jiazhizhong/higress
1
0
Fork 0
mirror of https://github.com/alibaba/higress.git synced 2026-03-20 02:07:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: wasm support opa (Open Policy Agent) (#760)

Browse Source
This commit is contained in:
baerwang
2024-01-30 15:29:51 +08:00
committed by GitHub
parent e67ed481cf
commit 612c94dd8a
16 changed files with 717 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

73
test/e2e/conformance/base/opa.yaml Normal file
View File

@@ -0,0 +1,73 @@
# Copyright (c) 2022 Alibaba Group Holding Ltd.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: apps/v1
kind: Deployment
metadata:
name: opa
namespace: higress-conformance-app-backend
spec:
replicas: 1
selector:
matchLabels:
app: opa
template:
metadata:
labels:
app: opa
spec:
containers:
- name: opa
image: openpolicyagent/opa:latest
ports:
- containerPort: 8181
command: [ "opa", "run", "-s" ]
---
apiVersion: v1
kind: Service
metadata:
name: opa
namespace: higress-conformance-app-backend
spec:
selector:
app: opa
ports:
- protocol: TCP
port: 8181
targetPort: 8181
type: ClusterIP
---
apiVersion: v1
kind: Pod
metadata:
name: curl-opa
namespace: higress-conformance-app-backend
spec:
containers:
- name: opa-test
image: curlimages/curl:latest
command:
- sh
- -c
- |
curl -X PUT 'http://opa:8181/v1/policies/example1' \
-H 'Content-Type: text/plain' \
-d 'package example1
import input.request
default allow = false
allow {
# HTTP method must GET
request.method == "GET"
}'
restartPolicy: OnFailure

83
test/e2e/conformance/tests/go-wasm-opa.go Normal file
View File

@@ -0,0 +1,83 @@
// Copyright (c) 2022 Alibaba Group Holding Ltd.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package tests
import (
stdHttp "net/http"
"testing"
"github.com/alibaba/higress/test/e2e/conformance/utils/http"
"github.com/alibaba/higress/test/e2e/conformance/utils/suite"
)
func init() {
Register(WasmPluginsOpa)
}
var WasmPluginsOpa = suite.ConformanceTest{
ShortName: "WasmPluginsOpa",
Description: "The Ingress in the higress-conformance-infra namespace test the opa wasm plugins.",
Manifests: []string{"tests/go-wasm-opa.yaml"},
Features: []suite.SupportedFeature{suite.WASMGoConformanceFeature},
Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
testcases := []http.Assertion{
{
Meta: http.AssertionMeta{
TargetBackend: "infra-backend-v1",
TargetNamespace: "higress-conformance-infra",
},
Request: http.AssertionRequest{
ActualRequest: http.Request{
Method: "GET",
Host: "foo.com",
Path: "/",
UnfollowRedirect: true,
},
},
Response: http.AssertionResponse{
ExpectedResponse: http.Response{
StatusCode: stdHttp.StatusOK,
},
},
},
{
Meta: http.AssertionMeta{
TargetBackend: "infra-backend-v1",
TargetNamespace: "higress-conformance-infra",
CompareTarget: http.CompareTargetResponse,
},
Request: http.AssertionRequest{
ActualRequest: http.Request{
Method: "POST",
Host: "foo.com",
Path: "/",
UnfollowRedirect: true,
},
},
Response: http.AssertionResponse{
ExpectedResponse: http.Response{
StatusCode: stdHttp.StatusUnauthorized,
Body: []byte("opa server not allowed"),
},
},
},
}
t.Run("WasmPlugins opa", func(t *testing.T) {
for _, testcase := range testcases {
http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, suite.GatewayAddress, testcase)
}
})
},
}

48
test/e2e/conformance/tests/go-wasm-opa.yaml Normal file
View File

@@ -0,0 +1,48 @@
# Copyright (c) 2022 Alibaba Group Holding Ltd.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
name: wasmplugin-opa
namespace: higress-conformance-infra
spec:
ingressClassName: higress
rules:
- host: "foo.com"
http:
paths:
- pathType: Prefix
path: "/"
backend:
service:
name: infra-backend-v1
port:
number: 8080
---
apiVersion: extensions.higress.io/v1alpha1
kind: WasmPlugin
metadata:
name: opa
namespace: higress-system
spec:
defaultConfig:
serviceSource: k8s
namespace: higress-conformance-app-backend
serviceName: opa
servicePort: 8181
policy: example1
timeout: 5s
url: file:///opt/plugins/wasm-go/extensions/opa/plugin.wasm

15
test/e2e/conformance/utils/http/http.go
View File

@@ -20,6 +20,7 @@ import (
"io"
"mime"
"mime/multipart"
"net/http"
"net/url"
"reflect"
"strings"
@@ -205,7 +206,7 @@ func MakeRequestAndExpectEventuallyConsistentResponse(t *testing.T, r roundtripp
expected.Request.ActualRequest.Method = strings.ToUpper(expected.Request.ActualRequest.Method)
if expected.Response.ExpectedResponse.StatusCode == 0 {
expected.Response.ExpectedResponse.StatusCode = 200
expected.Response.ExpectedResponse.StatusCode = http.StatusOK
}
t.Logf("Making %s request to %s://%s%s", expected.Request.ActualRequest.Method, scheme, gwAddr, expected.Request.ActualRequest.Path)
@@ -233,7 +234,7 @@ func MakeRequestAndExpectEventuallyConsistentResponse(t *testing.T, r roundtripp
}
}
backendSetHeaders := []string{}
backendSetHeaders := make([]string, 0, len(expected.Response.AdditionalResponseHeaders))
for name, val := range expected.Response.AdditionalResponseHeaders {
backendSetHeaders = append(backendSetHeaders, name+":"+val)
}
@@ -298,12 +299,12 @@ func WaitForConsistentResponse(t *testing.T, r roundtripper.RoundTripper, req ro
return false
}
if cRes.StatusCode == 200 && !expected.Response.ExpectedResponseNoRequest && cReq.Host == "" && cReq.Path == "" && cReq.Headers == nil && cReq.Body == nil {
if cRes.StatusCode == http.StatusOK && !expected.Response.ExpectedResponseNoRequest && cReq.Host == "" && cReq.Path == "" && cReq.Headers == nil && cReq.Body == nil {
t.Logf(`decoding client's response failed. Maybe you have chosen a wrong backend.
Choose echo-server if you want to check expected request header&body instead of response header&body.`)
return false
}
if err := CompareRequest(&req, cReq, cRes, expected); err != nil {
if err = CompareRequest(&req, cReq, cRes, expected); err != nil {
t.Logf("request expectation failed for actual request: %v not ready yet: %v (after %v)", req, err, elapsed)
return false
}
@@ -313,12 +314,12 @@ func WaitForConsistentResponse(t *testing.T, r roundtripper.RoundTripper, req ro
You can only choose one to compare between Response and Request.`)
return false
}
if err := CompareResponse(cRes, expected); err != nil {
if err = CompareResponse(cRes, expected); err != nil {
t.Logf("Response expectation failed for actual request: %v not ready yet: %v (after %v)", req, err, elapsed)
return false
}
} else {
t.Logf("invalid CompareTarget: %v please set it CompareTargetRequest or CompareTargetResponse", expected.Meta.CompareTarget)
t.Logf("invalid CompareTarget: %v please set it CompareTargetRequest or CompareTargetResponse", expected.Meta.CompareTarget)
return false
}
@@ -331,7 +332,7 @@ func CompareRequest(req *roundtripper.Request, cReq *roundtripper.CapturedReques
if expected.Response.ExpectedResponse.StatusCode != cRes.StatusCode {
return fmt.Errorf("expected status code to be %d, got %d", expected.Response.ExpectedResponse.StatusCode, cRes.StatusCode)
}
if cRes.StatusCode == 200 && !expected.Response.ExpectedResponseNoRequest {
if cRes.StatusCode == http.StatusOK && !expected.Response.ExpectedResponseNoRequest {
// The request expected to arrive at the backend is
// the same as the request made, unless otherwise
// specified.

10
test/e2e/conformance/utils/kubernetes/helpers.go
View File

@@ -15,11 +15,12 @@ package kubernetes
import (
"context"
"sigs.k8s.io/yaml"
"strings"
"testing"
"time"
"sigs.k8s.io/yaml"
"github.com/stretchr/testify/require"
v1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -141,10 +142,5 @@ func ApplyConfigmapDataWithYaml(t *testing.T, c client.Client, namespace string,
cm.Data[key] = data
t.Logf("🏗 Updating %s %s", name, namespace)
if err := c.Update(ctx, cm); err != nil {
return err
}
return nil
return c.Update(ctx, cm)
}

1
test/e2e/conformance/utils/suite/suite.go
View File

@@ -130,6 +130,7 @@ func New(s Options) *ConformanceTestSuite {
"base/eureka.yaml",
"base/nacos.yaml",
"base/dubbo.yaml",
"base/opa.yaml",
}
}