Default is an optional arbitrary JSON object that the context may take if the apiCall -returns error
+Default is an optional arbitrary JSON object that the context +value is set to, if the apiCall returns error.
+(Appears on: +ServiceCall) +
++
+| Field | +Description | +
|---|---|
+key+ +string + + |
+
+ Key is the header key + |
+
+value+ +string + + |
+
+ Value is the header value + |
+
@@ -4204,6 +4245,19 @@ string
headersHeaders is a list of optional HTTP headers to be included in the request.
+caBundleDefault is an optional arbitrary JSON object that the context may take if the apiCall -returns error
+Default is an optional arbitrary JSON object that the context +value is set to, if the apiCall returns error.
@@ -4766,6 +4766,99 @@ of deployments across all namespaces. + + + + ++ (Appears in: + ServiceCall) +
+ + + + + +| Field | +Description | +
|---|---|
key
+
+ *
+
+
+
+
+
+
+ string
+
+
+ |
+
+
+
+ Key is the header key + + + + + + |
+
value
+
+ *
+
+
+
+
+
+
+ string
+
+
+ |
+
+
+
+ Value is the header value + + + + + + |
+
headers
+
+ *
+
+
+
+
+
+
+
+ []HTTPHeader
+
+
+
+ Headers is a list of optional HTTP headers to be included in the request.
+ + + + + +caBundle
diff --git a/pkg/client/applyconfigurations/kyverno/v1/httpheader.go b/pkg/client/applyconfigurations/kyverno/v1/httpheader.go
new file mode 100644
index 0000000000..2a50d91fa6
--- /dev/null
+++ b/pkg/client/applyconfigurations/kyverno/v1/httpheader.go
@@ -0,0 +1,48 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+// HTTPHeaderApplyConfiguration represents an declarative configuration of the HTTPHeader type for use
+// with apply.
+type HTTPHeaderApplyConfiguration struct {
+ Key *string `json:"key,omitempty"`
+ Value *string `json:"value,omitempty"`
+}
+
+// HTTPHeaderApplyConfiguration constructs an declarative configuration of the HTTPHeader type for use with
+// apply.
+func HTTPHeader() *HTTPHeaderApplyConfiguration {
+ return &HTTPHeaderApplyConfiguration{}
+}
+
+// WithKey sets the Key field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Key field is set to the value of the last call.
+func (b *HTTPHeaderApplyConfiguration) WithKey(value string) *HTTPHeaderApplyConfiguration {
+ b.Key = &value
+ return b
+}
+
+// WithValue sets the Value field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Value field is set to the value of the last call.
+func (b *HTTPHeaderApplyConfiguration) WithValue(value string) *HTTPHeaderApplyConfiguration {
+ b.Value = &value
+ return b
+}
diff --git a/pkg/client/applyconfigurations/kyverno/v1/servicecall.go b/pkg/client/applyconfigurations/kyverno/v1/servicecall.go
index cedc9969a5..1bac9d4768 100644
--- a/pkg/client/applyconfigurations/kyverno/v1/servicecall.go
+++ b/pkg/client/applyconfigurations/kyverno/v1/servicecall.go
@@ -21,8 +21,9 @@ package v1
// ServiceCallApplyConfiguration represents an declarative configuration of the ServiceCall type for use
// with apply.
type ServiceCallApplyConfiguration struct {
- URL *string `json:"url,omitempty"`
- CABundle *string `json:"caBundle,omitempty"`
+ URL *string `json:"url,omitempty"`
+ Headers []HTTPHeaderApplyConfiguration `json:"headers,omitempty"`
+ CABundle *string `json:"caBundle,omitempty"`
}
// ServiceCallApplyConfiguration constructs an declarative configuration of the ServiceCall type for use with
@@ -39,6 +40,19 @@ func (b *ServiceCallApplyConfiguration) WithURL(value string) *ServiceCallApplyC
return b
}
+// WithHeaders adds the given value to the Headers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Headers field.
+func (b *ServiceCallApplyConfiguration) WithHeaders(values ...*HTTPHeaderApplyConfiguration) *ServiceCallApplyConfiguration {
+ for i := range values {
+ if values[i] == nil {
+ panic("nil value passed to WithHeaders")
+ }
+ b.Headers = append(b.Headers, *values[i])
+ }
+ return b
+}
+
// WithCABundle sets the CABundle field in the declarative configuration to the given value
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
// If called multiple times, the CABundle field is set to the value of the last call.
diff --git a/pkg/client/applyconfigurations/utils.go b/pkg/client/applyconfigurations/utils.go
index 5addd1898a..d051d1d11a 100644
--- a/pkg/client/applyconfigurations/utils.go
+++ b/pkg/client/applyconfigurations/utils.go
@@ -89,6 +89,8 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
return &kyvernov1.GenerationApplyConfiguration{}
case v1.SchemeGroupVersion.WithKind("GlobalContextEntryReference"):
return &kyvernov1.GlobalContextEntryReferenceApplyConfiguration{}
+ case v1.SchemeGroupVersion.WithKind("HTTPHeader"):
+ return &kyvernov1.HTTPHeaderApplyConfiguration{}
case v1.SchemeGroupVersion.WithKind("ImageExtractorConfig"):
return &kyvernov1.ImageExtractorConfigApplyConfiguration{}
case v1.SchemeGroupVersion.WithKind("ImageRegistry"):
diff --git a/pkg/engine/apicall/apiCall_test.go b/pkg/engine/apicall/apiCall_test.go
index 3034a9a3db..e088835ecd 100644
--- a/pkg/engine/apicall/apiCall_test.go
+++ b/pkg/engine/apicall/apiCall_test.go
@@ -2,7 +2,7 @@ package apicall
import (
"context"
- "fmt"
+ "encoding/json"
"io"
"net/http"
"net/http/httptest"
@@ -34,17 +34,34 @@ func buildTestServer(responseData []byte, useChunked bool) *httptest.Server {
mux := http.NewServeMux()
mux.HandleFunc("/resource", func(w http.ResponseWriter, r *http.Request) {
if r.Method == "GET" {
- w.Write(responseData)
+ auth := r.Header.Get("Authorization")
+ if auth != "Bearer 1234567890" {
+ http.Error(w, "Unauthorized", http.StatusUnauthorized)
+ return
+ }
+
+ contentType := r.Header.Get("Content-Type")
+ if contentType != "application/json" {
+ http.Error(w, "StatusUnsupportedMediaType", http.StatusUnsupportedMediaType)
+ return
+ }
if useChunked {
flusher, ok := w.(http.Flusher)
if !ok {
- panic("expected http.ResponseWriter to be an http.Flusher")
+ http.Error(w, "expected http.ResponseWriter to be an http.Flusher", http.StatusInternalServerError)
+ return
}
- for i := 1; i <= 10; i++ {
- fmt.Fprintf(w, "Chunk #%d\n", i)
+ chunkSize := len(responseData) / 10
+ for i := 0; i < 10; i++ {
+ data := responseData[i*chunkSize : (i+1)*chunkSize]
+ w.Write(data)
flusher.Flush()
}
+ w.Write(responseData[10*chunkSize:])
+ flusher.Flush()
+ } else {
+ w.Write(responseData)
}
return
@@ -63,7 +80,7 @@ func buildTestServer(responseData []byte, useChunked bool) *httptest.Server {
func Test_serviceGetRequest(t *testing.T) {
testfn := func(t *testing.T, useChunked bool) {
serverResponse := []byte(`{ "day": "Sunday" }`)
- s := buildTestServer(serverResponse, false)
+ s := buildTestServer(serverResponse, useChunked)
defer s.Close()
entry := kyvernov1.ContextEntry{}
@@ -77,6 +94,10 @@ func Test_serviceGetRequest(t *testing.T) {
APICall: kyvernov1.APICall{
Service: &kyvernov1.ServiceCall{
URL: s.URL,
+ Headers: []kyvernov1.HTTPHeader{
+ {Key: "Authorization", Value: "Bearer 1234567890"},
+ {Key: "Content-Type", Value: "application/json"},
+ },
},
},
}
@@ -192,3 +213,58 @@ func Test_servicePostRequest(t *testing.T) {
expectedResults := `{"images":["https://ghcr.io/tomcat/tomcat:9","https://ghcr.io/vault/vault:v3","https://ghcr.io/busybox/busybox:latest"]}`
assert.Equal(t, string(expectedResults)+"\n", string(data))
}
+
+func buildEchoHeaderTestServer() *httptest.Server {
+ mux := http.NewServeMux()
+ mux.HandleFunc("/resource", func(w http.ResponseWriter, r *http.Request) {
+ if r.Method == "GET" {
+ responseData := make(map[string][]string)
+ for k, v := range r.Header {
+ responseData[k] = v
+ }
+ responseBytes, err := json.Marshal(responseData)
+ if err != nil {
+ http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+ return
+ }
+ w.Write(responseBytes)
+ }
+ })
+ return httptest.NewServer(mux)
+}
+
+func Test_serviceHeaders(t *testing.T) {
+ s := buildEchoHeaderTestServer()
+ defer s.Close()
+
+ entry := kyvernov1.ContextEntry{}
+ ctx := enginecontext.NewContext(jp)
+
+ entry.Name = "test"
+ entry.APICall = &kyvernov1.ContextAPICall{
+ APICall: kyvernov1.APICall{
+ Method: "GET",
+ Service: &kyvernov1.ServiceCall{
+ URL: s.URL + "/resource",
+ Headers: []kyvernov1.HTTPHeader{
+ {Key: "Content-Type", Value: "application/json"},
+ {Key: "Custom-Key", Value: "CustomVal"},
+ },
+ },
+ },
+ }
+
+ entry.APICall.Service.URL = s.URL + "/resource"
+ call, err := New(logr.Discard(), jp, entry, ctx, nil, apiConfig)
+ assert.NilError(t, err)
+ data, err := call.FetchAndLoad(context.TODO())
+ assert.NilError(t, err)
+ assert.Assert(t, data != nil, "nil data")
+
+ var responseHeaders map[string][]string
+ err = json.Unmarshal(data, &responseHeaders)
+ assert.NilError(t, err)
+ assert.Equal(t, 4, len(responseHeaders))
+ assert.Equal(t, "application/json", responseHeaders["Content-Type"][0])
+ assert.Equal(t, "CustomVal", responseHeaders["Custom-Key"][0])
+}
diff --git a/pkg/engine/apicall/executor.go b/pkg/engine/apicall/executor.go
index e43509ea5e..34bf231cf9 100644
--- a/pkg/engine/apicall/executor.go
+++ b/pkg/engine/apicall/executor.go
@@ -110,34 +110,49 @@ func (a *executor) executeServiceCall(ctx context.Context, apiCall *kyvernov1.AP
return body, nil
}
-func (a *executor) buildHTTPRequest(ctx context.Context, apiCall *kyvernov1.APICall) (req *http.Request, err error) {
+func (a *executor) buildHTTPRequest(ctx context.Context, apiCall *kyvernov1.APICall) (*http.Request, error) {
if apiCall.Service == nil {
return nil, fmt.Errorf("missing service")
}
- token := a.getToken()
- defer func() {
- if token != "" && req != nil {
+ if apiCall.Method != "GET" && apiCall.Method != "POST" {
+ return nil, fmt.Errorf("invalid request type %s for APICall %s", apiCall.Method, a.name)
+ }
+
+ var data io.Reader = nil
+ if apiCall.Method == "POST" {
+ var err error
+ data, err = a.buildRequestData(apiCall.Data)
+ if err != nil {
+ return nil, fmt.Errorf("failed to build request data for APICall %s: %w", a.name, err)
+ }
+ }
+
+ req, err := http.NewRequestWithContext(ctx, string(apiCall.Method), apiCall.Service.URL, data)
+ if err != nil {
+ return nil, fmt.Errorf("failed to build request for APICall %s: %w", a.name, err)
+ }
+
+ if err := a.addHTTPHeaders(req, apiCall.Service.Headers); err != nil {
+ return nil, fmt.Errorf("failed to add headers for APICall %s: %w", a.name, err)
+ }
+
+ return req, nil
+}
+
+func (a *executor) addHTTPHeaders(req *http.Request, headers []kyvernov1.HTTPHeader) error {
+ for _, header := range headers {
+ req.Header.Add(header.Key, header.Value)
+ }
+
+ if req.Header.Get("Authorization") == "" {
+ token := a.getToken()
+ if token != "" {
req.Header.Add("Authorization", "Bearer "+token)
}
- }()
-
- if apiCall.Method == "GET" {
- req, err = http.NewRequestWithContext(ctx, "GET", apiCall.Service.URL, nil)
- return
}
- if apiCall.Method == "POST" {
- data, dataErr := a.buildRequestData(apiCall.Data)
- if dataErr != nil {
- return nil, dataErr
- }
-
- req, err = http.NewRequest("POST", apiCall.Service.URL, data)
- return
- }
-
- return nil, fmt.Errorf("invalid request type %s for APICall %s", apiCall.Method, a.name)
+ return nil
}
func (a *executor) getToken() string {