DevFW-CICD/ingress-nginx-helm
12
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: Ensure changes in MatchCN annotation are detected (#11173)

Browse source
This commit is contained in:
wdullaer 2024-07-02 05:48:24 +09:00 committed by GitHub
parent 6a111a974b
commit bcb98c0c8d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 55 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
internal/ingress/annotations/authtls/main.go
View file

@ -122,6 +122,9 @@ func (assl1 *Config) Equal(assl2 *Config) bool {
if assl1.PassCertToUpstream != assl2.PassCertToUpstream {
return false
}
if assl1.MatchCN != assl2.MatchCN {
return false
}
return true
}

9
internal/ingress/annotations/authtls/main_test.go
View file

@ -333,6 +333,15 @@ func TestEquals(t *testing.T) {
}
cfg2.PassCertToUpstream = true
// Different MatchCN
cfg1.MatchCN = "CN=(hello-app|goodbye)"
cfg2.MatchCN = "CN=(hello-app)"
result = cfg1.Equal(cfg2)
if result != false {
t.Errorf("Expected false")
}
cfg2.MatchCN = "CN=(hello-app|goodbye)"
// Equal Configs
result = cfg1.Equal(cfg2)
if result != true {

43
test/e2e/annotations/authtls.go
View file

@ -322,6 +322,49 @@ var _ = framework.DescribeAnnotation("auth-tls-*", func() {
Status(http.StatusOK)
})
ginkgo.It("should reload the nginx config when auth-tls-match-cn is updated", func() {
host := authTLSFooHost
nameSpace := f.Namespace
clientConfig, err := framework.CreateIngressMASecret(
f.KubeClientSet,
host,
host,
nameSpace)
assert.Nil(ginkgo.GinkgoT(), err)
// First add an annotation that forbids our connection
annotations := map[string]string{
"nginx.ingress.kubernetes.io/auth-tls-secret": nameSpace + "/" + host,
"nginx.ingress.kubernetes.io/auth-tls-verify-client": "on",
"nginx.ingress.kubernetes.io/auth-tls-match-cn": "CN=notvalid",
}
ingress := f.EnsureIngress(framework.NewSingleIngressWithTLS(host, "/", host, []string{host}, nameSpace, framework.EchoService, 80, annotations))
assertSslClientCertificateConfig(f, host, "on", "1")
f.HTTPTestClientWithTLSConfig(clientConfig).
GET("/").
WithURL(f.GetURL(framework.HTTPS)).
WithHeader("Host", host).
Expect().
Status(http.StatusForbidden)
// Update the annotation to something that allows the connection
ingress.Annotations["nginx.ingress.kubernetes.io/auth-tls-match-cn"] = "CN=authtls"
f.UpdateIngress(ingress)
assertSslClientCertificateConfig(f, host, "on", "1")
f.HTTPTestClientWithTLSConfig(clientConfig).
GET("/").
WithURL(f.GetURL(framework.HTTPS)).
WithHeader("Host", host).
Expect().
Status(http.StatusOK)
})
ginkgo.It("should return 200 using auth-tls-match-cn where atleast one of the regex options matches CN from client", func() {
host := authTLSFooHost
nameSpace := f.Namespace