envoyproxy/envoy

testing tools for extauth/rbac/etc policies

Open

#13,065 opened on Sep 11, 2020

View on GitHub
 (1 comment) (0 reactions) (0 assignees)C++ (5,373 forks)batch import
area/securityhelp wanted

Repository metrics

Stars
 (27,997 stars)
PR merge metrics
 (Avg merge 8d) (378 merged PRs in 30d)

Description

Inspired by https://twitter.com/fuzzyKB/status/1304180270858338309.

I think much like the route test tool, it would be useful to have some tools that can more easily test matching/rbac/extauth/jwt/etc. policies.

This would allow us to more easily write expectation style testing for different policies without having to stand up a full proxy and perform integration testing.

I'm imagining the ability to provide different configurations, and then provide input requests/JWT/etc. and potentially even specify different extauth responses to drive test cases. Under the hood this would use all of the prod code that actually performs these operations, extracted from the owning filters and network infra.

Contributor guide

Research direction
Examine the existing route test tool in Envoy and understand how policies like extauth, RBAC, and JWT are implemented in the codebase. Look for relevant filter classes and how they process requests. Consider extracting the core logic into reusable test helpers.
Tech stack
cpp
Domain
testing
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
C++testing
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40