Add tests for TLS Support (VS+VSR)

nginx · Aug 19, 2019 · 08c4533 · 08c4533
1 parent 6852528
commit 08c4533
Show file tree

Hide file tree

Showing 14 changed files with 711 additions and 2 deletions.
diff --git a/tests/data/common/app/secure/app.yaml b/tests/data/common/app/secure/app.yaml
@@ -0,0 +1,108 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend1
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: backend1
+  template:
+    metadata:
+      labels:
+        app: backend1
+    spec:
+      containers:
+      - name: backend1
+        image: nginxdemos/hello:plain-text
+        ports:
+        - containerPort: 80
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend1-svc
+spec:
+  ports:
+  - port: 80
+    targetPort: 80
+    protocol: TCP
+    name: http
+  selector:
+    app: backend1
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend2
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: backend2
+  template:
+    metadata:
+      labels:
+        app: backend2
+    spec:
+      containers:
+      - name: backend2
+        image: nginx
+        ports:
+        - containerPort: 80
+        volumeMounts:
+          - name: secret
+            mountPath: "/etc/nginx/ssl"
+            readOnly: true
+          - name: config-volume
+            mountPath: /etc/nginx/conf.d
+      volumes:
+      - name: secret
+        secret:
+          secretName: app-tls-secret
+      - name: config-volume
+        configMap:
+          name: secure-config
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend2-svc
+spec:
+  ports:
+  - port: 80
+    targetPort: 443
+    protocol: TCP
+    name: https
+  selector:
+    app: backend2
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: secure-config
+data:
+  app.conf: |-
+    server {
+      listen 443 ssl;
+
+      server_name app.example.com;
+
+      ssl_certificate /etc/nginx/ssl/tls.crt;
+      ssl_certificate_key /etc/nginx/ssl/tls.key;
+
+      default_type text/plain;
+
+      location / {
+        return 200 "here is your response via ssl port $server_port with X-Forwarded-Port $http_x_forwarded_port\n";
+      }
+    }
+---
+apiVersion: v1
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVCakNDQXU2Z0F3SUJBZ0lKQUpicWVnTHB0U2JhTUEwR0NTcUdTSWIzRFFFQkJRVUFNRjh4Q3pBSkJnTlYKQkFZVEFrZENNUk13RVFZRFZRUUlFd3BUYjIxbExWTjBZWFJsTVNFd0h3WURWUVFLRXhoSmJuUmxjbTVsZENCWAphV1JuYVhSeklGQjBlU0JNZEdReEdEQVdCZ05WQkFNVEQyRndjQzVsZUdGdGNHeGxMbU52YlRBZUZ3MHhPREF5Ck1USXdNREF6TkRWYUZ3MHhPVEF5TVRJd01EQXpORFZhTUY4eEN6QUpCZ05WQkFZVEFrZENNUk13RVFZRFZRUUkKRXdwVGIyMWxMVk4wWVhSbE1TRXdId1lEVlFRS0V4aEpiblJsY201bGRDQlhhV1JuYVhSeklGQjBlU0JNZEdReApHREFXQmdOVkJBTVREMkZ3Y0M1bGVHRnRjR3hsTG1OdmJUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQCkFEQ0NBUW9DZ2dFQkFLenNmMll0R2hVU0lyYWpTS1ZLSVBrTmFzODcrTzJDaHlsZTduL212V012WFJZZWI2R3oKQktKV3FkSS9UajlQQlJxTWVzajByMjF5UlAwaVc0VVBTYjZNT3psNisyYjBJeS9nTEhJRGxJN0NDTVU5cThHSAorL3Y4ZjAyMXJWYmUrNGdsWmZWVTZJbXg2Vlc0ODkzVTcwQXR6Y1hGNnFDUGRUWDNjWW02MTVmNE02M1YzdTdqClJGN1JINzBDL1NScVVvN29FVmZxR0thN1prdWVodnlLSWZURE5hQUt0WFhDLzlCeDlYSDIyREFxcTVKRUhHVHAKSVluRFE4eFdFRXlUQmx1V2JwU0JwUEVMRDcyUHhwQW9DU0trdVdXSzJYbmlKOG9BTFZJWlhaaHFvamw4Sk5SMgpiNWE3RFJEcTNTYzNNSzhwMEwzZXFsLzRPcnhjUGdJUVdtTUNBd0VBQWFPQnhEQ0J3VEFkQmdOVkhRNEVGZ1FVCmtvK2owNGJWaDZyTjdCbk8wbjRLMUo4S2tIRXdnWkVHQTFVZEl3U0JpVENCaG9BVWtvK2owNGJWaDZyTjdCbk8KMG40SzFKOEtrSEdoWTZSaE1GOHhDekFKQmdOVkJBWVRBa2RDTVJNd0VRWURWUVFJRXdwVGIyMWxMVk4wWVhSbApNU0V3SHdZRFZRUUtFeGhKYm5SbGNtNWxkQ0JYYVdSbmFYUnpJRkIwZVNCTWRHUXhHREFXQmdOVkJBTVREMkZ3CmNDNWxlR0Z0Y0d4bExtTnZiWUlKQUpicWVnTHB0U2JhTUF3R0ExVWRFd1FGTUFNQkFmOHdEUVlKS29aSWh2Y04KQVFFRkJRQURnZ0VCQUc3RUxMUGVrQXJkYy9COUxsZXZsMCtLNWtYN2JsZDBqa1JmZjRzalA5MTdkSFliem0zMQoxNi9QT0ZKc3ZmOTFhNXdOTnNzL3JOVG13ZEZuSC8xNTJJVEgyamJiUEd5bGIyMkNiemgvU09XWVUzcnJEeHk3ClVtMFNqMmdJUHRWdjc3WTY4Y1ZtOTNVK3oxNjM1akVNUUtXcUpYRlBCSU9iWVd1SWNManJ1WTg5dGhpdUtVNTcKNGlraFlqT0t2ZnU4NVNyUDQybGV5Qk1PMHROVVNCZWl6SmZpWDA1N3RtR0xwaXhRYnBsaTlXUjc5bXpLcFJwZApEaEdFMHpxZ1ZSMDlOeGF2cmpNcjdtNHpvRGg1d09McFVQSEVCU2FhU2QzNzA4WGwrTFVDSTNQajhHcEtvUWRlCm11b2t3MndVTFQzR0ZTZjd4OTZSdUJqTmRWb3NSRkJpZjM0PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcFFJQkFBS0NBUUVBck94L1ppMGFGUklpdHFOSXBVb2crUTFxenp2NDdZS0hLVjd1ZithOVl5OWRGaDV2Cm9iTUVvbGFwMGo5T1AwOEZHb3g2eVBTdmJYSkUvU0piaFE5SnZvdzdPWHI3WnZRakwrQXNjZ09VanNJSXhUMnIKd1lmNysveC9UYld0VnQ3N2lDVmw5VlRvaWJIcFZianozZFR2UUMzTnhjWHFvSTkxTmZkeGliclhsL2d6cmRYZQo3dU5FWHRFZnZRTDlKR3BTanVnUlYrb1lwcnRtUzU2Ry9Jb2g5TU0xb0FxMWRjTC8wSEgxY2ZiWU1DcXJra1FjClpPa2hpY05EekZZUVRKTUdXNVp1bElHazhRc1B2WS9Ha0NnSklxUzVaWXJaZWVJbnlnQXRVaGxkbUdxaU9Yd2sKMUhadmxyc05FT3JkSnpjd3J5blF2ZDZxWC9nNnZGdytBaEJhWXdJREFRQUJBb0lCQVFDSGd2WDdmbEM0UG5RUgpxRGZmd0EzQzNtN2JZK1laU25iZFJ0V2tTWkFVMENNa21FbG04RUVyYnJxNlZuM2RRdkYrOHFPdUk0SHVST1FuCmN1dEJoTStIa2FFLzFFNTdTY3JoVTgzQXMybVJ6aUROWVJ6ZUZ0Q3praFc1TWl4YXJYZDBJOHFZelNkRjhMUW8KUno1a2t0L0M3YUlaNEpXVHFaaHk2Q3lEZ0hZL1VpcEFGZG5mTE1NWG00Q1R3OTVGV1VpNGRaUHY4ZzVNNFZVUQo1K25sMUdPUFdsdGpNaWRlY0VxYVlYdzh3amVYQ1JNMDZLeWJSaDU1cU5reHladDZ4YWU4d0JLaE1PV2VRcmVPCjZhQ0tBQjNaOC9vM21JeTd2WjUzWE51WEFQaHhLR3E2OFVkQTgrQ1lKb3dPNFdscGhKRkE2QUcrYjZpRnJwNkgKZmFybVkxRkJBb0dCQU5wT0xZUGVhNEY1eXhxU3NpYkFpTXJiYkZROTlDejRZampkTUlEM25zWnpFblVrdjF0QwpGbTUwOHhodFk0TFRiUEQ0c2RPcmNETVlqYTM0UENKQTFOV0p5UXdZWkdMaEhxTXg1NWJjQ2VaL1Y0S3FlN29ZCm5aK2tPb29RbFBsQUFTZVViYU0vWCtHdDRUdjdwVGxjQWJETWVTd1Z0R2I2ZXFhZUpNUFJmZlhUQW9HQkFNckkKVGVBSjhkejQ2TC9raWZOMjMrVVFkSGdZdzZ5cExSZ0JuRllweGpIM1VWOWRFZVdXdUZzdzhraTVha25TVmIwVgpFaWJqb1BCdjZxd1RvWmhKNHE5L0lOdzJmZE4xTGV3N3ZOaG5vL1A5MHJpUDZ4b2llczJsN2c3bmlEUDJ5ZnRaCnpJSkU0OUs2SVJzT3c4ZHkrS3hrQzJaZDdWcy9BM2x1Q2hYZWVWOHhBb0dBSG9yTGdXU1A0K2gzU3Z0MUkwalMKbXBjQ1cvTGpBNXVvbWs0UDZDczhzb1VNOHdpMklQMXBDQUVpdGFzd1BmQjRrR29xN3ZOUVdrVzRKTHZUSmZPdQpFMFlZczdHQjhmZVBBc1FMbzZhYlYvMCs4QkFNQ1doQ1BVQ0wxQjhueUl0MDNlVzlSUmFyd25aQ1NkTVdOYVV5CnMxcVlKVnZRQm94S3RwN3ZnOW4rWm5NQ2dZRUFsUmJmNnJCbEdzb0dsYzg1ZmI4UXJpR0RBQ2wwOUNVTituQjAKdVFUTnF6N2luUEtZamV4YWJ2RjFzUEpocXhUeDVLcnhSWlptWldCamNWQ2RwcEhzRUl1dlpUakxHZ1UxVmxJMQpiZ1lGRFFhNVB1alJPYzNQN0JMckRCbytrYllJbXJ4VEdCUCtUSmg4YnFCVVlQZXV6VkJnOFVwdGtJQ3IxVU9LCk5ybnpFb0VDZ1lFQXh5a3JTblQreGdjZHFSaXBQenFnL1NJT0VJTXp2VHp2alQ2cG9nb1FhOGhYUkJxTTQ3NUoKVnJlMWlIUXF5b2tDcEM0d0wvTWx2SkhhNW1FMExkdGdyNG9UOUVsMkwrNy9qNHlUL01CUHB2a2M2UWtKaEFLcgpYQ2pIN29seHhWVmhjaVUwZG9JUlYwL0VjRjAwS1NnQnBXR1dOU2UyVm44cTdFelhISHpQVC80PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
+kind: Secret
+metadata:
+  name: app-tls-secret
+type: Opaque
diff --git a/tests/data/common/app/vsr/secure/multiple.yaml b/tests/data/common/app/vsr/secure/multiple.yaml
@@ -0,0 +1,66 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: backend1
+  template:
+    metadata:
+      labels:
+        app: backend1
+    spec:
+      containers:
+      - name: backend1
+        image: nginxdemos/hello:plain-text
+        ports:
+        - containerPort: 80
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend1-svc
+spec:
+  ports:
+  - port: 80
+    targetPort: 80
+    protocol: TCP
+    name: http
+  selector:
+    app: backend1
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend3
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: backend3
+  template:
+    metadata:
+      labels:
+        app: backend3 
+    spec:
+      containers:
+      - name: backend3 
+        image: nginxdemos/hello:plain-text
+        ports:
+        - containerPort: 80
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend3-svc
+  labels:
+spec:
+  ports:
+  - port: 80
+    targetPort: 80
+    protocol: TCP
+    name: http
+  selector:
+    app: backend3
diff --git a/tests/data/common/app/vsr/secure/single.yaml b/tests/data/common/app/vsr/secure/single.yaml
@@ -0,0 +1,79 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend2
+  namespace: backend2-namespace
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: backend2
+  template:
+    metadata:
+      labels:
+        app: backend2
+    spec:
+      containers:
+      - name: backend2
+        image: nginx
+        ports:
+        - containerPort: 80
+        volumeMounts:
+          - name: secret
+            mountPath: "/etc/nginx/ssl"
+            readOnly: true
+          - name: config-volume
+            mountPath: /etc/nginx/conf.d
+      volumes:
+      - name: secret
+        secret:
+          secretName: app-tls-secret
+      - name: config-volume
+        configMap:
+          name: secure-config
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend2-svc
+  namespace: backend2-namespace
+spec:
+  ports:
+  - port: 80
+    targetPort: 443
+    protocol: TCP
+    name: https
+  selector:
+    app: backend2
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: secure-config
+  namespace: backend2-namespace
+data:
+  app.conf: |-
+    server {
+      listen 443 ssl;
+
+      server_name app.example.com;
+
+      ssl_certificate /etc/nginx/ssl/tls.crt;
+      ssl_certificate_key /etc/nginx/ssl/tls.key;
+
+      default_type text/plain;
+
+      location / {
+        return 200 "here is your response via ssl port $server_port with X-Forwarded-Port $http_x_forwarded_port\n";
+      }
+    }
+---
+apiVersion: v1
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVCakNDQXU2Z0F3SUJBZ0lKQUpicWVnTHB0U2JhTUEwR0NTcUdTSWIzRFFFQkJRVUFNRjh4Q3pBSkJnTlYKQkFZVEFrZENNUk13RVFZRFZRUUlFd3BUYjIxbExWTjBZWFJsTVNFd0h3WURWUVFLRXhoSmJuUmxjbTVsZENCWAphV1JuYVhSeklGQjBlU0JNZEdReEdEQVdCZ05WQkFNVEQyRndjQzVsZUdGdGNHeGxMbU52YlRBZUZ3MHhPREF5Ck1USXdNREF6TkRWYUZ3MHhPVEF5TVRJd01EQXpORFZhTUY4eEN6QUpCZ05WQkFZVEFrZENNUk13RVFZRFZRUUkKRXdwVGIyMWxMVk4wWVhSbE1TRXdId1lEVlFRS0V4aEpiblJsY201bGRDQlhhV1JuYVhSeklGQjBlU0JNZEdReApHREFXQmdOVkJBTVREMkZ3Y0M1bGVHRnRjR3hsTG1OdmJUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQCkFEQ0NBUW9DZ2dFQkFLenNmMll0R2hVU0lyYWpTS1ZLSVBrTmFzODcrTzJDaHlsZTduL212V012WFJZZWI2R3oKQktKV3FkSS9UajlQQlJxTWVzajByMjF5UlAwaVc0VVBTYjZNT3psNisyYjBJeS9nTEhJRGxJN0NDTVU5cThHSAorL3Y4ZjAyMXJWYmUrNGdsWmZWVTZJbXg2Vlc0ODkzVTcwQXR6Y1hGNnFDUGRUWDNjWW02MTVmNE02M1YzdTdqClJGN1JINzBDL1NScVVvN29FVmZxR0thN1prdWVodnlLSWZURE5hQUt0WFhDLzlCeDlYSDIyREFxcTVKRUhHVHAKSVluRFE4eFdFRXlUQmx1V2JwU0JwUEVMRDcyUHhwQW9DU0trdVdXSzJYbmlKOG9BTFZJWlhaaHFvamw4Sk5SMgpiNWE3RFJEcTNTYzNNSzhwMEwzZXFsLzRPcnhjUGdJUVdtTUNBd0VBQWFPQnhEQ0J3VEFkQmdOVkhRNEVGZ1FVCmtvK2owNGJWaDZyTjdCbk8wbjRLMUo4S2tIRXdnWkVHQTFVZEl3U0JpVENCaG9BVWtvK2owNGJWaDZyTjdCbk8KMG40SzFKOEtrSEdoWTZSaE1GOHhDekFKQmdOVkJBWVRBa2RDTVJNd0VRWURWUVFJRXdwVGIyMWxMVk4wWVhSbApNU0V3SHdZRFZRUUtFeGhKYm5SbGNtNWxkQ0JYYVdSbmFYUnpJRkIwZVNCTWRHUXhHREFXQmdOVkJBTVREMkZ3CmNDNWxlR0Z0Y0d4bExtTnZiWUlKQUpicWVnTHB0U2JhTUF3R0ExVWRFd1FGTUFNQkFmOHdEUVlKS29aSWh2Y04KQVFFRkJRQURnZ0VCQUc3RUxMUGVrQXJkYy9COUxsZXZsMCtLNWtYN2JsZDBqa1JmZjRzalA5MTdkSFliem0zMQoxNi9QT0ZKc3ZmOTFhNXdOTnNzL3JOVG13ZEZuSC8xNTJJVEgyamJiUEd5bGIyMkNiemgvU09XWVUzcnJEeHk3ClVtMFNqMmdJUHRWdjc3WTY4Y1ZtOTNVK3oxNjM1akVNUUtXcUpYRlBCSU9iWVd1SWNManJ1WTg5dGhpdUtVNTcKNGlraFlqT0t2ZnU4NVNyUDQybGV5Qk1PMHROVVNCZWl6SmZpWDA1N3RtR0xwaXhRYnBsaTlXUjc5bXpLcFJwZApEaEdFMHpxZ1ZSMDlOeGF2cmpNcjdtNHpvRGg1d09McFVQSEVCU2FhU2QzNzA4WGwrTFVDSTNQajhHcEtvUWRlCm11b2t3MndVTFQzR0ZTZjd4OTZSdUJqTmRWb3NSRkJpZjM0PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcFFJQkFBS0NBUUVBck94L1ppMGFGUklpdHFOSXBVb2crUTFxenp2NDdZS0hLVjd1ZithOVl5OWRGaDV2Cm9iTUVvbGFwMGo5T1AwOEZHb3g2eVBTdmJYSkUvU0piaFE5SnZvdzdPWHI3WnZRakwrQXNjZ09VanNJSXhUMnIKd1lmNysveC9UYld0VnQ3N2lDVmw5VlRvaWJIcFZianozZFR2UUMzTnhjWHFvSTkxTmZkeGliclhsL2d6cmRYZQo3dU5FWHRFZnZRTDlKR3BTanVnUlYrb1lwcnRtUzU2Ry9Jb2g5TU0xb0FxMWRjTC8wSEgxY2ZiWU1DcXJra1FjClpPa2hpY05EekZZUVRKTUdXNVp1bElHazhRc1B2WS9Ha0NnSklxUzVaWXJaZWVJbnlnQXRVaGxkbUdxaU9Yd2sKMUhadmxyc05FT3JkSnpjd3J5blF2ZDZxWC9nNnZGdytBaEJhWXdJREFRQUJBb0lCQVFDSGd2WDdmbEM0UG5RUgpxRGZmd0EzQzNtN2JZK1laU25iZFJ0V2tTWkFVMENNa21FbG04RUVyYnJxNlZuM2RRdkYrOHFPdUk0SHVST1FuCmN1dEJoTStIa2FFLzFFNTdTY3JoVTgzQXMybVJ6aUROWVJ6ZUZ0Q3praFc1TWl4YXJYZDBJOHFZelNkRjhMUW8KUno1a2t0L0M3YUlaNEpXVHFaaHk2Q3lEZ0hZL1VpcEFGZG5mTE1NWG00Q1R3OTVGV1VpNGRaUHY4ZzVNNFZVUQo1K25sMUdPUFdsdGpNaWRlY0VxYVlYdzh3amVYQ1JNMDZLeWJSaDU1cU5reHladDZ4YWU4d0JLaE1PV2VRcmVPCjZhQ0tBQjNaOC9vM21JeTd2WjUzWE51WEFQaHhLR3E2OFVkQTgrQ1lKb3dPNFdscGhKRkE2QUcrYjZpRnJwNkgKZmFybVkxRkJBb0dCQU5wT0xZUGVhNEY1eXhxU3NpYkFpTXJiYkZROTlDejRZampkTUlEM25zWnpFblVrdjF0QwpGbTUwOHhodFk0TFRiUEQ0c2RPcmNETVlqYTM0UENKQTFOV0p5UXdZWkdMaEhxTXg1NWJjQ2VaL1Y0S3FlN29ZCm5aK2tPb29RbFBsQUFTZVViYU0vWCtHdDRUdjdwVGxjQWJETWVTd1Z0R2I2ZXFhZUpNUFJmZlhUQW9HQkFNckkKVGVBSjhkejQ2TC9raWZOMjMrVVFkSGdZdzZ5cExSZ0JuRllweGpIM1VWOWRFZVdXdUZzdzhraTVha25TVmIwVgpFaWJqb1BCdjZxd1RvWmhKNHE5L0lOdzJmZE4xTGV3N3ZOaG5vL1A5MHJpUDZ4b2llczJsN2c3bmlEUDJ5ZnRaCnpJSkU0OUs2SVJzT3c4ZHkrS3hrQzJaZDdWcy9BM2x1Q2hYZWVWOHhBb0dBSG9yTGdXU1A0K2gzU3Z0MUkwalMKbXBjQ1cvTGpBNXVvbWs0UDZDczhzb1VNOHdpMklQMXBDQUVpdGFzd1BmQjRrR29xN3ZOUVdrVzRKTHZUSmZPdQpFMFlZczdHQjhmZVBBc1FMbzZhYlYvMCs4QkFNQ1doQ1BVQ0wxQjhueUl0MDNlVzlSUmFyd25aQ1NkTVdOYVV5CnMxcVlKVnZRQm94S3RwN3ZnOW4rWm5NQ2dZRUFsUmJmNnJCbEdzb0dsYzg1ZmI4UXJpR0RBQ2wwOUNVTituQjAKdVFUTnF6N2luUEtZamV4YWJ2RjFzUEpocXhUeDVLcnhSWlptWldCamNWQ2RwcEhzRUl1dlpUakxHZ1UxVmxJMQpiZ1lGRFFhNVB1alJPYzNQN0JMckRCbytrYllJbXJ4VEdCUCtUSmg4YnFCVVlQZXV6VkJnOFVwdGtJQ3IxVU9LCk5ybnpFb0VDZ1lFQXh5a3JTblQreGdjZHFSaXBQenFnL1NJT0VJTXp2VHp2alQ2cG9nb1FhOGhYUkJxTTQ3NUoKVnJlMWlIUXF5b2tDcEM0d0wvTWx2SkhhNW1FMExkdGdyNG9UOUVsMkwrNy9qNHlUL01CUHB2a2M2UWtKaEFLcgpYQ2pIN29seHhWVmhjaVUwZG9JUlYwL0VjRjAwS1NnQnBXR1dOU2UyVm44cTdFelhISHpQVC80PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
+kind: Secret
+metadata:
+  name: app-tls-secret
+  namespace: backend2-namespace
+type: Opaque
diff --git a/tests/data/virtual-server-route-upstream-tls/route-multiple.yaml b/tests/data/virtual-server-route-upstream-tls/route-multiple.yaml
@@ -0,0 +1,22 @@
+apiVersion: k8s.nginx.org/v1alpha1
+kind: VirtualServerRoute
+metadata:
+  name: backends
+spec:
+  host: virtual-server-route.example.com
+  upstreams:
+  - name: backend1
+    service: backend1-svc
+    port: 80
+    tls:
+      enable:
+  - name: backend3
+    service: backend3-svc
+    port: 80
+    tls:
+      enable: False
+  subroutes:
+  - path: "/backends/backend1"
+    upstream: backend1
+  - path: "/backends/backend3"
+    upstream: backend3
diff --git a/tests/data/virtual-server-route-upstream-tls/route-single-disable-tls.yaml b/tests/data/virtual-server-route-upstream-tls/route-single-disable-tls.yaml
@@ -0,0 +1,15 @@
+apiVersion: k8s.nginx.org/v1alpha1
+kind: VirtualServerRoute
+metadata:
+  name: backend2
+spec:
+  host: virtual-server-route.example.com
+  upstreams:
+  - name: backend2
+    service: backend2-svc
+    port: 80
+    tls:
+      enable:
+  subroutes:
+  - path: "/backend2"
+    upstream: backend2
diff --git a/tests/data/virtual-server-route-upstream-tls/route-single-invalid.yaml b/tests/data/virtual-server-route-upstream-tls/route-single-invalid.yaml
@@ -0,0 +1,15 @@
+apiVersion: k8s.nginx.org/v1alpha1
+kind: VirtualServerRoute
+metadata:
+  name: backend2
+spec:
+  host: virtual-server-route.example.com
+  upstreams:
+  - name: backend2
+    service: backend2-svc
+    port: 80
+    tls:
+      enable: ""
+  subroutes:
+  - path: "/backend2"
+    upstream: backend2
diff --git a/tests/data/virtual-server-route-upstream-tls/route-single.yaml b/tests/data/virtual-server-route-upstream-tls/route-single.yaml
@@ -0,0 +1,15 @@
+apiVersion: k8s.nginx.org/v1alpha1
+kind: VirtualServerRoute
+metadata:
+  name: backend2
+spec:
+  host: virtual-server-route.example.com
+  upstreams:
+  - name: backend2
+    service: backend2-svc
+    port: 80
+    tls:
+      enable: True
+  subroutes:
+  - path: "/backend2"
+    upstream: backend2
diff --git a/tests/data/virtual-server-route-upstream-tls/standard/virtual-server.yaml b/tests/data/virtual-server-route-upstream-tls/standard/virtual-server.yaml
@@ -0,0 +1,11 @@
+apiVersion: k8s.nginx.org/v1alpha1
+kind: VirtualServer
+metadata:
+  name: virtual-server-route
+spec:
+  host: virtual-server-route.example.com
+  routes:
+  - path: "/backends"
+    route: backends-namespace/backends
+  - path: "/backend2"
+    route: backend2-namespace/backend2
diff --git a/tests/data/virtual-server-upstream-tls/standard/virtual-server.yaml b/tests/data/virtual-server-upstream-tls/standard/virtual-server.yaml
@@ -0,0 +1,22 @@
+apiVersion: k8s.nginx.org/v1alpha1
+kind: VirtualServer
+metadata:
+  name: virtual-server
+spec:
+  host: virtual-server.example.com
+  upstreams:
+  - name: backend2
+    service: backend2-svc
+    port: 80
+    tls:
+      enable: True
+  - name: backend1
+    service: backend1-svc
+    port: 80
+    tls:
+      enable: False
+  routes:
+  - path: "/backend1"
+    upstream: backend1
+  - path: "/backend2"
+    upstream: backend2
diff --git a/tests/data/virtual-server-upstream-tls/virtual-server-disable-tls.yaml b/tests/data/virtual-server-upstream-tls/virtual-server-disable-tls.yaml
@@ -0,0 +1,22 @@
+apiVersion: k8s.nginx.org/v1alpha1
+kind: VirtualServer
+metadata:
+  name: virtual-server
+spec:
+  host: virtual-server.example.com
+  upstreams:
+  - name: backend2
+    service: backend2-svc
+    port: 80
+    tls:
+      enable:
+  - name: backend1
+    service: backend1-svc
+    port: 80
+    tls:
+      enable: False
+  routes:
+  - path: "/backend1"
+    upstream: backend1
+  - path: "/backend2"
+    upstream: backend2