90b01b1f13
- Introduced a suite of pytest-based integration tests for Kubernetes using `kind`. - Automated local installation of dependencies (`kind`, `kubectl`, and `helm`) when missing. - Implemented fixtures for Kubernetes resource management and TLS secrets. - Added end-to-end tests for HTTP and HTTPS ingress functionality.
135 lines
3.7 KiB
YAML
135 lines
3.7 KiB
YAML
# Example demonstrating JWT validator with Kubernetes secret
|
|
# This shows the recommended way to provide JWT public keys in Kubernetes
|
|
#
|
|
# IMPORTANT: Before applying this manifest, generate JWT keys by running:
|
|
# cd /path/to/examples && bash generate-keys.sh
|
|
#
|
|
# Then create the secrets with your generated keys:
|
|
# kubectl create secret generic jwt-pubkey-secret \
|
|
# --from-file=pubkey=docker/jwt_pubkey.pem -n default
|
|
# kubectl create secret generic jwt-custom-secret \
|
|
# --from-file=rsa-public-key=docker/jwt_pubkey.pem -n default
|
|
#
|
|
# TWO ANNOTATION FORMATS:
|
|
# 1. Auto-detect key (tries common variations):
|
|
# easyhaproxy.plugin.jwt_validator.k8s_secret.pubkey: "jwt-pubkey-secret"
|
|
# Tries keys: pubkey, public-key, jwt.pub, tls.crt
|
|
#
|
|
# 2. Explicit key (no variations):
|
|
# easyhaproxy.plugin.jwt_validator.k8s_secret.pubkey: "jwt-pubkey-secret/rsa-public-key"
|
|
# Only tries key: rsa-public-key
|
|
|
|
---
|
|
# NOTE: Secrets should be created separately using your generated JWT keys
|
|
# See instructions at the top of this file
|
|
# The test fixture creates these secrets automatically
|
|
|
|
---
|
|
# Deployment for API service
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: api
|
|
namespace: default
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: api
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: api
|
|
spec:
|
|
containers:
|
|
- name: api
|
|
image: byjg/static-httpserver
|
|
ports:
|
|
- containerPort: 8080
|
|
env:
|
|
- name: TITLE
|
|
value: "Protected API - JWT Required"
|
|
|
|
---
|
|
# Service to be protected with JWT
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: api-service
|
|
namespace: default
|
|
spec:
|
|
selector:
|
|
app: api
|
|
ports:
|
|
- port: 8080
|
|
targetPort: 8080
|
|
|
|
---
|
|
# Ingress Example 1: Auto-detect key (uses standard key name "pubkey")
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: api-ingress-jwt-auto
|
|
namespace: default
|
|
annotations:
|
|
# Enable JWT validator plugin
|
|
easyhaproxy.plugins: "jwt_validator"
|
|
|
|
# JWT validator configuration
|
|
easyhaproxy.plugin.jwt_validator.algorithm: "RS256"
|
|
easyhaproxy.plugin.jwt_validator.issuer: "https://auth.example.com/"
|
|
easyhaproxy.plugin.jwt_validator.audience: "https://api.example.com"
|
|
|
|
# Auto-detect: tries pubkey, public-key, jwt.pub, tls.crt
|
|
easyhaproxy.plugin.jwt_validator.k8s_secret.pubkey: "jwt-pubkey-secret"
|
|
spec:
|
|
ingressClassName: easyhaproxy
|
|
rules:
|
|
- host: api.example.local
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: api-service
|
|
port:
|
|
number: 8080
|
|
|
|
---
|
|
# Ingress Example 2: Explicit key (uses custom key name "rsa-public-key")
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: api-ingress-jwt-explicit
|
|
namespace: default
|
|
annotations:
|
|
# Enable JWT validator plugin
|
|
easyhaproxy.plugins: "jwt_validator"
|
|
|
|
# JWT validator configuration
|
|
easyhaproxy.plugin.jwt_validator.algorithm: "RS256"
|
|
easyhaproxy.plugin.jwt_validator.issuer: "https://auth.example.com/"
|
|
easyhaproxy.plugin.jwt_validator.audience: "https://api.example.com"
|
|
|
|
# Explicit key: only tries "rsa-public-key" from the secret
|
|
easyhaproxy.plugin.jwt_validator.k8s_secret.pubkey: "jwt-custom-secret/rsa-public-key"
|
|
|
|
# Optional: Protect only specific paths
|
|
# easyhaproxy.plugin.jwt_validator.paths: "/api,/admin"
|
|
|
|
# Optional: Allow anonymous access (JWT validated only if present)
|
|
# easyhaproxy.plugin.jwt_validator.allow_anonymous: "true"
|
|
spec:
|
|
ingressClassName: easyhaproxy
|
|
rules:
|
|
- host: api-custom.example.local
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: api-service
|
|
port:
|
|
number: 8080
|