-
Notifications
You must be signed in to change notification settings - Fork 591
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Handle
KongIngress deprecation in admission webhook and in `KongIng…
…ress` validation rules (#5022) Co-authored-by: Grzegorz Burzyński <czeslavo@gmail.com> Co-authored-by: Patryk Małek <patryk.malek@konghq.com>
- Loading branch information
3 people
committed
Oct 31, 2023
1 parent
0eb998f
commit 2fccacb
Showing
18 changed files
with
311 additions
and
55 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -68,6 +68,7 @@ webhooks: | |
| - UPDATE | ||
| resources: | ||
| - secrets | ||
| - services | ||
| - apiGroups: | ||
| - networking.k8s.io | ||
| apiVersions: | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,147 @@ | ||
| package admission | ||
|
|
||
| import ( | ||
| "context" | ||
| "encoding/json" | ||
| "fmt" | ||
| "testing" | ||
|
|
||
| "github.com/go-logr/logr" | ||
| "github.com/stretchr/testify/require" | ||
| admissionv1 "k8s.io/api/admission/v1" | ||
| corev1 "k8s.io/api/core/v1" | ||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| "k8s.io/apimachinery/pkg/runtime" | ||
| k8stypes "k8s.io/apimachinery/pkg/types" | ||
|
|
||
| "github.com/kong/kubernetes-ingress-controller/v3/internal/annotations" | ||
| kongv1 "github.com/kong/kubernetes-ingress-controller/v3/pkg/apis/configuration/v1" | ||
| kongv1beta1 "github.com/kong/kubernetes-ingress-controller/v3/pkg/apis/configuration/v1beta1" | ||
| ) | ||
|
|
||
| func TestHandleKongIngress(t *testing.T) { | ||
| tests := []struct { | ||
| name string | ||
| resource kongv1.KongIngress | ||
| wantWarnings []string | ||
| }{ | ||
| { | ||
| name: "has proxy", | ||
| resource: kongv1.KongIngress{ | ||
| Proxy: &kongv1.KongIngressService{}, | ||
| }, | ||
| wantWarnings: []string{proxyWarning}, | ||
| }, | ||
| { | ||
| name: "has route", | ||
| resource: kongv1.KongIngress{ | ||
| Route: &kongv1.KongIngressRoute{}, | ||
| }, | ||
| wantWarnings: []string{routeWarning}, | ||
| }, | ||
| { | ||
| name: "has upstream", | ||
| resource: kongv1.KongIngress{ | ||
| Upstream: &kongv1.KongIngressUpstream{}, | ||
| }, | ||
| wantWarnings: []string{upstreamWarning}, | ||
| }, | ||
| { | ||
| name: "has everything", | ||
| resource: kongv1.KongIngress{ | ||
| Proxy: &kongv1.KongIngressService{}, | ||
| Route: &kongv1.KongIngressRoute{}, | ||
| Upstream: &kongv1.KongIngressUpstream{}, | ||
| }, | ||
| wantWarnings: []string{proxyWarning, routeWarning, upstreamWarning}, | ||
| }, | ||
| } | ||
| for _, tt := range tests { | ||
| resource := tt.resource | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| validator := KongHTTPValidator{} | ||
| raw, err := json.Marshal(tt.resource) | ||
| require.NoError(t, err) | ||
| request := admissionv1.AdmissionRequest{ | ||
| Object: runtime.RawExtension{ | ||
| Object: &resource, | ||
| Raw: raw, | ||
| }, | ||
| } | ||
|
|
||
| handler := RequestHandler{ | ||
| Validator: validator, | ||
| Logger: logr.Discard(), | ||
| } | ||
|
|
||
| responseBuilder := NewResponseBuilder(k8stypes.UID("")) | ||
|
|
||
| got, err := handler.handleKongIngress(context.Background(), request, responseBuilder) | ||
| require.NoError(t, err) | ||
| require.True(t, got.Allowed) | ||
| require.Equal(t, tt.wantWarnings, got.Warnings) | ||
| }) | ||
| } | ||
| } | ||
|
|
||
| func TestHandleService(t *testing.T) { | ||
| tests := []struct { | ||
| name string | ||
| resource corev1.Service | ||
| wantWarnings []string | ||
| }{ | ||
| { | ||
| name: "has kongingress annotation", | ||
| resource: corev1.Service{ | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: "test", | ||
| Annotations: map[string]string{ | ||
| annotations.AnnotationPrefix + annotations.ConfigurationKey: "test", | ||
| }, | ||
| }, | ||
| }, | ||
| wantWarnings: []string{ | ||
| fmt.Sprintf(serviceWarning, annotations.AnnotationPrefix+annotations.ConfigurationKey, | ||
| kongv1beta1.KongUpstreamPolicyAnnotationKey), | ||
| }, | ||
| }, | ||
| { | ||
| name: "has upstream policy annotation", | ||
| resource: corev1.Service{ | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: "test", | ||
| Annotations: map[string]string{ | ||
| annotations.AnnotationPrefix + kongv1beta1.KongUpstreamPolicyAnnotationKey: "test", | ||
| }, | ||
| }, | ||
| }, | ||
| wantWarnings: nil, | ||
| }, | ||
| } | ||
| for _, tt := range tests { | ||
| resource := tt.resource | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| validator := KongHTTPValidator{} | ||
| raw, err := json.Marshal(tt.resource) | ||
| require.NoError(t, err) | ||
| request := admissionv1.AdmissionRequest{ | ||
| Object: runtime.RawExtension{ | ||
| Object: &resource, | ||
| Raw: raw, | ||
| }, | ||
| } | ||
|
|
||
| handler := RequestHandler{ | ||
| Validator: validator, | ||
| Logger: logr.Discard(), | ||
| } | ||
|
|
||
| responseBuilder := NewResponseBuilder(k8stypes.UID("")) | ||
|
|
||
| got, err := handler.handleService(context.Background(), request, responseBuilder) | ||
| require.NoError(t, err) | ||
| require.True(t, got.Allowed) | ||
| require.Equal(t, tt.wantWarnings, got.Warnings) | ||
| }) | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
Oops, something went wrong.