add gcpAuthzExtension CRD

authz-extension/cr-validation/backend_ref_invalid_group.yaml

@@ -0,0 +1,11 @@
+apiVersion: networking.gke.io/v1
+kind: GCPAuthzExtension
+metadata:
+  name: "test"
+spec:
+  backendRef:
+    group: "fake-group"
+    kind: Service
+    name: test-service
+    port: 80
+  authority: hello.com

authz-extension/cr-validation/backend_ref_invalid_kind.yaml

@@ -0,0 +1,11 @@
+apiVersion: networking.gke.io/v1
+kind: GCPAuthzExtension
+metadata:
+  name: "test"
+spec:
+  backendRef:
+    group: ""
+    kind: Gateway
+    name: test-service
+    port: 80
+  authority: hello.com

authz-extension/cr-validation/invalid_metadata_key.yaml

@@ -0,0 +1,14 @@
+apiVersion: networking.gke.io/v1
+kind: GCPAuthzExtension
+metadata:
+  name: "test"
+spec:
+  backendRef:
+    group: ""
+    kind: Service
+    name: test-service
+    port: 80
+  authority: hello.com
+  timeout: 1s
+  metadata:
+    "???": "value"

authz-extension/cr-validation/invalid_metadata_value.yaml

@@ -0,0 +1,14 @@
+apiVersion: networking.gke.io/v1
+kind: GCPAuthzExtension
+metadata:
+  name: "test"
+spec:
+  backendRef:
+    group: ""
+    kind: Service
+    name: test-service
+    port: 80
+  authority: hello.com
+  timeout: 1s
+  metadata:
+    "key": ""

authz-extension/cr-validation/no_authority.yaml

@@ -0,0 +1,11 @@
+apiVersion: networking.gke.io/v1
+kind: GCPAuthzExtension
+metadata:
+  name: "test"
+spec:
+  backendRef:
+    group: ""
+    kind: Service
+    name: test-service
+    port: 80
+  timeout: 1s

authz-extension/cr-validation/no_timeout.yaml

@@ -0,0 +1,11 @@
+apiVersion: networking.gke.io/v1
+kind: GCPAuthzExtension
+metadata:
+  name: "test"
+spec:
+  backendRef:
+    group: ""
+    kind: Service
+    name: test-service
+    port: 80
+  authority: hello.com

authz-extension/cr-validation/run-test.sh

@@ -0,0 +1,52 @@
+#!/bin/bash
+
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit;
+set -o nounset;
+set -o pipefail;
+set -o xtrace;
+
+check_cr_validation() {
+    path="$1"
+    fail="$2"
+    crd_path="./gateway-api/config/mesh/crd/experimental" 
+    set +e
+    output=$(kubectl validate "${path}" --local-crds "${crd_path}"  2>&1)
+    set -e
+
+    # Check if the validation passed or failed
+    if [[ "$output" == *"OK"* && "$fail" == "false" ]]; then
+        echo "Validation passed."
+        return 0  # Test passes
+    elif [[ "$output" != *"OK"* && "$fail" == "true" ]]; then
+        echo "Validation failed as expected due to fail condition."
+        return 0  # Test passes because fail is true and we expect validation to fail
+    else
+        echo "Validation failed."
+        return 1  # Test fails
+    fi
+}
+
+check_cr_validation "./authz-extension/cr-validation/backend_ref_invalid_group.yaml" "true"
+check_cr_validation "./authz-extension/cr-validation/backend_ref_invalid_kind.yaml" "true"
+check_cr_validation "./authz-extension/cr-validation/invalid_metadata_key.yaml" "true"
+check_cr_validation "./authz-extension/cr-validation/invalid_metadata_value.yaml" "true"
+check_cr_validation "./authz-extension/cr-validation/no_authority.yaml" "true"
+check_cr_validation "./authz-extension/cr-validation/no_timeout.yaml" "true"
+check_cr_validation "./authz-extension/cr-validation/too_big_timeout.yaml" "true"
+check_cr_validation "./authz-extension/cr-validation/too_small_timeout.yaml" "true"
+check_cr_validation "./authz-extension/cr-validation/wrong_wire_format.yaml" "true"
+check_cr_validation "./authz-extension/cr-validation/valid.yaml" "false"

authz-extension/cr-validation/too_big_timeout.yaml

@@ -0,0 +1,12 @@
+apiVersion: networking.gke.io/v1
+kind: GCPAuthzExtension
+metadata:
+  name: "test"
+spec:
+  backendRef:
+    group: ""
+    kind: Service
+    name: test-service
+    port: 80
+  authority: hello.com
+  timeout: 11s

authz-extension/cr-validation/too_small_timeout.yaml

@@ -0,0 +1,12 @@
+apiVersion: networking.gke.io/v1
+kind: GCPAuthzExtension
+metadata:
+  name: "test"
+spec:
+  backendRef:
+    group: ""
+    kind: Service
+    name: test-service
+    port: 80
+  authority: hello.com
+  timeout: 1ms

authz-extension/cr-validation/valid.yaml

@@ -0,0 +1,18 @@
+apiVersion: networking.gke.io/v1
+kind: GCPAuthzExtension
+metadata:
+  name: "test"
+spec:
+  backendRef:
+    group: ""
+    kind: Service
+    name: test-service
+    port: 80
+  authority: hello.com
+  timeout: 1s
+  failOpen: true
+  metadata:
+    "key": "value"
+  forwardHeaders:
+  - hello.com
+  wireFormat: ExtProcGRPC

authz-extension/cr-validation/wrong_wire_format.yaml

@@ -0,0 +1,13 @@
+apiVersion: networking.gke.io/v1
+kind: GCPAuthzExtension
+metadata:
+  name: "test"
+spec:
+  backendRef:
+    group: ""
+    kind: Service
+    name: test-service
+    port: 80
+  timeout: 1s
+  authority: hello.com
+  wireFormat: ExtProc