Skip to content

Commit 292a968

Browse files
danehansdanehans
authored
Merge pull request #17 from puertomontt/tls
support auth-secret-type
2 parents d065707 + 5ed18d4 commit 292a968

10 files changed

Lines changed: 279 additions & 39 deletions

File tree

‎pkg/i2gw/implementations/kgateway/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,7 @@ The command should generate Gateway API and Kgateway resources.
8484

8585
- `nginx.ingress.kubernetes.io/auth-type`: Must be set to `"basic"` to enable basic authentication. Maps to `TrafficPolicy.spec.basicAuth`.
8686
- `nginx.ingress.kubernetes.io/auth-secret`: Specifies the secret containing basic auth credentials in `namespace/name` format (or just `name` if in the same namespace). Maps to `TrafficPolicy.spec.basicAuth.secretRef.name`.
87+
- `nginx.ingress.kubernetes.io/auth-secret-type`: Specifies the format of the secret. Values: `"auth-file"` (default) or `"auth-map"`. For `"auth-file"`, the secret contains an htpasswd file in the key `"auth"`. For `"auth-map"`, the keys of the secret are usernames and values are hashed passwords. When set to `"auth-file"` (or default), maps to `TrafficPolicy.spec.basicAuth.secretRef.key` set to `"auth"`.
8788

8889
### Backend TLS
8990

‎pkg/i2gw/implementations/kgateway/emitter.go‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -776,6 +776,7 @@ func applyAccessLogPolicy(
776776
//
777777
// Semantics:
778778
// - If BasicAuth is configured, set spec.basicAuth.secretRef.name in TrafficPolicy.
779+
// - If AuthType is "auth-file" (default), also set spec.basicAuth.secretRef.key to "auth".
779780
func applyBasicAuthPolicy(
780781
pol intermediate.Policy,
781782
ingressName, namespace string,
@@ -786,10 +787,15 @@ func applyBasicAuthPolicy(
786787
}
787788

788789
t := ensureTrafficPolicy(tp, ingressName, namespace)
790+
secretRef := &kgateway.SecretReference{
791+
Name: gwv1.ObjectName(pol.BasicAuth.SecretName),
792+
}
793+
// Set Key field to "auth" when AuthType is "auth-file" (default format)
794+
if pol.BasicAuth.AuthType == "auth-file" {
795+
secretRef.Key = ptr.To("auth")
796+
}
789797
t.Spec.BasicAuth = &kgateway.BasicAuthPolicy{
790-
SecretRef: &kgateway.SecretReference{
791-
Name: gwv1.ObjectName(pol.BasicAuth.SecretName),
792-
},
798+
SecretRef: secretRef,
793799
}
794800
return true
795801
}

‎pkg/i2gw/implementations/kgateway/emitter_integration_test.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -242,6 +242,15 @@ func TestKgatewayIngressNginxIntegration_Golden(t *testing.T) {
242242
"pkg", "i2gw", "implementations", "kgateway", "testing", "testdata", "output", "service_upstream.yaml",
243243
),
244244
},
245+
{
246+
name: "basic_auth",
247+
inputRel: filepath.Join(
248+
"pkg", "i2gw", "implementations", "kgateway", "testing", "testdata", "input", "basic_auth.yaml",
249+
),
250+
goldenRel: filepath.Join(
251+
"pkg", "i2gw", "implementations", "kgateway", "testing", "testdata", "output", "basic_auth.yaml",
252+
),
253+
},
245254
}
246255

247256
for _, tt := range tests {

‎pkg/i2gw/implementations/kgateway/testing/testdata/input/basic_auth.yaml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: Ingress
3+
metadata:
4+
annotations:
5+
ingress2gateway.kubernetes.io/implementation: kgateway
6+
nginx.ingress.kubernetes.io/auth-type: "basic"
7+
nginx.ingress.kubernetes.io/auth-secret: "default/basic-auth-secret"
8+
name: ingress-basic-auth-file-default
9+
namespace: default
10+
spec:
11+
ingressClassName: nginx
12+
rules:
13+
- host: app1.example.org
14+
http:
15+
paths:
16+
- backend:
17+
service:
18+
name: app1
19+
port:
20+
number: 80
21+
path: /
22+
pathType: Prefix
23+
---
24+
apiVersion: networking.k8s.io/v1
25+
kind: Ingress
26+
metadata:
27+
annotations:
28+
ingress2gateway.kubernetes.io/implementation: kgateway
29+
nginx.ingress.kubernetes.io/auth-type: "basic"
30+
nginx.ingress.kubernetes.io/auth-secret: "default/basic-auth-secret"
31+
nginx.ingress.kubernetes.io/auth-secret-type: "auth-file"
32+
name: ingress-basic-auth-file-explicit
33+
namespace: default
34+
spec:
35+
ingressClassName: nginx
36+
rules:
37+
- host: app2.example.org
38+
http:
39+
paths:
40+
- backend:
41+
service:
42+
name: app2
43+
port:
44+
number: 80
45+
path: /
46+
pathType: Prefix
47+
---
48+
apiVersion: networking.k8s.io/v1
49+
kind: Ingress
50+
metadata:
51+
annotations:
52+
ingress2gateway.kubernetes.io/implementation: kgateway
53+
nginx.ingress.kubernetes.io/auth-type: "basic"
54+
nginx.ingress.kubernetes.io/auth-secret: "auth-map-secret"
55+
nginx.ingress.kubernetes.io/auth-secret-type: "auth-map"
56+
name: ingress-basic-auth-map
57+
namespace: default
58+
spec:
59+
ingressClassName: nginx
60+
rules:
61+
- host: app3.example.org
62+
http:
63+
paths:
64+
- backend:
65+
service:
66+
name: app3
67+
port:
68+
number: 80
69+
path: /
70+
pathType: Prefix
71+

‎pkg/i2gw/implementations/kgateway/testing/testdata/input/golden.yaml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -63,8 +63,6 @@ metadata:
6363
nginx.ingress.kubernetes.io/proxy-send-timeout: "90s"
6464
nginx.ingress.kubernetes.io/proxy-read-timeout: "90s"
6565
nginx.ingress.kubernetes.io/proxy-connect-timeout: "120"
66-
nginx.ingress.kubernetes.io/auth-type: "basic"
67-
nginx.ingress.kubernetes.io/auth-secret: "default/basic-auth-secret"
6866
name: ingress-myserviceb
6967
namespace: default
7068
spec:

‎pkg/i2gw/implementations/kgateway/testing/testdata/output/basic_auth.yaml‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
apiVersion: gateway.networking.k8s.io/v1
2+
kind: Gateway
3+
metadata:
4+
annotations:
5+
gateway.networking.k8s.io/generator: ingress2gateway-dev
6+
name: nginx
7+
namespace: default
8+
spec:
9+
gatewayClassName: kgateway
10+
listeners:
11+
- hostname: app1.example.org
12+
name: app1-example-org-http
13+
port: 80
14+
protocol: HTTP
15+
- hostname: app2.example.org
16+
name: app2-example-org-http
17+
port: 80
18+
protocol: HTTP
19+
- hostname: app3.example.org
20+
name: app3-example-org-http
21+
port: 80
22+
protocol: HTTP
23+
status: {}
24+
---
25+
apiVersion: gateway.networking.k8s.io/v1
26+
kind: HTTPRoute
27+
metadata:
28+
annotations:
29+
gateway.networking.k8s.io/generator: ingress2gateway-dev
30+
name: ingress-basic-auth-file-default-app1-example-org
31+
namespace: default
32+
spec:
33+
hostnames:
34+
- app1.example.org
35+
parentRefs:
36+
- name: nginx
37+
rules:
38+
- backendRefs:
39+
- name: app1
40+
port: 80
41+
matches:
42+
- path:
43+
type: PathPrefix
44+
value: /
45+
status:
46+
parents: []
47+
---
48+
apiVersion: gateway.networking.k8s.io/v1
49+
kind: HTTPRoute
50+
metadata:
51+
annotations:
52+
gateway.networking.k8s.io/generator: ingress2gateway-dev
53+
name: ingress-basic-auth-file-explicit-app2-example-org
54+
namespace: default
55+
spec:
56+
hostnames:
57+
- app2.example.org
58+
parentRefs:
59+
- name: nginx
60+
rules:
61+
- backendRefs:
62+
- name: app2
63+
port: 80
64+
matches:
65+
- path:
66+
type: PathPrefix
67+
value: /
68+
status:
69+
parents: []
70+
---
71+
apiVersion: gateway.networking.k8s.io/v1
72+
kind: HTTPRoute
73+
metadata:
74+
annotations:
75+
gateway.networking.k8s.io/generator: ingress2gateway-dev
76+
name: ingress-basic-auth-map-app3-example-org
77+
namespace: default
78+
spec:
79+
hostnames:
80+
- app3.example.org
81+
parentRefs:
82+
- name: nginx
83+
rules:
84+
- backendRefs:
85+
- name: app3
86+
port: 80
87+
matches:
88+
- path:
89+
type: PathPrefix
90+
value: /
91+
status:
92+
parents: []
93+
---
94+
apiVersion: gateway.kgateway.dev/v1alpha1
95+
kind: TrafficPolicy
96+
metadata:
97+
name: ingress-basic-auth-file-default
98+
namespace: default
99+
spec:
100+
basicAuth:
101+
secretRef:
102+
key: auth
103+
name: basic-auth-secret
104+
targetRefs:
105+
- group: gateway.networking.k8s.io
106+
kind: HTTPRoute
107+
name: ingress-basic-auth-file-default-app1-example-org
108+
status:
109+
ancestors: null
110+
---
111+
apiVersion: gateway.kgateway.dev/v1alpha1
112+
kind: TrafficPolicy
113+
metadata:
114+
name: ingress-basic-auth-file-explicit
115+
namespace: default
116+
spec:
117+
basicAuth:
118+
secretRef:
119+
key: auth
120+
name: basic-auth-secret
121+
targetRefs:
122+
- group: gateway.networking.k8s.io
123+
kind: HTTPRoute
124+
name: ingress-basic-auth-file-explicit-app2-example-org
125+
status:
126+
ancestors: null
127+
---
128+
apiVersion: gateway.kgateway.dev/v1alpha1
129+
kind: TrafficPolicy
130+
metadata:
131+
name: ingress-basic-auth-map
132+
namespace: default
133+
spec:
134+
basicAuth:
135+
secretRef:
136+
name: auth-map-secret
137+
targetRefs:
138+
- group: gateway.networking.k8s.io
139+
kind: HTTPRoute
140+
name: ingress-basic-auth-map-app3-example-org
141+
status:
142+
ancestors: null

0 commit comments

Comments
 (0)