Skip to content

Commit 13903d8

Browse files
ccroncaccronca
authored
feat: add HTTP Basic and HTTP Header authentication e2e tests (#412)
* feat: add e2e tests for HTTP Basic and HTTP Header authentication Add end-to-end tests to validate authentication scenarios: Tests verify both configuration setup (via logs) and actual header transmission (via scan results), ensuring authentication works end-to-end. * feat: add secret scanning protection for authentication e2e tests Add secret scanning configuration to prevent false positives from dummy test credentials used in authentication e2e tests. These configurations should ensure dummy test credentials are not flagged as real secrets while maintaining security scanning for actual sensitive data. * feat(k8s): add isolated VAPI deployment for authentication e2e tests Create dedicated VAPI resources for authentication tests to prevent resource conflicts with integration tests * feat(deps): Install gtk3 dependency Install gtk3 to resolve the "libgtk-3.so.0: cannot open shared object file" error when validating Firefox version * feat(deps): Install gtk3 dependency in Garak Containerfile Install gtk3 to resolve the "libgtk-3.so.0: cannot open shared object file" error when validating Firefox version
1 parent 9b2fd5f commit 13903d8

12 files changed

+334
-3
lines changed

‎.github/secret_scanning.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# GitHub Secret Scanning configuration
2+
# https://docs.github.com/en/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning
3+
4+
paths-ignore:
5+
# E2E test files with dummy authentication credentials
6+
- 'e2e-tests/manifests/rapidast-vapi-configmap-http-basic.yaml'
7+
- 'e2e-tests/manifests/rapidast-vapi-configmap-http-header.yaml'
8+
- 'e2e-tests/test_authentication.py'

‎.gitleaks.toml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Gitleaks configuration to exclude dummy test secrets
2+
# https://github.com/gitleaks/gitleaks
3+
4+
# Exclude specific files containing dummy authentication credentials
5+
[[allowlist]]
6+
description = "E2E test files with dummy authentication credentials"
7+
paths = [
8+
'''e2e-tests/manifests/rapidast-vapi-configmap-http-basic\.yaml''',
9+
'''e2e-tests/manifests/rapidast-vapi-configmap-http-header\.yaml''',
10+
'''e2e-tests/test_authentication\.py'''
11+
]

‎.tekton/integration-test.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -210,7 +210,7 @@ spec:
210210
source /workspace/.tekton/scripts/setup-cachi2-env.sh
211211
212212
python3.12 -m pip install -r requirements-dev.txt
213-
pytest -s e2e-tests/test_integration.py --json-report --json-report-summary --json-report-file $(results.TEST_OUTPUT.path)
213+
pytest -s e2e-tests/test_integration.py e2e-tests/test_authentication.py --json-report --json-report-summary --json-report-file $(results.TEST_OUTPUT.path)
214214
cat $(results.TEST_OUTPUT.path)
215215
216216
# XXX temporarily disabled

‎containerize/Containerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ ARG FF_FILE=$DEPS_DIR/firefox.tar.bz2
2222
ARG TRIVY_FILE=$DEPS_DIR/trivy.tar.gz
2323
ARG KCTL_FILE=$DEPS_DIR/kubectl
2424

25-
RUN microdnf install -y tar gzip bzip2 java-21-openjdk nodejs
25+
RUN microdnf install -y tar gzip bzip2 java-21-openjdk nodejs gtk3
2626

2727
RUN mkdir "${DEPS_DIR}" /tmp/node_modules && if [ "$PREFETCH" == "true" ]; then \
2828
echo "PREFETCH is true: Copying dependencies from /cachi2/output/deps..." && \

‎containerize/Containerfile.garak‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ ARG FF_FILE=$DEPS_DIR/firefox.tar.bz2
2222
ARG TRIVY_FILE=$DEPS_DIR/trivy.tar.gz
2323
ARG KCTL_FILE=$DEPS_DIR/kubectl
2424

25-
RUN microdnf install -y tar gzip bzip2 java-21-openjdk nodejs
25+
RUN microdnf install -y tar gzip bzip2 java-21-openjdk nodejs gtk3
2626

2727
RUN mkdir "${DEPS_DIR}" /tmp/node_modules && if [ "$PREFETCH" == "true" ]; then \
2828
echo "PREFETCH is true: Copying dependencies from /cachi2/output/deps..." && \

‎e2e-tests/manifests/rapidast-vapi-configmap-http-basic.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
apiVersion: v1
2+
data:
3+
config.yaml: |+
4+
config:
5+
configVersion: 5
6+
7+
application:
8+
shortName: "http-basic-auth-test"
9+
url: "http://vapi-auth:5000"
10+
11+
scanners:
12+
zap:
13+
apiScan:
14+
apis:
15+
apiUrl: "http://vapi-auth:5000/docs/openapi.json"
16+
17+
authentication:
18+
type: "http_basic"
19+
parameters:
20+
# NOTE: These are dummy test credentials for e2e testing - not real secrets
21+
username: "user"
22+
password: "mypassw0rd"
23+
24+
passiveScan:
25+
# Enable passive scanning to capture authentication headers
26+
disabledRules: ""
27+
28+
container:
29+
parameters:
30+
executable: "zap.sh"
31+
32+
kind: ConfigMap
33+
metadata:
34+
name: rapidast-vapi-http-basic

‎e2e-tests/manifests/rapidast-vapi-configmap-http-header.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
apiVersion: v1
2+
data:
3+
config.yaml: |+
4+
config:
5+
configVersion: 5
6+
7+
application:
8+
shortName: "http-header-auth-test"
9+
url: "http://vapi-auth:5000"
10+
11+
scanners:
12+
zap:
13+
apiScan:
14+
apis:
15+
apiUrl: "http://vapi-auth:5000/docs/openapi.json"
16+
17+
authentication:
18+
type: "http_header"
19+
parameters:
20+
name: "Authorization"
21+
# NOTE: This is a dummy test header value for e2e testing - not a real secret
22+
value: "MySecretHeader"
23+
24+
passiveScan:
25+
# Enable passive scanning to capture authentication headers
26+
disabledRules: ""
27+
28+
container:
29+
parameters:
30+
executable: "zap.sh"
31+
32+
kind: ConfigMap
33+
metadata:
34+
name: rapidast-vapi-http-header

‎e2e-tests/manifests/rapidast-vapi-pod-http-basic.yaml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
annotations:
5+
name: rapidast-vapi-http-basic
6+
spec:
7+
initContainers:
8+
# Run rapidast as initContainer, second container prints the results
9+
- image: ${IMAGE} # quay.io/redhatproductsecurity/rapidast:latest
10+
imagePullPolicy: Always
11+
name: rapidast
12+
resources:
13+
limits:
14+
cpu: 1
15+
memory: 2Gi
16+
requests:
17+
cpu: 250m
18+
memory: 512Mi
19+
volumeMounts:
20+
- name: config-volume
21+
mountPath: /opt/rapidast/config
22+
- name: results
23+
mountPath: /opt/rapidast/results
24+
containers:
25+
# Expects initContainer to already have created results
26+
- command: ["bash", "-c", "cat /opt/rapidast/results/*/*/zap/zap-report.json"]
27+
image: registry.redhat.io/ubi9/ubi-micro
28+
name: results
29+
volumeMounts:
30+
- name: results
31+
mountPath: /opt/rapidast/results
32+
volumes:
33+
- name: config-volume
34+
configMap:
35+
name: rapidast-vapi-http-basic
36+
- name: results
37+
emptyDir: {}
38+
restartPolicy: Never

‎e2e-tests/manifests/rapidast-vapi-pod-http-header.yaml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
annotations:
5+
name: rapidast-vapi-http-header
6+
spec:
7+
initContainers:
8+
# Run rapidast as initContainer, second container prints the results
9+
- image: ${IMAGE} # quay.io/redhatproductsecurity/rapidast:latest
10+
imagePullPolicy: Always
11+
name: rapidast
12+
resources:
13+
limits:
14+
cpu: 1
15+
memory: 2Gi
16+
requests:
17+
cpu: 250m
18+
memory: 512Mi
19+
volumeMounts:
20+
- name: config-volume
21+
mountPath: /opt/rapidast/config
22+
- name: results
23+
mountPath: /opt/rapidast/results
24+
containers:
25+
# Expects initContainer to already have created results
26+
- command: ["bash", "-c", "cat /opt/rapidast/results/*/*/zap/zap-report.json"]
27+
image: registry.redhat.io/ubi9/ubi-micro
28+
name: results
29+
volumeMounts:
30+
- name: results
31+
mountPath: /opt/rapidast/results
32+
volumes:
33+
- name: config-volume
34+
configMap:
35+
name: rapidast-vapi-http-header
36+
- name: results
37+
emptyDir: {}
38+
restartPolicy: Never

‎e2e-tests/manifests/vapi-auth-deployment.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
apiVersion: apps/v1
3+
kind: Deployment
4+
metadata:
5+
annotations:
6+
name: vapi-auth
7+
labels:
8+
app: vapi-auth
9+
spec:
10+
replicas: 1
11+
selector:
12+
matchLabels:
13+
app: vapi-auth
14+
template:
15+
metadata:
16+
labels:
17+
app: vapi-auth
18+
spec:
19+
containers:
20+
- command:
21+
- bash
22+
- -c
23+
- . start.sh && sleep infinity
24+
image: quay.io/sfowler/vapi:latest
25+
imagePullPolicy: Always
26+
name: vapi
27+
# The pod should only be marked as "ready" once both
28+
# the frontend and backend services are listening on their respective ports
29+
lifecycle:
30+
postStart:
31+
exec:
32+
command:
33+
- /bin/bash
34+
- -c
35+
- |
36+
echo "Checking services..."
37+
echo "Waiting for ports 3000 and 5000..."
38+
while ! (echo > /dev/tcp/localhost/3000) 2>/dev/null; do echo "Port 3000 not ready" && sleep 1; done
39+
while ! (echo > /dev/tcp/localhost/5000) 2>/dev/null; do echo "Port 5000 not ready" && sleep 1; done
40+
echo "All ports are ready"

0 commit comments

Comments
 (0)