Refactor e2e test to be usable for addressables

test/experimental/auth_test.go

@@ -25,26 +25,15 @@ import (
 
 	"knative.dev/pkg/system"
 	"knative.dev/reconciler-test/pkg/environment"
+	"knative.dev/reconciler-test/pkg/feature"
 	"knative.dev/reconciler-test/pkg/k8s"
 	"knative.dev/reconciler-test/pkg/knative"
 
 	"knative.dev/eventing/test/experimental/features/auth"
+	brokerfeatures "knative.dev/eventing/test/rekt/features/broker"
+	"knative.dev/eventing/test/rekt/resources/broker"
 )
 
-func TestBrokerAudiencePopulated(t *testing.T) {
-	t.Parallel()
-
-	ctx, env := global.Environment(
-		knative.WithKnativeNamespace(system.Namespace()),
-		knative.WithLoggingConfig,
-		knative.WithTracingConfig,
-		k8s.WithEventListener,
-		environment.Managed(t),
-	)
-
-	env.Test(ctx, t, auth.BrokerGetsAudiencePopulated(env.Namespace()))
-}
-
 func TestBrokerSupportsOIDC(t *testing.T) {
 	t.Parallel()
 
@@ -57,6 +46,9 @@ func TestBrokerSupportsOIDC(t *testing.T) {
 		environment.WithPollTimings(4*time.Second, 12*time.Minute),
 	)
 
-	env.Test(ctx, t, auth.BrokerRejectEventForWrongAudience())
-	env.Test(ctx, t, auth.BrokerHandlesEventWithValidOIDCToken())
+	name := feature.MakeRandomK8sName("broker")
+	env.Prerequisite(ctx, t, brokerfeatures.GoesReady(name, broker.WithEnvConfig()...))
+
+	env.TestSet(ctx, t, auth.AddressableOIDCConformance(broker.GVR(), "Broker", name, env.Namespace()))
+	env.Test(ctx, t, auth.BrokerSendEventWithOIDCToken())
 }

test/experimental/features/auth/addressable_oidc_conformance.go

@@ -0,0 +1,169 @@
+/*
+Copyright 2023 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package auth
+
+import (
+	"fmt"
+
+	"github.com/cloudevents/sdk-go/v2/test"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"knative.dev/eventing/pkg/auth"
+	"knative.dev/eventing/test/rekt/resources/addressable"
+	"knative.dev/reconciler-test/pkg/eventshub"
+	eventassert "knative.dev/reconciler-test/pkg/eventshub/assert"
+	"knative.dev/reconciler-test/pkg/feature"
+	"knative.dev/reconciler-test/pkg/k8s"
+)
+
+func AddressableOIDCConformance(gvr schema.GroupVersionResource, kind, name, namespace string) *feature.FeatureSet {
+	fs := feature.FeatureSet{
+		Name:     fmt.Sprintf("%s handles requests with OIDC tokens correctly", kind),
+		Features: AddressableOIDCTokenConformance(gvr, kind, name).Features,
+	}
+
+	fs.Features = append(fs.Features,
+		AddressableHasAudiencePopulated(gvr, kind, name, namespace),
+	)
+
+	return &fs
+}
+
+func AddressableOIDCTokenConformance(gvr schema.GroupVersionResource, kind, name string) *feature.FeatureSet {
+	fs := feature.FeatureSet{
+		Name: fmt.Sprintf("%s handles requests with OIDC tokens correctly", kind),
+		Features: []*feature.Feature{
+			AddressableRejectInvalidAudience(gvr, kind, name),
+			AddressableRejectCorruptedSignature(gvr, kind, name),
+			AddressableRejectExpiredToken(gvr, kind, name),
+			AddressableAllowsValidRequest(gvr, kind, name),
+		},
+	}
+
+	return &fs
+}
+
+func AddressableHasAudiencePopulated(gvr schema.GroupVersionResource, kind, name, namespace string) *feature.Feature {
+	f := feature.NewFeatureNamed(fmt.Sprintf("%s populates its .status.address.audience correctly", kind))
+
+	f.Requirement(fmt.Sprintf("%s is ready", kind), k8s.IsReady(gvr, name))
+	f.Requirement(fmt.Sprintf("%s is addressable", kind), k8s.IsAddressable(gvr, name))
+
+	expectedAudience := auth.GetAudience(gvr.GroupVersion().WithKind(kind), metav1.ObjectMeta{
+		Name:      name,
+		Namespace: namespace,
+	})
+
+	f.Alpha(kind).Must("have audience set", addressable.ValidateAddress(gvr, name, addressable.AssertAddressWithAudience(expectedAudience)))
+
+	return f
+}
+
+func AddressableRejectInvalidAudience(gvr schema.GroupVersionResource, kind, name string) *feature.Feature {
+	f := feature.NewFeatureNamed(fmt.Sprintf("%s reject event for wrong OIDC audience", kind))
+
+	source := feature.MakeRandomK8sName("source")
+
+	event := test.FullEvent()
+
+	f.Requirement(fmt.Sprintf("%s is ready", kind), k8s.IsReady(gvr, name))
+	f.Requirement(fmt.Sprintf("%s is addressable", kind), k8s.IsAddressable(gvr, name))
+
+	f.Requirement("install source", eventshub.Install(
+		source,
+		eventshub.StartSenderToResource(gvr, name),
+		eventshub.OIDCInvalidAudience(),
+		eventshub.InputEvent(event),
+	))
+
+	f.Alpha(kind).
+		Must("event sent", eventassert.OnStore(source).MatchSentEvent(test.HasId(event.ID())).Exact(1)).
+		Must("get 401 on response", eventassert.OnStore(source).Match(eventassert.MatchStatusCode(401)).Exact(1))
+
+	return f
+}
+
+func AddressableRejectExpiredToken(gvr schema.GroupVersionResource, kind, name string) *feature.Feature {
+	f := feature.NewFeatureNamed(fmt.Sprintf("%s reject event with expired OIDC token", kind))
+
+	source := feature.MakeRandomK8sName("source")
+
+	event := test.FullEvent()
+
+	f.Requirement(fmt.Sprintf("%s is ready", kind), k8s.IsReady(gvr, name))
+	f.Requirement(fmt.Sprintf("%s is addressable", kind), k8s.IsAddressable(gvr, name))
+
+	f.Requirement("install source", eventshub.Install(
+		source,
+		eventshub.StartSenderToResource(gvr, name),
+		eventshub.OIDCExpiredToken(),
+		eventshub.InputEvent(event),
+	))
+
+	f.Alpha(kind).
+		Must("event sent", eventassert.OnStore(source).MatchSentEvent(test.HasId(event.ID())).Exact(1)).
+		Must("get 401 on response", eventassert.OnStore(source).Match(eventassert.MatchStatusCode(401)).Exact(1))
+
+	return f
+}
+
+func AddressableRejectCorruptedSignature(gvr schema.GroupVersionResource, kind, name string) *feature.Feature {
+	f := feature.NewFeatureNamed(fmt.Sprintf("%s reject event with corrupted OIDC token signature", kind))
+
+	source := feature.MakeRandomK8sName("source")
+
+	event := test.FullEvent()
+
+	f.Requirement(fmt.Sprintf("%s is ready", kind), k8s.IsReady(gvr, name))
+	f.Requirement(fmt.Sprintf("%s is addressable", kind), k8s.IsAddressable(gvr, name))
+
+	f.Requirement("install source", eventshub.Install(
+		source,
+		eventshub.StartSenderToResource(gvr, name),
+		eventshub.OIDCCorruptedSignature(),
+		eventshub.InputEvent(event),
+	))
+
+	f.Alpha(kind).
+		Must("event sent", eventassert.OnStore(source).MatchSentEvent(test.HasId(event.ID())).Exact(1)).
+		Must("get 401 on response", eventassert.OnStore(source).Match(eventassert.MatchStatusCode(401)).Exact(1))
+
+	return f
+}
+
+func AddressableAllowsValidRequest(gvr schema.GroupVersionResource, kind, name string) *feature.Feature {
+	f := feature.NewFeatureNamed(fmt.Sprintf("%s handles event with valid OIDC token", kind))
+
+	source := feature.MakeRandomK8sName("source")
+
+	event := test.FullEvent()
+
+	f.Requirement(fmt.Sprintf("%s is ready", kind), k8s.IsReady(gvr, name))
+	f.Requirement(fmt.Sprintf("%s is addressable", kind), k8s.IsAddressable(gvr, name))
+
+	f.Requirement("install source", eventshub.Install(
+		source,
+		eventshub.StartSenderToResource(gvr, name),
+		eventshub.InputEvent(event),
+	))
+
+	f.Alpha(kind).
+		Must("event sent", eventassert.OnStore(source).MatchSentEvent(test.HasId(event.ID())).Exact(1)).
+		Must("get 202 on response", eventassert.OnStore(source).Match(eventassert.MatchStatusCode(202)).Exact(1))
+
+	return f
+}

test/experimental/features/auth/broker.go

@@ -0,0 +1,66 @@
+/*
+Copyright 2023 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package auth
+
+import (
+	"github.com/cloudevents/sdk-go/v2/test"
+	"knative.dev/eventing/test/rekt/resources/broker"
+	"knative.dev/eventing/test/rekt/resources/trigger"
+	"knative.dev/reconciler-test/pkg/eventshub"
+	eventassert "knative.dev/reconciler-test/pkg/eventshub/assert"
+	"knative.dev/reconciler-test/pkg/feature"
+	"knative.dev/reconciler-test/pkg/resources/service"
+)
+
+func BrokerSendEventWithOIDCToken() *feature.Feature {
+	f := feature.NewFeatureNamed("Broker supports flow with OIDC tokens")
+
+	source := feature.MakeRandomK8sName("source")
+	brokerName := feature.MakeRandomK8sName("broker")
+	sink := feature.MakeRandomK8sName("sink")
+	triggerName := feature.MakeRandomK8sName("triggerName")
+
+	event := test.FullEvent()
+
+	// Install the broker
+	f.Setup("install broker", broker.Install(brokerName, broker.WithEnvConfig()...))
+	f.Setup("broker is ready", broker.IsReady(brokerName))
+	f.Setup("broker is addressable", broker.IsAddressable(brokerName))
+
+	// Install the sink
+	f.Setup("install sink", eventshub.Install(sink, eventshub.StartReceiver))
+
+	// Install the trigger and Point the Trigger subscriber to the sink svc.
+	f.Setup("install trigger", trigger.Install(
+		triggerName,
+		brokerName,
+		trigger.WithSubscriber(service.AsKReference(sink), ""),
+	))
+	f.Setup("trigger goes ready", trigger.IsReady(triggerName))
+
+	// Send event
+	f.Requirement("install source", eventshub.Install(
+		source,
+		eventshub.StartSenderToResource(broker.GVR(), brokerName),
+		eventshub.InputEvent(event),
+	))
+
+	f.Alpha("Broker").
+		Must("handles event with valid OIDC token", eventassert.OnStore(sink).MatchReceivedEvent(test.HasId(event.ID())).Exact(1))
+
+	return f
+}