Skip to content

Commit df7fa25

Browse files
k8s-infra-cherrypick-robotoyiz-michael
k8s-infra-cherrypick-robot
and
oyiz-michael
authored
Tests: Enhance SSL Proxy. (#13784)
Co-authored-by: Michael <[email protected]>
1 parent 8db513c commit df7fa25

File tree

1 file changed

+150
-2
lines changed

1 file changed

+150
-2
lines changed

‎pkg/flags/flags_test.go‎

Lines changed: 150 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@ import (
2020
"os"
2121
"testing"
2222
"time"
23+
24+
"k8s.io/ingress-nginx/internal/ingress/controller"
25+
"k8s.io/ingress-nginx/internal/ingress/controller/config"
2326
)
2427

2528
func TestNoMandatoryFlag(t *testing.T) {
@@ -55,8 +58,153 @@ func TestDefaults(t *testing.T) {
5558
}
5659
}
5760

58-
func TestSetupSSLProxy(_ *testing.T) {
59-
// TODO TestSetupSSLProxy
61+
func TestSetupSSLProxy(t *testing.T) {
62+
tests := []struct {
63+
name string
64+
args []string
65+
expectError bool
66+
description string
67+
validateConfig func(t *testing.T, _ bool, cfg *controller.Configuration)
68+
}{
69+
{
70+
name: "valid SSL proxy configuration with passthrough enabled",
71+
args: []string{"cmd", "--enable-ssl-passthrough", "--ssl-passthrough-proxy-port", "9999"},
72+
expectError: false,
73+
description: "Should accept valid SSL proxy port with passthrough enabled",
74+
validateConfig: func(t *testing.T, _ bool, cfg *controller.Configuration) {
75+
if !cfg.EnableSSLPassthrough {
76+
t.Error("Expected EnableSSLPassthrough to be true")
77+
}
78+
if cfg.ListenPorts.SSLProxy != 9999 {
79+
t.Errorf("Expected SSLProxy port to be 9999, got %d", cfg.ListenPorts.SSLProxy)
80+
}
81+
},
82+
},
83+
{
84+
name: "SSL proxy port without explicit passthrough enabling",
85+
args: []string{"cmd", "--ssl-passthrough-proxy-port", "8443"},
86+
expectError: false,
87+
description: "Should accept SSL proxy port configuration without explicit passthrough enable",
88+
validateConfig: func(t *testing.T, _ bool, cfg *controller.Configuration) {
89+
if cfg.ListenPorts.SSLProxy != 8443 {
90+
t.Errorf("Expected SSLProxy port to be 8443, got %d", cfg.ListenPorts.SSLProxy)
91+
}
92+
},
93+
},
94+
{
95+
name: "SSL proxy with default backend service",
96+
args: []string{"cmd", "--enable-ssl-passthrough", "--default-backend-service", "default/backend", "--ssl-passthrough-proxy-port", "9000"},
97+
expectError: false,
98+
description: "Should work with default backend service and SSL passthrough",
99+
validateConfig: func(t *testing.T, _ bool, cfg *controller.Configuration) {
100+
if !cfg.EnableSSLPassthrough {
101+
t.Error("Expected EnableSSLPassthrough to be true")
102+
}
103+
if cfg.DefaultService != "default/backend" {
104+
t.Errorf("Expected DefaultService to be 'default/backend', got %s", cfg.DefaultService)
105+
}
106+
if cfg.ListenPorts.SSLProxy != 9000 {
107+
t.Errorf("Expected SSLProxy port to be 9000, got %d", cfg.ListenPorts.SSLProxy)
108+
}
109+
},
110+
},
111+
{
112+
name: "SSL proxy with default SSL certificate",
113+
args: []string{"cmd", "--enable-ssl-passthrough", "--default-ssl-certificate", "default/tls-cert", "--ssl-passthrough-proxy-port", "8080"},
114+
expectError: false,
115+
description: "Should work with default SSL certificate and passthrough",
116+
validateConfig: func(t *testing.T, _ bool, cfg *controller.Configuration) {
117+
if !cfg.EnableSSLPassthrough {
118+
t.Error("Expected EnableSSLPassthrough to be true")
119+
}
120+
if cfg.DefaultSSLCertificate != "default/tls-cert" {
121+
t.Errorf("Expected DefaultSSLCertificate to be 'default/tls-cert', got %s", cfg.DefaultSSLCertificate)
122+
}
123+
if cfg.ListenPorts.SSLProxy != 8080 {
124+
t.Errorf("Expected SSLProxy port to be 8080, got %d", cfg.ListenPorts.SSLProxy)
125+
}
126+
},
127+
},
128+
{
129+
name: "SSL proxy with chain completion enabled",
130+
args: []string{"cmd", "--enable-ssl-passthrough", "--enable-ssl-chain-completion", "--ssl-passthrough-proxy-port", "7443"},
131+
expectError: false,
132+
description: "Should work with SSL chain completion and passthrough",
133+
validateConfig: func(t *testing.T, _ bool, cfg *controller.Configuration) {
134+
if !cfg.EnableSSLPassthrough {
135+
t.Error("Expected EnableSSLPassthrough to be true")
136+
}
137+
if !config.EnableSSLChainCompletion {
138+
t.Error("Expected EnableSSLChainCompletion to be true")
139+
}
140+
if cfg.ListenPorts.SSLProxy != 7443 {
141+
t.Errorf("Expected SSLProxy port to be 7443, got %d", cfg.ListenPorts.SSLProxy)
142+
}
143+
},
144+
},
145+
{
146+
name: "SSL proxy with minimal configuration",
147+
args: []string{"cmd", "--enable-ssl-passthrough"},
148+
expectError: false,
149+
description: "Should work with minimal SSL passthrough configuration using default port",
150+
validateConfig: func(t *testing.T, _ bool, cfg *controller.Configuration) {
151+
if !cfg.EnableSSLPassthrough {
152+
t.Error("Expected EnableSSLPassthrough to be true")
153+
}
154+
// Default port should be 442
155+
if cfg.ListenPorts.SSLProxy != 442 {
156+
t.Errorf("Expected default SSLProxy port to be 442, got %d", cfg.ListenPorts.SSLProxy)
157+
}
158+
},
159+
},
160+
{
161+
name: "SSL proxy with comprehensive configuration",
162+
args: []string{"cmd", "--enable-ssl-passthrough", "--enable-ssl-chain-completion", "--default-ssl-certificate", "kube-system/default-cert", "--default-backend-service", "kube-system/default-backend", "--ssl-passthrough-proxy-port", "10443"},
163+
expectError: false,
164+
description: "Should work with comprehensive SSL proxy configuration",
165+
validateConfig: func(t *testing.T, _ bool, cfg *controller.Configuration) {
166+
if !cfg.EnableSSLPassthrough {
167+
t.Error("Expected EnableSSLPassthrough to be true")
168+
}
169+
if !config.EnableSSLChainCompletion {
170+
t.Error("Expected EnableSSLChainCompletion to be true")
171+
}
172+
if cfg.DefaultSSLCertificate != "kube-system/default-cert" {
173+
t.Errorf("Expected DefaultSSLCertificate to be 'kube-system/default-cert', got %s", cfg.DefaultSSLCertificate)
174+
}
175+
if cfg.DefaultService != "kube-system/default-backend" {
176+
t.Errorf("Expected DefaultService to be 'kube-system/default-backend', got %s", cfg.DefaultService)
177+
}
178+
if cfg.ListenPorts.SSLProxy != 10443 {
179+
t.Errorf("Expected SSLProxy port to be 10443, got %d", cfg.ListenPorts.SSLProxy)
180+
}
181+
},
182+
},
183+
}
184+
185+
for _, tt := range tests {
186+
t.Run(tt.name, func(t *testing.T) {
187+
ResetForTesting(func() { t.Fatal("Parsing failed") })
188+
189+
oldArgs := os.Args
190+
defer func() { os.Args = oldArgs }()
191+
192+
os.Args = tt.args
193+
194+
showVersion, cfg, err := ParseFlags()
195+
if tt.expectError && err == nil {
196+
t.Fatalf("Expected error for %s, but got none", tt.description)
197+
}
198+
if !tt.expectError && err != nil {
199+
t.Fatalf("Expected no error for %s, got: %v", tt.description, err)
200+
}
201+
202+
// Run additional validation if provided and no error occurred
203+
if !tt.expectError && tt.validateConfig != nil {
204+
tt.validateConfig(t, showVersion, cfg)
205+
}
206+
})
207+
}
60208
}
61209

62210
func TestFlagConflict(t *testing.T) {

0 commit comments

Comments
 (0)