From 3ce0ad988fac83132dfa8ffc6668c4551a00e3bf Mon Sep 17 00:00:00 2001 From: takonomura Date: Thu, 19 Jul 2018 22:37:28 +0900 Subject: [PATCH] Add e2e test for external auth --- test/e2e/annotations/auth.go | 74 +++++++++++++++++++ test/e2e/framework/{echo.go => deployment.go} | 32 +++++--- 2 files changed, 95 insertions(+), 11 deletions(-) rename test/e2e/framework/{echo.go => deployment.go} (76%) diff --git a/test/e2e/annotations/auth.go b/test/e2e/annotations/auth.go index 31cc1f504..1816f2614 100644 --- a/test/e2e/annotations/auth.go +++ b/test/e2e/annotations/auth.go @@ -19,6 +19,7 @@ package annotations import ( "fmt" "net/http" + "net/url" "os/exec" "time" @@ -27,7 +28,9 @@ import ( "github.com/parnurzeal/gorequest" corev1 "k8s.io/api/core/v1" + "k8s.io/apimachinery/pkg/api/errors" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/util/wait" "k8s.io/ingress-nginx/test/e2e/framework" ) @@ -265,6 +268,77 @@ var _ = framework.IngressNginxDescribe("Annotations - Auth", func() { Expect(len(errs)).Should(BeNumerically("==", 0)) Expect(resp.StatusCode).Should(Equal(http.StatusInternalServerError)) }) + + Context("when external authentication is configured", func() { + host := "auth" + + BeforeEach(func() { + err := f.NewHttpbinDeployment() + Expect(err).NotTo(HaveOccurred()) + + var httpbinIP string + err = wait.PollImmediate(time.Second, time.Minute, func() (bool, error) { + e, err := f.KubeClientSet.CoreV1().Endpoints(f.IngressController.Namespace).Get("httpbin", metav1.GetOptions{}) + if errors.IsNotFound(err) { + return false, nil + } + if err != nil { + return false, err + } + if len(e.Subsets) < 1 || len(e.Subsets[0].Addresses) < 1 { + return false, nil + } + httpbinIP = e.Subsets[0].Addresses[0].IP + return true, nil + }) + Expect(err).NotTo(HaveOccurred()) + + bi, err := f.EnsureIngress(framework.NewSingleIngress(host, "/", host, f.IngressController.Namespace, "http-svc", 80, &map[string]string{ + "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/basic-auth/user/password", httpbinIP), + "nginx.ingress.kubernetes.io/auth-signin": "http://$host/auth/start", + })) + Expect(err).NotTo(HaveOccurred()) + Expect(bi).NotTo(BeNil()) + + err = f.WaitForNginxServer(host, func(server string) bool { + return Expect(server).ShouldNot(ContainSubstring("return 503")) + }) + Expect(err).NotTo(HaveOccurred()) + }) + + It("should return status code 200 when signed in", func() { + resp, _, errs := gorequest.New(). + Get(f.IngressController.HTTPURL). + Retry(10, 1*time.Second, http.StatusNotFound). + Set("Host", host). + SetBasicAuth("user", "password"). + End() + + for _, err := range errs { + Expect(err).NotTo(HaveOccurred()) + } + Expect(resp.StatusCode).Should(Equal(http.StatusOK)) + }) + + It("should redirect to signin url when not signed in", func() { + resp, _, errs := gorequest.New(). + Get(f.IngressController.HTTPURL). + Retry(10, 1*time.Second, http.StatusNotFound). + Set("Host", host). + RedirectPolicy(func(req gorequest.Request, via []gorequest.Request) error { + return http.ErrUseLastResponse + }). + Param("a", "b"). + Param("c", "d"). + End() + + for _, err := range errs { + Expect(err).NotTo(HaveOccurred()) + } + Expect(resp.StatusCode).Should(Equal(http.StatusFound)) + Expect(resp.Header.Get("Location")).Should(Equal(fmt.Sprintf("http://%s/auth/start?rd=http://%s%s", host, host, url.QueryEscape("/?a=b&c=d")))) + }) + }) }) // TODO: test Digest Auth diff --git a/test/e2e/framework/echo.go b/test/e2e/framework/deployment.go similarity index 76% rename from test/e2e/framework/echo.go rename to test/e2e/framework/deployment.go index bda12f7e5..225e2af57 100644 --- a/test/e2e/framework/echo.go +++ b/test/e2e/framework/deployment.go @@ -37,35 +37,45 @@ func (f *Framework) NewEchoDeployment() error { // NewEchoDeploymentWithReplicas creates a new deployment of the echoserver image in a particular namespace. Number of // replicas is configurable func (f *Framework) NewEchoDeploymentWithReplicas(replicas int32) error { + return f.NewDeployment("http-svc", "gcr.io/google_containers/echoserver:1.10", 8080, replicas) +} + +// NewHttpbinDeployment creates a new single replica deployment of the httpbin image in a particular namespace. +func (f *Framework) NewHttpbinDeployment() error { + return f.NewDeployment("httpbin", "kennethreitz/httpbin", 80, 1) +} + +// NewDeployment creates a new deployment in a particular namespace. +func (f *Framework) NewDeployment(name, image string, port int32, replicas int32) error { deployment := &extensions.Deployment{ ObjectMeta: metav1.ObjectMeta{ - Name: "http-svc", + Name: name, Namespace: f.IngressController.Namespace, }, Spec: extensions.DeploymentSpec{ Replicas: NewInt32(replicas), Selector: &metav1.LabelSelector{ MatchLabels: map[string]string{ - "app": "http-svc", + "app": name, }, }, Template: corev1.PodTemplateSpec{ ObjectMeta: metav1.ObjectMeta{ Labels: map[string]string{ - "app": "http-svc", + "app": name, }, }, Spec: corev1.PodSpec{ TerminationGracePeriodSeconds: NewInt64(0), Containers: []corev1.Container{ { - Name: "http-svc", - Image: "gcr.io/google_containers/echoserver:1.10", + Name: name, + Image: image, Env: []corev1.EnvVar{}, Ports: []corev1.ContainerPort{ { Name: "http", - ContainerPort: 8080, + ContainerPort: port, }, }, }, @@ -81,7 +91,7 @@ func (f *Framework) NewEchoDeploymentWithReplicas(replicas int32) error { } if d == nil { - return fmt.Errorf("unexpected error creating deployement for echoserver") + return fmt.Errorf("unexpected error creating deployement %s", name) } err = WaitForPodsReady(f.KubeClientSet, 5*time.Minute, int(replicas), f.IngressController.Namespace, metav1.ListOptions{ @@ -93,7 +103,7 @@ func (f *Framework) NewEchoDeploymentWithReplicas(replicas int32) error { service := &corev1.Service{ ObjectMeta: metav1.ObjectMeta{ - Name: "http-svc", + Name: name, Namespace: f.IngressController.Namespace, }, Spec: corev1.ServiceSpec{ @@ -101,12 +111,12 @@ func (f *Framework) NewEchoDeploymentWithReplicas(replicas int32) error { { Name: "http", Port: 80, - TargetPort: intstr.FromInt(8080), + TargetPort: intstr.FromInt(int(port)), Protocol: "TCP", }, }, Selector: map[string]string{ - "app": "http-svc", + "app": name, }, }, } @@ -117,7 +127,7 @@ func (f *Framework) NewEchoDeploymentWithReplicas(replicas int32) error { } if s == nil { - return fmt.Errorf("unexpected error creating service for echoserver deployment") + return fmt.Errorf("unexpected error creating service %s", name) } return nil