crd: Upgrade prohibited target CRD api-version and add tests

crds/AzureIngressProhibitedTarget-v1-CRD-v1.yaml

@@ -0,0 +1,28 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: azureingressprohibitedtargets.appgw.ingress.k8s.io
+spec:
+  group: appgw.ingress.k8s.io
+  names:
+    kind: AzureIngressProhibitedTarget
+    plural: azureingressprohibitedtargets
+  scope: Namespaced
+  versions:
+    - name: v1
+      served: true 
+      storage: true 
+      schema: 
+        openAPIV3Schema:
+          properties:
+            spec:
+              properties:
+                hostname:
+                  description: "(optional) Hostname of the prohibited target"
+                  type: string
+                paths:
+                  description: "(optional) A list of URL paths, for which the Ingress Controller is prohibited from mutating Application Gateway configuration; Must begin with a / and end with /*"
+                  type: array
+                  items:
+                      type: string
+                      pattern: '^\/(?:.+\/)?\*$'

helm/ingress-azure/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v1
-appVersion: "1.2.0"
+appVersion: "1.4.0"
 description: Use Azure Application Gateway as the ingress for an Azure Kubernetes Service cluster.
 name: ingress-azure
-version: 1.2.1
+version: 1.4.0

helm/ingress-azure/crds/azureingressprohibitedtarget.yaml

@@ -1,27 +1,30 @@
-apiVersion: apiextensions.k8s.io/v1beta1
+apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   name: azureingressprohibitedtargets.appgw.ingress.k8s.io
-  annotations:	  
+  annotations:
     "helm.sh/hook": crd-install
 spec:
   group: appgw.ingress.k8s.io
-  version: v1
   names:
     kind: AzureIngressProhibitedTarget
     plural: azureingressprohibitedtargets
   scope: Namespaced
-  validation:
-    openAPIV3Schema:
-      properties:
-        spec:
+  versions:
+    - name: v1
+      served: true 
+      storage: true 
+      schema: 
+        openAPIV3Schema:
           properties:
-            hostname:
-              description: "(optional) Hostname of the prohibited target"
-              type: string
-            paths:
-              description: "(optional) A list of URL paths, for which the Ingress Controller is prohibited from mutating Application Gateway configuration; Must begin with a / and end with /*"
-              type: array
-              items:
+            spec:
+              properties:
+                hostname:
+                  description: "(optional) Hostname of the prohibited target"
                   type: string
-                  pattern: '^\/(?:.+\/)?\*$'
+                paths:
+                  description: "(optional) A list of URL paths, for which the Ingress Controller is prohibited from mutating Application Gateway configuration; Must begin with a / and end with /*"
+                  type: array
+                  items:
+                      type: string
+                      pattern: '^\/(?:.+\/)?\*$'

helm/ingress-azure/tests/fixtures/sample-config-prohibited-target.json

@@ -0,0 +1,29 @@
+{
+    "verbosityLevel": 3,
+    "appgw": {
+        "subscriptionId": "0000-0000-0000-0000-00000000",
+        "resourceGroup": "resgp",
+        "name": "gateway",
+        "usePrivateIP": false,
+        "shared": true,
+        "prohibitedTargets": [
+            {
+                "name": "prohibit-backend-ns",
+                "paths": [
+                    "/blacklist/*"
+                ]
+            }
+        ]
+    },
+    "armAuth": {
+        "type": "aadPodIdentity",
+        "identityResourceID": "/a/b/c",
+        "identityClientID": "0000-0000-0000-0000-00000000"
+    },
+    "rbac": {
+        "enabled": false
+    },
+    "kubernetes": {
+        "resources": {}
+    }
+}

helm/ingress-azure/tests/snapshots/sample-config-empty/ingress-azure/templates/configmap.yaml

@@ -6,16 +6,16 @@ metadata:
   name: RELEASE-NAME-cm-ingress-azure
   labels:
     app: ingress-azure
-    chart: ingress-azure-1.2.1
+    chart: ingress-azure-1.4.0
     heritage: Helm
     release: RELEASE-NAME
 data:
   APPGW_VERBOSITY_LEVEL: "3"
+  MULTI_CLUSTER_MODE: "false"
   HTTP_SERVICE_PORT:     "8123"
   APPGW_SUBSCRIPTION_ID: "0000-0000-0000-0000-00000000"
   APPGW_RESOURCE_GROUP:  "resgp"
   APPGW_NAME:            "gateway"
   APPGW_SUBNET_NAME: "gateway-subnet"
-  MULTI_CLUSTER_MODE: "false"
   AZURE_CLIENT_ID: "0000-0000-0000-0000-00000000"
   USE_MANAGED_IDENTITY_FOR_POD: "true"

helm/ingress-azure/tests/snapshots/sample-config-empty/ingress-azure/templates/deployment.yaml

@@ -6,7 +6,7 @@ metadata:
   name: RELEASE-NAME-ingress-azure
   labels:
     app: ingress-azure
-    chart: ingress-azure-1.2.1
+    chart: ingress-azure-1.4.0
     heritage: Helm
     release: RELEASE-NAME
 spec:
@@ -30,7 +30,7 @@ spec:
         runAsUser: 0
       containers:
       - name: ingress-azure
-        image: mcr.microsoft.com/azure-application-gateway/kubernetes-ingress:1.2.0
+        image: mcr.microsoft.com/azure-application-gateway/kubernetes-ingress:1.4.0
         imagePullPolicy: Always
         readinessProbe:
           httpGet:

helm/ingress-azure/tests/snapshots/sample-config-empty/ingress-azure/templates/serviceaccount.yaml

@@ -5,7 +5,7 @@ kind: ServiceAccount
 metadata:
   labels:
     app: ingress-azure
-    chart: ingress-azure-1.2.1
+    chart: ingress-azure-1.4.0
     heritage: Helm
     release: RELEASE-NAME
   name: RELEASE-NAME-sa-ingress-azure

helm/ingress-azure/tests/snapshots/sample-config-prohibited-target/ingress-azure/templates/aadpodidbinding.yaml

@@ -0,0 +1,10 @@
+---
+# Source: ingress-azure/templates/aadpodidbinding.yaml
+# Please see https://github.com/Azure/aad-pod-identity for more inromation
+apiVersion: "aadpodidentity.k8s.io/v1"
+kind: AzureIdentityBinding
+metadata:
+  name: RELEASE-NAME-azidbinding-ingress-azure
+spec: 
+  azureIdentity: RELEASE-NAME-azid-ingress-azure
+  selector: RELEASE-NAME-ingress-azure

helm/ingress-azure/tests/snapshots/sample-config-prohibited-target/ingress-azure/templates/aadpodidentity.yaml

@@ -0,0 +1,11 @@
+---
+# Source: ingress-azure/templates/aadpodidentity.yaml
+# Please see https://github.com/Azure/aad-pod-identity for more information
+apiVersion: "aadpodidentity.k8s.io/v1"
+kind: AzureIdentity
+metadata:
+  name: RELEASE-NAME-azid-ingress-azure
+spec:
+  type: 0
+  resourceID: /a/b/c
+  clientID: 0000-0000-0000-0000-00000000

helm/ingress-azure/tests/snapshots/sample-config-prohibited-target/ingress-azure/templates/configmap.yaml

@@ -0,0 +1,22 @@
+---
+# Source: ingress-azure/templates/configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: RELEASE-NAME-cm-ingress-azure
+  labels:
+    app: ingress-azure
+    chart: ingress-azure-1.4.0
+    heritage: Helm
+    release: RELEASE-NAME
+data:
+  APPGW_VERBOSITY_LEVEL: "3"
+  MULTI_CLUSTER_MODE: "false"
+  HTTP_SERVICE_PORT:     "8123"
+  APPGW_SUBSCRIPTION_ID: "0000-0000-0000-0000-00000000"
+  APPGW_RESOURCE_GROUP:  "resgp"
+  APPGW_NAME:            "gateway"
+  APPGW_SUBNET_NAME: "gateway-subnet"
+  APPGW_ENABLE_SHARED_APPGW: "true"
+  AZURE_CLIENT_ID: "0000-0000-0000-0000-00000000"
+  USE_MANAGED_IDENTITY_FOR_POD: "true"

helm/ingress-azure/tests/snapshots/sample-config-prohibited-target/ingress-azure/templates/crds.yaml

@@ -0,0 +1,9 @@
+---
+# Source: ingress-azure/templates/crds.yaml
+apiVersion: appgw.ingress.k8s.io/v1
+kind: AzureIngressProhibitedTarget
+metadata:
+  name: prohibit-backend-ns
+spec:
+  paths:
+  - /blacklist/*

helm/ingress-azure/tests/snapshots/sample-config-prohibited-target/ingress-azure/templates/deployment.yaml

@@ -0,0 +1,69 @@
+---
+# Source: ingress-azure/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: RELEASE-NAME-ingress-azure
+  labels:
+    app: ingress-azure
+    chart: ingress-azure-1.4.0
+    heritage: Helm
+    release: RELEASE-NAME
+spec:
+  replicas: 1 # TODO: Make configurable when leader election is supported.
+  selector:
+    matchLabels:
+      app: ingress-azure
+      release: RELEASE-NAME
+  template:
+    metadata:
+      labels:
+        app: ingress-azure
+        release: RELEASE-NAME
+        aadpodidbinding: RELEASE-NAME-ingress-azure
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "8123"
+    spec:
+      serviceAccountName: RELEASE-NAME-sa-ingress-azure
+      securityContext:
+        runAsUser: 0
+      containers:
+      - name: ingress-azure
+        image: mcr.microsoft.com/azure-application-gateway/kubernetes-ingress:1.4.0
+        imagePullPolicy: Always
+        readinessProbe:
+          httpGet:
+            path: /health/ready
+            port: 8123
+          initialDelaySeconds: 5
+          periodSeconds: 10
+        livenessProbe:
+          httpGet:
+            path: /health/alive
+            port: 8123
+          initialDelaySeconds: 15
+          periodSeconds: 20
+        env:
+        - name: AZURE_CLOUD_PROVIDER_LOCATION
+          value: /etc/appgw/azure.json
+        - name: AGIC_POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: AGIC_POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        envFrom:
+        - configMapRef:
+            name: RELEASE-NAME-cm-ingress-azure
+        volumeMounts:
+        - name: azure
+          mountPath: /etc/appgw/
+          readOnly: true
+      volumes:
+      - name: azure
+        hostPath:
+          path: /etc/kubernetes/
+          type: Directory

helm/ingress-azure/tests/snapshots/sample-config-prohibited-target/ingress-azure/templates/serviceaccount.yaml

@@ -0,0 +1,11 @@
+---
+# Source: ingress-azure/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app: ingress-azure
+    chart: ingress-azure-1.4.0
+    heritage: Helm
+    release: RELEASE-NAME
+  name: RELEASE-NAME-sa-ingress-azure

helm/ingress-azure/tests/snapshots/sample-config/ingress-azure/templates/configmap.yaml

@@ -6,17 +6,17 @@ metadata:
   name: RELEASE-NAME-cm-ingress-azure
   labels:
     app: ingress-azure
-    chart: ingress-azure-1.2.1
+    chart: ingress-azure-1.4.0
     heritage: Helm
     release: RELEASE-NAME
 data:
   APPGW_VERBOSITY_LEVEL: "3"
+  MULTI_CLUSTER_MODE: "false"
   HTTP_SERVICE_PORT:     "8123"
   APPGW_SUBSCRIPTION_ID: "0000-0000-0000-0000-00000000"
   APPGW_RESOURCE_GROUP:  "resgp"
   APPGW_NAME:            "gateway"
   APPGW_SUBNET_NAME: "gateway-subnet"
   KUBERNETES_WATCHNAMESPACE: "a,b,c"
-  MULTI_CLUSTER_MODE: "false"
   AZURE_CLIENT_ID: "0000-0000-0000-0000-00000000"
   USE_MANAGED_IDENTITY_FOR_POD: "true"

helm/ingress-azure/tests/snapshots/sample-config/ingress-azure/templates/deployment.yaml

@@ -6,7 +6,7 @@ metadata:
   name: RELEASE-NAME-ingress-azure
   labels:
     app: ingress-azure
-    chart: ingress-azure-1.2.1
+    chart: ingress-azure-1.4.0
     heritage: Helm
     release: RELEASE-NAME
 spec:
@@ -32,7 +32,7 @@ spec:
         runAsUser: 3000
       containers:
       - name: ingress-azure
-        image: mcr.microsoft.com/azure-application-gateway/kubernetes-ingress:1.2.0
+        image: mcr.microsoft.com/azure-application-gateway/kubernetes-ingress:1.4.0
         imagePullPolicy: Always
         readinessProbe:
           httpGet:

helm/ingress-azure/tests/snapshots/sample-config/ingress-azure/templates/serviceaccount.yaml

@@ -5,7 +5,7 @@ kind: ServiceAccount
 metadata:
   labels:
     app: ingress-azure
-    chart: ingress-azure-1.2.1
+    chart: ingress-azure-1.4.0
     heritage: Helm
     release: RELEASE-NAME
   name: RELEASE-NAME-sa-ingress-azure

helm/ingress-azure/values.yaml

@@ -11,7 +11,7 @@ verbosityLevel: 3
 
 image:
   repository: mcr.microsoft.com/azure-application-gateway/kubernetes-ingress
-  tag: 1.2.0
+  tag: 1.4.0
   pullPolicy: Always