You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by al...@apache.org on 2026/04/27 07:49:02 UTC
(apisix-ingress-controller) 01/02: fix(e2e): add skip guards and redesign ADC validation tests
This is an automated email from the ASF dual-hosted git repository.
AlinsRan pushed a commit to branch feat/webhook-adc-validation
in repository https://gitbox.apache.org/repos/asf/apisix-ingress-controller.git
commit 10d76b4cf0b74abf1235a33580e5ebf961eba827
Author: rongxin <ro...@api7.ai>
AuthorDate: Mon Apr 27 15:46:01 2026 +0800
fix(e2e): add skip guards and redesign ADC validation tests
- Add ProviderTypeAPISIXStandalone skip guards to all ADC validation
e2e tests so they are skipped on non-standalone backends that do not
expose the /apisix/admin/configs/validate endpoint
- Replace the 'duplicate credentials' consumer tests with invalid
jwt-auth algorithm tests; APISIX validates plugin config schema in
isolation and cannot detect cross-consumer key uniqueness, but it
does reject unknown enum values (e.g. algorithm: INVALID_ALGO)
Co-authored-by: Copilot <22...@users.noreply.github.com>
---
test/e2e/webhook/apisixconsumer.go | 32 ++++++++++++++++++++------------
test/e2e/webhook/apisixroute.go | 5 +++++
test/e2e/webhook/apisixtls.go | 5 +++++
test/e2e/webhook/consumer.go | 33 ++++++++++++++++++++-------------
4 files changed, 50 insertions(+), 25 deletions(-)
diff --git a/test/e2e/webhook/apisixconsumer.go b/test/e2e/webhook/apisixconsumer.go
index 5c8cd4a0..3f123811 100644
--- a/test/e2e/webhook/apisixconsumer.go
+++ b/test/e2e/webhook/apisixconsumer.go
@@ -24,6 +24,7 @@ import (
. "github.com/onsi/ginkgo/v2"
. "github.com/onsi/gomega"
+ "github.com/apache/apisix-ingress-controller/test/e2e/framework"
"github.com/apache/apisix-ingress-controller/test/e2e/scaffold"
)
@@ -86,7 +87,11 @@ stringData:
Expect(output).NotTo(ContainSubstring(fmt.Sprintf("Warning: Referenced Secret '%s/%s' not found", s.Namespace(), missingSecret)))
})
- It("should reject duplicate credentials during ADC validation", func() {
+ It("should reject invalid plugin config during ADC validation", func() {
+ if framework.ProviderType != framework.ProviderTypeAPISIXStandalone {
+ Skip("ADC validation requires apisix-standalone backend")
+ }
+
firstConsumer := fmt.Sprintf(`
apiVersion: apisix.apache.org/v2
kind: ApisixConsumer
@@ -96,16 +101,17 @@ metadata:
spec:
ingressClassName: %s
authParameter:
- keyAuth:
+ jwtAuth:
value:
- key: shared-key
+ key: consumer-a-key
+ algorithm: HS256
`, s.Namespace(), s.Namespace())
- By("creating the first ApisixConsumer")
+ By("creating the first ApisixConsumer with valid jwt-auth config")
err := s.CreateResourceFromString(firstConsumer)
Expect(err).NotTo(HaveOccurred(), "creating first ApisixConsumer")
- secondConsumer := fmt.Sprintf(`
+ invalidConsumer := fmt.Sprintf(`
apiVersion: apisix.apache.org/v2
kind: ApisixConsumer
metadata:
@@ -114,13 +120,14 @@ metadata:
spec:
ingressClassName: %s
authParameter:
- keyAuth:
+ jwtAuth:
value:
- key: shared-key
+ key: consumer-b-key
+ algorithm: INVALID_ALGO
`, s.Namespace(), s.Namespace())
- By("creating a second ApisixConsumer with the same key")
- err = s.CreateResourceFromString(secondConsumer)
+ By("creating ApisixConsumer with an invalid jwt-auth algorithm")
+ err = s.CreateResourceFromString(invalidConsumer)
expectAdmissionDenied(s, "apisixconsumer", "webhook-apisixconsumer-b", err)
correctedConsumer := fmt.Sprintf(`
@@ -132,12 +139,13 @@ metadata:
spec:
ingressClassName: %s
authParameter:
- keyAuth:
+ jwtAuth:
value:
- key: unique-key
+ key: consumer-b-key
+ algorithm: HS256
`, s.Namespace(), s.Namespace())
- By("creating a corrected ApisixConsumer with a unique key")
+ By("creating corrected ApisixConsumer with a valid algorithm")
err = s.CreateResourceFromString(correctedConsumer)
Expect(err).NotTo(HaveOccurred(), "creating corrected ApisixConsumer")
})
diff --git a/test/e2e/webhook/apisixroute.go b/test/e2e/webhook/apisixroute.go
index 280ab87e..5a1c04d2 100644
--- a/test/e2e/webhook/apisixroute.go
+++ b/test/e2e/webhook/apisixroute.go
@@ -24,6 +24,7 @@ import (
. "github.com/onsi/ginkgo/v2"
. "github.com/onsi/gomega"
+ "github.com/apache/apisix-ingress-controller/test/e2e/framework"
"github.com/apache/apisix-ingress-controller/test/e2e/scaffold"
)
@@ -98,6 +99,10 @@ spec:
})
It("should reject routes that fail ADC validation", func() {
+ if framework.ProviderType != framework.ProviderTypeAPISIXStandalone {
+ Skip("ADC validation requires apisix-standalone backend")
+ }
+
backendService := "webhook-route-backend"
routeName := "webhook-apisixroute-invalid"
diff --git a/test/e2e/webhook/apisixtls.go b/test/e2e/webhook/apisixtls.go
index 335f6f1e..b6951a13 100644
--- a/test/e2e/webhook/apisixtls.go
+++ b/test/e2e/webhook/apisixtls.go
@@ -24,6 +24,7 @@ import (
. "github.com/onsi/ginkgo/v2"
. "github.com/onsi/gomega"
+ "github.com/apache/apisix-ingress-controller/test/e2e/framework"
"github.com/apache/apisix-ingress-controller/test/e2e/scaffold"
)
@@ -91,6 +92,10 @@ spec:
})
It("should reject invalid TLS material during ADC validation", func() {
+ if framework.ProviderType != framework.ProviderTypeAPISIXStandalone {
+ Skip("ADC validation requires apisix-standalone backend")
+ }
+
serverSecret := "invalid-server-tls"
tlsName := "webhook-apisixtls-invalid"
host := "invalid-webhook.example.com"
diff --git a/test/e2e/webhook/consumer.go b/test/e2e/webhook/consumer.go
index f312d5c9..18cc0602 100644
--- a/test/e2e/webhook/consumer.go
+++ b/test/e2e/webhook/consumer.go
@@ -24,6 +24,7 @@ import (
. "github.com/onsi/ginkgo/v2"
. "github.com/onsi/gomega"
+ "github.com/apache/apisix-ingress-controller/test/e2e/framework"
"github.com/apache/apisix-ingress-controller/test/e2e/scaffold"
)
@@ -91,7 +92,11 @@ stringData:
Expect(output).NotTo(ContainSubstring(fmt.Sprintf("Warning: Referenced Secret '%s/%s' not found", s.Namespace(), missingSecret)))
})
- It("should reject duplicate credentials during ADC validation", func() {
+ It("should reject invalid plugin config during ADC validation", func() {
+ if framework.ProviderType != framework.ProviderTypeAPISIXStandalone {
+ Skip("ADC validation requires apisix-standalone backend")
+ }
+
gatewayName := s.Namespace()
firstConsumer := fmt.Sprintf(`
@@ -106,14 +111,14 @@ spec:
- type: key-auth
name: key-auth-a
config:
- key: shared-key
+ key: consumer-a-key
`, gatewayName)
- By("creating the first Consumer")
+ By("creating the first Consumer with valid key-auth config")
err := s.CreateResourceFromString(firstConsumer)
Expect(err).NotTo(HaveOccurred(), "creating first Consumer")
- secondConsumer := fmt.Sprintf(`
+ invalidConsumer := fmt.Sprintf(`
apiVersion: apisix.apache.org/v1alpha1
kind: Consumer
metadata:
@@ -122,14 +127,15 @@ spec:
gatewayRef:
name: %s
credentials:
- - type: key-auth
- name: key-auth-b
+ - type: jwt-auth
+ name: jwt-cred
config:
- key: shared-key
+ key: consumer-b-key
+ algorithm: INVALID_ALGO
`, gatewayName)
- By("creating a second Consumer with the same key")
- err = s.CreateResourceFromString(secondConsumer)
+ By("creating Consumer with an invalid jwt-auth algorithm")
+ err = s.CreateResourceFromString(invalidConsumer)
expectAdmissionDenied(s, "consumer", "webhook-consumer-b", err)
correctedConsumer := fmt.Sprintf(`
@@ -141,13 +147,14 @@ spec:
gatewayRef:
name: %s
credentials:
- - type: key-auth
- name: key-auth-b
+ - type: jwt-auth
+ name: jwt-cred
config:
- key: unique-key
+ key: consumer-b-key
+ algorithm: HS256
`, gatewayName)
- By("creating a corrected Consumer with a unique key")
+ By("creating corrected Consumer with a valid algorithm")
err = s.CreateResourceFromString(correctedConsumer)
Expect(err).NotTo(HaveOccurred(), "creating corrected Consumer")
})