DevFW-CICD/ingress-nginx-helm
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: Ensure changes in MatchCN annotation are detected (#11529)

Browse source 
Co-authored-by: Wouter Dullaert <wouter.dullaert@exoscale.ch>
This commit is contained in:
k8s-infra-cherrypick-robot 2024-07-02 01:29:41 -07:00 • committed by GitHub
parent 6a111a974b
commit 52f89fa1be
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 55 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

43
test/e2e/annotations/authtls.go
View file

@ -322,6 +322,49 @@ var _ = framework.DescribeAnnotation("auth-tls-*", func() {
Status(http.StatusOK)
})
ginkgo.It("should reload the nginx config when auth-tls-match-cn is updated", func() {
host := authTLSFooHost
nameSpace := f.Namespace
clientConfig, err := framework.CreateIngressMASecret(
f.KubeClientSet,
host,
host,
nameSpace)
assert.Nil(ginkgo.GinkgoT(), err)
// First add an annotation that forbids our connection
annotations := map[string]string{
"nginx.ingress.kubernetes.io/auth-tls-secret": nameSpace + "/" + host,
"nginx.ingress.kubernetes.io/auth-tls-verify-client": "on",
"nginx.ingress.kubernetes.io/auth-tls-match-cn": "CN=notvalid",
}
ingress := f.EnsureIngress(framework.NewSingleIngressWithTLS(host, "/", host, []string{host}, nameSpace, framework.EchoService, 80, annotations))
assertSslClientCertificateConfig(f, host, "on", "1")
f.HTTPTestClientWithTLSConfig(clientConfig).
GET("/").
WithURL(f.GetURL(framework.HTTPS)).
WithHeader("Host", host).
Expect().
Status(http.StatusForbidden)
// Update the annotation to something that allows the connection
ingress.Annotations["nginx.ingress.kubernetes.io/auth-tls-match-cn"] = "CN=authtls"
f.UpdateIngress(ingress)
assertSslClientCertificateConfig(f, host, "on", "1")
f.HTTPTestClientWithTLSConfig(clientConfig).
GET("/").
WithURL(f.GetURL(framework.HTTPS)).
WithHeader("Host", host).
Expect().
Status(http.StatusOK)
})
ginkgo.It("should return 200 using auth-tls-match-cn where atleast one of the regex options matches CN from client", func() {
host := authTLSFooHost
nameSpace := f.Namespace