Merge pull request #2161 from slayer321/test-request-route-w-backend-ref

fix: Validate requestRedirect with backendrefs

apis/v1alpha2/validation/httproute_test.go

@@ -868,7 +868,7 @@ func TestValidateHTTPRouteTypeMatchesField(t *testing.T) {
 				StatusCode: new(int),
 			},
 		},
-		errCount: 0,
+		errCount: 1,
 	}, {
 		name: "invalid HTTPRouteFilterRequestRedirect type filter with non-matching field",
 		routeFilter: gatewayv1a2.HTTPRouteFilter{

apis/v1beta1/validation/httproute.go

@@ -55,6 +55,7 @@ func ValidateHTTPRouteSpec(spec *gatewayv1b1.HTTPRouteSpec, path *field.Path) fi
 	var errs field.ErrorList
 	for i, rule := range spec.Rules {
 		errs = append(errs, validateHTTPRouteFilters(rule.Filters, rule.Matches, path.Child("rules").Index(i))...)
+		errs = append(errs, validateRequestRedirectFiltersWithBackendRefs(rule, path.Child("rules").Index(i))...)
 		for j, backendRef := range rule.BackendRefs {
 			errs = append(errs, validateHTTPRouteFilters(backendRef.Filters, rule.Matches, path.Child("rules").Index(i).Child("backendRefs").Index(j))...)
 		}
@@ -77,6 +78,17 @@ func ValidateHTTPRouteSpec(spec *gatewayv1b1.HTTPRouteSpec, path *field.Path) fi
 	return errs
 }
 
+// validateRequestRedirectFiltersWithBackendRefs validates that RequestRedirect filters are not used with backendRefs
+func validateRequestRedirectFiltersWithBackendRefs(rule gatewayv1b1.HTTPRouteRule, path *field.Path) field.ErrorList {
+	var errs field.ErrorList
+	for _, filter := range rule.Filters {
+		if filter.RequestRedirect != nil && len(rule.BackendRefs) > 0 {
+			errs = append(errs, field.Invalid(path.Child("filters"), gatewayv1b1.HTTPRouteFilterRequestRedirect, "RequestRedirect filter is not allowed with backendRefs"))
+		}
+	}
+	return errs
+}
+
 // validateHTTPRouteBackendServicePorts validates that v1.Service backends always have a port.
 func validateHTTPRouteBackendServicePorts(rules []gatewayv1b1.HTTPRouteRule, path *field.Path) field.ErrorList {
 	var errs field.ErrorList

apis/v1beta1/validation/httproute_test.go

@@ -1049,7 +1049,7 @@ func TestValidateHTTPRouteTypeMatchesField(t *testing.T) {
 				StatusCode: new(int),
 			},
 		},
-		errCount: 0,
+		errCount: 1,
 	}, {
 		name: "invalid HTTPRouteFilterRequestRedirect type filter with non-matching field",
 		routeFilter: gatewayv1b1.HTTPRouteFilter{
@@ -1140,3 +1140,67 @@ func TestValidateHTTPRouteTypeMatchesField(t *testing.T) {
 		})
 	}
 }
+
+func TestValidateRequestRedirectFiltersWithNoBackendRef(t *testing.T) {
+	testService := gatewayv1b1.ObjectName("test-service")
+	tests := []struct {
+		name     string
+		rules    []gatewayv1b1.HTTPRouteRule
+		errCount int
+	}{
+		{
+			name:     "backendref with request redirect httpRoute filter",
+			errCount: 1,
+			rules: []gatewayv1b1.HTTPRouteRule{
+				{
+					Filters: []gatewayv1b1.HTTPRouteFilter{
+						{
+							Type: gatewayv1b1.HTTPRouteFilterRequestRedirect,
+							RequestRedirect: &gatewayv1b1.HTTPRequestRedirectFilter{
+								Scheme:     ptrTo("https"),
+								StatusCode: ptrTo(301),
+							},
+						},
+					},
+					BackendRefs: []gatewayv1b1.HTTPBackendRef{
+						{
+							BackendRef: gatewayv1b1.BackendRef{
+								BackendObjectReference: gatewayv1b1.BackendObjectReference{
+									Name: testService,
+									Port: ptrTo(gatewayv1b1.PortNumber(80)),
+								},
+							},
+						},
+					},
+				},
+			},
+		}, {
+			name:     "request redirect without backendref in httpRoute filter",
+			errCount: 0,
+			rules: []gatewayv1b1.HTTPRouteRule{
+				{
+					Filters: []gatewayv1b1.HTTPRouteFilter{
+						{
+							Type: gatewayv1b1.HTTPRouteFilterRequestRedirect,
+							RequestRedirect: &gatewayv1b1.HTTPRequestRedirectFilter{
+								Scheme:     ptrTo("https"),
+								StatusCode: ptrTo(301),
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			var errs field.ErrorList
+			route := gatewayv1b1.HTTPRoute{Spec: gatewayv1b1.HTTPRouteSpec{Rules: tc.rules}}
+			errs = ValidateHTTPRoute(&route)
+			if len(errs) != tc.errCount {
+				t.Errorf("got %d errors, want %d errors: %s", len(errs), tc.errCount, errs)
+			}
+		})
+	}
+}

hack/invalid-examples/v1beta1/httproute/invalid-request-redirect-with-backendref.yaml

@@ -0,0 +1,16 @@
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: HTTPRoute
+metadata:
+  name: http-filter-rewrite
+spec:
+  hostnames:
+    - rewrite.example
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      backendRefs:
+        - name: example-svc
+          port: 80