Migrate examples to tests_e2e directory structure
- Relocated all files and scripts from `examples` to `tests_e2e` for better organization. - Updated references and paths in configurations, scripts, and test files. - Adjusted `bump-version.sh` to handle the new `tests_e2e` structure. - Updated `.gitignore` to reflect path changes.
This commit is contained in:
parent
b34d7822e4
commit
d66c4f8595
51 changed files with 35 additions and 35 deletions
124
tests_e2e/kubernetes/ip-whitelist.yml
Normal file
124
tests_e2e/kubernetes/ip-whitelist.yml
Normal file
|
|
@ -0,0 +1,124 @@
|
|||
# ==============================================================================
|
||||
# EXAMPLE: IP Whitelist Plugin for Kubernetes
|
||||
# ==============================================================================
|
||||
#
|
||||
# WHAT THIS DEMONSTRATES:
|
||||
# - Restricting access to specific IP addresses or CIDR ranges
|
||||
# - Using annotations for IP-based access control
|
||||
# - Protecting admin panels or sensitive services in Kubernetes
|
||||
# - Custom HTTP status code for blocked requests
|
||||
#
|
||||
# REQUIREMENTS (run these first):
|
||||
# ```bash
|
||||
# # 1. Ensure EasyHAProxy is installed in your cluster
|
||||
# kubectl create namespace easyhaproxy
|
||||
# kubectl apply -f https://raw.githubusercontent.com/byjg/docker-easy-haproxy/5.0.0/deploy/kubernetes/easyhaproxy-daemonset.yml
|
||||
#
|
||||
# # 2. IMPORTANT: Edit this file (line 80) and update allowed_ips
|
||||
# # with your actual office/VPN IP addresses or networks
|
||||
# ```
|
||||
#
|
||||
# HOW TO START:
|
||||
# ```bash
|
||||
# kubectl apply -f ip-whitelist.yml
|
||||
# ```
|
||||
#
|
||||
# HOW TO VERIFY IT'S WORKING:
|
||||
# ```bash
|
||||
# # Check resources are created
|
||||
# kubectl get deployment,service,ingress -l app=admin
|
||||
#
|
||||
# # Test from allowed IP
|
||||
# kubectl port-forward -n easyhaproxy deployment/easyhaproxy 8080:80
|
||||
# curl -H "Host: admin.example.local" http://localhost:8080
|
||||
# # Expected: 200 OK with "Admin Panel - IP Restricted" (if your IP is in allowed_ips)
|
||||
#
|
||||
# # Test from non-allowed IP
|
||||
# # Expected: HTTP 403 Forbidden
|
||||
# ```
|
||||
#
|
||||
# CLEAN UP:
|
||||
# ```bash
|
||||
# kubectl delete -f ip-whitelist.yml
|
||||
# ```
|
||||
#
|
||||
# ==============================================================================
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: admin-service
|
||||
namespace: default
|
||||
spec:
|
||||
ports:
|
||||
- port: 8080
|
||||
targetPort: 8080
|
||||
selector:
|
||||
app: admin
|
||||
type: ClusterIP
|
||||
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: admin
|
||||
namespace: default
|
||||
spec:
|
||||
replicas: 2
|
||||
selector:
|
||||
matchLabels:
|
||||
app: admin
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: admin
|
||||
spec:
|
||||
containers:
|
||||
- name: admin
|
||||
image: byjg/static-httpserver
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
env:
|
||||
- name: TITLE
|
||||
value: "Admin Panel - IP Restricted"
|
||||
resources:
|
||||
limits:
|
||||
cpu: '0.1'
|
||||
memory: '64Mi'
|
||||
requests:
|
||||
cpu: '0.05'
|
||||
memory: '32Mi'
|
||||
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
annotations:
|
||||
# Enable IP whitelist plugin
|
||||
easyhaproxy.plugins: "ip_whitelist"
|
||||
|
||||
# Allow specific IPs and networks
|
||||
# UPDATE THIS with your actual office/VPN IPs!
|
||||
# For testing: includes localhost and Docker/Kubernetes private networks
|
||||
easyhaproxy.plugin.ip_whitelist.allowed_ips: "127.0.0.1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,203.0.113.0/24,198.51.100.42"
|
||||
|
||||
# Status code to return for blocked IPs
|
||||
easyhaproxy.plugin.ip_whitelist.status_code: "403"
|
||||
name: admin-ingress-whitelist
|
||||
namespace: default
|
||||
spec:
|
||||
# Use ingressClassName instead of the deprecated annotation
|
||||
# For backward compatibility, annotation kubernetes.io/ingress.class is still supported
|
||||
ingressClassName: easyhaproxy
|
||||
rules:
|
||||
- host: admin.example.local
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: admin-service
|
||||
port:
|
||||
number: 8080
|
||||
Loading…
Add table
Add a link
Reference in a new issue