add gcpAuthzExtension CRD

GoogleCloudPlatform · Oct 21, 2024 · aa0b7bb · aa0b7bb
1 parent 1e93516
commit aa0b7bb
Show file tree

Hide file tree

Showing 12 changed files with 610 additions and 0 deletions.
diff --git a/authz/authz-cr-validation/backend_ref_invalid_group.yaml b/authz/authz-cr-validation/backend_ref_invalid_group.yaml
@@ -0,0 +1,11 @@
+apiVersion: networking.gke.io/v1
+kind: GCPAuthzExtension
+metadata:
+  name: "test"
+spec:
+  backendRef:
+    group: "fake-group"
+    kind: Service
+    name: test-service
+    port: 80
+  authority: hello.com
diff --git a/authz/authz-cr-validation/backend_ref_invalid_kind.yaml b/authz/authz-cr-validation/backend_ref_invalid_kind.yaml
@@ -0,0 +1,11 @@
+apiVersion: networking.gke.io/v1
+kind: GCPAuthzExtension
+metadata:
+  name: "test"
+spec:
+  backendRef:
+    group: ""
+    kind: Gateway
+    name: test-service
+    port: 80
+  authority: hello.com
diff --git a/authz/authz-cr-validation/invalid_metadata_key.yaml b/authz/authz-cr-validation/invalid_metadata_key.yaml
@@ -0,0 +1,14 @@
+apiVersion: networking.gke.io/v1
+kind: GCPAuthzExtension
+metadata:
+  name: "test"
+spec:
+  backendRef:
+    group: ""
+    kind: Service
+    name: test-service
+    port: 80
+  authority: hello.com
+  timeout: 1s
+  metadata:
+    "???": "value"
diff --git a/authz/authz-cr-validation/invalid_metadata_value.yaml b/authz/authz-cr-validation/invalid_metadata_value.yaml
@@ -0,0 +1,14 @@
+apiVersion: networking.gke.io/v1
+kind: GCPAuthzExtension
+metadata:
+  name: "test"
+spec:
+  backendRef:
+    group: ""
+    kind: Service
+    name: test-service
+    port: 80
+  authority: hello.com
+  timeout: 1s
+  metadata:
+    "key": ""
diff --git a/authz/authz-cr-validation/no_authority.yaml b/authz/authz-cr-validation/no_authority.yaml
@@ -0,0 +1,11 @@
+apiVersion: networking.gke.io/v1
+kind: GCPAuthzExtension
+metadata:
+  name: "test"
+spec:
+  backendRef:
+    group: ""
+    kind: Service
+    name: test-service
+    port: 80
+  timeout: 1s
diff --git a/authz/authz-cr-validation/no_timeout.yaml b/authz/authz-cr-validation/no_timeout.yaml
@@ -0,0 +1,11 @@
+apiVersion: networking.gke.io/v1
+kind: GCPAuthzExtension
+metadata:
+  name: "test"
+spec:
+  backendRef:
+    group: ""
+    kind: Service
+    name: test-service
+    port: 80
+  authority: hello.com
diff --git a/authz/authz-cr-validation/run-test.sh b/authz/authz-cr-validation/run-test.sh
@@ -45,3 +45,14 @@ check_cr_validation "./authz/authz-cr-validation/invalid_provider_deny.yaml" "tr
 check_cr_validation "./authz/authz-cr-validation/invalid_provider_custom.yaml" "true"
 check_cr_validation "./authz/authz-cr-validation/invalid_multiple_providers.yaml" "true"
 check_cr_validation "./authz/authz-cr-validation/valid.yaml" "false"
+
+check_cr_validation "./authz/authz-cr-validation/backend_ref_invalid_group.yaml" "true"
+check_cr_validation "./authz/authz-cr-validation/backend_ref_invalid_kind.yaml" "true"
+check_cr_validation "./authz/authz-cr-validation/invalid_metadata_key.yaml" "true"
+check_cr_validation "./authz/authz-cr-validation/invalid_metadata_value.yaml" "true"
+check_cr_validation "./authz/authz-cr-validation/no_authority.yaml" "true"
+check_cr_validation "./authz/authz-cr-validation/no_timeout.yaml" "true"
+check_cr_validation "./authz/authz-cr-validation/too_big_timeout.yaml" "true"
+check_cr_validation "./authz/authz-cr-validation/too_small_timeout.yaml" "true"
+check_cr_validation "./authz/authz-cr-validation/wrong_wire_format.yaml" "true"
+check_cr_validation "./authz/authz-cr-validation/valid_extension.yaml" "false"
diff --git a/authz/authz-cr-validation/too_big_timeout.yaml b/authz/authz-cr-validation/too_big_timeout.yaml
@@ -0,0 +1,12 @@
+apiVersion: networking.gke.io/v1
+kind: GCPAuthzExtension
+metadata:
+  name: "test"
+spec:
+  backendRef:
+    group: ""
+    kind: Service
+    name: test-service
+    port: 80
+  authority: hello.com
+  timeout: 11s
diff --git a/authz/authz-cr-validation/too_small_timeout.yaml b/authz/authz-cr-validation/too_small_timeout.yaml
@@ -0,0 +1,12 @@
+apiVersion: networking.gke.io/v1
+kind: GCPAuthzExtension
+metadata:
+  name: "test"
+spec:
+  backendRef:
+    group: ""
+    kind: Service
+    name: test-service
+    port: 80
+  authority: hello.com
+  timeout: 1ms
diff --git a/authz/authz-cr-validation/valid_extension.yaml b/authz/authz-cr-validation/valid_extension.yaml
@@ -0,0 +1,18 @@
+apiVersion: networking.gke.io/v1
+kind: GCPAuthzExtension
+metadata:
+  name: "test"
+spec:
+  backendRef:
+    group: ""
+    kind: Service
+    name: test-service
+    port: 80
+  authority: hello.com
+  timeout: 1s
+  failOpen: true
+  metadata:
+    "key": "value"
+  forwardHeaders:
+  - hello.com
+  wireFormat: ExtProcGRPC
diff --git a/authz/authz-cr-validation/wrong_wire_format.yaml b/authz/authz-cr-validation/wrong_wire_format.yaml
@@ -0,0 +1,13 @@
+apiVersion: networking.gke.io/v1
+kind: GCPAuthzExtension
+metadata:
+  name: "test"
+spec:
+  backendRef:
+    group: ""
+    kind: Service
+    name: test-service
+    port: 80
+  timeout: 1s
+  authority: hello.com
+  wireFormat: ExtProc