Skip to content

Commit b30bf41

Browse files
wasagawasaga
committed
ingress-controller: add enable_google_cloud_serverless_authentication annotation
Allow users to set the EnableGoogleCloudServerlessAuthentication Route field via the ingress.pomerium.io/enable_google_cloud_serverless_authentication annotation, enabling GCP ID-token auth for Cloud Run / Cloud Functions upstreams.
1 parent 68903df commit b30bf41

2 files changed

Lines changed: 48 additions & 45 deletions

File tree

‎pomerium/ingress_annotations.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ var (
3030
"cors_allow_preflight",
3131
"depends_on",
3232
"description",
33+
"enable_google_cloud_serverless_authentication",
3334
"health_checks",
3435
"healthy_panic_threshold",
3536
"host_path_regex_rewrite_pattern",

‎pomerium/ingress_annotations_test.go‎

Lines changed: 47 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -40,51 +40,52 @@ func TestAnnotations(t *testing.T) {
4040
ObjectMeta: v1.ObjectMeta{
4141
Namespace: "test",
4242
Annotations: map[string]string{
43-
"a/allow_any_authenticated_user": "false",
44-
"a/allow_public_unauthenticated_access": "false",
45-
"a/allow_spdy": "true",
46-
"a/allow_upgrades": `["x","y","z"]`,
47-
"a/allow_websockets": "true",
48-
"a/allowed_domains": `["a"]`,
49-
"a/allowed_idp_claims": `key: ["val1", "val2"]`,
50-
"a/allowed_users": `["a"]`,
51-
"a/bearer_token_format": `idp_access_token`,
52-
"a/circuit_breaker_thresholds": `{"max_connections": 1, "max_pending_requests": 2, "max_requests": 3, "max_retries": 4, "max_connection_pools": 5}`,
53-
"a/cors_allow_preflight": "true",
54-
"a/depends_on": `["foo.example.com", "bar.example.com", "baz.example.com"]`,
55-
"a/description": "DESCRIPTION",
56-
"a/health_checks": `[{"timeout": "10s", "interval": "1m", "healthy_threshold": 1, "unhealthy_threshold": 2, "http_health_check": {"path": "/"}}]`,
57-
"a/healthy_panic_threshold": "27",
58-
"a/host_path_regex_rewrite_pattern": "rewrite-pattern",
59-
"a/host_path_regex_rewrite_substitution": "rewrite-sub",
60-
"a/host_rewrite_header": "rewrite-header",
61-
"a/host_rewrite": "rewrite",
62-
"a/identity_provider_secret": "identity_provider_secret",
63-
"a/idle_timeout": `60s`,
64-
"a/idp_access_token_allowed_audiences": `["x","y","z"]`,
65-
"a/kubernetes_service_account_token_secret": "k8s_token",
66-
"a/load_balancing_policy": "LEAST_REQUEST",
67-
"a/logo_url": "LOGO_URL",
68-
"a/pass_identity_headers": "true",
69-
"a/policy": testPPL1,
70-
"a/prefix_rewrite": "/",
71-
"a/preserve_host_header": "true",
72-
"a/regex_rewrite_pattern": `^/service/([^/]+)(/.*)$`,
73-
"a/regex_rewrite_substitution": `\\2/instance/\\1`,
74-
"a/remove_request_headers": `["a"]`,
75-
"a/rewrite_response_headers": `[{"header": "a", "prefix": "b", "value": "c"}]`,
76-
"a/secure_upstream": "true",
77-
"a/set_request_headers_secret": `request_headers`,
78-
"a/set_request_headers": `{"a": "aaa"}`,
79-
"a/set_response_headers_secret": `response_headers`,
80-
"a/set_response_headers": `{"disable": true}`,
81-
"a/timeout": `2m`,
82-
"a/tls_client_secret": "my_client_secret",
83-
"a/tls_custom_ca_secret": "my_custom_ca_secret",
84-
"a/tls_downstream_client_ca_secret": "my_downstream_client_ca_secret",
85-
"a/tls_server_name": "my.server.name",
86-
"a/tls_skip_verify": "true",
87-
"a/upstream_tunnel_ssh_policy": testPPL2,
43+
"a/allow_any_authenticated_user": "false",
44+
"a/allow_public_unauthenticated_access": "false",
45+
"a/allow_spdy": "true",
46+
"a/allow_upgrades": `["x","y","z"]`,
47+
"a/allow_websockets": "true",
48+
"a/allowed_domains": `["a"]`,
49+
"a/allowed_idp_claims": `key: ["val1", "val2"]`,
50+
"a/allowed_users": `["a"]`,
51+
"a/bearer_token_format": `idp_access_token`,
52+
"a/circuit_breaker_thresholds": `{"max_connections": 1, "max_pending_requests": 2, "max_requests": 3, "max_retries": 4, "max_connection_pools": 5}`,
53+
"a/cors_allow_preflight": "true",
54+
"a/depends_on": `["foo.example.com", "bar.example.com", "baz.example.com"]`,
55+
"a/description": "DESCRIPTION",
56+
"a/enable_google_cloud_serverless_authentication": "true",
57+
"a/health_checks": `[{"timeout": "10s", "interval": "1m", "healthy_threshold": 1, "unhealthy_threshold": 2, "http_health_check": {"path": "/"}}]`,
58+
"a/healthy_panic_threshold": "27",
59+
"a/host_path_regex_rewrite_pattern": "rewrite-pattern",
60+
"a/host_path_regex_rewrite_substitution": "rewrite-sub",
61+
"a/host_rewrite_header": "rewrite-header",
62+
"a/host_rewrite": "rewrite",
63+
"a/identity_provider_secret": "identity_provider_secret",
64+
"a/idle_timeout": `60s`,
65+
"a/idp_access_token_allowed_audiences": `["x","y","z"]`,
66+
"a/kubernetes_service_account_token_secret": "k8s_token",
67+
"a/load_balancing_policy": "LEAST_REQUEST",
68+
"a/logo_url": "LOGO_URL",
69+
"a/pass_identity_headers": "true",
70+
"a/policy": testPPL1,
71+
"a/prefix_rewrite": "/",
72+
"a/preserve_host_header": "true",
73+
"a/regex_rewrite_pattern": `^/service/([^/]+)(/.*)$`,
74+
"a/regex_rewrite_substitution": `\\2/instance/\\1`,
75+
"a/remove_request_headers": `["a"]`,
76+
"a/rewrite_response_headers": `[{"header": "a", "prefix": "b", "value": "c"}]`,
77+
"a/secure_upstream": "true",
78+
"a/set_request_headers_secret": `request_headers`,
79+
"a/set_request_headers": `{"a": "aaa"}`,
80+
"a/set_response_headers_secret": `response_headers`,
81+
"a/set_response_headers": `{"disable": true}`,
82+
"a/timeout": `2m`,
83+
"a/tls_client_secret": "my_client_secret",
84+
"a/tls_custom_ca_secret": "my_custom_ca_secret",
85+
"a/tls_downstream_client_ca_secret": "my_downstream_client_ca_secret",
86+
"a/tls_server_name": "my.server.name",
87+
"a/tls_skip_verify": "true",
88+
"a/upstream_tunnel_ssh_policy": testPPL2,
8889
},
8990
},
9091
},
@@ -153,6 +154,7 @@ func TestAnnotations(t *testing.T) {
153154
CorsAllowPreflight: true,
154155
DependsOn: []string{"foo.example.com", "bar.example.com", "baz.example.com"},
155156
Description: proto.String("DESCRIPTION"),
157+
EnableGoogleCloudServerlessAuthentication: true,
156158
HealthChecks: []*pb.HealthCheck{{
157159
Timeout: durationpb.New(10 * time.Second),
158160
Interval: durationpb.New(time.Minute),

0 commit comments

Comments
 (0)