feat: implement API Key Auth security policy #4986

sanposhiho · 2024-12-31T08:55:56Z

What type of PR is this?

What this PR does / why we need it:

implement API Key Auth security policy.

Which issue(s) this PR fixes:

Fixes #2630

Release Notes: Yes

api/v1alpha1/api_key_auth_types.go

sanposhiho · 2025-01-01T06:59:53Z

E2e test passed on my local and opened the PR for the review.

api/v1alpha1/validation/securitypolicy_validate.go

api/v1alpha1/api_key_auth_types.go

codecov · 2025-01-10T16:32:29Z

Codecov Report

Attention: Patch coverage is 53.17073% with 96 lines in your changes missing coverage. Please review.

Project coverage is 66.68%. Comparing base (00ed0b8) to head (b22453a).
Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/gatewayapi/securitypolicy.go	8.33%	42 Missing and 2 partials ⚠️
internal/xds/translator/api_key_auth.go	68.69%	25 Missing and 11 partials ⚠️
internal/provider/kubernetes/controller.go	0.00%	15 Missing ⚠️
api/v1alpha1/validation/securitypolicy_validate.go	94.11%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4986      +/-   ##
==========================================
- Coverage   66.75%   66.68%   -0.08%     
==========================================
  Files         209      210       +1     
  Lines       32409    32609     +200     
==========================================
+ Hits        21636    21744     +108     
- Misses       9468     9548      +80     
- Partials     1305     1317      +12

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

api/v1alpha1/validation/securitypolicy_validate.go

arkodg

LGTM thanks !

arkodg · 2025-01-10T18:36:06Z

ptal @zhaohuabing

arkodg · 2025-01-10T18:45:39Z

@sanposhiho looks like the e2e is failing consistently

sanposhiho · 2025-01-10T18:47:05Z

Yeah, sorry for that. I'll look into it in this weekend.

internal/ir/xds.go

zirain · 2025-01-11T08:01:47Z

@sanposhiho can you rebase master and rerun make -k gen-check.

Signed-off-by: Kensei Nakada <[email protected]>

zhaohuabing

LGTM thanks!

sanposhiho force-pushed the api-key-auth branch from 7da88c9 to ab9eb56 Compare December 31, 2024 09:32

zhaohuabing reviewed Dec 31, 2024

View reviewed changes

api/v1alpha1/api_key_auth_types.go Outdated Show resolved Hide resolved

zhaohuabing reviewed Dec 31, 2024

View reviewed changes

api/v1alpha1/api_key_auth_types.go Outdated Show resolved Hide resolved

zhaohuabing reviewed Dec 31, 2024

View reviewed changes

api/v1alpha1/api_key_auth_types.go Outdated Show resolved Hide resolved

sanposhiho force-pushed the api-key-auth branch 2 times, most recently from 999022c to 46d4f6a Compare January 1, 2025 06:59

sanposhiho marked this pull request as ready for review January 1, 2025 06:59

sanposhiho requested a review from a team as a code owner January 1, 2025 06:59

sanposhiho force-pushed the api-key-auth branch from 46d4f6a to 47fed4a Compare January 1, 2025 07:00

sanposhiho commented Jan 1, 2025

View reviewed changes

api/v1alpha1/validation/securitypolicy_validate.go Show resolved Hide resolved

sanposhiho force-pushed the api-key-auth branch from d7139e3 to eabdd76 Compare January 1, 2025 07:04

arkodg reviewed Jan 2, 2025

View reviewed changes

api/v1alpha1/api_key_auth_types.go Outdated Show resolved Hide resolved

arkodg reviewed Jan 8, 2025

View reviewed changes

api/v1alpha1/api_key_auth_types.go Outdated Show resolved Hide resolved

arkodg reviewed Jan 8, 2025

View reviewed changes

api/v1alpha1/api_key_auth_types.go Outdated Show resolved Hide resolved

arkodg reviewed Jan 8, 2025

View reviewed changes

api/v1alpha1/api_key_auth_types.go Outdated Show resolved Hide resolved

arkodg reviewed Jan 8, 2025

View reviewed changes

api/v1alpha1/api_key_auth_types.go Show resolved Hide resolved

sanposhiho force-pushed the api-key-auth branch from eb7be82 to 551d0e6 Compare January 9, 2025 02:40

arkodg reviewed Jan 9, 2025

View reviewed changes

api/v1alpha1/api_key_auth_types.go Outdated Show resolved Hide resolved

sanposhiho force-pushed the api-key-auth branch 4 times, most recently from f4d8fad to 6ece2e9 Compare January 10, 2025 15:57

sanposhiho force-pushed the api-key-auth branch from 8527213 to 3568426 Compare January 10, 2025 16:36

arkodg reviewed Jan 10, 2025

View reviewed changes

api/v1alpha1/validation/securitypolicy_validate.go Show resolved Hide resolved

arkodg previously approved these changes Jan 10, 2025

View reviewed changes

arkodg requested review from a team January 10, 2025 18:36

sanposhiho dismissed arkodg’s stale review via 16cc07e January 10, 2025 23:35

sanposhiho force-pushed the api-key-auth branch from 16cc07e to 73ec9a1 Compare January 11, 2025 00:55

zhaohuabing reviewed Jan 11, 2025

View reviewed changes

internal/ir/xds.go Outdated Show resolved Hide resolved

sanposhiho force-pushed the api-key-auth branch from 700e685 to 6070814 Compare January 11, 2025 07:59

sanposhiho added 14 commits January 11, 2025 17:10

feat: implement API Key Auth security policy

cf79caf

Signed-off-by: Kensei Nakada <[email protected]>

doc: add a release note

28d4420

Signed-off-by: Kensei Nakada <[email protected]>

fix: regenerate manifests

53d33fd

Signed-off-by: Kensei Nakada <[email protected]>

fix: rename KeySources to ExtractFrom

a2b0289

Signed-off-by: Kensei Nakada <[email protected]>

fix: address reviews

74e3b6e

Signed-off-by: Kensei Nakada <[email protected]>

fix: add type to extractFrom

22f53ca

Signed-off-by: Kensei Nakada <[email protected]>

fix: rename QueryParams to QueryParam

2529444

Signed-off-by: Kensei Nakada <[email protected]>

chore: cleanup allowedClients in test cases

4812fd7

Signed-off-by: Kensei Nakada <[email protected]>

fix: change the API based on the discussion

511264b

Signed-off-by: Kensei Nakada <[email protected]>

fix: move CEL validation to ValidateSecurityPolicy

1637c89

Signed-off-by: Kensei Nakada <[email protected]>

fix: regenerate yamls

f6999d9

Signed-off-by: Kensei Nakada <[email protected]>

fix: failing e2e test

ebf2dc5

Signed-off-by: Kensei Nakada <[email protected]>

fix: remove name from APIKeyAuth ir

3c5b78b

Signed-off-by: Kensei Nakada <[email protected]>

fix: regenerate the site contents

b22453a

Signed-off-by: Kensei Nakada <[email protected]>

sanposhiho force-pushed the api-key-auth branch from 6070814 to b22453a Compare January 11, 2025 08:13

zhaohuabing approved these changes Jan 13, 2025

View reviewed changes

arkodg approved these changes Jan 13, 2025

View reviewed changes

arkodg merged commit 271a697 into envoyproxy:main Jan 13, 2025
27 of 28 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: implement API Key Auth security policy #4986

feat: implement API Key Auth security policy #4986

sanposhiho commented Dec 31, 2024 •

edited

Loading

sanposhiho commented Jan 1, 2025

codecov bot commented Jan 10, 2025 •

edited

Loading

arkodg left a comment

arkodg commented Jan 10, 2025

arkodg commented Jan 10, 2025

sanposhiho commented Jan 10, 2025

zirain commented Jan 11, 2025

zhaohuabing left a comment

feat: implement API Key Auth security policy #4986

feat: implement API Key Auth security policy #4986

Conversation

sanposhiho commented Dec 31, 2024 • edited Loading

sanposhiho commented Jan 1, 2025

codecov bot commented Jan 10, 2025 • edited Loading

Codecov Report

arkodg left a comment

Choose a reason for hiding this comment

arkodg commented Jan 10, 2025

arkodg commented Jan 10, 2025

sanposhiho commented Jan 10, 2025

zirain commented Jan 11, 2025

zhaohuabing left a comment

Choose a reason for hiding this comment

sanposhiho commented Dec 31, 2024 •

edited

Loading

codecov bot commented Jan 10, 2025 •

edited

Loading