Expand tests to account for audit access policy #12847
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
alpeb
force-pushed
the
alpeb/policy-audit-impl
branch
3 times, most recently
from
bff10a5 to
a9caff0
Compare
alpeb
added a commit
that referenced
this pull request
Jul 23, 2024
Followup to #12845 This expands the policy controller index in the following ways: - Adds the new Audit variant to the DefaultPolicy enum - Expands the function that synthesizes the authorizations for a given default policy (DefaultPolicy::default_authzs) so that it also creates an Unauthenticated client auth and a allow-all NetworkMatch for the new Audit default policy. - Now that a Server can have a default policy different than Deny, when generating InboundServer authorizations (PolicyIndex::client_authzs) make sure to append the default authorizations when DefaultPolicy is Allow or Audit Also, the admission controller ensures the new accessPolicy field contains a valid value. Required test changes are addressed in #12847. Also note you'll need the proxy changes at linkerd/linkerd2-proxy#3068 to make this work. Please check linkerd/website#1805 for how this is supposed to work from the user's perspective.
alpeb
force-pushed
the
alpeb/policy-audit-impl
branch
from
a9caff0 to
a0ded8a
Compare
alpeb
force-pushed
the
alpeb/policy-audit-tests
branch
from
17eb633 to
5670f17
Compare
alpeb
added a commit
that referenced
this pull request
Jul 24, 2024
The filter for the changed-files job in the integration.yml workflow wasn't taking into account Rust files. So changes that touched only the policy controller weren't triggering the policy controller integration tests, as seen in #12847
alpeb
added a commit
that referenced
this pull request
Jul 25, 2024
The filter for the changed-files job in the integration.yml workflow wasn't taking into account Rust files. So changes that touched only the policy controller weren't triggering the policy controller integration tests, as seen in #12847
alpeb
added a commit
that referenced
this pull request
Jul 25, 2024
Followup to #12845 This expands the policy controller index in the following ways: - Adds the new Audit variant to the DefaultPolicy enum - Expands the function that synthesizes the authorizations for a given default policy (DefaultPolicy::default_authzs) so that it also creates an Unauthenticated client auth and a allow-all NetworkMatch for the new Audit default policy. - Now that a Server can have a default policy different than Deny, when generating InboundServer authorizations (PolicyIndex::client_authzs) make sure to append the default authorizations when DefaultPolicy is Allow or Audit Also, the admission controller ensures the new accessPolicy field contains a valid value. Required test changes are addressed in #12847. Also note you'll need the proxy changes at linkerd/linkerd2-proxy#3068 to make this work. Please check linkerd/website#1805 for how this is supposed to work from the user's perspective.
alpeb
force-pushed
the
alpeb/policy-audit-impl
branch
from
a0ded8a to
5ff8d95
Compare
alpeb
force-pushed
the
alpeb/policy-audit-tests
branch
from
5670f17 to
b196083
Compare
alpeb
added a commit
that referenced
this pull request
Jul 26, 2024
Followup to #12845 This expands the policy controller index in the following ways: - Adds the new Audit variant to the DefaultPolicy enum - Expands the function that synthesizes the authorizations for a given default policy (DefaultPolicy::default_authzs) so that it also creates an Unauthenticated client auth and a allow-all NetworkMatch for the new Audit default policy. - Now that a Server can have a default policy different than Deny, when generating InboundServer authorizations (PolicyIndex::client_authzs) make sure to append the default authorizations when DefaultPolicy is Allow or Audit Also, the admission controller ensures the new accessPolicy field contains a valid value. Required test changes are addressed in #12847. Also note you'll need the proxy changes at linkerd/linkerd2-proxy#3068 to make this work. Please check linkerd/website#1805 for how this is supposed to work from the user's perspective.
alpeb
force-pushed
the
alpeb/policy-audit-impl
branch
from
5ff8d95 to
9ad80a5
Compare
Followup to #12846, branched off alpeb/policy-audit-impl This fixes the policy controller unit and integration tests by accounting for the new Audit default policy and the new accessPolicy field in Server. New integration tests added: - e2e_audit.rs exercising first the audit policy in Server, and then at the namespace level - in admit_server.rs a new test checks invalid accessPolicy values are rejected. - in inbound_api.rs server_with_audit_policy verifies the synthesized audit authorization is returned for a Server with accessPolicy=audit
alpeb
force-pushed
the
alpeb/policy-audit-tests
branch
from
b196083 to
aa8f607
Compare
adleong
approved these changes
Jul 26, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Followup to #12846, branched off alpeb/policy-audit-impl
This fixes the policy controller unit and integration tests by accounting for the new Audit default policy and the new accessPolicy field in Server.
New integration tests added:
Please check linkerd/website#1805 for how this is supposed to work from the user's perspective.