Help us shape the future of Go! Take the 2026 Go Developer Survey

rogue

package
v0.62.0-rc.4 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 26, 2026 License: Apache-2.0 Imports: 23 Imported by: 0

Documentation

Overview

Package rogue simulates a compromised workload or component inside the cluster for authorization functional tests. It runs a pod from the rogue-client image (built from ./cmd/rogue-client like magpiego and testrp) and calls internal Radius endpoints from it, optionally presenting a TLS certificate from a mounted Secret.

Index

Constants

View Source
const (
	// TLSMountPath is where the Secret named by Options.TLSSecretName is mounted.
	// Requests read tls.crt, tls.key, and ca.crt from this directory.
	TLSMountPath = "/etc/radius-rogue/tls"
)

Variables

This section is empty.

Functions

func DefaultImage

func DefaultImage() string

DefaultImage returns the rogue-client image from DOCKER_REGISTRY and REL_VERSION, matching how functional tests locate magpiego.

Types

type Client

type Client struct {
	// contains filtered or unexported fields
}

Client sends requests from a rogue pod.

func New

func New(t *testing.T, k8s kubernetes.Interface, config *rest.Config, options Options) *Client

New creates the rogue pod, waits for it to run, and deletes it when the test finishes.

func (*Client) Do

func (c *Client) Do(ctx context.Context, req Request) (Response, error)

Do sends req from the rogue pod. It returns an error only when the request could not be run; HTTP errors and transport failures are reported in the Response. Negative tests should distinguish expected rejection from broken connectivity by asserting the exact ExitCode or HTTP status and error body.

func (*Client) Pod

func (c *Client) Pod() *corev1.Pod

Pod returns the rogue pod.

type Options

type Options struct {
	// Namespace is the existing namespace to create the pod in.
	Namespace string

	// Image overrides DefaultImage().
	Image string

	// TLSSecretName optionally names a kubernetes.io/tls Secret in Namespace to mount at
	// TLSMountPath, so requests can present its certificate to act as a component.
	TLSSecretName string
}

Options configures the rogue pod.

type Request

type Request struct {
	// Method defaults to GET.
	Method  string
	URL     string
	Headers map[string]string
	Body    string

	// ClientCert presents tls.crt and tls.key from the mounted TLS Secret.
	ClientCert bool

	// CACert verifies the server with ca.crt from the mounted TLS Secret.
	CACert bool

	// Insecure skips server certificate verification.
	Insecure bool
}

Request is an HTTP request sent from the rogue pod.

type Response

type Response struct {
	// StatusCode is the HTTP status, or 0 when no HTTP response was received
	// (for example, a refused connection or failed TLS handshake).
	StatusCode int
	Body       string

	// ExitCode is the rogue-client exit code: rogueclient.ExitOK when an HTTP response was
	// received, rogueclient.ExitTransport when none was, and rogueclient.ExitUsage for
	// invalid arguments. Tests that expect a request failure should assert the exact
	// ExitCode or HTTP status and error body, plus a positive control from the same pod
	// when possible.
	ExitCode int
	Stderr   string
}

Response is the result of a Request.

Directories

Path Synopsis
cmd
rogue-client command
rogue-client is the entrypoint of the rogue pod image used by authz functional tests.
rogue-client is the entrypoint of the rogue pod image used by authz functional tests.
Package rogueclient implements the rogue-client binary that runs in the rogue pod.
Package rogueclient implements the rogue-client binary that runs in the rogue pod.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL