@@ -16,6 +16,7 @@ package ambient
1616
1717import (
1818 "context"
19+ "fmt"
1920 "testing"
2021 "time"
2122
@@ -231,6 +232,9 @@ func TestWaypointPolicyStatusCollection(t *testing.T) {
231232 clientSe := kclient.New [* networkingclient.ServiceEntry ](c )
232233 seCol := krt .WrapClient (clientSe , opts .WithName ("seCol" )... )
233234
235+ clientGwClass := kclient.New [* gtwapiv1beta1.GatewayClass ](c )
236+ gwClassCol := krt .WrapClient (clientGwClass , opts .WithName ("gwClassCol" )... )
237+
234238 clientNs := kclient.New [* v1.Namespace ](c )
235239 nsCol := krt .WrapClient (clientNs , opts .WithName ("nsCol" )... )
236240
@@ -261,7 +265,7 @@ func TestWaypointPolicyStatusCollection(t *testing.T) {
261265 }
262266 }, opts .WithName ("waypoint" )... )
263267
264- wpsCollection := WaypointPolicyStatusCollection (authzPolCol , waypointCol , svcCol , seCol , nsCol , opts )
268+ wpsCollection := WaypointPolicyStatusCollection (authzPolCol , waypointCol , svcCol , seCol , gwClassCol , nsCol , opts )
265269 c .RunAndWait (ctx .Done ())
266270
267271 _ , err := clientNs .Create (& v1.Namespace {
@@ -981,6 +985,123 @@ func TestWaypointPolicyStatusCollection(t *testing.T) {
981985 },
982986 },
983987 },
988+ {
989+ testName : "single-bind-gateway-class" ,
990+ gatewayClasses : []gtwapiv1beta1.GatewayClass {
991+ {
992+ ObjectMeta : metav1.ObjectMeta {
993+ Name : "istio-waypoint" ,
994+ },
995+ Spec : gtwapiv1beta1.GatewayClassSpec {
996+ ControllerName : constants .ManagedGatewayMeshController ,
997+ },
998+ },
999+ },
1000+ policy : securityclient.AuthorizationPolicy {
1001+ ObjectMeta : metav1.ObjectMeta {
1002+ Name : "single-gateway-class-pol" ,
1003+ Namespace : "istio-system" ,
1004+ Generation : 1 ,
1005+ },
1006+ Spec : v1beta1.AuthorizationPolicy {
1007+ TargetRefs : []* apiv1beta1.PolicyTargetReference {
1008+ {
1009+ Group : gvk .GatewayClass .Group ,
1010+ Kind : gvk .GatewayClass .Kind ,
1011+ Name : "istio-waypoint" ,
1012+ },
1013+ },
1014+ Rules : []* v1beta1.Rule {},
1015+ Action : 0 ,
1016+ },
1017+ },
1018+ expect : []model.PolicyBindingStatus {
1019+ {
1020+ Ancestor : "GatewayClass.gateway.networking.k8s.io:istio-system/istio-waypoint" ,
1021+ Status : & model.StatusMessage {
1022+ Reason : model .WaypointPolicyReasonAccepted ,
1023+ Message : "bound to istio-waypoint" ,
1024+ },
1025+ Bound : true ,
1026+ ObservedGeneration : 1 ,
1027+ },
1028+ },
1029+ },
1030+ {
1031+ testName : "nonexistent-gateway-class" ,
1032+ gatewayClasses : []gtwapiv1beta1.GatewayClass {},
1033+ policy : securityclient.AuthorizationPolicy {
1034+ ObjectMeta : metav1.ObjectMeta {
1035+ Name : "single-no-gateway-class-pol" ,
1036+ Namespace : "istio-system" ,
1037+ Generation : 1 ,
1038+ },
1039+ Spec : v1beta1.AuthorizationPolicy {
1040+ TargetRefs : []* apiv1beta1.PolicyTargetReference {
1041+ {
1042+ Group : gvk .GatewayClass .Group ,
1043+ Kind : gvk .GatewayClass .Kind ,
1044+ Name : "nonexistent-gateway-class" ,
1045+ },
1046+ },
1047+ Rules : []* v1beta1.Rule {},
1048+ Action : 0 ,
1049+ },
1050+ },
1051+ expect : []model.PolicyBindingStatus {
1052+ {
1053+ Ancestor : "GatewayClass.gateway.networking.k8s.io:istio-system/nonexistent-gateway-class" ,
1054+ Status : & model.StatusMessage {
1055+ Reason : model .WaypointPolicyReasonTargetNotFound ,
1056+ Message : "not bound" ,
1057+ },
1058+ Bound : false ,
1059+ ObservedGeneration : 1 ,
1060+ },
1061+ },
1062+ },
1063+ {
1064+ testName : "non-waypoint-gateway-class" ,
1065+ gatewayClasses : []gtwapiv1beta1.GatewayClass {
1066+ {
1067+ ObjectMeta : metav1.ObjectMeta {
1068+ Name : "not-for-waypoint" ,
1069+ },
1070+ Spec : gtwapiv1beta1.GatewayClassSpec {
1071+ ControllerName : "random-controller" ,
1072+ },
1073+ },
1074+ },
1075+ policy : securityclient.AuthorizationPolicy {
1076+ ObjectMeta : metav1.ObjectMeta {
1077+ Name : "non-waypoint-gateway-class-pol" ,
1078+ Namespace : "istio-system" ,
1079+ Generation : 1 ,
1080+ },
1081+ Spec : v1beta1.AuthorizationPolicy {
1082+ TargetRefs : []* apiv1beta1.PolicyTargetReference {
1083+ {
1084+ Group : gvk .GatewayClass .Group ,
1085+ Kind : gvk .GatewayClass .Kind ,
1086+ Name : "not-for-waypoint" ,
1087+ },
1088+ },
1089+ Rules : []* v1beta1.Rule {},
1090+ Action : 0 ,
1091+ },
1092+ },
1093+ expect : []model.PolicyBindingStatus {
1094+ {
1095+ Ancestor : "GatewayClass.gateway.networking.k8s.io:istio-system/not-for-waypoint" ,
1096+ Status : & model.StatusMessage {
1097+ Reason : model .WaypointPolicyReasonInvalid ,
1098+ Message : fmt .Sprintf ("GatewayClass must use controller name `%s` for waypoints" , constants .ManagedGatewayMeshController ),
1099+ },
1100+ Bound : false ,
1101+ ObservedGeneration : 1 ,
1102+ },
1103+ },
1104+ },
9841105 }
9851106
9861107 // these nolint are to suppress findings regarding copying the mutex contained within our service entry proto fields
@@ -999,6 +1120,11 @@ func TestWaypointPolicyStatusCollection(t *testing.T) {
9991120 assert .NoError (t , err )
10001121 }
10011122
1123+ for _ , gwClass := range tc .gatewayClasses {
1124+ _ , err := clientGwClass .Create (& gwClass )
1125+ assert .NoError (t , err )
1126+ }
1127+
10021128 _ , err := clientAuthzPol .Create (& tc .policy )
10031129 assert .NoError (t , err )
10041130
@@ -1017,6 +1143,7 @@ type TestWaypointPolicyStatusCollectionTestCase struct {
10171143 testName string
10181144 serviceEntries []networkingclient.ServiceEntry
10191145 services []v1.Service
1146+ gatewayClasses []gtwapiv1beta1.GatewayClass
10201147 policy securityclient.AuthorizationPolicy
10211148 expect []model.PolicyBindingStatus
10221149}
0 commit comments