Add additional tests for ingress recipes.

* Add ingress-cloudarmor test.
* Add ingress-custom-default-backend test.
* Add ingress-https test.
* Add ingress-nginx test.
* Add ingress-custom-http-health-check test.
* Add ingress-iap test.

.gitignore

@@ -5,4 +5,4 @@ asm/
 .key
 .pem
 certs/
-test/test.conf
+test/test.conf

ingress/single-cluster/ingress-cloudarmor/cleanup.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit;
+set -o nounset;
+set -o pipefail;
+set -o xtrace;
+
+source ./test/helper.sh
+source ./test/test.conf
+test_name="ingress-cloudarmor"
+suffix=$(get_hash "${test_name}")
+context=$(kubectl config view -o json | jq -r ".contexts[] | select(.name | test(\"-${suffix}\")).name" || true)
+# Set a non-empty value for conext since --context="" will default to use current context
+if [[ -z "${context}" ]]; then
+    context="empty-context"
+fi
+
+ingress_name="cloudarmor-test"
+fr=$(get_forwarding_rule "${ingress_name}" "${test_name}" "${context}")
+thp=$(get_target_http_proxy "${ingress_name}" "${test_name}" "${context}")
+thsp=$(get_target_https_proxy "${ingress_name}" "${test_name}" "${context}")
+um=$(get_url_map "${ingress_name}" "${test_name}" "${context}")
+backends=$(get_backends "${ingress_name}" "${test_name}" "${context}")
+negs=$(get_negs "${context}")
+
+resource_yaml="ingress/single-cluster/ingress-cloudarmor/cloudarmor-ingress.yaml"
+kubectl --context "${context}" delete -f "${resource_yaml}" -n "${test_name}" || true
+kubectl --context "${context}" delete namespace "${test_name}" || true
+wait_for_glbc_deletion "${fr}" "${thp}" "${thsp}" "${um}" "${backends}" "${negs}"
+
+policy_name="allow-my-ip"
+sed -i'.bak' "s/${policy_name}/\$POLICY_NAME/g" "${resource_yaml}"
+rm -f "${resource_yaml}".bak
+gcloud compute security-policies delete "${policy_name}" --quiet || true
+
+cleanup_gke_basic "${test_name}" "${zone}" "${subnet_region}"

ingress/single-cluster/ingress-cloudarmor/run-test.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit;
+set -o nounset;
+set -o pipefail;
+set -o xtrace;
+
+source ./test/helper.sh
+source ./test/test.conf
+test_name="ingress-cloudarmor"
+suffix=$(get_hash "${test_name}")
+context=$(kubectl config view -o json | jq -r ".contexts[] | select(.name | test(\"-${suffix}\")).name" || true)
+# Set a non-empty value for conext since --context="" will default to use current context
+if [[ -z "${context}" ]]; then
+    context="empty-context"
+fi
+
+vip=$(wait_for_ingress_ip "cloudarmor-test" "${test_name}" "${context}")
+echo "Load balancer IP is ${vip}"
+
+check_http_status "${vip}/whereami" 200
+check_http_status "${vip}" 404
+check_http_status "${vip}/whereami" 502 "" "${test_name}" "${zone}"
+check_http_status "${vip}" 404 "" "${test_name}" "${zone}"

ingress/single-cluster/ingress-cloudarmor/setup.sh

@@ -0,0 +1,43 @@
+#!/bin/bash
+
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit;
+set -o nounset;
+set -o pipefail;
+set -o xtrace;
+
+source ./test/helper.sh
+source ./test/test.conf
+test_name="ingress-cloudarmor"
+setup_gke_basic "${test_name}" "${zone}" "${subnet_region}"
+suffix=$(get_hash "${test_name}")
+context=$(kubectl config view -o json | jq -r ".contexts[] | select(.name | test(\"-${suffix}\")).name" || true)
+# Set a non-empty value for conext since --context="" will default to use current context
+if [[ -z "${context}" ]]; then
+    context="empty-context"
+fi
+
+resource_yaml="ingress/single-cluster/ingress-cloudarmor/cloudarmor-ingress.yaml"
+kubectl --context "${context}" create namespace "${test_name}"
+
+currentIP=$(curl -s ifconfig.me)
+policy_name="allow-my-ip"
+gcloud compute security-policies create "${policy_name}"
+gcloud compute security-policies rules update 2147483647  --security-policy "${policy_name}" --action "deny-502" # Update the default policy(2147483647 is the priority value for default rule).
+gcloud compute security-policies rules create 1000 --security-policy "${policy_name}" --src-ip-ranges "${currentIP}" --action "allow"
+sed -i'.bak' "s/\$POLICY_NAME/${policy_name}/g" "${resource_yaml}"
+
+kubectl --context "${context}" apply -f "${resource_yaml}" -n "${test_name}"

ingress/single-cluster/ingress-custom-default-backend/cleanup.sh

@@ -0,0 +1,45 @@
+#!/bin/bash
+
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit;
+set -o nounset;
+set -o pipefail;
+set -o xtrace;
+
+source ./test/helper.sh
+source ./test/test.conf
+test_name="ingress-custom-default-backend"
+suffix=$(get_hash "${test_name}")
+context=$(kubectl config view -o json | jq -r ".contexts[] | select(.name | test(\"-${suffix}\")).name" || true)
+# Set a non-empty value for conext since --context="" will default to use current context
+if [[ -z "${context}" ]]; then
+    context="empty-context"
+fi
+
+ingress_name="foo-internal"
+fr=$(get_forwarding_rule "${ingress_name}" "${test_name}" "${context}")
+thp=$(get_target_http_proxy "${ingress_name}" "${test_name}" "${context}")
+thsp=$(get_target_https_proxy "${ingress_name}" "${test_name}" "${context}")
+um=$(get_url_map "${ingress_name}" "${test_name}" "${context}")
+backends=$(get_backends "${ingress_name}" "${test_name}" "${context}")
+negs=$(get_negs "${context}")
+
+resource_yaml="ingress/single-cluster/ingress-custom-default-backend/ingress-custom-default-backend.yaml"
+kubectl --context "${context}" delete -f "${resource_yaml}" -n "${test_name}" || true
+kubectl --context "${context}" delete namespace "${test_name}" || true
+wait_for_glbc_deletion "${fr}" "${thp}" "${thsp}" "${um}" "${backends}" "${negs}"
+
+cleanup_gke_basic "${test_name}" "${zone}" "${subnet_region}"

ingress/single-cluster/ingress-custom-default-backend/run-test.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit;
+set -o nounset;
+set -o pipefail;
+set -o xtrace;
+
+source ./test/helper.sh
+source ./test/test.conf
+test_name="ingress-custom-default-backend"
+suffix=$(get_hash "${test_name}")
+context=$(kubectl config view -o json | jq -r ".contexts[] | select(.name | test(\"-${suffix}\")).name" || true)
+# Set a non-empty value for conext since --context="" will default to use current context
+if [[ -z "${context}" ]]; then
+    context="empty-context"
+fi
+
+vip=$(wait_for_ingress_ip "foo-internal" "${test_name}" "${context}")
+echo "Load balancer IP is ${vip}"
+
+check_http_status "${vip}/foo" 200 "" "${test_name}" "${zone}"
+check_http_status "${vip}/bar" 200 "" "${test_name}" "${zone}"

ingress/single-cluster/ingress-custom-default-backend/setup.sh

@@ -0,0 +1,37 @@
+#!/bin/bash
+
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit;
+set -o nounset;
+set -o pipefail;
+set -o xtrace;
+
+source ./test/helper.sh
+source ./test/test.conf
+test_name="ingress-custom-default-backend"
+setup_gke_basic "${test_name}" "${zone}" "${subnet_region}"
+setup_ilb "${test_name}" "${subnet_region}"
+suffix=$(get_hash "${test_name}")
+context=$(kubectl config view -o json | jq -r ".contexts[] | select(.name | test(\"-${suffix}\")).name" || true)
+# Set a non-empty value for conext since --context="" will default to use current context
+if [[ -z "${context}" ]]; then
+    context="empty-context"
+fi
+
+resource_yaml="ingress/single-cluster/ingress-custom-default-backend/ingress-custom-default-backend.yaml"
+kubectl --context "${context}" create namespace "${test_name}"
+
+kubectl --context "${context}" apply -f "${resource_yaml}" -n "${test_name}"

ingress/single-cluster/ingress-custom-http-health-check/cleanup.sh

@@ -0,0 +1,46 @@
+#!/bin/bash
+
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit;
+set -o nounset;
+set -o pipefail;
+set -o xtrace;
+
+source ./test/helper.sh
+source ./test/helper.sh
+source ./test/test.conf
+test_name="ingress-custom-http-health-check"
+suffix=$(get_hash "${test_name}")
+context=$(kubectl config view -o json | jq -r ".contexts[] | select(.name | test(\"-${suffix}\")).name" || true)
+# Set a non-empty value for conext since --context="" will default to use current context
+if [[ -z "${context}" ]]; then
+    context="empty-context"
+fi
+
+ingress_name="hc-test"
+fr=$(get_forwarding_rule "${ingress_name}" "${test_name}" "${context}")
+thp=$(get_target_http_proxy "${ingress_name}" "${test_name}" "${context}")
+thsp=$(get_target_https_proxy "${ingress_name}" "${test_name}" "${context}")
+um=$(get_url_map "${ingress_name}" "${test_name}" "${context}")
+backends=$(get_backends "${ingress_name}" "${test_name}" "${context}")
+negs=$(get_negs "${context}")
+
+resource_yaml="ingress/single-cluster/ingress-custom-http-health-check/custom-http-hc-ingress.yaml"
+kubectl --context "${context}" delete -f "${resource_yaml}" -n "${test_name}" || true
+kubectl --context "${context}" delete namespace "${test_name}" || true
+wait_for_glbc_deletion "${fr}" "${thp}" "${thsp}" "${um}" "${backends}" "${negs}"
+
+cleanup_gke_basic "${test_name}" "${zone}" "${subnet_region}"

ingress/single-cluster/ingress-custom-http-health-check/run-test.sh

@@ -0,0 +1,35 @@
+#!/bin/bash
+
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit;
+set -o nounset;
+set -o pipefail;
+set -o xtrace;
+
+source ./test/helper.sh
+source ./test/test.conf
+test_name="ingress-custom-http-health-check"
+suffix=$(get_hash "${test_name}")
+context=$(kubectl config view -o json | jq -r ".contexts[] | select(.name | test(\"-${suffix}\")).name" || true)
+# Set a non-empty value for conext since --context="" will default to use current context
+if [[ -z "${context}" ]]; then
+    context="empty-context"
+fi
+
+vip=$(wait_for_ingress_ip "hc-test" "${test_name}" "${context}")
+echo "Load balancer IP is ${vip}"
+
+check_http_status "${vip}" 200

ingress/single-cluster/ingress-custom-http-health-check/setup.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit;
+set -o nounset;
+set -o pipefail;
+set -o xtrace;
+
+source ./test/helper.sh
+source ./test/test.conf
+test_name="ingress-custom-http-health-check"
+setup_gke_basic "${test_name}" "${zone}" "${subnet_region}"
+suffix=$(get_hash "${test_name}")
+context=$(kubectl config view -o json | jq -r ".contexts[] | select(.name | test(\"-${suffix}\")).name" || true)
+# Set a non-empty value for conext since --context="" will default to use current context
+if [[ -z "${context}" ]]; then
+    context="empty-context"
+fi
+
+resource_yaml="ingress/single-cluster/ingress-custom-http-health-check/custom-http-hc-ingress.yaml"
+kubectl --context "${context}" create namespace "${test_name}"
+
+kubectl --context "${context}" apply -f "${resource_yaml}" -n "${test_name}"