DevFW-CICD/ingress-nginx-helm
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

added new auth-tls-match-cn annotation (#8434)

Browse source 
* added new auth-tls-match-cn annotation

* added few more tests
This commit is contained in:
Chris Shino 2022-04-15 15:59:10 -04:00 • committed by GitHub
parent 81c2afd975
commit f9372aa495
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 116 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

87
test/e2e/annotations/authtls.go
View file

@ -262,6 +262,93 @@ var _ = framework.DescribeAnnotation("auth-tls-*", func() {
Status(http.StatusOK)
})
ginkgo.It("should return 403 using auth-tls-match-cn with no matching CN from client", func() {
host := "authtls.foo.com"
nameSpace := f.Namespace
clientConfig, err := framework.CreateIngressMASecret(
f.KubeClientSet,
host,
host,
nameSpace)
assert.Nil(ginkgo.GinkgoT(), err)
annotations := map[string]string{
"nginx.ingress.kubernetes.io/auth-tls-secret": nameSpace + "/" + host,
"nginx.ingress.kubernetes.io/auth-tls-verify-client": "on",
"nginx.ingress.kubernetes.io/auth-tls-match-cn": "CN=notgonnamatch",
}
f.EnsureIngress(framework.NewSingleIngressWithTLS(host, "/", host, []string{host}, nameSpace, framework.EchoService, 80, annotations))
assertSslClientCertificateConfig(f, host, "on", "1")
f.HTTPTestClientWithTLSConfig(clientConfig).
GET("/").
WithURL(f.GetURL(framework.HTTPS)).
WithHeader("Host", host).
Expect().
Status(http.StatusForbidden)
})
ginkgo.It("should return 200 using auth-tls-match-cn with matching CN from client", func() {
host := "authtls.foo.com"
nameSpace := f.Namespace
clientConfig, err := framework.CreateIngressMASecret(
f.KubeClientSet,
host,
host,
nameSpace)
assert.Nil(ginkgo.GinkgoT(), err)
annotations := map[string]string{
"nginx.ingress.kubernetes.io/auth-tls-secret": nameSpace + "/" + host,
"nginx.ingress.kubernetes.io/auth-tls-verify-client": "on",
"nginx.ingress.kubernetes.io/auth-tls-match-cn": "CN=authtls",
}
f.EnsureIngress(framework.NewSingleIngressWithTLS(host, "/", host, []string{host}, nameSpace, framework.EchoService, 80, annotations))
assertSslClientCertificateConfig(f, host, "on", "1")
f.HTTPTestClientWithTLSConfig(clientConfig).
GET("/").
WithURL(f.GetURL(framework.HTTPS)).
WithHeader("Host", host).
Expect().
Status(http.StatusOK)
})
ginkgo.It("should return 200 using auth-tls-match-cn where atleast one of the regex options matches CN from client", func() {
host := "authtls.foo.com"
nameSpace := f.Namespace
clientConfig, err := framework.CreateIngressMASecret(
f.KubeClientSet,
host,
host,
nameSpace)
assert.Nil(ginkgo.GinkgoT(), err)
annotations := map[string]string{
"nginx.ingress.kubernetes.io/auth-tls-secret": nameSpace + "/" + host,
"nginx.ingress.kubernetes.io/auth-tls-verify-client": "on",
"nginx.ingress.kubernetes.io/auth-tls-match-cn": "CN=(itwillmatch|withthenextoption|authtls)",
}
f.EnsureIngress(framework.NewSingleIngressWithTLS(host, "/", host, []string{host}, nameSpace, framework.EchoService, 80, annotations))
assertSslClientCertificateConfig(f, host, "on", "1")
f.HTTPTestClientWithTLSConfig(clientConfig).
GET("/").
WithURL(f.GetURL(framework.HTTPS)).
WithHeader("Host", host).
Expect().
Status(http.StatusOK)
})
})
func assertSslClientCertificateConfig(f *framework.Framework, host string, verifyClient string, verifyDepth string) {