add gcpAuthzPolicy CRD

authz/cleanup.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit;
+set -o nounset;
+set -o pipefail;
+set -o xtrace;
+
+source ./test/helper.sh
+test_name="authz-validation"
+context=$(get_context "${test_name}")
+cleanup_gke_basic "${test_name}" "${ZONE}" "${REGION}"

authz/invalid_http_rules.yaml

@@ -0,0 +1,10 @@
+apiVersion: networking.gke.io/v1
+kind: GCPAuthzPolicy
+metadata:
+  name: "test"
+spec:
+  action: ALLOW
+  targetRefs:
+  - kind: Deployment
+    name: test-deploy
+    group: ""

authz/invalid_multiple_providers.yaml

@@ -0,0 +1,22 @@
+apiVersion: networking.gke.io/v1
+kind: GCPAuthzPolicy
+metadata:
+  name: "test"
+spec:
+  action: CUSTOM
+  httpRules:
+  - to:
+      operations:
+      - paths:
+        - type: Exact
+          value: "/"
+  customProviders:
+    cloudIAP: true
+    extensionRefs:
+    - kind: Service
+      name: test
+      group: ""
+  targetRefs:
+  - kind: Deployment
+    name: test-deploy
+    group: ""

authz/invalid_provider_custom.yaml

@@ -0,0 +1,18 @@
+apiVersion: networking.gke.io/v1
+kind: GCPAuthzPolicy
+metadata:
+  name: "test"
+spec:
+  action: CUSTOM
+  httpRules:
+  - to:
+      operations:
+      - paths:
+        - type: Exact
+          value: "/"
+  targetRefs:
+  - kind: Deployment
+    name: test-deploy
+    group: ""
+
+

authz/invalid_providers_deny.yaml

@@ -0,0 +1,18 @@
+apiVersion: networking.gke.io/v1
+kind: GCPAuthzPolicy
+metadata:
+  name: "test"
+spec:
+  action: DENY
+  httpRules:
+  - to:
+      operations:
+      - paths:
+        - type: Exact
+          value: "/"
+  customProviders:
+    cloudIAP: true
+  targetRefs:
+  - kind: Deployment
+    name: test-deploy
+    group: ""

authz/run-test.sh

@@ -0,0 +1,58 @@
+#!/bin/bash
+
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit;
+set -o nounset;
+set -o pipefail;
+set -o xtrace;
+
+source ./test/helper.sh
+test_name="ingress-external-basic"
+context=$(get_context "${test_name}")
+
+if [[ -z "${context}" ]]; then
+    exit 1
+fi
+
+check_cr_validation() {
+    context="$1"
+    path="$2"
+    fail="$3"
+
+    set +e
+    output=$(kubectl validate "${path}" --kube-context "${context}" 2>&1)
+    status=$?
+    set -e
+
+    # Check if the validation passed or failed
+    if [[ "$output" == *"OK"* && "$fail" == "false" ]]; then
+        echo "Validation passed."
+        return 0  # Test passes
+    elif [[ "$output" != *"OK"* && "$fail" == "true" ]]; then
+        echo "Validation failed as expected due to fail condition."
+        return 0  # Test passes because fail is true and we expect validation to fail
+    else
+        echo "Validation failed."
+        return 1  # Test fails
+    fi
+}
+
+
+check_cr_validation "${context}" "./authz/invalid_http_rules.yaml" "true"
+check_cr_validation "${context}" "./authz/invalid_provider_deny.yaml" "true"
+check_cr_validation "${context}" "./authz/invalid_provider_custom.yaml" "true"
+check_cr_validation "${context}" "./authz/invalid_multiple_providers.yaml" "true"
+check_cr_validation "${context}" "./authz/valid.yaml" "false"

authz/setup.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit;
+set -o nounset;
+set -o pipefail;
+set -o xtrace;
+
+source ./test/helper.sh
+test_name="authz-validation"
+setup_gke_basic "${test_name}" "${ZONE}" "${REGION}"
+context=$(get_context "${test_name}")
+
+if [[ -z "${context}" ]]; then
+    exit 1
+fi
+
+kubectl --context "${context}" apply -f gke-networking-recipes/gateway-api/config/mesh/crd/experimental/gcpauthzpolicy.yaml

authz/valid.yaml

@@ -0,0 +1,16 @@
+apiVersion: networking.gke.io/v1
+kind: GCPAuthzPolicy
+metadata:
+  name: "test"
+spec:
+  action: DENY
+  httpRules:
+  - to:
+      operations:
+      - paths:
+        - type: Exact
+          value: "/"
+  targetRefs:
+  - kind: Deployment
+    name: test-deploy
+    group: ""