|
| 1 | +package framework |
| 2 | + |
| 3 | +import ( |
| 4 | + "context" |
| 5 | + "fmt" |
| 6 | + "net/http" |
| 7 | + "strings" |
| 8 | + "time" |
| 9 | + |
| 10 | + core "k8s.io/api/core/v1" |
| 11 | + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
| 12 | + "k8s.io/client-go/kubernetes" |
| 13 | + "k8s.io/client-go/kubernetes/scheme" |
| 14 | + "k8s.io/client-go/rest" |
| 15 | + "k8s.io/client-go/tools/remotecommand" |
| 16 | +) |
| 17 | + |
| 18 | +// ExpectedNginxField contains an nginx directive key and value, |
| 19 | +// and the expected file, server, and location block that it should exist in. |
| 20 | +type ExpectedNginxField struct { |
| 21 | + // Key is the directive name. |
| 22 | + Key string |
| 23 | + // Value is the value for the directive. Can be the full value or a substring. |
| 24 | + Value string |
| 25 | + // File is the file name that should contain the directive. Can be a full filename or a substring. |
| 26 | + File string |
| 27 | + // Location is the location name that the directive should exist in. |
| 28 | + Location string |
| 29 | + // Servers are the server names that the directive should exist in. |
| 30 | + Servers []string |
| 31 | + // ValueSubstringAllowed allows the expected value to be a substring of the real value. |
| 32 | + // This makes it easier for cases when real values are complex file names or contain things we |
| 33 | + // don't care about, and we just want to check if a substring exists. |
| 34 | + ValueSubstringAllowed bool |
| 35 | +} |
| 36 | + |
| 37 | +// ValidateNginxFieldExists accepts the nginx config and the configuration for the expected field, |
| 38 | +// and returns whether or not that field exists where it should. |
| 39 | +func ValidateNginxFieldExists(conf *Payload, expFieldCfg ExpectedNginxField) bool { |
| 40 | + for _, config := range conf.Config { |
| 41 | + if !strings.Contains(config.File, expFieldCfg.File) { |
| 42 | + continue |
| 43 | + } |
| 44 | + |
| 45 | + for _, directive := range config.Parsed { |
| 46 | + if len(expFieldCfg.Servers) == 0 { |
| 47 | + if expFieldCfg.fieldFound(directive) { |
| 48 | + return true |
| 49 | + } |
| 50 | + continue |
| 51 | + } |
| 52 | + |
| 53 | + for _, serverName := range expFieldCfg.Servers { |
| 54 | + if directive.Directive == "server" && getServerName(directive.Block) == serverName { |
| 55 | + for _, serverDirective := range directive.Block { |
| 56 | + if expFieldCfg.Location == "" && expFieldCfg.fieldFound(serverDirective) { |
| 57 | + return true |
| 58 | + } else if serverDirective.Directive == "location" && |
| 59 | + fieldExistsInLocation(serverDirective, expFieldCfg) { |
| 60 | + return true |
| 61 | + } |
| 62 | + } |
| 63 | + } |
| 64 | + } |
| 65 | + } |
| 66 | + } |
| 67 | + |
| 68 | + return false |
| 69 | +} |
| 70 | + |
| 71 | +func getServerName(serverBlock Directives) string { |
| 72 | + for _, directive := range serverBlock { |
| 73 | + if directive.Directive == "server_name" { |
| 74 | + return directive.Args[0] |
| 75 | + } |
| 76 | + } |
| 77 | + |
| 78 | + return "" |
| 79 | +} |
| 80 | + |
| 81 | +func (e ExpectedNginxField) fieldFound(directive *Directive) bool { |
| 82 | + arg := strings.Join(directive.Args, " ") |
| 83 | + |
| 84 | + valueMatch := arg == e.Value |
| 85 | + if e.ValueSubstringAllowed { |
| 86 | + valueMatch = strings.Contains(arg, e.Value) |
| 87 | + } |
| 88 | + |
| 89 | + return directive.Directive == e.Key && valueMatch |
| 90 | +} |
| 91 | + |
| 92 | +func fieldExistsInLocation(serverDirective *Directive, expFieldCfg ExpectedNginxField) bool { |
| 93 | + // location could start with '=', so get the last element which is the path |
| 94 | + loc := serverDirective.Args[len(serverDirective.Args)-1] |
| 95 | + if loc == expFieldCfg.Location { |
| 96 | + for _, locDirective := range serverDirective.Block { |
| 97 | + if expFieldCfg.fieldFound(locDirective) { |
| 98 | + return true |
| 99 | + } |
| 100 | + } |
| 101 | + } |
| 102 | + |
| 103 | + return false |
| 104 | +} |
| 105 | + |
| 106 | +// injectCrossplaneContainer adds an ephemeral container that contains crossplane for parsing |
| 107 | +// nginx config. It attaches to the nginx container and shares volumes with it. |
| 108 | +func injectCrossplaneContainer( |
| 109 | + k8sClient kubernetes.Interface, |
| 110 | + timeout time.Duration, |
| 111 | + ngfPodName, |
| 112 | + namespace string, |
| 113 | +) error { |
| 114 | + ctx, cancel := context.WithTimeout(context.Background(), timeout) |
| 115 | + defer cancel() |
| 116 | + |
| 117 | + pod := &core.Pod{ |
| 118 | + ObjectMeta: metav1.ObjectMeta{ |
| 119 | + Name: ngfPodName, |
| 120 | + Namespace: namespace, |
| 121 | + }, |
| 122 | + Spec: core.PodSpec{ |
| 123 | + EphemeralContainers: []core.EphemeralContainer{ |
| 124 | + { |
| 125 | + TargetContainerName: "nginx", |
| 126 | + EphemeralContainerCommon: core.EphemeralContainerCommon{ |
| 127 | + Name: "crossplane", |
| 128 | + Image: "nginx-crossplane:latest", |
| 129 | + ImagePullPolicy: "Never", |
| 130 | + Stdin: true, |
| 131 | + VolumeMounts: []core.VolumeMount{ |
| 132 | + { |
| 133 | + MountPath: "/etc/nginx/conf.d", |
| 134 | + Name: "nginx-conf", |
| 135 | + }, |
| 136 | + { |
| 137 | + MountPath: "/etc/nginx/stream-conf.d", |
| 138 | + Name: "nginx-stream-conf", |
| 139 | + }, |
| 140 | + { |
| 141 | + MountPath: "/etc/nginx/module-includes", |
| 142 | + Name: "module-includes", |
| 143 | + }, |
| 144 | + { |
| 145 | + MountPath: "/etc/nginx/secrets", |
| 146 | + Name: "nginx-secrets", |
| 147 | + }, |
| 148 | + { |
| 149 | + MountPath: "/etc/nginx/includes", |
| 150 | + Name: "nginx-includes", |
| 151 | + }, |
| 152 | + }, |
| 153 | + }, |
| 154 | + }, |
| 155 | + }, |
| 156 | + }, |
| 157 | + } |
| 158 | + |
| 159 | + podClient := k8sClient.CoreV1().Pods(namespace) |
| 160 | + if _, err := podClient.UpdateEphemeralContainers(ctx, ngfPodName, pod, metav1.UpdateOptions{}); err != nil { |
| 161 | + return fmt.Errorf("error adding ephemeral container: %w", err) |
| 162 | + } |
| 163 | + |
| 164 | + return nil |
| 165 | +} |
| 166 | + |
| 167 | +// createCrossplaneExecutor creates the executor for the crossplane command. |
| 168 | +func createCrossplaneExecutor( |
| 169 | + k8sClient kubernetes.Interface, |
| 170 | + k8sConfig *rest.Config, |
| 171 | + ngfPodName, |
| 172 | + namespace string, |
| 173 | +) (remotecommand.Executor, error) { |
| 174 | + cmd := []string{"crossplane", "parse", "/etc/nginx/nginx.conf"} |
| 175 | + opts := &core.PodExecOptions{ |
| 176 | + Command: cmd, |
| 177 | + Container: "crossplane", |
| 178 | + Stdout: true, |
| 179 | + Stderr: true, |
| 180 | + } |
| 181 | + |
| 182 | + req := k8sClient.CoreV1().RESTClient().Post(). |
| 183 | + Resource("pods"). |
| 184 | + SubResource("exec"). |
| 185 | + Name(ngfPodName). |
| 186 | + Namespace(namespace). |
| 187 | + VersionedParams(opts, scheme.ParameterCodec) |
| 188 | + |
| 189 | + exec, err := remotecommand.NewSPDYExecutor(k8sConfig, http.MethodPost, req.URL()) |
| 190 | + if err != nil { |
| 191 | + return nil, fmt.Errorf("error creating executor: %w", err) |
| 192 | + } |
| 193 | + |
| 194 | + return exec, nil |
| 195 | +} |
| 196 | + |
| 197 | +// The following types are copied from https://github.com/nginxinc/nginx-go-crossplane, |
| 198 | +// with unnecessary fields stripped out. |
| 199 | +type Payload struct { |
| 200 | + Config []Config `json:"config"` |
| 201 | +} |
| 202 | + |
| 203 | +type Config struct { |
| 204 | + File string `json:"file"` |
| 205 | + Parsed Directives `json:"parsed"` |
| 206 | +} |
| 207 | + |
| 208 | +type Directive struct { |
| 209 | + Comment *string `json:"comment,omitempty"` |
| 210 | + Directive string `json:"directive"` |
| 211 | + File string `json:"file,omitempty"` |
| 212 | + Args []string `json:"args"` |
| 213 | + Includes []int `json:"includes,omitempty"` |
| 214 | + Block Directives `json:"block,omitempty"` |
| 215 | + Line int `json:"line"` |
| 216 | +} |
| 217 | + |
| 218 | +type Directives []*Directive |
0 commit comments