Skip to content

Commit d2c30a3

Browse files
markuskoblermarkuskobler
committed
Adding more agw backend tests
Signed-off-by: Markus Kobler <[email protected]>
1 parent 8a12cc3 commit d2c30a3

File tree

9 files changed

+217
-13
lines changed

9 files changed

+217
-13
lines changed

‎pkg/agentgateway/plugins/backend_policies.go‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,11 @@ func translateBackendPolicyToAgw(
9393
}
9494

9595
if backend.MCP.Authentication != nil {
96-
pol := translateBackendMCPAuthentication(ctx, policy, policyTarget)
96+
pol, err := translateBackendMCPAuthentication(ctx, policy, policyTarget)
97+
if err != nil {
98+
logger.Error("error processing backend mcp auth", "err", err)
99+
errs = append(errs, err)
100+
}
97101
agwPolicies = append(agwPolicies, pol...)
98102
}
99103
}
@@ -280,14 +284,14 @@ func translateBackendMCPAuthorization(policy *agentgateway.AgentgatewayPolicy, t
280284
return []AgwPolicy{{Policy: mcpPolicy}}
281285
}
282286

283-
func translateBackendMCPAuthentication(ctx PolicyCtx, policy *agentgateway.AgentgatewayPolicy, target *api.PolicyTarget) []AgwPolicy {
287+
func translateBackendMCPAuthentication(ctx PolicyCtx, policy *agentgateway.AgentgatewayPolicy, target *api.PolicyTarget) ([]AgwPolicy, error) {
284288
backend := policy.Spec.Backend
285289
if backend == nil || backend.MCP == nil || backend.MCP.Authentication == nil {
286-
return nil
290+
return nil, nil
287291
}
288292
authnPolicy := backend.MCP.Authentication
289293
if authnPolicy == nil {
290-
return nil
294+
return nil, nil
291295
}
292296

293297
idp := api.BackendPolicySpec_McpAuthentication_AUTH0
@@ -298,9 +302,10 @@ func translateBackendMCPAuthentication(ctx PolicyCtx, policy *agentgateway.Agent
298302
translatedInlineJwks, err := resolveRemoteJWKSInline(ctx, authnPolicy.JWKS.JwksUri)
299303
if err != nil {
300304
logger.Error("failed resolving jwks", "jwks_uri", authnPolicy.JWKS.JwksUri, "error", err)
301-
return nil
305+
return nil, err
302306
}
303307

308+
var errs []error
304309
var extraResourceMetadata map[string]*structpb.Value
305310
for k, v := range authnPolicy.ResourceMetadata {
306311
if extraResourceMetadata == nil {
@@ -310,6 +315,7 @@ func translateBackendMCPAuthentication(ctx PolicyCtx, policy *agentgateway.Agent
310315
pbVal, err := structpb.NewValue(v)
311316
if err != nil {
312317
logger.Error("error converting resource metadata", "key", k, "error", err)
318+
errs = append(errs, err)
313319
continue
314320
}
315321

@@ -341,7 +347,7 @@ func translateBackendMCPAuthentication(ctx PolicyCtx, policy *agentgateway.Agent
341347
"policy", policy.Name,
342348
"agentgateway_policy", mcpAuthnPolicy.Name)
343349

344-
return []AgwPolicy{{Policy: mcpAuthnPolicy}}
350+
return []AgwPolicy{{Policy: mcpAuthnPolicy}}, errors.Join(errs...)
345351
}
346352

347353
// translateBackendAI processes AI configuration and creates corresponding Agw policies

pkg/kgateway/agentgatewaysyncer/backend/testdata/backend/backend-secret-not-found.yaml renamed to pkg/kgateway/agentgatewaysyncer/backend/testdata/backend/ai-auth-secret-ref-not-found.yaml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,17 @@
11
apiVersion: agentgateway.dev/v1alpha1
22
kind: AgentgatewayBackend
33
metadata:
4-
name: openai-backend
54
namespace: default
5+
name: openai-backend
66
spec:
7-
policies:
8-
auth:
9-
secretRef:
10-
name: missing-secret
117
ai:
128
provider:
139
openai:
1410
model: gpt-4
11+
policies:
12+
auth:
13+
secretRef:
14+
name: missing-secret
1515
---
1616
# Output
1717
output:

pkg/kgateway/agentgatewaysyncer/backend/testdata/backend/backend-secret.yaml renamed to pkg/kgateway/agentgatewaysyncer/backend/testdata/backend/ai-auth-secret-ref.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
apiVersion: agentgateway.dev/v1alpha1
22
kind: AgentgatewayBackend
33
metadata:
4-
name: anthropic-backend
54
namespace: default
5+
name: anthropic-backend
66
spec:
77
ai:
88
provider:

‎pkg/kgateway/agentgatewaysyncer/backend/testdata/backend/ai-webhook-backend-ref-not-found.yaml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
apiVersion: agentgateway.dev/v1alpha1
2+
kind: AgentgatewayBackend
3+
metadata:
4+
namespace: default
5+
name: anthropic-backend
6+
spec:
7+
ai:
8+
provider:
9+
anthropic:
10+
model: claude-4-5-sonnet
11+
policies:
12+
ai:
13+
promptGuard:
14+
request:
15+
- webhook:
16+
backendRef:
17+
name: invalid-request-ref
18+
port: 123
19+
response:
20+
- webhook:
21+
backendRef:
22+
name: invalid-response-ref
23+
port: 456
24+
---
25+
# Output
26+
output:
27+
- gateway:
28+
Name: ""
29+
Namespace: ""
30+
resource:
31+
backend:
32+
ai:
33+
providerGroups:
34+
- providers:
35+
- anthropic:
36+
model: claude-4-5-sonnet
37+
name: backend
38+
inlinePolicies:
39+
- ai:
40+
promptGuard: {}
41+
key: default/anthropic-backend
42+
name:
43+
name: anthropic-backend
44+
namespace: default
45+
status:
46+
conditions:
47+
- lastTransitionTime: fake
48+
message: Backend successfully accepted
49+
reason: Accepted
50+
status: "True"
51+
type: Accepted

‎pkg/kgateway/agentgatewaysyncer/backend/testdata/backend/mcp-authentication-jwks-store-init.yaml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
apiVersion: agentgateway.dev/v1alpha1
2+
kind: AgentgatewayBackend
3+
metadata:
4+
namespace: default
5+
name: mcp-backend
6+
spec:
7+
mcp:
8+
targets:
9+
- name: mcp-example
10+
selector:
11+
namespaces:
12+
matchLabels:
13+
kubernetes.io/metadata.name: mcp-servers
14+
policies:
15+
mcp:
16+
authentication:
17+
jwks:
18+
uri: http://store-uninitialized/
19+
---
20+
# Output
21+
output:
22+
- gateway:
23+
Name: ""
24+
Namespace: ""
25+
resource:
26+
backend:
27+
key: default/mcp-backend
28+
mcp: {}
29+
name:
30+
name: mcp-backend
31+
namespace: default
32+
status:
33+
conditions:
34+
- lastTransitionTime: fake
35+
message: Backend successfully accepted
36+
reason: Accepted
37+
status: "True"
38+
type: Accepted

‎pkg/kgateway/agentgatewaysyncer/backend/testdata/backend/static-auth-passthrough.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
apiVersion: agentgateway.dev/v1alpha1
2+
kind: AgentgatewayBackend
3+
metadata:
4+
namespace: default
5+
name: static-backend
6+
spec:
7+
static:
8+
host: example.com
9+
port: 8888
10+
policies:
11+
auth:
12+
# kubebuilder:validate allows this but `translateBackendAuth` exepects "inline key or secretRef"
13+
passthrough: {}
14+
---
15+
# Output
16+
output:
17+
- gateway:
18+
Name: ""
19+
Namespace: ""
20+
resource:
21+
backend:
22+
key: default/static-backend
23+
name:
24+
name: static-backend
25+
namespace: default
26+
static:
27+
host: example.com
28+
port: 8888
29+
status:
30+
conditions:
31+
- lastTransitionTime: fake
32+
message: Backend successfully accepted
33+
reason: Accepted
34+
status: "True"
35+
type: Accepted

‎pkg/kgateway/agentgatewaysyncer/backend/testdata/backend/static-secrets-not-found.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
apiVersion: agentgateway.dev/v1alpha1
2+
kind: AgentgatewayBackend
3+
metadata:
4+
namespace: default
5+
name: static-backend
6+
spec:
7+
static:
8+
host: example.com
9+
port: 8888
10+
policies:
11+
auth:
12+
secretRef:
13+
name: missing-secret
14+
---
15+
# Output
16+
output:
17+
- gateway:
18+
Name: ""
19+
Namespace: ""
20+
resource:
21+
backend:
22+
key: default/static-backend
23+
name:
24+
name: static-backend
25+
namespace: default
26+
static:
27+
host: example.com
28+
port: 8888
29+
status:
30+
conditions:
31+
- lastTransitionTime: fake
32+
message: Backend successfully accepted
33+
reason: Accepted
34+
status: "True"
35+
type: Accepted

‎pkg/kgateway/agentgatewaysyncer/backend/testdata/backend/static-tls-ca-bundle-not-found.yaml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
apiVersion: agentgateway.dev/v1alpha1
2+
kind: AgentgatewayBackend
3+
metadata:
4+
namespace: default
5+
name: tls-backend
6+
spec:
7+
static:
8+
host: example.com
9+
port: 8888
10+
policies:
11+
tls:
12+
mtlsCertificateRef:
13+
- name: unknown-mtls
14+
caCertificateRefs:
15+
- name: unknown-ca-bundle
16+
---
17+
# Output
18+
output:
19+
- gateway:
20+
Name: ""
21+
Namespace: ""
22+
resource:
23+
backend:
24+
inlinePolicies:
25+
- backendTls: {}
26+
key: default/tls-backend
27+
name:
28+
name: tls-backend
29+
namespace: default
30+
static:
31+
host: example.com
32+
port: 8888
33+
status:
34+
conditions:
35+
- lastTransitionTime: fake
36+
message: Backend successfully accepted
37+
reason: Accepted
38+
status: "True"
39+
type: Accepted

‎pkg/kgateway/agentgatewaysyncer/backend/translate_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -723,7 +723,7 @@ func createMockMCPService(namespace, serviceName, labels string) *corev1.Service
723723
return mockService
724724
}
725725

726-
// createMockServiceCollectionMultiNamespace creates a mock service collection with services in multiple namespaces
726+
// createMockMultipleNamespaceServices creates a mock service collection with services in multiple namespaces
727727
func createMockMultipleNamespaceServices() []any {
728728
services := []any{
729729
&corev1.Service{

0 commit comments

Comments
 (0)