress.yaml
 $ gcloud compute addresses delete --global gke-foobar-public-ip
-$ gcloud compute ssl-policies delete gke-ingress-ssl-policy
+$ gcloud compute ssl-policies delete gke-ingress-ssl-policy-https
 ```
 
 ### Testing

diff --git a/ingress/single-cluster/ingress-https/cleanup.sh b/ingress/single-cluster/ingress-https/cleanup.sh
@@ -0,0 +1,56 @@
+#!/bin/bash
+
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit;
+set -o nounset;
+set -o pipefail;
+set -o xtrace;
+
+source ./test/helper.sh
+test_name="ingress-https"
+context=$(get_context "${test_name}")
+
+foo_dns_record="foo.${DNS_NAME}"
+bar_dns_record="bar.${DNS_NAME}"
+
+if [[ ! -z "${context}" ]]; then
+    ingress_name="secure-ingress"
+    fr=$(get_forwarding_rule "${ingress_name}" "${test_name}" "${context}")
+    thp=$(get_target_http_proxy "${ingress_name}" "${test_name}" "${context}")
+    thsp=$(get_target_https_proxy "${ingress_name}" "${test_name}" "${context}")
+    um=$(get_url_map "${ingress_name}" "${test_name}" "${context}")
+    backends=$(get_backends "${ingress_name}" "${test_name}" "${context}")
+    negs=$(get_negs "${context}")
+
+    resource_yaml="ingress/single-cluster/ingress-https/secure-ingress.yaml"
+    kubectl --context "${context}" delete -f "${resource_yaml}" -n "${test_name}" || true
+    sed -i'.bak' "s/${foo_dns_record}/foo.\${DOMAIN}.com/g" "${resource_yaml}"
+    sed -i'.bak' "s/${bar_dns_record}/bar.\${DOMAIN}.com/g" "${resource_yaml}"
+    rm -f "${resource_yaml}".bak
+    wait_for_glbc_deletion "${fr}" "${thp}" "${thsp}" "${um}" "${backends}" "${negs}"
+    kubectl --context "${context}" delete namespace "${test_name}" || true
+fi
+
+gcloud compute ssl-policies delete gke-ingress-ssl-policy-https --quiet || true
+gcloud compute addresses delete --global gke-foobar-public-ip --quiet || true
+gcloud dns --project="${DNS_PROJECT}" record-sets delete "${foo_dns_record}" \
+    --zone="${DNS_ZONE}" \
+    --type="A" || true
+gcloud dns --project="${DNS_PROJECT}" record-sets delete "${bar_dns_record}" \
+    --zone="${DNS_ZONE}" \
+    --type="A" || true
+
+cleanup_gke_basic "${test_name}" "${ZONE}" "${REGION}"
diff --git a/ingress/single-cluster/ingress-https/run-test.sh b/ingress/single-cluster/ingress-https/run-test.sh
@@ -0,0 +1,39 @@
+#!/bin/bash
+
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit;
+set -o nounset;
+set -o pipefail;
+set -o xtrace;
+
+source ./test/helper.sh
+test_name="ingress-https"
+context=$(get_context "${test_name}")
+
+if [[ -z "${context}" ]]; then
+    exit 1
+fi
+
+vip=$(wait_for_ingress_ip "secure-ingress" "${test_name}" "${context}")
+
+wait_for_managed_cert "foobar-certificate" "ingress-https" "${context}"
+
+foo_dns_record="foo.${DNS_NAME}"
+bar_dns_record="bar.${DNS_NAME}"
+check_http_status "https://${foo_dns_record}" 200
+check_http_status "https://${bar_dns_record}" 200
+check_http_status "http://${foo_dns_record}" 301
+check_http_status "http://${bar_dns_record}" 301
diff --git a/ingress/single-cluster/ingress-https/secure-ingress.yaml b/ingress/single-cluster/ingress-https/secure-ingress.yaml
@@ -49,7 +49,7 @@ kind: FrontendConfig
 metadata:
   name: ingress-security-config
 spec:
-  sslPolicy: gke-ingress-ssl-policy
+  sslPolicy: gke-ingress-ssl-policy-https
   redirectToHttps:
     enabled: true
 ---

diff --git a/ingress/single-cluster/ingress-https/setup.sh b/ingress/single-cluster/ingress-https/setup.sh
@@ -0,0 +1,59 @@
+#!/bin/bash
+
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit;
+set -o nounset;
+set -o pipefail;
+set -o xtrace;
+
+if [[ -z "${DNS_PROJECT-}" ||  -z "${DNS_ZONE-}" ||  -z "${DNS_NAME-}" ]]; then
+    echo "Required environment variables are not set. See ingress-https/REAME.md for details."
+    exit 1
+fi
+
+source ./test/helper.sh
+test_name="ingress-https"
+setup_gke_basic "${test_name}" "${ZONE}" "${REGION}"
+context=$(get_context "${test_name}")
+
+if [[ -z "${context}" ]]; then
+    exit 1
+fi
+
+kubectl --context "${context}" create namespace "${test_name}"
+
+static_ip_name=gke-foobar-public-ip
+gcloud compute addresses create --global "${static_ip_name}"
+static_ip=$(gcloud compute addresses describe --global "${static_ip_name}" --format="value(address)")
+gcloud compute ssl-policies create gke-ingress-ssl-policy-https --profile MODERN --min-tls-version 1.2
+
+foo_dns_record="foo.${DNS_NAME}"
+bar_dns_record="bar.${DNS_NAME}"
+gcloud dns --project="${DNS_PROJECT}" record-sets create "${foo_dns_record}" \
+    --zone="${DNS_ZONE}" \
+    --type="A" \
+    --ttl="14400" \
+    --rrdatas="${static_ip}"
+gcloud dns --project="${DNS_PROJECT}" record-sets create "${bar_dns_record}" \
+    --zone="${DNS_ZONE}" \
+    --type="A" \
+    --ttl="14400" \
+    --rrdatas="${static_ip}"
+
+resource_yaml="ingress/single-cluster/ingress-https/secure-ingress.yaml"
+sed -i'.bak' "s/foo.\${DOMAIN}.com/${foo_dns_record}/g" "${resource_yaml}"
+sed -i'.bak' "s/bar.\${DOMAIN}.com/${bar_dns_record}/g" "${resource_yaml}"
+kubectl --context "${context}" apply -f "${resource_yaml}" -n "${test_name}"