def test_openapi_validation_flow(self, kube_apis,
ingress_controller_prerequisites,
crd_ingress_controller,
virtual_server_setup):
ic_pod_name = get_first_pod_name(
kube_apis.v1, ingress_controller_prerequisites.namespace)
config_old = get_vs_nginx_template_conf(
kube_apis.v1, virtual_server_setup.namespace,
virtual_server_setup.vs_name, ic_pod_name,
ingress_controller_prerequisites.namespace)
vs_src = f"{TEST_DATA}/virtual-server-redirects/virtual-server-invalid-openapi.yaml"
try:
patch_virtual_server_from_yaml(kube_apis.custom_objects,
virtual_server_setup.vs_name,
vs_src,
virtual_server_setup.namespace)
except ApiException as ex:
assert ex.status == 422 \
and "spec.routes.action.redirect.url" in ex.body \
and "spec.routes.action.redirect.code" in ex.body
except Exception as ex:
pytest.fail(f"An unexpected exception is raised: {ex}")
else:
pytest.fail("Expected an exception but there was none")
wait_before_test(1)
config_new = get_vs_nginx_template_conf(
kube_apis.v1, virtual_server_setup.namespace,
virtual_server_setup.vs_name, ic_pod_name,
ingress_controller_prerequisites.namespace)
assert config_old == config_new, "Expected: config doesn't change"
def test_tls_redirect_based_on_scheme(self, kube_apis, ingress_controller_prerequisites,
crd_ingress_controller, virtual_server_setup):
patch_virtual_server_from_yaml(kube_apis.custom_objects,
virtual_server_setup.vs_name,
f"{TEST_DATA}/virtual-server-tls-redirect/virtual-server-scheme-redirect.yaml",
virtual_server_setup.namespace)
wait_before_test(1)
ic_pod_name = get_first_pod_name(kube_apis.v1, ingress_controller_prerequisites.namespace)
config = get_vs_nginx_template_conf(kube_apis.v1,
virtual_server_setup.namespace,
virtual_server_setup.vs_name,
ic_pod_name,
ingress_controller_prerequisites.namespace)
assert "proxy_set_header X-Forwarded-Proto $scheme;" in config
resp_1 = requests.get(virtual_server_setup.backend_1_url,
headers={"host": virtual_server_setup.vs_host},
allow_redirects=False)
resp_2 = requests.get(virtual_server_setup.backend_2_url,
headers={"host": virtual_server_setup.vs_host},
allow_redirects=False)
assert resp_1.status_code == 302, "Expected: a redirect for scheme=http"
assert resp_2.status_code == 302, "Expected: a redirect for scheme=http"
resp_3 = requests.get(virtual_server_setup.backend_1_url_ssl,
headers={"host": virtual_server_setup.vs_host},
allow_redirects=False, verify=False)
resp_4 = requests.get(virtual_server_setup.backend_2_url_ssl,
headers={"host": virtual_server_setup.vs_host},
allow_redirects=False, verify=False)
assert resp_3.status_code == 200, "Expected: no redirect for scheme=https"
assert resp_4.status_code == 200, "Expected: no redirect for scheme=https"
def assert_vs_conf_exists(kube_apis, ic_pod_name, ic_namespace,
virtual_server_setup):
new_response = get_vs_nginx_template_conf(kube_apis.v1,
virtual_server_setup.namespace,
virtual_server_setup.vs_name,
ic_pod_name, ic_namespace)
assert "No such file or directory" not in new_response
def test_validation_flow(self, kube_apis, ingress_controller_prerequisites,
crd_ingress_controller, virtual_server_setup):
ic_pod_name = get_first_pod_name(
kube_apis.v1, ingress_controller_prerequisites.namespace)
initial_events_vs = get_events(kube_apis.v1,
virtual_server_setup.namespace)
try:
patch_virtual_server_from_yaml(
kube_apis.custom_objects, virtual_server_setup.vs_name,
f"{TEST_DATA}/virtual-server-upstream-tls/virtual-server-invalid.yaml",
virtual_server_setup.namespace)
except ApiException as ex:
assert ex.status == 422 and "spec.upstreams.tls.enable" in ex.body
except Exception as ex:
pytest.fail(f"An unexpected exception is raised: {ex}")
else:
pytest.fail("Expected an exception but there was none")
wait_before_test(1)
config = get_vs_nginx_template_conf(
kube_apis.v1, virtual_server_setup.namespace,
virtual_server_setup.vs_name, ic_pod_name,
ingress_controller_prerequisites.namespace)
resp_1 = requests.get(virtual_server_setup.backend_1_url,
headers={"host": virtual_server_setup.vs_host})
resp_2 = requests.get(virtual_server_setup.backend_2_url,
headers={"host": virtual_server_setup.vs_host})
new_events_vs = get_events(kube_apis.v1,
virtual_server_setup.namespace)
proxy_host = f"vs_{virtual_server_setup.namespace}_{virtual_server_setup.vs_name}"
assert f'proxy_pass https://{proxy_host}_backend1' not in config
assert f'proxy_pass https://{proxy_host}_backend2' in config
assert_response_codes(resp_1, resp_2)
assert_no_new_events(initial_events_vs, new_events_vs)
def test_responses_and_config_after_disable_tls(
self, kube_apis, ingress_controller_prerequisites,
crd_ingress_controller, virtual_server_setup):
ic_pod_name = get_first_pod_name(
kube_apis.v1, ingress_controller_prerequisites.namespace)
text = f"{virtual_server_setup.namespace}/{virtual_server_setup.vs_name}"
vs_event_text = f"Configuration for {text} was added or updated"
initial_events_vs = get_events(kube_apis.v1,
virtual_server_setup.namespace)
initial_count = assert_event_and_get_count(vs_event_text,
initial_events_vs)
patch_virtual_server_from_yaml(
kube_apis.custom_objects, virtual_server_setup.vs_name,
f"{TEST_DATA}/virtual-server-upstream-tls/virtual-server-disable-tls.yaml",
virtual_server_setup.namespace)
wait_before_test(1)
config = get_vs_nginx_template_conf(
kube_apis.v1, virtual_server_setup.namespace,
virtual_server_setup.vs_name, ic_pod_name,
ingress_controller_prerequisites.namespace)
resp_1 = requests.get(virtual_server_setup.backend_1_url,
headers={"host": virtual_server_setup.vs_host})
resp_2 = requests.get(virtual_server_setup.backend_2_url,
headers={"host": virtual_server_setup.vs_host})
new_events_vs = get_events(kube_apis.v1,
virtual_server_setup.namespace)
assert 'proxy_pass https://' not in config
assert_response_codes(resp_1, resp_2, 200, 400)
assert_event_count_increased(vs_event_text, initial_count,
new_events_vs)
def test_make_existing_vsr_invalid(self, kube_apis,
ingress_controller_prerequisites,
crd_ingress_controller, v_s_route_setup,
route_yaml):
ic_pod_name = get_first_pod_name(
kube_apis.v1, ingress_controller_prerequisites.namespace)
patch_v_s_route_from_yaml(kube_apis.custom_objects,
v_s_route_setup.route_s.name, route_yaml,
v_s_route_setup.route_s.namespace)
wait_before_test(1)
new_config = get_vs_nginx_template_conf(
kube_apis.v1, v_s_route_setup.namespace, v_s_route_setup.vs_name,
ic_pod_name, ingress_controller_prerequisites.namespace)
new_vs_events = get_events(kube_apis.v1, v_s_route_setup.namespace)
new_vsr_events = get_events(kube_apis.v1,
v_s_route_setup.route_s.namespace)
assert_locations_not_in_config(new_config,
v_s_route_setup.route_s.paths)
text = f"{v_s_route_setup.route_s.namespace}/{v_s_route_setup.route_s.name}"
assert_event_and_count(
f"Configuration for {v_s_route_setup.namespace}/{v_s_route_setup.vs_name} was added or updated with warning(s)",
1, new_vs_events)
if route_yaml == f"{TEST_DATA}/virtual-server-route/route-single-invalid-host.yaml":
assert_event_and_count(
f"VirtualServer is invalid or doesn't exist", 1,
new_vsr_events)
else:
assert_event_and_count(
f"VirtualServerRoute {text} was rejected with error", 1,
new_vsr_events)
def test_create_invalid_vsr(self, kube_apis,
ingress_controller_prerequisites,
crd_ingress_controller, v_s_route_setup):
route_yaml = f"{TEST_DATA}/virtual-server-route/route-single-duplicate-path.yaml"
ic_pod_name = get_first_pod_name(
kube_apis.v1, ingress_controller_prerequisites.namespace)
text = f"{v_s_route_setup.route_s.namespace}/{v_s_route_setup.route_s.name}"
vs_event_text = f"Configuration for {v_s_route_setup.namespace}/{v_s_route_setup.vs_name} was added or updated with warning(s)"
vsr_event_text = f"VirtualServerRoute {text} was rejected with error: spec.subroutes[1].path: Duplicate value: \"/backend2\""
delete_v_s_route(kube_apis.custom_objects,
v_s_route_setup.route_s.name,
v_s_route_setup.route_s.namespace)
create_v_s_route_from_yaml(kube_apis.custom_objects, route_yaml,
v_s_route_setup.route_s.namespace)
wait_before_test(1)
new_config = get_vs_nginx_template_conf(
kube_apis.v1, v_s_route_setup.namespace, v_s_route_setup.vs_name,
ic_pod_name, ingress_controller_prerequisites.namespace)
new_vs_events = get_events(kube_apis.v1, v_s_route_setup.namespace)
new_vsr_events = get_events(kube_apis.v1,
v_s_route_setup.route_s.namespace)
assert_locations_not_in_config(new_config,
v_s_route_setup.route_s.paths)
assert_event_and_count(vs_event_text, 1, new_vs_events)
assert_event_and_count(vsr_event_text, 1, new_vsr_events)
def test_flow_for_invalid_vsr(self, kube_apis,
ingress_controller_prerequisites,
crd_ingress_controller, v_s_route_setup,
v_s_route_app_setup):
ic_pod_name = get_first_pod_name(
kube_apis.v1, ingress_controller_prerequisites.namespace)
text_vs = f"{v_s_route_setup.namespace}/{v_s_route_setup.vs_name}"
text_vsr_s = f"{v_s_route_setup.route_m.namespace}/{v_s_route_setup.route_m.name}"
vs_event_text = f'Configuration for {text_vs} was added or updated with warning(s)'
vsr_event_text = f'VirtualServerRoute {text_vsr_s} was rejected with error: ' \
f'spec.subroutes[1].path: Duplicate value: "=/backends/exact-match$request"'
vs_src_yaml = f"{TEST_DATA}" \
f"/virtual-server-route-regexp-location/standard/virtual-server-exact.yaml"
patch_virtual_server_from_yaml(kube_apis.custom_objects,
v_s_route_setup.vs_name, vs_src_yaml,
v_s_route_setup.namespace)
vsr_src_yaml = f"{TEST_DATA}" \
f"/virtual-server-route-regexp-location/route-multiple-invalid-multiple-regexp-subroutes.yaml"
patch_v_s_route_from_yaml(kube_apis.custom_objects,
v_s_route_setup.route_m.name, vsr_src_yaml,
v_s_route_setup.route_m.namespace)
wait_before_test(2)
config = get_vs_nginx_template_conf(
kube_apis.v1, v_s_route_setup.namespace, v_s_route_setup.vs_name,
ic_pod_name, ingress_controller_prerequisites.namespace)
ns_events = get_events(kube_apis.v1, v_s_route_setup.route_m.namespace)
assert_event(vsr_event_text, ns_events) and assert_event(
vs_event_text, ns_events)
assert "location =/backends/exact-match$request {" not in config
def test_when_option_in_config_map_only(self, kube_apis, ingress_controller_prerequisites,
crd_ingress_controller, virtual_server_setup, restore_configmap,
config_map_file, expected_strings, unexpected_strings):
text = f"{virtual_server_setup.namespace}/{virtual_server_setup.vs_name}"
vs_event_text = f"Configuration for {text} was added or updated"
print(f"Case 3: key specified in ConfigMap, no option in VS")
patch_virtual_server_from_yaml(kube_apis.custom_objects, virtual_server_setup.vs_name,
f"{TEST_DATA}/virtual-server-upstream-options/standard/virtual-server.yaml",
virtual_server_setup.namespace)
config_map_name = ingress_controller_prerequisites.config_map["metadata"]["name"]
replace_configmap_from_yaml(kube_apis.v1, config_map_name,
ingress_controller_prerequisites.namespace,
config_map_file)
wait_before_test(1)
ic_pod_name = get_first_pod_name(kube_apis.v1, ingress_controller_prerequisites.namespace)
config = get_vs_nginx_template_conf(kube_apis.v1,
virtual_server_setup.namespace,
virtual_server_setup.vs_name,
ic_pod_name,
ingress_controller_prerequisites.namespace)
resp_1 = requests.get(virtual_server_setup.backend_1_url,
headers={"host": virtual_server_setup.vs_host})
resp_2 = requests.get(virtual_server_setup.backend_2_url,
headers={"host": virtual_server_setup.vs_host})
vs_events = get_events(kube_apis.v1, virtual_server_setup.namespace)
assert_event(vs_event_text, vs_events)
for _ in expected_strings:
assert _ in config
for _ in unexpected_strings:
assert _ not in config
assert_response_codes(resp_1, resp_2)
def test_slow_start_warning(self, kube_apis,
ingress_controller_prerequisites, crd_ingress_controller,
v_s_route_setup, v_s_route_app_setup, options):
ic_pod_name = get_first_pod_name(kube_apis.v1, ingress_controller_prerequisites.namespace)
text_s = f"{v_s_route_setup.route_s.namespace}/{v_s_route_setup.route_s.name}"
text_m = f"{v_s_route_setup.route_m.namespace}/{v_s_route_setup.route_m.name}"
vsr_s_event_text = f"Configuration for {text_s} was added or updated with warning(s): " \
f"Slow start will be disabled"
vsr_m_event_text = f"Configuration for {text_m} was added or updated with warning(s): " \
f"Slow start will be disabled"
print(f"Case 2: no key in ConfigMap, option specified in VSR")
new_body_m = generate_item_with_upstream_options(
f"{TEST_DATA}/virtual-server-route-upstream-options/route-multiple.yaml",
options)
new_body_s = generate_item_with_upstream_options(
f"{TEST_DATA}/virtual-server-route-upstream-options/route-single.yaml",
options)
patch_v_s_route(kube_apis.custom_objects,
v_s_route_setup.route_m.name, v_s_route_setup.route_m.namespace, new_body_m)
patch_v_s_route(kube_apis.custom_objects,
v_s_route_setup.route_s.name, v_s_route_setup.route_s.namespace, new_body_s)
wait_before_test(1)
config = get_vs_nginx_template_conf(kube_apis.v1,
v_s_route_setup.namespace,
v_s_route_setup.vs_name,
ic_pod_name,
ingress_controller_prerequisites.namespace)
vsr_s_events = get_events(kube_apis.v1, v_s_route_setup.route_s.namespace)
vsr_m_events = get_events(kube_apis.v1, v_s_route_setup.route_m.namespace)
assert_event(vsr_s_event_text, vsr_s_events)
assert_event(vsr_m_event_text, vsr_m_events)
assert "slow_start" not in config
def test_when_option_in_v_s_only(self, kube_apis, ingress_controller_prerequisites,
crd_ingress_controller, virtual_server_setup,
options, expected_strings):
text = f"{virtual_server_setup.namespace}/{virtual_server_setup.vs_name}"
vs_event_text = f"Configuration for {text} was added or updated"
events_vs = get_events(kube_apis.v1, virtual_server_setup.namespace)
initial_count = assert_event_and_get_count(vs_event_text, events_vs)
print(f"Case 2: no key in ConfigMap , option specified in VS")
new_body = generate_item_with_upstream_options(
f"{TEST_DATA}/virtual-server-upstream-options/standard/virtual-server.yaml",
options)
patch_virtual_server(kube_apis.custom_objects,
virtual_server_setup.vs_name, virtual_server_setup.namespace, new_body)
wait_before_test(1)
ic_pod_name = get_first_pod_name(kube_apis.v1, ingress_controller_prerequisites.namespace)
config = get_vs_nginx_template_conf(kube_apis.v1,
virtual_server_setup.namespace,
virtual_server_setup.vs_name,
ic_pod_name,
ingress_controller_prerequisites.namespace)
resp_1 = requests.get(virtual_server_setup.backend_1_url,
headers={"host": virtual_server_setup.vs_host})
resp_2 = requests.get(virtual_server_setup.backend_2_url,
headers={"host": virtual_server_setup.vs_host})
vs_events = get_events(kube_apis.v1, virtual_server_setup.namespace)
assert_event_count_increased(vs_event_text, initial_count, vs_events)
for _ in expected_strings:
assert _ in config
assert_response_codes(resp_1, resp_2)
def test_config(self, kube_apis, ingress_controller_prerequisites, crd_ingress_controller, v_s_route_setup):
wait_before_test(1)
ic_pod_name = get_first_pod_name(kube_apis.v1, ingress_controller_prerequisites.namespace)
config = get_vs_nginx_template_conf(kube_apis.v1,
v_s_route_setup.namespace,
v_s_route_setup.vs_name,
ic_pod_name,
ingress_controller_prerequisites.namespace)
assert "error_page 418 =407" in config and "error_page 418 =200" in config
def test_config(self, kube_apis, ingress_controller_prerequisites,
crd_ingress_controller, virtual_server_setup):
ic_pod_name = get_first_pod_name(
kube_apis.v1, ingress_controller_prerequisites.namespace)
config = get_vs_nginx_template_conf(
kube_apis.v1, virtual_server_setup.namespace,
virtual_server_setup.vs_name, ic_pod_name,
ingress_controller_prerequisites.namespace)
assert 'error_page 418 =307' in config and 'error_page 418 =301' in config
def test_openapi_validation_flow(self, kube_apis, ingress_controller_prerequisites,
crd_ingress_controller, v_s_route_setup):
ic_pod_name = get_first_pod_name(kube_apis.v1, ingress_controller_prerequisites.namespace)
invalid_fields = [
"upstreams.healthCheck.enable", "upstreams.healthCheck.path",
"upstreams.healthCheck.interval", "upstreams.healthCheck.jitter",
"upstreams.healthCheck.fails", "upstreams.healthCheck.passes",
"upstreams.healthCheck.port", "upstreams.healthCheck.connect-timeout",
"upstreams.healthCheck.read-timeout", "upstreams.healthCheck.send-timeout",
"upstreams.healthCheck.headers.name", "upstreams.healthCheck.headers.value",
"upstreams.healthCheck.statusMatch",
"upstreams.slow-start",
"upstreams.queue.size", "upstreams.queue.timeout",
"upstreams.sessionCookie.name", "upstreams.sessionCookie.path",
"upstreams.sessionCookie.expires", "upstreams.sessionCookie.domain",
"upstreams.sessionCookie.httpOnly", "upstreams.sessionCookie.secure"
]
config_old = get_vs_nginx_template_conf(kube_apis.v1,
v_s_route_setup.namespace,
v_s_route_setup.vs_name,
ic_pod_name,
ingress_controller_prerequisites.namespace)
source_yaml = f"{TEST_DATA}/virtual-server-route-upstream-options/plus-route-s-invalid-keys-openapi.yaml"
try:
patch_v_s_route_from_yaml(kube_apis.custom_objects,
v_s_route_setup.route_s.name,
source_yaml,
v_s_route_setup.route_s.namespace)
except ApiException as ex:
assert ex.status == 422
for item in invalid_fields:
assert item in ex.body
except Exception as ex:
pytest.fail(f"An unexpected exception is raised: {ex}")
else:
pytest.fail("Expected an exception but there was none")
wait_before_test(2)
config_new = get_vs_nginx_template_conf(kube_apis.v1,
v_s_route_setup.namespace,
v_s_route_setup.vs_name,
ic_pod_name,
ingress_controller_prerequisites.namespace)
assert config_old == config_new, "Expected: config doesn't change"
def test_ssl_keys(self, cli_arguments, kube_apis,
ingress_controller_prerequisites, crd_ingress_controller,
virtual_server_setup, clean_up):
ic_pods_amount = get_pods_amount(
kube_apis.v1, ingress_controller_prerequisites.namespace)
ic_pod_name = get_first_pod_name(
kube_apis.v1, ingress_controller_prerequisites.namespace)
initial_list = get_events(kube_apis.v1, virtual_server_setup.namespace)
print("Step 1: update ConfigMap with valid ssl keys")
replace_configmap_from_yaml(
kube_apis.v1,
ingress_controller_prerequisites.config_map['metadata']['name'],
ingress_controller_prerequisites.namespace,
f"{TEST_DATA}/virtual-server-configmap-keys/configmap-ssl-keys.yaml"
)
wait_before_test(1)
step_1_events = get_events(kube_apis.v1,
virtual_server_setup.namespace)
step_1_config = get_vs_nginx_template_conf(
kube_apis.v1, virtual_server_setup.namespace,
virtual_server_setup.vs_name, ic_pod_name,
ingress_controller_prerequisites.namespace)
assert_update_event_count_increased(virtual_server_setup,
step_1_events, initial_list)
assert_ssl_keys(step_1_config)
print("Step 2: update ConfigMap with invalid ssl keys")
replace_configmap_from_yaml(
kube_apis.v1,
ingress_controller_prerequisites.config_map['metadata']['name'],
ingress_controller_prerequisites.namespace,
f"{TEST_DATA}/virtual-server-configmap-keys/configmap-ssl-keys-invalid.yaml"
)
wait_before_test(1)
step_2_events = get_events(kube_apis.v1,
virtual_server_setup.namespace)
step_2_config = get_vs_nginx_template_conf(
kube_apis.v1, virtual_server_setup.namespace,
virtual_server_setup.vs_name, ic_pod_name,
ingress_controller_prerequisites.namespace)
assert_update_event_count_increased(virtual_server_setup,
step_2_events, step_1_events)
assert_defaults_of_ssl_keys(step_2_config)
def test_event_message_and_config(self, kube_apis, ingress_controller_prerequisites,
crd_ingress_controller, v_s_route_setup):
invalid_fields_s = [
"upstreams[0].lb-method", "upstreams[0].fail-timeout",
"upstreams[0].max-fails", "upstreams[0].connect-timeout",
"upstreams[0].read-timeout", "upstreams[0].send-timeout",
"upstreams[0].keepalive", "upstreams[0].max-conns",
"upstreams[0].next-upstream",
"upstreams[0].next-upstream-timeout", "upstreams[0].next-upstream-tries",
"upstreams[0].client-max-body-size",
"upstreams[0].buffers.number", "upstreams[0].buffers.size", "upstreams[0].buffer-size"
]
invalid_fields_m = [
"upstreams[0].lb-method", "upstreams[0].fail-timeout",
"upstreams[0].max-fails", "upstreams[0].connect-timeout",
"upstreams[0].read-timeout", "upstreams[0].send-timeout",
"upstreams[0].keepalive", "upstreams[0].max-conns",
"upstreams[0].next-upstream",
"upstreams[0].next-upstream-timeout", "upstreams[0].next-upstream-tries",
"upstreams[0].client-max-body-size",
"upstreams[0].buffers.number", "upstreams[0].buffers.size", "upstreams[0].buffer-size",
"upstreams[1].lb-method", "upstreams[1].fail-timeout",
"upstreams[1].max-fails", "upstreams[1].connect-timeout",
"upstreams[1].read-timeout", "upstreams[1].send-timeout",
"upstreams[1].keepalive", "upstreams[1].max-conns",
"upstreams[1].next-upstream",
"upstreams[1].next-upstream-timeout", "upstreams[1].next-upstream-tries",
"upstreams[1].client-max-body-size",
"upstreams[1].buffers.number", "upstreams[1].buffers.size", "upstreams[1].buffer-size"
]
text_s = f"{v_s_route_setup.route_s.namespace}/{v_s_route_setup.route_s.name}"
text_m = f"{v_s_route_setup.route_m.namespace}/{v_s_route_setup.route_m.name}"
vsr_s_event_text = f"VirtualServerRoute {text_s} was rejected with error:"
vsr_m_event_text = f"VirtualServerRoute {text_m} was rejected with error:"
patch_v_s_route_from_yaml(kube_apis.custom_objects,
v_s_route_setup.route_s.name,
f"{TEST_DATA}/virtual-server-route-upstream-options/route-single-invalid-keys.yaml",
v_s_route_setup.route_s.namespace)
patch_v_s_route_from_yaml(kube_apis.custom_objects,
v_s_route_setup.route_m.name,
f"{TEST_DATA}/virtual-server-route-upstream-options/route-multiple-invalid-keys.yaml",
v_s_route_setup.route_m.namespace)
wait_before_test(2)
ic_pod_name = get_first_pod_name(kube_apis.v1, ingress_controller_prerequisites.namespace)
config = get_vs_nginx_template_conf(kube_apis.v1,
v_s_route_setup.namespace,
v_s_route_setup.vs_name,
ic_pod_name,
ingress_controller_prerequisites.namespace)
vsr_s_events = get_events(kube_apis.v1, v_s_route_setup.route_s.namespace)
vsr_m_events = get_events(kube_apis.v1, v_s_route_setup.route_m.namespace)
assert_event_starts_with_text_and_contains_errors(vsr_s_event_text, vsr_s_events, invalid_fields_s)
assert_event_starts_with_text_and_contains_errors(vsr_m_event_text, vsr_m_events, invalid_fields_m)
assert "upstream" not in config
def test_openapi_validation_flow(self, kube_apis, ingress_controller_prerequisites,
crd_ingress_controller, virtual_server_setup):
ic_pod_name = get_first_pod_name(kube_apis.v1, ingress_controller_prerequisites.namespace)
invalid_fields = [
"lb-method", "fail-timeout",
"max-fails", "connect-timeout",
"read-timeout", "send-timeout",
"keepalive", "max-conns",
"next-upstream",
"next-upstream-timeout", "next-upstream-tries",
"client-max-body-size",
"buffers.number", "buffers.size", "buffer-size",
"buffering", "tls"
]
config_old = get_vs_nginx_template_conf(kube_apis.v1,
virtual_server_setup.namespace,
virtual_server_setup.vs_name,
ic_pod_name,
ingress_controller_prerequisites.namespace)
vs_file = f"{TEST_DATA}/virtual-server-upstream-options/virtual-server-with-invalid-keys-openapi.yaml"
try:
patch_virtual_server_from_yaml(kube_apis.custom_objects,
virtual_server_setup.vs_name,
vs_file,
virtual_server_setup.namespace)
except ApiException as ex:
assert ex.status == 422
for item in invalid_fields:
assert item in ex.body
except Exception as ex:
pytest.fail(f"An unexpected exception is raised: {ex}")
else:
pytest.fail("Expected an exception but there was none")
wait_before_test(2)
config_new = get_vs_nginx_template_conf(kube_apis.v1,
virtual_server_setup.namespace,
virtual_server_setup.vs_name,
ic_pod_name,
ingress_controller_prerequisites.namespace)
assert config_old == config_new, "Expected: config doesn't change"
def test_config_after_setup(self, kube_apis, ingress_controller_prerequisites, crd_ingress_controller,
backend_setup, virtual_server_setup):
print("\nStep 1: assert config")
ic_pod_name = get_first_pod_name(kube_apis.v1, ingress_controller_prerequisites.namespace)
config = get_vs_nginx_template_conf(kube_apis.v1,
virtual_server_setup.namespace,
virtual_server_setup.vs_name,
ic_pod_name,
ingress_controller_prerequisites.namespace)
assert_grpc_entries_exist(config)
assert_proxy_entries_do_not_exist(config)
def test_tls_redirect_without_tls_termination(self, kube_apis, ingress_controller_prerequisites,
crd_ingress_controller, virtual_server_setup):
source_yaml = f"{TEST_DATA}/virtual-server-tls-redirect/virtual-server-no-tls-termination-redirect.yaml"
patch_virtual_server_from_yaml(kube_apis.custom_objects,
virtual_server_setup.vs_name,
source_yaml,
virtual_server_setup.namespace)
wait_before_test(1)
ic_pod_name = get_first_pod_name(kube_apis.v1, ingress_controller_prerequisites.namespace)
config = get_vs_nginx_template_conf(kube_apis.v1,
virtual_server_setup.namespace,
virtual_server_setup.vs_name,
ic_pod_name,
ingress_controller_prerequisites.namespace)
assert "proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;" in config
resp_1 = requests.get(virtual_server_setup.backend_1_url,
headers={"host": virtual_server_setup.vs_host, "x-forwarded-proto": "http"},
allow_redirects=False)
resp_2 = requests.get(virtual_server_setup.backend_2_url,
headers={"host": virtual_server_setup.vs_host, "x-forwarded-proto": "http"},
allow_redirects=False)
assert resp_1.status_code == 308, "Expected: a redirect for x-forwarded-proto=http"
assert resp_2.status_code == 308, "Expected: a redirect for x-forwarded-proto=http"
resp_3 = requests.get(virtual_server_setup.backend_1_url_ssl,
headers={"host": virtual_server_setup.vs_host, "x-forwarded-proto": "http"},
allow_redirects=False, verify=False)
resp_4 = requests.get(virtual_server_setup.backend_2_url_ssl,
headers={"host": virtual_server_setup.vs_host, "x-forwarded-proto": "http"},
allow_redirects=False, verify=False)
assert resp_3.status_code == 404, "Expected: 404 for x-forwarded-proto=http and scheme=https"
assert resp_4.status_code == 404, "Expected: 404 for x-forwarded-proto=http and scheme=https"
resp_5 = requests.get(virtual_server_setup.backend_1_url,
headers={"host": virtual_server_setup.vs_host, "x-forwarded-proto": "https"},
allow_redirects=False)
resp_6 = requests.get(virtual_server_setup.backend_2_url,
headers={"host": virtual_server_setup.vs_host, "x-forwarded-proto": "https"},
allow_redirects=False)
assert resp_5.status_code == 200, "Expected: no redirect for x-forwarded-proto=https"
assert resp_6.status_code == 200, "Expected: no redirect for x-forwarded-proto=https"
resp_7 = requests.get(virtual_server_setup.backend_1_url_ssl,
headers={"host": virtual_server_setup.vs_host, "x-forwarded-proto": "https"},
allow_redirects=False, verify=False)
resp_8 = requests.get(virtual_server_setup.backend_2_url_ssl,
headers={"host": virtual_server_setup.vs_host, "x-forwarded-proto": "https"},
allow_redirects=False, verify=False)
assert resp_7.status_code == 404, "Expected: no redirect for x-forwarded-proto=https and scheme=https"
assert resp_8.status_code == 404, "Expected: no redirect for x-forwarded-proto=https and scheme=https"
def test_template_config(self, kube_apis, ingress_controller_prerequisites,
crd_ingress_controller,
virtual_server_setup, vs_externalname_setup):
result_conf = get_vs_nginx_template_conf(kube_apis.v1,
virtual_server_setup.namespace,
virtual_server_setup.vs_name,
vs_externalname_setup.ic_pod_name,
ingress_controller_prerequisites.namespace)
line = f"zone vs_{virtual_server_setup.namespace}_{virtual_server_setup.vs_name}_backend1 512k;"
assert line in result_conf
assert "random two least_conn;" in result_conf
assert f"server {vs_externalname_setup.external_host}:80 max_fails=1 fail_timeout=10s max_conns=0 resolve;"\
in result_conf
def test_config_after_enable_tls(self, kube_apis, ingress_controller_prerequisites,
crd_ingress_controller, backend_setup, virtual_server_setup):
ic_pod_name = get_first_pod_name(kube_apis.v1, ingress_controller_prerequisites.namespace)
patch_virtual_server_from_yaml(kube_apis.custom_objects,
virtual_server_setup.vs_name,
f"{TEST_DATA}/virtual-server-grpc/virtual-server-updated.yaml",
virtual_server_setup.namespace)
wait_before_test()
config = get_vs_nginx_template_conf(kube_apis.v1,
virtual_server_setup.namespace,
virtual_server_setup.vs_name,
ic_pod_name,
ingress_controller_prerequisites.namespace)
assert 'grpc_pass grpcs://' in config
def test_v_s_r_overrides_config_map(self, kube_apis,
ingress_controller_prerequisites,
crd_ingress_controller, v_s_route_setup, v_s_route_app_setup, restore_configmap,
options, expected_strings, unexpected_strings):
req_url = f"http://{v_s_route_setup.public_endpoint.public_ip}:{v_s_route_setup.public_endpoint.port}"
text_s = f"{v_s_route_setup.route_s.namespace}/{v_s_route_setup.route_s.name}"
text_m = f"{v_s_route_setup.route_m.namespace}/{v_s_route_setup.route_m.name}"
vsr_s_event_text = f"Configuration for {text_s} was added or updated"
vsr_m_event_text = f"Configuration for {text_m} was added or updated"
events_ns_m = get_events(kube_apis.v1, v_s_route_setup.route_m.namespace)
events_ns_s = get_events(kube_apis.v1, v_s_route_setup.route_s.namespace)
initial_count_vsr_m = assert_event_and_get_count(vsr_m_event_text, events_ns_m)
initial_count_vsr_s = assert_event_and_get_count(vsr_s_event_text, events_ns_s)
print(f"Case 4: key specified in ConfigMap, option specified in VS")
new_body_m = generate_item_with_upstream_options(
f"{TEST_DATA}/virtual-server-route-upstream-options/route-multiple.yaml",
options)
new_body_s = generate_item_with_upstream_options(
f"{TEST_DATA}/virtual-server-route-upstream-options/route-single.yaml",
options)
patch_v_s_route(kube_apis.custom_objects,
v_s_route_setup.route_m.name, v_s_route_setup.route_m.namespace, new_body_m)
patch_v_s_route(kube_apis.custom_objects,
v_s_route_setup.route_s.name, v_s_route_setup.route_s.namespace, new_body_s)
config_map_name = ingress_controller_prerequisites.config_map["metadata"]["name"]
replace_configmap_from_yaml(kube_apis.v1, config_map_name,
ingress_controller_prerequisites.namespace,
f"{TEST_DATA}/virtual-server-route-upstream-options/configmap-with-keys.yaml")
wait_before_test()
ic_pod_name = get_first_pod_name(kube_apis.v1, ingress_controller_prerequisites.namespace)
config = get_vs_nginx_template_conf(kube_apis.v1,
v_s_route_setup.namespace,
v_s_route_setup.vs_name,
ic_pod_name,
ingress_controller_prerequisites.namespace)
resp_1 = requests.get(f"{req_url}{v_s_route_setup.route_m.paths[0]}",
headers={"host": v_s_route_setup.vs_host})
resp_2 = requests.get(f"{req_url}{v_s_route_setup.route_s.paths[0]}",
headers={"host": v_s_route_setup.vs_host})
vsr_s_events = get_events(kube_apis.v1, v_s_route_setup.route_s.namespace)
vsr_m_events = get_events(kube_apis.v1, v_s_route_setup.route_m.namespace)
assert_event_count_increased(vsr_m_event_text, initial_count_vsr_m, vsr_m_events)
assert_event_count_increased(vsr_s_event_text, initial_count_vsr_s, vsr_s_events)
for _ in expected_strings:
assert _ in config
for _ in unexpected_strings:
assert _ not in config
assert_response_codes(resp_1, resp_2)
def test_mixed_config(self, kube_apis, ingress_controller_prerequisites,
crd_ingress_controller, backend_setup,
v_s_route_setup):
patch_v_s_route_from_yaml(
kube_apis.custom_objects, v_s_route_setup.route_m.name,
f"{TEST_DATA}/virtual-server-route-grpc/route-multiple-mixed.yaml",
v_s_route_setup.route_m.namespace)
wait_before_test()
ic_pod_name = get_first_pod_name(
kube_apis.v1, ingress_controller_prerequisites.namespace)
config = get_vs_nginx_template_conf(
kube_apis.v1, v_s_route_setup.namespace, v_s_route_setup.vs_name,
ic_pod_name, ingress_controller_prerequisites.namespace)
assert_proxy_entries_exist(config)
assert_grpc_entries_exist(config)
def test_template_config(self, kube_apis, ingress_controller_prerequisites,
crd_ingress_controller, vsr_externalname_setup):
ic_pod_name = get_first_pod_name(
kube_apis.v1, ingress_controller_prerequisites.namespace)
initial_config = get_vs_nginx_template_conf(
kube_apis.v1, vsr_externalname_setup.namespace,
vsr_externalname_setup.vs_name, ic_pod_name,
ingress_controller_prerequisites.namespace)
line = f"zone vs_{vsr_externalname_setup.namespace}_{vsr_externalname_setup.vs_name}" \
f"_vsr_{vsr_externalname_setup.route.namespace}_{vsr_externalname_setup.route.name}_ext-backend 512k;"
assert line in initial_config
assert "random two least_conn;" in initial_config
assert f"server {vsr_externalname_setup.external_host}:80 max_fails=1 fail_timeout=10s max_conns=0 resolve;"\
in initial_config
def test_responses_and_config_after_disable_tls(
self, kube_apis, ingress_controller_prerequisites,
crd_ingress_controller, v_s_route_setup,
v_s_route_secure_app_setup):
ic_pod_name = get_first_pod_name(
kube_apis.v1, ingress_controller_prerequisites.namespace)
text_s = f"{v_s_route_setup.route_s.namespace}/{v_s_route_setup.route_s.name}"
text_m = f"{v_s_route_setup.route_m.namespace}/{v_s_route_setup.route_m.name}"
text_vs = f"{v_s_route_setup.namespace}/{v_s_route_setup.vs_name}"
vsr_s_event_text = f"Configuration for {text_s} was added or updated"
vsr_m_event_text = f"Configuration for {text_m} was added or updated"
vs_event_text = f"Configuration for {text_vs} was added or updated"
initial_events_ns_m = get_events(kube_apis.v1,
v_s_route_setup.route_m.namespace)
initial_events_ns_s = get_events(kube_apis.v1,
v_s_route_setup.route_s.namespace)
initial_count_vsr_m = assert_event_and_get_count(
vsr_m_event_text, initial_events_ns_m)
initial_count_vsr_s = assert_event_and_get_count(
vsr_s_event_text, initial_events_ns_s)
initial_count_vs = assert_event_and_get_count(vs_event_text,
initial_events_ns_m)
patch_v_s_route_from_yaml(
kube_apis.custom_objects, v_s_route_setup.route_s.name,
f"{TEST_DATA}/virtual-server-route-upstream-tls/route-single-disable-tls.yaml",
v_s_route_setup.route_s.namespace)
wait_before_test(1)
config = get_vs_nginx_template_conf(
kube_apis.v1, v_s_route_setup.namespace, v_s_route_setup.vs_name,
ic_pod_name, ingress_controller_prerequisites.namespace)
req_url = f"http://{v_s_route_setup.public_endpoint.public_ip}:{v_s_route_setup.public_endpoint.port}"
resp_1 = requests.get(f"{req_url}{v_s_route_setup.route_m.paths[0]}",
headers={"host": v_s_route_setup.vs_host})
resp_2 = requests.get(f"{req_url}{v_s_route_setup.route_s.paths[0]}",
headers={"host": v_s_route_setup.vs_host})
new_events_ns_m = get_events(kube_apis.v1,
v_s_route_setup.route_m.namespace)
new_events_ns_s = get_events(kube_apis.v1,
v_s_route_setup.route_s.namespace)
assert 'proxy_pass https://' not in config
assert_response_codes(resp_1, resp_2, 200, 400)
assert_event_count_increased(vsr_m_event_text, initial_count_vsr_m,
new_events_ns_m)
assert_event_count_increased(vs_event_text, initial_count_vs,
new_events_ns_m)
assert_event_count_increased(vsr_s_event_text, initial_count_vsr_s,
new_events_ns_s)
def test_config_after_enable_healthcheck(self, kube_apis, ingress_controller_prerequisites,
crd_ingress_controller, backend_setup, virtual_server_setup):
ic_pod_name = get_first_pod_name(kube_apis.v1, ingress_controller_prerequisites.namespace)
patch_virtual_server_from_yaml(kube_apis.custom_objects,
virtual_server_setup.vs_name,
f"{TEST_DATA}/virtual-server-grpc/virtual-server-healthcheck.yaml",
virtual_server_setup.namespace)
wait_before_test()
config = get_vs_nginx_template_conf(kube_apis.v1,
virtual_server_setup.namespace,
virtual_server_setup.vs_name,
ic_pod_name,
ingress_controller_prerequisites.namespace)
param_list = ["health_check port=50051 interval=1s jitter=2s", "type=grpc grpc_status=12", "grpc_service=helloworld.Greeter;"]
for p in param_list:
assert p in config
def test_config_after_setup(self, kube_apis,
ingress_controller_prerequisites,
crd_ingress_controller, backend_setup,
virtual_server_setup):
print("\nStep 1: assert config")
ic_pod_name = get_first_pod_name(
kube_apis.v1, ingress_controller_prerequisites.namespace)
config = get_vs_nginx_template_conf(
kube_apis.v1, virtual_server_setup.namespace,
virtual_server_setup.vs_name, ic_pod_name,
ingress_controller_prerequisites.namespace)
assert_grpc_entries_exist(config)
assert_proxy_entries_exist(config)
print("\nStep 2: check connection to http backend")
print("\nrequest URL: ", virtual_server_setup.backend_2_url)
resp = requests.get(virtual_server_setup.backend_2_url,
headers={"host": virtual_server_setup.vs_host})
print("Response from http backend: {}".format(resp))
assert resp.status_code == 200
print("\nStep 3: Check connection to app")
cert = get_certificate(virtual_server_setup.public_endpoint.public_ip,
virtual_server_setup.vs_host,
virtual_server_setup.public_endpoint.port_ssl)
target = f'{virtual_server_setup.public_endpoint.public_ip}:{virtual_server_setup.public_endpoint.port_ssl}'
credentials = grpc.ssl_channel_credentials(
root_certificates=cert.encode())
options = (('grpc.ssl_target_name_override',
virtual_server_setup.vs_host), )
with grpc.secure_channel(target, credentials, options) as channel:
stub = GreeterStub(channel)
response = ""
try:
response = stub.SayHello(
HelloRequest(
name=virtual_server_setup.public_endpoint.public_ip))
valid_message = "Hello {}".format(
virtual_server_setup.public_endpoint.public_ip)
assert valid_message in response.message
except grpc.RpcError as e:
print(e.details())
pytest.fail(
"RPC error was not expected during call, exiting...")
def test_responses_and_config_after_setup(self, kube_apis,
ingress_controller_prerequisites,
crd_ingress_controller,
virtual_server_setup):
ic_pod_name = get_first_pod_name(
kube_apis.v1, ingress_controller_prerequisites.namespace)
config = get_vs_nginx_template_conf(
kube_apis.v1, virtual_server_setup.namespace,
virtual_server_setup.vs_name, ic_pod_name,
ingress_controller_prerequisites.namespace)
resp_1 = requests.get(virtual_server_setup.backend_1_url,
headers={"host": virtual_server_setup.vs_host})
resp_2 = requests.get(virtual_server_setup.backend_2_url,
headers={"host": virtual_server_setup.vs_host})
proxy_host = f"vs_{virtual_server_setup.namespace}_{virtual_server_setup.vs_name}"
assert f'proxy_pass https://{proxy_host}_backend1' not in config
assert f'proxy_pass https://{proxy_host}_backend2' in config
assert_response_codes(resp_1, resp_2)
def test_validation_flow(self, kube_apis, ingress_controller_prerequisites,
crd_ingress_controller, v_s_route_setup,
v_s_route_secure_app_setup):
ic_pod_name = get_first_pod_name(
kube_apis.v1, ingress_controller_prerequisites.namespace)
initial_events_ns_m = get_events(kube_apis.v1,
v_s_route_setup.route_m.namespace)
initial_events_ns_s = get_events(kube_apis.v1,
v_s_route_setup.route_s.namespace)
try:
patch_v_s_route_from_yaml(
kube_apis.custom_objects, v_s_route_setup.route_s.name,
f"{TEST_DATA}/virtual-server-route-upstream-tls/route-single-invalid.yaml",
v_s_route_setup.route_s.namespace)
except ApiException as ex:
assert ex.status == 422 and "tls.enable" in ex.body
except Exception as ex:
pytest.fail(f"An unexpected exception is raised: {ex}")
else:
pytest.fail("Expected an exception but there was none")
wait_before_test(1)
config = get_vs_nginx_template_conf(
kube_apis.v1, v_s_route_setup.namespace, v_s_route_setup.vs_name,
ic_pod_name, ingress_controller_prerequisites.namespace)
req_url = f"http://{v_s_route_setup.public_endpoint.public_ip}:{v_s_route_setup.public_endpoint.port}"
resp_1 = requests.get(f"{req_url}{v_s_route_setup.route_m.paths[0]}",
headers={"host": v_s_route_setup.vs_host})
resp_2 = requests.get(f"{req_url}{v_s_route_setup.route_s.paths[0]}",
headers={"host": v_s_route_setup.vs_host})
new_events_ns_m = get_events(kube_apis.v1,
v_s_route_setup.route_m.namespace)
new_events_ns_s = get_events(kube_apis.v1,
v_s_route_setup.route_s.namespace)
vs_line = f"vs_{v_s_route_setup.namespace}_{v_s_route_setup.vs_name}"
proxy_host_s = f"{vs_line}_vsr_{v_s_route_setup.route_s.namespace}_{v_s_route_setup.route_s.name}"
proxy_host_m = f"{vs_line}_vsr_{v_s_route_setup.route_m.namespace}_{v_s_route_setup.route_m.name}"
assert f'proxy_pass https://{proxy_host_m}' not in config
assert f'proxy_pass https://{proxy_host_s}' in config
assert_response_codes(resp_1, resp_2)
assert_no_new_events(initial_events_ns_m, new_events_ns_m)
assert_no_new_events(initial_events_ns_s, new_events_ns_s)
def test_when_option_in_config_map_only(self, kube_apis,
ingress_controller_prerequisites,
crd_ingress_controller,
v_s_route_setup, v_s_route_app_setup, restore_configmap,
config_map_file, expected_strings, unexpected_strings):
req_url = f"http://{v_s_route_setup.public_endpoint.public_ip}:{v_s_route_setup.public_endpoint.port}"
text_s = f"{v_s_route_setup.route_s.namespace}/{v_s_route_setup.route_s.name}"
text_m = f"{v_s_route_setup.route_m.namespace}/{v_s_route_setup.route_m.name}"
vsr_s_event_text = f"Configuration for {text_s} was added or updated"
vsr_m_event_text = f"Configuration for {text_m} was added or updated"
print(f"Case 3: key specified in ConfigMap, no option in VS")
patch_v_s_route_from_yaml(kube_apis.custom_objects, v_s_route_setup.route_m.name,
f"{TEST_DATA}/virtual-server-route-upstream-options/route-multiple.yaml",
v_s_route_setup.route_m.namespace)
patch_v_s_route_from_yaml(kube_apis.custom_objects, v_s_route_setup.route_s.name,
f"{TEST_DATA}/virtual-server-route-upstream-options/route-single.yaml",
v_s_route_setup.route_s.namespace)
config_map_name = ingress_controller_prerequisites.config_map["metadata"]["name"]
replace_configmap_from_yaml(kube_apis.v1, config_map_name,
ingress_controller_prerequisites.namespace,
config_map_file)
wait_before_test()
ic_pod_name = get_first_pod_name(kube_apis.v1, ingress_controller_prerequisites.namespace)
config = get_vs_nginx_template_conf(kube_apis.v1,
v_s_route_setup.namespace,
v_s_route_setup.vs_name,
ic_pod_name,
ingress_controller_prerequisites.namespace)
resp_1 = requests.get(f"{req_url}{v_s_route_setup.route_m.paths[0]}",
headers={"host": v_s_route_setup.vs_host})
resp_2 = requests.get(f"{req_url}{v_s_route_setup.route_s.paths[0]}",
headers={"host": v_s_route_setup.vs_host})
vsr_s_events = get_events(kube_apis.v1, v_s_route_setup.route_s.namespace)
vsr_m_events = get_events(kube_apis.v1, v_s_route_setup.route_m.namespace)
assert_event(vsr_m_event_text, vsr_m_events)
assert_event(vsr_s_event_text, vsr_s_events)
for _ in expected_strings:
assert _ in config
for _ in unexpected_strings:
assert _ not in config
assert_response_codes(resp_1, resp_2)
