Skip to content

Commit da1bc76

Browse files
markuskoblermarkuskobler
committed
Adding more agw backend tests
Signed-off-by: Markus Kobler <[email protected]>
1 parent bbb7330 commit da1bc76

File tree

9 files changed

+217
-13
lines changed

9 files changed

+217
-13
lines changed

‎pkg/agentgateway/plugins/backend_policies.go‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,11 @@ func translateBackendPolicyToAgw(
9393
}
9494

9595
if backend.MCP.Authentication != nil {
96-
pol := translateBackendMCPAuthentication(ctx, policy, policyTarget)
96+
pol, err := translateBackendMCPAuthentication(ctx, policy, policyTarget)
97+
if err != nil {
98+
logger.Error("error processing backend mcp auth", "err", err)
99+
errs = append(errs, err)
100+
}
97101
agwPolicies = append(agwPolicies, pol...)
98102
}
99103
}
@@ -283,14 +287,14 @@ func translateBackendMCPAuthorization(policy *agentgateway.AgentgatewayPolicy, t
283287
return []AgwPolicy{{Policy: mcpPolicy}}
284288
}
285289

286-
func translateBackendMCPAuthentication(ctx PolicyCtx, policy *agentgateway.AgentgatewayPolicy, target *api.PolicyTarget) []AgwPolicy {
290+
func translateBackendMCPAuthentication(ctx PolicyCtx, policy *agentgateway.AgentgatewayPolicy, target *api.PolicyTarget) ([]AgwPolicy, error) {
287291
backend := policy.Spec.Backend
288292
if backend == nil || backend.MCP == nil || backend.MCP.Authentication == nil {
289-
return nil
293+
return nil, nil
290294
}
291295
authnPolicy := backend.MCP.Authentication
292296
if authnPolicy == nil {
293-
return nil
297+
return nil, nil
294298
}
295299

296300
idp := api.BackendPolicySpec_McpAuthentication_AUTH0
@@ -301,9 +305,10 @@ func translateBackendMCPAuthentication(ctx PolicyCtx, policy *agentgateway.Agent
301305
translatedInlineJwks, err := resolveRemoteJWKSInline(ctx, authnPolicy.JWKS.JwksUri)
302306
if err != nil {
303307
logger.Error("failed resolving jwks", "jwks_uri", authnPolicy.JWKS.JwksUri, "error", err)
304-
return nil
308+
return nil, err
305309
}
306310

311+
var errs []error
307312
var extraResourceMetadata map[string]*structpb.Value
308313
for k, v := range authnPolicy.ResourceMetadata {
309314
if extraResourceMetadata == nil {
@@ -313,6 +318,7 @@ func translateBackendMCPAuthentication(ctx PolicyCtx, policy *agentgateway.Agent
313318
pbVal, err := structpb.NewValue(v)
314319
if err != nil {
315320
logger.Error("error converting resource metadata", "key", k, "error", err)
321+
errs = append(errs, err)
316322
continue
317323
}
318324

@@ -345,7 +351,7 @@ func translateBackendMCPAuthentication(ctx PolicyCtx, policy *agentgateway.Agent
345351
"policy", policy.Name,
346352
"agentgateway_policy", mcpAuthnPolicy.Name)
347353

348-
return []AgwPolicy{{Policy: mcpAuthnPolicy}}
354+
return []AgwPolicy{{Policy: mcpAuthnPolicy}}, errors.Join(errs...)
349355
}
350356

351357
// translateBackendAI processes AI configuration and creates corresponding Agw policies

pkg/kgateway/agentgatewaysyncer/backend/testdata/backend/backend-secret-not-found.yaml renamed to pkg/kgateway/agentgatewaysyncer/backend/testdata/backend/ai-auth-secret-ref-not-found.yaml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,17 @@
11
apiVersion: agentgateway.dev/v1alpha1
22
kind: AgentgatewayBackend
33
metadata:
4-
name: openai-backend
54
namespace: default
5+
name: openai-backend
66
spec:
7-
policies:
8-
auth:
9-
secretRef:
10-
name: missing-secret
117
ai:
128
provider:
139
openai:
1410
model: gpt-4
11+
policies:
12+
auth:
13+
secretRef:
14+
name: missing-secret
1515
---
1616
# Output
1717
output:

pkg/kgateway/agentgatewaysyncer/backend/testdata/backend/backend-secret.yaml renamed to pkg/kgateway/agentgatewaysyncer/backend/testdata/backend/ai-auth-secret-ref.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
apiVersion: agentgateway.dev/v1alpha1
22
kind: AgentgatewayBackend
33
metadata:
4-
name: anthropic-backend
54
namespace: default
5+
name: anthropic-backend
66
spec:
77
ai:
88
provider:

‎pkg/kgateway/agentgatewaysyncer/backend/testdata/backend/ai-webhook-backend-ref-not-found.yaml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
apiVersion: agentgateway.dev/v1alpha1
2+
kind: AgentgatewayBackend
3+
metadata:
4+
namespace: default
5+
name: anthropic-backend
6+
spec:
7+
ai:
8+
provider:
9+
anthropic:
10+
model: claude-4-5-sonnet
11+
policies:
12+
ai:
13+
promptGuard:
14+
request:
15+
- webhook:
16+
backendRef:
17+
name: invalid-request-ref
18+
port: 123
19+
response:
20+
- webhook:
21+
backendRef:
22+
name: invalid-response-ref
23+
port: 456
24+
---
25+
# Output
26+
output:
27+
- gateway:
28+
Name: ""
29+
Namespace: ""
30+
resource:
31+
backend:
32+
ai:
33+
providerGroups:
34+
- providers:
35+
- anthropic:
36+
model: claude-4-5-sonnet
37+
name: backend
38+
inlinePolicies:
39+
- ai:
40+
promptGuard: {}
41+
key: default/anthropic-backend
42+
name:
43+
name: anthropic-backend
44+
namespace: default
45+
status:
46+
conditions:
47+
- lastTransitionTime: fake
48+
message: Backend successfully accepted
49+
reason: Accepted
50+
status: "True"
51+
type: Accepted

‎pkg/kgateway/agentgatewaysyncer/backend/testdata/backend/mcp-authentication-jwks-store-init.yaml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
apiVersion: agentgateway.dev/v1alpha1
2+
kind: AgentgatewayBackend
3+
metadata:
4+
namespace: default
5+
name: mcp-backend
6+
spec:
7+
mcp:
8+
targets:
9+
- name: mcp-example
10+
selector:
11+
namespaces:
12+
matchLabels:
13+
kubernetes.io/metadata.name: mcp-servers
14+
policies:
15+
mcp:
16+
authentication:
17+
jwks:
18+
uri: http://store-uninitialized/
19+
---
20+
# Output
21+
output:
22+
- gateway:
23+
Name: ""
24+
Namespace: ""
25+
resource:
26+
backend:
27+
key: default/mcp-backend
28+
mcp: {}
29+
name:
30+
name: mcp-backend
31+
namespace: default
32+
status:
33+
conditions:
34+
- lastTransitionTime: fake
35+
message: Backend successfully accepted
36+
reason: Accepted
37+
status: "True"
38+
type: Accepted

‎pkg/kgateway/agentgatewaysyncer/backend/testdata/backend/static-auth-passthrough.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
apiVersion: agentgateway.dev/v1alpha1
2+
kind: AgentgatewayBackend
3+
metadata:
4+
namespace: default
5+
name: static-backend
6+
spec:
7+
static:
8+
host: example.com
9+
port: 8888
10+
policies:
11+
auth:
12+
# kubebuilder:validate allows this but `translateBackendAuth` exepects "inline key or secretRef"
13+
passthrough: {}
14+
---
15+
# Output
16+
output:
17+
- gateway:
18+
Name: ""
19+
Namespace: ""
20+
resource:
21+
backend:
22+
key: default/static-backend
23+
name:
24+
name: static-backend
25+
namespace: default
26+
static:
27+
host: example.com
28+
port: 8888
29+
status:
30+
conditions:
31+
- lastTransitionTime: fake
32+
message: Backend successfully accepted
33+
reason: Accepted
34+
status: "True"
35+
type: Accepted

‎pkg/kgateway/agentgatewaysyncer/backend/testdata/backend/static-secrets-not-found.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
apiVersion: agentgateway.dev/v1alpha1
2+
kind: AgentgatewayBackend
3+
metadata:
4+
namespace: default
5+
name: static-backend
6+
spec:
7+
static:
8+
host: example.com
9+
port: 8888
10+
policies:
11+
auth:
12+
secretRef:
13+
name: missing-secret
14+
---
15+
# Output
16+
output:
17+
- gateway:
18+
Name: ""
19+
Namespace: ""
20+
resource:
21+
backend:
22+
key: default/static-backend
23+
name:
24+
name: static-backend
25+
namespace: default
26+
static:
27+
host: example.com
28+
port: 8888
29+
status:
30+
conditions:
31+
- lastTransitionTime: fake
32+
message: Backend successfully accepted
33+
reason: Accepted
34+
status: "True"
35+
type: Accepted

‎pkg/kgateway/agentgatewaysyncer/backend/testdata/backend/static-tls-ca-bundle-not-found.yaml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
apiVersion: agentgateway.dev/v1alpha1
2+
kind: AgentgatewayBackend
3+
metadata:
4+
namespace: default
5+
name: tls-backend
6+
spec:
7+
static:
8+
host: example.com
9+
port: 8888
10+
policies:
11+
tls:
12+
mtlsCertificateRef:
13+
- name: unknown-mtls
14+
caCertificateRefs:
15+
- name: unknown-ca-bundle
16+
---
17+
# Output
18+
output:
19+
- gateway:
20+
Name: ""
21+
Namespace: ""
22+
resource:
23+
backend:
24+
inlinePolicies:
25+
- backendTls: {}
26+
key: default/tls-backend
27+
name:
28+
name: tls-backend
29+
namespace: default
30+
static:
31+
host: example.com
32+
port: 8888
33+
status:
34+
conditions:
35+
- lastTransitionTime: fake
36+
message: Backend successfully accepted
37+
reason: Accepted
38+
status: "True"
39+
type: Accepted

‎pkg/kgateway/agentgatewaysyncer/backend/translate_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -723,7 +723,7 @@ func createMockMCPService(namespace, serviceName, labels string) *corev1.Service
723723
return mockService
724724
}
725725

726-
// createMockServiceCollectionMultiNamespace creates a mock service collection with services in multiple namespaces
726+
// createMockMultipleNamespaceServices creates a mock service collection with services in multiple namespaces
727727
func createMockMultipleNamespaceServices() []any {
728728
services := []any{
729729
&corev1.Service{

0 commit comments

Comments
 (0)