Add Kubernetes integration tests for EasyHAProxy examples

- Introduced a suite of pytest-based integration tests for Kubernetes using `kind`.
- Automated local installation of dependencies (`kind`, `kubectl`, and `helm`) when missing.
- Implemented fixtures for Kubernetes resource management and TLS secrets.
- Added end-to-end tests for HTTP and HTTPS ingress functionality.

examples/kubernetes/jwt-validator-secret-example.yml

@@ -0,0 +1,135 @@
+# Example demonstrating JWT validator with Kubernetes secret
+# This shows the recommended way to provide JWT public keys in Kubernetes
+#
+# IMPORTANT: Before applying this manifest, generate JWT keys by running:
+#   cd /path/to/examples && bash generate-keys.sh
+#
+# Then create the secrets with your generated keys:
+#   kubectl create secret generic jwt-pubkey-secret \
+#     --from-file=pubkey=docker/jwt_pubkey.pem -n default
+#   kubectl create secret generic jwt-custom-secret \
+#     --from-file=rsa-public-key=docker/jwt_pubkey.pem -n default
+#
+# TWO ANNOTATION FORMATS:
+# 1. Auto-detect key (tries common variations):
+#    easyhaproxy.plugin.jwt_validator.k8s_secret.pubkey: "jwt-pubkey-secret"
+#    Tries keys: pubkey, public-key, jwt.pub, tls.crt
+#
+# 2. Explicit key (no variations):
+#    easyhaproxy.plugin.jwt_validator.k8s_secret.pubkey: "jwt-pubkey-secret/rsa-public-key"
+#    Only tries key: rsa-public-key
+
+---
+# NOTE: Secrets should be created separately using your generated JWT keys
+# See instructions at the top of this file
+# The test fixture creates these secrets automatically
+
+---
+# Deployment for API service
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: api
+  namespace: default
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: api
+  template:
+    metadata:
+      labels:
+        app: api
+    spec:
+      containers:
+      - name: api
+        image: byjg/static-httpserver
+        ports:
+        - containerPort: 8080
+        env:
+        - name: TITLE
+          value: "Protected API - JWT Required"
+
+---
+# Service to be protected with JWT
+apiVersion: v1
+kind: Service
+metadata:
+  name: api-service
+  namespace: default
+spec:
+  selector:
+    app: api
+  ports:
+  - port: 8080
+    targetPort: 8080
+
+---
+# Ingress Example 1: Auto-detect key (uses standard key name "pubkey")
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: api-ingress-jwt-auto
+  namespace: default
+  annotations:
+    # Enable JWT validator plugin
+    easyhaproxy.plugins: "jwt_validator"
+
+    # JWT validator configuration
+    easyhaproxy.plugin.jwt_validator.algorithm: "RS256"
+    easyhaproxy.plugin.jwt_validator.issuer: "https://auth.example.com/"
+    easyhaproxy.plugin.jwt_validator.audience: "https://api.example.com"
+
+    # Auto-detect: tries pubkey, public-key, jwt.pub, tls.crt
+    easyhaproxy.plugin.jwt_validator.k8s_secret.pubkey: "jwt-pubkey-secret"
+spec:
+  ingressClassName: easyhaproxy
+  rules:
+  - host: api.example.local
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: api-service
+            port:
+              number: 8080
+
+---
+# Ingress Example 2: Explicit key (uses custom key name "rsa-public-key")
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: api-ingress-jwt-explicit
+  namespace: default
+  annotations:
+    # Enable JWT validator plugin
+    easyhaproxy.plugins: "jwt_validator"
+
+    # JWT validator configuration
+    easyhaproxy.plugin.jwt_validator.algorithm: "RS256"
+    easyhaproxy.plugin.jwt_validator.issuer: "https://auth.example.com/"
+    easyhaproxy.plugin.jwt_validator.audience: "https://api.example.com"
+
+    # Explicit key: only tries "rsa-public-key" from the secret
+    easyhaproxy.plugin.jwt_validator.k8s_secret.pubkey: "jwt-custom-secret/rsa-public-key"
+
+    # Optional: Protect only specific paths
+    # easyhaproxy.plugin.jwt_validator.paths: "/api,/admin"
+
+    # Optional: Allow anonymous access (JWT validated only if present)
+    # easyhaproxy.plugin.jwt_validator.allow_anonymous: "true"
+spec:
+  ingressClassName: easyhaproxy
+  rules:
+  - host: api-custom.example.local
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: api-service
+            port:
+              number: 8080