Skip to content

Commit 265ddf2

Browse files
puertomonttpuertomontt
committed
support auth-secret-type
Signed-off-by: omar <omar.hammami@solo.io>
1 parent d065707 commit 265ddf2

8 files changed

Lines changed: 181 additions & 3 deletions

File tree

‎pkg/i2gw/implementations/kgateway/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,7 @@ The command should generate Gateway API and Kgateway resources.
8484

8585
- `nginx.ingress.kubernetes.io/auth-type`: Must be set to `"basic"` to enable basic authentication. Maps to `TrafficPolicy.spec.basicAuth`.
8686
- `nginx.ingress.kubernetes.io/auth-secret`: Specifies the secret containing basic auth credentials in `namespace/name` format (or just `name` if in the same namespace). Maps to `TrafficPolicy.spec.basicAuth.secretRef.name`.
87+
- `nginx.ingress.kubernetes.io/auth-secret-type`: Specifies the format of the secret. Values: `"auth-file"` (default) or `"auth-map"`. For `"auth-file"`, the secret contains an htpasswd file in the key `"auth"`. For `"auth-map"`, the keys of the secret are usernames and values are hashed passwords. When set to `"auth-file"` (or default), maps to `TrafficPolicy.spec.basicAuth.secretRef.key` set to `"auth"`.
8788

8889
### Backend TLS
8990

‎pkg/i2gw/implementations/kgateway/emitter.go‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -776,6 +776,7 @@ func applyAccessLogPolicy(
776776
//
777777
// Semantics:
778778
// - If BasicAuth is configured, set spec.basicAuth.secretRef.name in TrafficPolicy.
779+
// - If AuthType is "auth-file" (default), also set spec.basicAuth.secretRef.key to "auth".
779780
func applyBasicAuthPolicy(
780781
pol intermediate.Policy,
781782
ingressName, namespace string,
@@ -786,10 +787,15 @@ func applyBasicAuthPolicy(
786787
}
787788

788789
t := ensureTrafficPolicy(tp, ingressName, namespace)
790+
secretRef := &kgateway.SecretReference{
791+
Name: gwv1.ObjectName(pol.BasicAuth.SecretName),
792+
}
793+
// Set Key field to "auth" when AuthType is "auth-file" (default format)
794+
if pol.BasicAuth.AuthType == "auth-file" {
795+
secretRef.Key = ptr.To("auth")
796+
}
789797
t.Spec.BasicAuth = &kgateway.BasicAuthPolicy{
790-
SecretRef: &kgateway.SecretReference{
791-
Name: gwv1.ObjectName(pol.BasicAuth.SecretName),
792-
},
798+
SecretRef: secretRef,
793799
}
794800
return true
795801
}

‎pkg/i2gw/implementations/kgateway/emitter_integration_test.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -242,6 +242,15 @@ func TestKgatewayIngressNginxIntegration_Golden(t *testing.T) {
242242
"pkg", "i2gw", "implementations", "kgateway", "testing", "testdata", "output", "service_upstream.yaml",
243243
),
244244
},
245+
{
246+
name: "basic_auth",
247+
inputRel: filepath.Join(
248+
"pkg", "i2gw", "implementations", "kgateway", "testing", "testdata", "input", "basic_auth.yaml",
249+
),
250+
goldenRel: filepath.Join(
251+
"pkg", "i2gw", "implementations", "kgateway", "testing", "testdata", "output", "basic_auth.yaml",
252+
),
253+
},
245254
}
246255

247256
for _, tt := range tests {

‎pkg/i2gw/implementations/kgateway/testing/testdata/input/basic_auth.yaml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: Ingress
3+
metadata:
4+
annotations:
5+
ingress2gateway.kubernetes.io/implementation: kgateway
6+
nginx.ingress.kubernetes.io/auth-type: "basic"
7+
nginx.ingress.kubernetes.io/auth-secret: "default/basic-auth-secret"
8+
name: ingress-basic-auth-file-default
9+
namespace: default
10+
spec:
11+
ingressClassName: nginx
12+
rules:
13+
- host: app1.example.org
14+
http:
15+
paths:
16+
- backend:
17+
service:
18+
name: app1
19+
port:
20+
number: 80
21+
path: /
22+
pathType: Prefix
23+
---
24+
apiVersion: networking.k8s.io/v1
25+
kind: Ingress
26+
metadata:
27+
annotations:
28+
ingress2gateway.kubernetes.io/implementation: kgateway
29+
nginx.ingress.kubernetes.io/auth-type: "basic"
30+
nginx.ingress.kubernetes.io/auth-secret: "default/basic-auth-secret"
31+
nginx.ingress.kubernetes.io/auth-secret-type: "auth-file"
32+
name: ingress-basic-auth-file-explicit
33+
namespace: default
34+
spec:
35+
ingressClassName: nginx
36+
rules:
37+
- host: app2.example.org
38+
http:
39+
paths:
40+
- backend:
41+
service:
42+
name: app2
43+
port:
44+
number: 80
45+
path: /
46+
pathType: Prefix
47+
---

‎pkg/i2gw/implementations/kgateway/testing/testdata/output/basic_auth.yaml‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
apiVersion: gateway.networking.k8s.io/v1
2+
kind: Gateway
3+
metadata:
4+
annotations:
5+
gateway.networking.k8s.io/generator: ingress2gateway-dev
6+
name: nginx
7+
namespace: default
8+
spec:
9+
gatewayClassName: kgateway
10+
listeners:
11+
- hostname: app1.example.org
12+
name: app1-example-org-http
13+
port: 80
14+
protocol: HTTP
15+
- hostname: app2.example.org
16+
name: app2-example-org-http
17+
port: 80
18+
protocol: HTTP
19+
status: {}
20+
---
21+
apiVersion: gateway.networking.k8s.io/v1
22+
kind: HTTPRoute
23+
metadata:
24+
annotations:
25+
gateway.networking.k8s.io/generator: ingress2gateway-dev
26+
name: ingress-basic-auth-file-default-app1-example-org
27+
namespace: default
28+
spec:
29+
hostnames:
30+
- app1.example.org
31+
parentRefs:
32+
- name: nginx
33+
rules:
34+
- backendRefs:
35+
- name: app1
36+
port: 80
37+
matches:
38+
- path:
39+
type: PathPrefix
40+
value: /
41+
status:
42+
parents: []
43+
---
44+
apiVersion: gateway.networking.k8s.io/v1
45+
kind: HTTPRoute
46+
metadata:
47+
annotations:
48+
gateway.networking.k8s.io/generator: ingress2gateway-dev
49+
name: ingress-basic-auth-file-explicit-app2-example-org
50+
namespace: default
51+
spec:
52+
hostnames:
53+
- app2.example.org
54+
parentRefs:
55+
- name: nginx
56+
rules:
57+
- backendRefs:
58+
- name: app2
59+
port: 80
60+
matches:
61+
- path:
62+
type: PathPrefix
63+
value: /
64+
status:
65+
parents: []
66+
---
67+
apiVersion: gateway.kgateway.dev/v1alpha1
68+
kind: TrafficPolicy
69+
metadata:
70+
name: ingress-basic-auth-file-default
71+
namespace: default
72+
spec:
73+
basicAuth:
74+
secretRef:
75+
key: auth
76+
name: basic-auth-secret
77+
targetRefs:
78+
- group: gateway.networking.k8s.io
79+
kind: HTTPRoute
80+
name: ingress-basic-auth-file-default-app1-example-org
81+
status:
82+
ancestors: null
83+
---
84+
apiVersion: gateway.kgateway.dev/v1alpha1
85+
kind: TrafficPolicy
86+
metadata:
87+
name: ingress-basic-auth-file-explicit
88+
namespace: default
89+
spec:
90+
basicAuth:
91+
secretRef:
92+
key: auth
93+
name: basic-auth-secret
94+
targetRefs:
95+
- group: gateway.networking.k8s.io
96+
kind: HTTPRoute
97+
name: ingress-basic-auth-file-explicit-app2-example-org
98+
status:
99+
ancestors: null

‎pkg/i2gw/intermediate/provider_ingressnginx.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,10 @@ type ExtAuthPolicy struct {
8484
type BasicAuthPolicy struct {
8585
// SecretName defines the name of the secret containing basic auth credentials.
8686
SecretName string
87+
// AuthType defines the format of the secret: "auth-file" (default) or "auth-map".
88+
// For "auth-file", the secret contains an htpasswd file in a specific key.
89+
// For "auth-map", the keys of the secret are usernames and values are hashed passwords.
90+
AuthType string
8791
}
8892

8993
// SessionAffinityPolicy defines a session affinity policy that has been extracted from ingress-nginx annotations.

‎pkg/i2gw/providers/ingressnginx/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@ The ingress-nginx provider currently supports translating the following annotati
7878

7979
- `nginx.ingress.kubernetes.io/auth-type`: Must be set to `"basic"` to enable basic authentication. For the Kgateway implementation, this maps to `TrafficPolicy.spec.basicAuth`.
8080
- `nginx.ingress.kubernetes.io/auth-secret`: Specifies the secret containing basic auth credentials in `namespace/name` format (or just `name` if in the same namespace). For the Kgateway implementation, this maps to `TrafficPolicy.spec.basicAuth.secretRef.name`.
81+
- `nginx.ingress.kubernetes.io/auth-secret-type`: Specifies the format of the secret. Values: `"auth-file"` (default) or `"auth-map"`. For `"auth-file"`, the secret contains an htpasswd file in the key `"auth"`. For `"auth-map"`, the keys of the secret are usernames and values are hashed passwords. For the Kgateway implementation, when set to `"auth-file"` (or default), this maps to `TrafficPolicy.spec.basicAuth.secretRef.key` set to `"auth"`.
8182

8283
---
8384

‎pkg/i2gw/providers/ingressnginx/external_auth.go‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ const (
3232
authResponseHeadersAnnotation = "nginx.ingress.kubernetes.io/auth-response-headers"
3333
authTypeAnnotation = "nginx.ingress.kubernetes.io/auth-type"
3434
authSecretAnnotation = "nginx.ingress.kubernetes.io/auth-secret"
35+
authSecretTypeAnnotation = "nginx.ingress.kubernetes.io/auth-secret-type"
3536
)
3637

3738
// extAuthFeature extracts the "auth-url" and "auth-response-headers" annotations and
@@ -167,6 +168,7 @@ func basicAuthFeature(
167168
ing := &ingresses[i]
168169
authTypeRaw := strings.TrimSpace(ing.Annotations[authTypeAnnotation])
169170
authSecretRaw := strings.TrimSpace(ing.Annotations[authSecretAnnotation])
171+
authSecretTypeRaw := strings.TrimSpace(ing.Annotations[authSecretTypeAnnotation])
170172

171173
// Only process if auth-type is "basic" and auth-secret is present
172174
if authTypeRaw != "basic" || authSecretRaw == "" {
@@ -191,8 +193,17 @@ func basicAuthFeature(
191193
}
192194
}
193195

196+
// Determine auth type based on auth-secret-type annotation
197+
// auth-file (default): htpasswd file in key "auth"
198+
// auth-map: keys are usernames, values are hashed passwords
199+
authType := authSecretTypeRaw
200+
if authType == "" {
201+
authType = "auth-file" // default
202+
}
203+
194204
pol.BasicAuth = &intermediate.BasicAuthPolicy{
195205
SecretName: secretName,
206+
AuthType: authType,
196207
}
197208
}
198209

0 commit comments

Comments
 (0)