@@ -2,6 +2,8 @@ package ingress
22
33import (
44 "context"
5+ awssdk "github.com/aws/aws-sdk-go-v2/aws"
6+ "github.com/aws/aws-sdk-go/aws"
57 "testing"
68
79 "github.com/stretchr/testify/assert"
@@ -54,7 +56,6 @@ func Test_computeIngressListenPortConfigByPort_MutualAuthentication(t *testing.T
5456 },
5557 want : []WantStruct {{port : 443 , mutualAuth : & (elbv2.MutualAuthenticationAttributes {Mode : "off" , TrustStoreArn : nil , IgnoreClientCertificateExpiry : nil })}, {port : 80 , mutualAuth : & (elbv2.MutualAuthenticationAttributes {Mode : "passthrough" , TrustStoreArn : nil , IgnoreClientCertificateExpiry : nil })}},
5658 },
57-
5859 {
5960
6061 name : "Listener Config when MutualAuthentication annotation is not specified" ,
@@ -79,6 +80,54 @@ func Test_computeIngressListenPortConfigByPort_MutualAuthentication(t *testing.T
7980 },
8081 want : []WantStruct {{port : 443 , mutualAuth : nil }, {port : 80 , mutualAuth : nil }},
8182 },
83+ {
84+ name : "Listener Config when MutualAuthentication annotation is specified with advertise trust store CA not set" ,
85+ fields : fields {
86+ ingGroup : Group {
87+ ID : GroupID {Name : "explicit-group" },
88+ Members : []ClassifiedIngress {
89+ {
90+ Ing : & networking.Ingress {
91+ ObjectMeta : metav1.ObjectMeta {
92+ Namespace : "awesome-ns" ,
93+ Name : "ing-1" ,
94+ Annotations : map [string ]string {
95+ "alb.ingress.kubernetes.io/listen-ports" : `[{"HTTPS": 443}, {"HTTPS": 80}]` ,
96+ "alb.ingress.kubernetes.io/mutual-authentication" : `[{"port":443,"mode":"off"}, {"port":80,"mode":"passthrough"}]` ,
97+ "alb.ingress.kubernetes.io/certificate-arn" : "arn:aws:iam::123456789:server-certificate/new-clb-cert" ,
98+ },
99+ },
100+ },
101+ },
102+ },
103+ },
104+ },
105+ want : []WantStruct {{port : 443 , mutualAuth : & (elbv2.MutualAuthenticationAttributes {Mode : "off" , TrustStoreArn : nil , IgnoreClientCertificateExpiry : nil })}, {port : 80 , mutualAuth : & (elbv2.MutualAuthenticationAttributes {Mode : "passthrough" , TrustStoreArn : nil , IgnoreClientCertificateExpiry : nil })}},
106+ },
107+ {
108+ name : "Listener Config when MutualAuthentication annotation is specified with advertise trust store CA set" ,
109+ fields : fields {
110+ ingGroup : Group {
111+ ID : GroupID {Name : "explicit-group" },
112+ Members : []ClassifiedIngress {
113+ {
114+ Ing : & networking.Ingress {
115+ ObjectMeta : metav1.ObjectMeta {
116+ Namespace : "awesome-ns" ,
117+ Name : "ing-1" ,
118+ Annotations : map [string ]string {
119+ "alb.ingress.kubernetes.io/listen-ports" : `[{"HTTPS": 443}, {"HTTPS": 80}]` ,
120+ "alb.ingress.kubernetes.io/mutual-authentication" : `[{"port":443,"mode":"off"}, {"port":80,"mode":"verify", "advertiseTrustStoreCaNames": "on", "trustStore": "arn:aws:elasticloadbalancing:trustStoreArn"}]` ,
121+ "alb.ingress.kubernetes.io/certificate-arn" : "arn:aws:iam::123456789:server-certificate/new-clb-cert" ,
122+ },
123+ },
124+ },
125+ },
126+ },
127+ },
128+ },
129+ want : []WantStruct {{port : 443 , mutualAuth : & (elbv2.MutualAuthenticationAttributes {Mode : "off" , TrustStoreArn : nil , IgnoreClientCertificateExpiry : nil })}, {port : 80 , mutualAuth : & (elbv2.MutualAuthenticationAttributes {Mode : "verify" , TrustStoreArn : awssdk .String ("arn:aws:elasticloadbalancing:trustStoreArn" ), AdvertiseTrustStoreCaNames : awssdk .String ("on" ), IgnoreClientCertificateExpiry : nil })}},
130+ },
82131 }
83132 for _ , tt := range tests {
84133 t .Run (tt .name , func (t * testing.T ) {
@@ -96,6 +145,11 @@ func Test_computeIngressListenPortConfigByPort_MutualAuthentication(t *testing.T
96145 mutualAuth := tt .want [i ].mutualAuth
97146 if mutualAuth != nil {
98147 assert .Equal (t , mutualAuth .Mode , got [port ].mutualAuthentication .Mode )
148+
149+ if mutualAuth .AdvertiseTrustStoreCaNames != nil {
150+ assert .Equal (t , * mutualAuth .AdvertiseTrustStoreCaNames , * got [port ].mutualAuthentication .AdvertiseTrustStoreCaNames )
151+ }
152+
99153 } else {
100154 assert .Equal (t , mutualAuth , got [port ].mutualAuthentication )
101155 }
@@ -376,3 +430,139 @@ func Test_buildListenerAttributes(t *testing.T) {
376430 })
377431 }
378432}
433+
434+ func Test_validateMutualAuthenticationConfig (t * testing.T ) {
435+ tests := []struct {
436+ name string
437+ port int32
438+ mode string
439+ trustStoreARN string
440+ ignoreClientCert * bool
441+ advertiseCANames * string
442+ expectedErrorMessage * string
443+ }{
444+ {
445+ name : "happy path no validation error off mode" ,
446+ port : 800 ,
447+ mode : string (elbv2model .MutualAuthenticationOffMode ),
448+ },
449+ {
450+ name : "happy path no validation error pass through mode" ,
451+ port : 800 ,
452+ mode : string (elbv2model .MutualAuthenticationPassthroughMode ),
453+ },
454+ {
455+ name : "happy path no validation error verify mode" ,
456+ port : 800 ,
457+ mode : string (elbv2model .MutualAuthenticationVerifyMode ),
458+ trustStoreARN : "truststore" ,
459+ },
460+ {
461+ name : "happy path no validation error verify mode, with ignore client cert expiry" ,
462+ port : 800 ,
463+ mode : string (elbv2model .MutualAuthenticationVerifyMode ),
464+ trustStoreARN : "truststore" ,
465+ ignoreClientCert : aws .Bool (true ),
466+ },
467+ {
468+ name : "happy path no validation error verify mode, with ignore client cert expiry false" ,
469+ port : 800 ,
470+ mode : string (elbv2model .MutualAuthenticationVerifyMode ),
471+ trustStoreARN : "truststore" ,
472+ ignoreClientCert : aws .Bool (false ),
473+ },
474+ {
475+ name : "happy path no validation error verify mode, with advertise ca on" ,
476+ port : 800 ,
477+ mode : string (elbv2model .MutualAuthenticationVerifyMode ),
478+ trustStoreARN : "truststore" ,
479+ advertiseCANames : aws .String ("on" ),
480+ },
481+ {
482+ name : "happy path no validation error verify mode, with advertise ca off" ,
483+ port : 800 ,
484+ mode : string (elbv2model .MutualAuthenticationVerifyMode ),
485+ trustStoreARN : "truststore" ,
486+ advertiseCANames : aws .String ("off" ),
487+ },
488+ {
489+ name : "no mode" ,
490+ port : 800 ,
491+ expectedErrorMessage : awssdk .String ("mutualAuthentication mode cannot be empty for port 800" ),
492+ },
493+ {
494+ name : "unknown mode" ,
495+ port : 800 ,
496+ mode : "foo" ,
497+ expectedErrorMessage : awssdk .String ("mutualAuthentication mode value must be among" ),
498+ },
499+ {
500+ name : "port invalid" ,
501+ port : 800000 ,
502+ mode : string (elbv2model .MutualAuthenticationOffMode ),
503+ expectedErrorMessage : awssdk .String ("listen port must be within [1, 65535]: 800000" ),
504+ },
505+ {
506+ name : "missing truststore arn for verify" ,
507+ port : 800 ,
508+ mode : string (elbv2model .MutualAuthenticationVerifyMode ),
509+ expectedErrorMessage : awssdk .String ("trustStore is required when mutualAuthentication mode is verify for port 800" ),
510+ },
511+ {
512+ name : "truststore arn set but mode not verify" ,
513+ port : 800 ,
514+ mode : string (elbv2model .MutualAuthenticationOffMode ),
515+ trustStoreARN : "truststore" ,
516+ expectedErrorMessage : awssdk .String ("Mutual Authentication mode off does not support trustStore for port 800" ),
517+ },
518+ {
519+ name : "ignore client cert expiry set for off mode" ,
520+ port : 800 ,
521+ mode : string (elbv2model .MutualAuthenticationOffMode ),
522+ ignoreClientCert : awssdk .Bool (true ),
523+ expectedErrorMessage : awssdk .String ("Mutual Authentication mode off does not support ignoring client certificate expiry for port 800" ),
524+ },
525+ {
526+ name : "ignore client cert expiry set for passthrough mode" ,
527+ port : 800 ,
528+ mode : string (elbv2model .MutualAuthenticationPassthroughMode ),
529+ ignoreClientCert : awssdk .Bool (true ),
530+ expectedErrorMessage : awssdk .String ("Mutual Authentication mode passthrough does not support ignoring client certificate expiry for port 800" ),
531+ },
532+ {
533+ name : "advertise ca set for off mode" ,
534+ port : 800 ,
535+ mode : string (elbv2model .MutualAuthenticationOffMode ),
536+ advertiseCANames : awssdk .String ("on" ),
537+ expectedErrorMessage : awssdk .String ("Authentication mode off does not support advertiseTrustStoreCaNames for port 800" ),
538+ },
539+ {
540+ name : "advertise ca set for passthrough mode" ,
541+ port : 800 ,
542+ mode : string (elbv2model .MutualAuthenticationPassthroughMode ),
543+ advertiseCANames : awssdk .String ("on" ),
544+ expectedErrorMessage : awssdk .String ("Authentication mode passthrough does not support advertiseTrustStoreCaNames for port 800" ),
545+ },
546+ {
547+ name : "advertise ca set with invalid value" ,
548+ port : 800 ,
549+ mode : string (elbv2model .MutualAuthenticationVerifyMode ),
550+ trustStoreARN : "truststore" ,
551+ advertiseCANames : awssdk .String ("foo" ),
552+ expectedErrorMessage : awssdk .String ("advertiseTrustStoreCaNames only supports the values \" on\" and \" off\" got value foo for port 800" ),
553+ },
554+ }
555+
556+ for _ , tt := range tests {
557+ t .Run (tt .name , func (t * testing.T ) {
558+ task := & defaultModelBuildTask {}
559+ res := task .validateMutualAuthenticationConfig (tt .port , tt .mode , tt .trustStoreARN , tt .ignoreClientCert , tt .advertiseCANames )
560+
561+ if tt .expectedErrorMessage == nil {
562+ assert .Nil (t , res )
563+ } else {
564+ assert .Contains (t , res .Error (), * tt .expectedErrorMessage )
565+ }
566+ })
567+ }
568+ }
0 commit comments