Documentation
¶
Overview ¶
Package rogue simulates a compromised workload or component inside the cluster for authorization functional tests. It runs a pod from the rogue-client image (built from ./cmd/rogue-client like magpiego and testrp) and calls internal Radius endpoints from it, optionally presenting a TLS certificate from a mounted Secret.
Index ¶
Constants ¶
const ( // TLSMountPath is where the Secret named by Options.TLSSecretName is mounted. // Requests read tls.crt, tls.key, and ca.crt from this directory. TLSMountPath = "/etc/radius-rogue/tls" )
Variables ¶
This section is empty.
Functions ¶
func DefaultImage ¶
func DefaultImage() string
DefaultImage returns the rogue-client image from DOCKER_REGISTRY and REL_VERSION, matching how functional tests locate magpiego.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client sends requests from a rogue pod.
func (*Client) Do ¶
Do sends req from the rogue pod. It returns an error only when the request could not be run; HTTP errors and transport failures are reported in the Response. Negative tests should distinguish expected rejection from broken connectivity by asserting the exact ExitCode or HTTP status and error body.
type Options ¶
type Options struct {
// Namespace is the existing namespace to create the pod in.
Namespace string
// Image overrides DefaultImage().
Image string
// TLSSecretName optionally names a kubernetes.io/tls Secret in Namespace to mount at
// TLSMountPath, so requests can present its certificate to act as a component.
TLSSecretName string
}
Options configures the rogue pod.
type Request ¶
type Request struct {
// Method defaults to GET.
Method string
URL string
Headers map[string]string
Body string
// ClientCert presents tls.crt and tls.key from the mounted TLS Secret.
ClientCert bool
// CACert verifies the server with ca.crt from the mounted TLS Secret.
CACert bool
// Insecure skips server certificate verification.
Insecure bool
}
Request is an HTTP request sent from the rogue pod.
type Response ¶
type Response struct {
// StatusCode is the HTTP status, or 0 when no HTTP response was received
// (for example, a refused connection or failed TLS handshake).
StatusCode int
Body string
// ExitCode is the rogue-client exit code: rogueclient.ExitOK when an HTTP response was
// received, rogueclient.ExitTransport when none was, and rogueclient.ExitUsage for
// invalid arguments. Tests that expect a request failure should assert the exact
// ExitCode or HTTP status and error body, plus a positive control from the same pod
// when possible.
ExitCode int
Stderr string
}
Response is the result of a Request.
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
rogue-client
command
rogue-client is the entrypoint of the rogue pod image used by authz functional tests.
|
rogue-client is the entrypoint of the rogue pod image used by authz functional tests. |
|
Package rogueclient implements the rogue-client binary that runs in the rogue pod.
|
Package rogueclient implements the rogue-client binary that runs in the rogue pod. |