ingress-controller/gateway: fix missing source ppl (#1324)

Backport edf5320 from #1323

Co-authored-by: Caleb Doxsey <cdoxsey@pomerium.com>

Author: backport-actions-token[bot]

cspell.config.yaml

@@ -17,6 +17,7 @@ words:
   - protobuf
   - protojson
   - readyz
+  - rego
   - sharedkey
   - sslcert
   - sslkey

internal/policy/policy.go

@@ -0,0 +1,29 @@
+package policy
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/open-policy-agent/opa/ast"
+	"google.golang.org/protobuf/proto"
+
+	"github.com/pomerium/pomerium/pkg/policy"
+)
+
+// Parse parses PPL into rego.
+func Parse(src string) (ppl *string, rego []string, err error) {
+	regoSrc, err := policy.GenerateRegoFromReader(strings.NewReader(src))
+	if err != nil {
+		return nil, nil, fmt.Errorf("couldn't parse policy: %w", err)
+	}
+
+	_, err = ast.ParseModule("policy.rego", regoSrc)
+	if err != nil && strings.Contains(err.Error(), "package expected") {
+		_, err = ast.ParseModule("policy.rego", "package pomerium.policy\n\n"+regoSrc)
+	}
+	if err != nil {
+		return nil, nil, fmt.Errorf("internal error: %w", err)
+	}
+
+	return proto.String(src), []string{regoSrc}, nil
+}

pomerium/gateway/filters.go

@@ -2,15 +2,13 @@ package gateway
 
 import (
 	"fmt"
-	"strings"
 
-	"github.com/open-policy-agent/opa/ast"
 	gateway_v1 "sigs.k8s.io/gateway-api/apis/v1"
 
 	icgv1alpha1 "github.com/pomerium/ingress-controller/apis/gateway/v1alpha1"
+	"github.com/pomerium/ingress-controller/internal/policy"
 	"github.com/pomerium/ingress-controller/model"
 	pb "github.com/pomerium/pomerium/pkg/grpc/config"
-	"github.com/pomerium/pomerium/pkg/policy"
 )
 
 func applyFilters(
@@ -107,27 +105,25 @@ func applyExtensionFilter(
 
 // PolicyFilter applies a Pomerium policy defined by the PolicyFilter CRD.
 type PolicyFilter struct {
-	rego string
+	ppl  *string
+	rego []string
 }
 
 // NewPolicyFilter parses a PolicyFilter CRD object, returning an error if the object is not valid.
 func NewPolicyFilter(obj *icgv1alpha1.PolicyFilter) (*PolicyFilter, error) {
-	src, err := policy.GenerateRegoFromReader(strings.NewReader(obj.Spec.PPL))
+	var err error
+	filter := new(PolicyFilter)
+	filter.ppl, filter.rego, err = policy.Parse(obj.Spec.PPL)
 	if err != nil {
-		return nil, fmt.Errorf("couldn't parse policy: %w", err)
+		return nil, err
 	}
-
-	_, err = ast.ParseModule("policy.rego", src)
-	if err != nil && strings.Contains(err.Error(), "package expected") {
-		_, err = ast.ParseModule("policy.rego", "package pomerium.policy\n\n"+src)
-	}
-	if err != nil {
-		return nil, fmt.Errorf("internal error: %w", err)
-	}
-	return &PolicyFilter{src}, nil
+	return filter, nil
 }
 
 // ApplyToRoute applies this policy filter to a Pomerium route proto.
 func (f *PolicyFilter) ApplyToRoute(r *pb.Route) {
-	r.Policies = append(r.Policies, &pb.Policy{Rego: []string{f.rego}})
+	r.Policies = append(r.Policies, &pb.Policy{
+		Rego:      f.rego,
+		SourcePpl: f.ppl,
+	})
 }

pomerium/gateway/translate_test.go

@@ -0,0 +1,73 @@
+package gateway_test
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	v1 "sigs.k8s.io/gateway-api/apis/v1"
+
+	icgv1alpha1 "github.com/pomerium/ingress-controller/apis/gateway/v1alpha1"
+	"github.com/pomerium/ingress-controller/model"
+	"github.com/pomerium/ingress-controller/pomerium/gateway"
+)
+
+func TestTranslate(t *testing.T) {
+	t.Parallel()
+
+	t.Run("fills source ppl", func(t *testing.T) {
+		t.Parallel()
+
+		var policy icgv1alpha1.PolicyFilter
+		require.NoError(t, json.Unmarshal([]byte(`{
+			"metadata": {
+				"name": "example"
+			},
+			"spec": {
+				"ppl": "allow:\n  and:\n    - email:\n        is: user@example.com"
+			}
+		}`), &policy))
+		policyFilter, err := gateway.NewPolicyFilter(&policy)
+		require.NoError(t, err)
+
+		var route v1.HTTPRoute
+		require.NoError(t, json.Unmarshal([]byte(`{
+			"spec": {
+				"hostnames": ["example.com"],
+				"rules": [{
+					"matches": [{
+						"path": {
+							"value": "/"
+						}
+					}],
+					"filters": [{
+						"type": "ExtensionRef",
+						"extensionRef": {
+							"group": "gateway.pomerium.io",
+							"kind": "PolicyFilter",
+							"name": "example"
+						}
+					}]
+				}]
+			}
+		}`), &route))
+
+		result := gateway.TranslateRoutes(t.Context(),
+			&model.GatewayConfig{
+				ExtensionFilters: map[model.ExtensionFilterKey]model.ExtensionFilter{
+					{Kind: "PolicyFilter", Namespace: "", Name: "example"}: policyFilter,
+				},
+			},
+			&model.GatewayHTTPRouteConfig{
+				HTTPRoute: &route,
+				Hostnames: []v1.Hostname{"example.com"},
+			})
+		if assert.Len(t, result, 1) {
+			if assert.Len(t, result[0].Policies, 1) {
+				assert.Equal(t, policy.Spec.PPL, result[0].Policies[0].GetSourcePpl(),
+					"should fill source ppl")
+			}
+		}
+	})
+}

pomerium/ingress_annotations.go

@@ -6,14 +6,13 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/open-policy-agent/opa/ast"
 	"google.golang.org/protobuf/proto"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
 
 	pomerium "github.com/pomerium/pomerium/pkg/grpc/config"
-	"github.com/pomerium/pomerium/pkg/policy"
 
+	"github.com/pomerium/ingress-controller/internal/policy"
 	"github.com/pomerium/ingress-controller/model"
 	"github.com/pomerium/ingress-controller/util"
 )
@@ -200,21 +199,12 @@ func unmarshalPolicyAnnotations(p *pomerium.Policy, kvs map[string]string) error
 		return nil
 	}
 
-	src, err := policy.GenerateRegoFromReader(strings.NewReader(ppl))
+	var err error
+	p.SourcePpl, p.Rego, err = policy.Parse(ppl)
 	if err != nil {
-		return fmt.Errorf("parsing policy: %w", err)
-	}
-
-	_, err = ast.ParseModule("policy.rego", src)
-	if err != nil && strings.Contains(err.Error(), "package expected") {
-		_, err = ast.ParseModule("policy.rego", "package pomerium.policy\n\n"+src)
-	}
-	if err != nil {
-		return fmt.Errorf("invalid custom rego: %w", err)
+		return err
 	}
 
-	p.SourcePpl = proto.String(ppl)
-	p.Rego = []string{src}
 	return nil
 }