Add CORS policy to config-contour

config/config-contour.yaml

@@ -54,3 +54,19 @@ data:
       ClusterLocal:
         class: contour-internal
         service: contour-internal/envoy
+    # corsPolicy contains the configuration to set CORS policy for HTTPProxies.
+    corsPolicy: |
+      allowCredentials: true
+      allowOrigin:
+        - example.com
+      allowMethods:
+        - GET
+        - POST
+        - OPTIONS
+      allowHeaders:
+        - authorization
+        - cache-control
+      exposeHeaders:
+        - Content-Length
+        - Content-Range
+      maxAge: "10m"

pkg/reconciler/contour/config/contour.go

@@ -18,6 +18,7 @@ package config
 
 import (
 	"fmt"
+	"regexp"
 	"time"
 
 	corev1 "k8s.io/api/core/v1"
@@ -39,6 +40,7 @@ const (
 	defaultTLSSecretConfigKey = "default-tls-secret"
 	timeoutPolicyIdleKey      = "timeout-policy-idle"
 	timeoutPolicyResponseKey  = "timeout-policy-response"
+	corsPolicy                = "corsPolicy"
 )
 
 // Contour contains contour related configuration defined in the
@@ -49,18 +51,29 @@ type Contour struct {
 	DefaultTLSSecret      *types.NamespacedName
 	TimeoutPolicyResponse string
 	TimeoutPolicyIdle     string
+	CORSPolicy            *CORSPolicy
+}
+
+type CORSPolicy struct {
+	AllowCredentials bool     `json:"allowCredentials"`
+	AllowOrigin      []string `json:"allowOrigin"`
+	AllowMethods     []string `json:"allowMethods"`
+	AllowHeaders     []string `json:"allowHeaders"`
+	ExposeHeaders    []string `json:"exposeHeaders"`
+	MaxAge           string   `json:"maxAge"`
 }
 
 type visibilityValue struct {
 	Class   string `json:"class"`
 	Service string `json:"service"`
 }
 
-// NewContourFromConfigMap creates an Contour config from the supplied ConfigMap
+// NewContourFromConfigMap creates a Contour config from the supplied ConfigMap
 func NewContourFromConfigMap(configMap *corev1.ConfigMap) (*Contour, error) {
 	var tlsSecret *types.NamespacedName
 	var timeoutPolicyResponse = "infinity"
 	var timeoutPolicyIdle = "infinity"
+	var contourCORSPolicy *CORSPolicy
 
 	if err := configmap.Parse(configMap.Data,
 		configmap.AsOptionalNamespacedName(defaultTLSSecretConfigKey, &tlsSecret),
@@ -70,6 +83,37 @@ func NewContourFromConfigMap(configMap *corev1.ConfigMap) (*Contour, error) {
 		return nil, err
 	}
 
+	cors, ok := configMap.Data[corsPolicy]
+	if ok {
+		if err := yaml.Unmarshal([]byte(cors), &contourCORSPolicy); err != nil {
+			return nil, err
+		}
+
+		fields := [][]string{
+			contourCORSPolicy.AllowOrigin,
+			contourCORSPolicy.AllowMethods,
+			contourCORSPolicy.AllowHeaders,
+			contourCORSPolicy.ExposeHeaders,
+		}
+		for _, field := range fields {
+			if len(field) > 0 {
+				var validOption = regexp.MustCompile("^[a-zA-Z0-9!#$%&'*+.^_`|~-]+$")
+				for _, option := range field {
+					if !validOption.MatchString(option) {
+						return nil, fmt.Errorf("option %s is not validly formated", option)
+					}
+				}
+			} else {
+				return nil, fmt.Errorf("fields AllowOrigin, AllowMethods, AllowHeaders, and ExposeHeaders require at least one value")
+			}
+		}
+
+		_, err := time.ParseDuration(contourCORSPolicy.MaxAge)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse MaxAge: %w", err)
+		}
+	}
+
 	v, ok := configMap.Data[visibilityConfigKey]
 	if !ok {
 		// These are the defaults.
@@ -85,6 +129,7 @@ func NewContourFromConfigMap(configMap *corev1.ConfigMap) (*Contour, error) {
 			},
 			TimeoutPolicyResponse: timeoutPolicyResponse,
 			TimeoutPolicyIdle:     timeoutPolicyIdle,
+			CORSPolicy:            contourCORSPolicy,
 		}, nil
 	}
 	entry := make(map[v1alpha1.IngressVisibility]visibilityValue)
@@ -107,6 +152,7 @@ func NewContourFromConfigMap(configMap *corev1.ConfigMap) (*Contour, error) {
 		VisibilityClasses:     make(map[v1alpha1.IngressVisibility]string, 2),
 		TimeoutPolicyResponse: timeoutPolicyResponse,
 		TimeoutPolicyIdle:     timeoutPolicyIdle,
+		CORSPolicy:            contourCORSPolicy,
 	}
 	for key, value := range entry {
 		// Check that the visibility makes sense.

pkg/reconciler/contour/config/contour_test.go

@@ -19,6 +19,8 @@ package config
 import (
 	"testing"
 
+	"github.com/google/go-cmp/cmp"
+
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
@@ -40,6 +42,204 @@ func TestContour(t *testing.T) {
 	}
 }
 
+func TestCORSPolicy(t *testing.T) {
+	cm := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: system.Namespace(),
+			Name:      ContourConfigName,
+		},
+		Data: map[string]string{
+			corsPolicy: `
+allowCredentials: true
+allowOrigin:
+  - "*"
+allowMethods:
+  - GET
+  - POST
+  - OPTIONS
+allowHeaders:
+  - authorization
+  - cache-control
+exposeHeaders:
+  - Content-Length
+  - Content-Range
+maxAge: "10m"
+`,
+		},
+	}
+
+	cfg, err := NewContourFromConfigMap(cm)
+	if err != nil {
+		t.Error("NewContourFromConfigMap(corsPolicy) =", err)
+		t.FailNow()
+	}
+
+	want := &CORSPolicy{
+		AllowCredentials: true,
+		AllowOrigin:      []string{"*"},
+		AllowMethods:     []string{"GET", "POST", "OPTIONS"},
+		AllowHeaders:     []string{"authorization", "cache-control"},
+		ExposeHeaders:    []string{"Content-Length", "Content-Range"},
+		MaxAge:           "10m",
+	}
+	got := cfg.CORSPolicy
+	if !cmp.Equal(got, want) {
+		t.Errorf("Got = %v, want: %v, diff:\n%s", got, want, cmp.Diff(got, want))
+	}
+}
+func TestCORSPolicyConfigurationErrors(t *testing.T) {
+	tests := []struct {
+		name    string
+		wantErr bool
+		config  *corev1.ConfigMap
+	}{{
+		name:    "failure parsing yaml",
+		wantErr: true,
+		config: &corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{
+				Namespace: system.Namespace(),
+				Name:      ContourConfigName,
+			},
+			Data: map[string]string{
+				corsPolicy: "moo",
+			},
+		},
+	}, {
+		name:    "wrong type",
+		wantErr: true,
+		config: &corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{
+				Namespace: system.Namespace(),
+				Name:      ContourConfigName,
+			},
+			Data: map[string]string{
+				corsPolicy: `
+allowCredentials: 3
+allowOrigin: true
+allowMethods: "moo"
+allowHeaders:
+  - authorization
+  - cache-control
+exposeHeaders:
+  - Content-Length
+  - Content-Range
+maxAge: "10m"
+`,
+			},
+		},
+	}, {
+		name:    "incomplete configuration",
+		wantErr: true,
+		config: &corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{
+				Namespace: system.Namespace(),
+				Name:      ContourConfigName,
+			},
+			Data: map[string]string{
+				corsPolicy: `
+allowHeaders:
+  - authorization
+  - cache-control
+exposeHeaders:
+  - Content-Length
+  - Content-Range
+maxAge: "10m"
+`,
+			},
+		},
+	}, {
+		name:    "empty value",
+		wantErr: true,
+		config: &corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{
+				Namespace: system.Namespace(),
+				Name:      ContourConfigName,
+			},
+			Data: map[string]string{
+				corsPolicy: `
+allowCredentials: false
+allowOrigin: []
+allowMethods:
+  - GET
+  - POST
+  - OPTIONS
+allowHeaders:
+  - authorization
+  - cache-control
+exposeHeaders:
+  - Content-Length
+  - Content-Range
+maxAge: "10m"
+`,
+			},
+		},
+	}, {
+		name:    "wrong option",
+		wantErr: true,
+		config: &corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{
+				Namespace: system.Namespace(),
+				Name:      ContourConfigName,
+			},
+			Data: map[string]string{
+				corsPolicy: `
+allowCredentials: true
+allowOrigin:
+  - "*"
+allowMethods:
+  - ((GET))
+  - POST
+  - OPTIONS
+allowHeaders:
+  - authorization
+  - cache-control
+exposeHeaders:
+  - Content-Length
+  - Content-Range
+maxAge: "10m"
+`,
+			},
+		},
+	}, {
+		name:    "invalid duration",
+		wantErr: true,
+		config: &corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{
+				Namespace: system.Namespace(),
+				Name:      ContourConfigName,
+			},
+			Data: map[string]string{
+				corsPolicy: `
+allowCredentials: true
+allowOrigin:
+  - "*"
+allowMethods:
+  - GET
+  - POST
+  - OPTIONS
+allowHeaders:
+  - authorization
+  - cache-control
+exposeHeaders:
+  - Content-Length
+  - Content-Range
+maxAge: "10"
+`,
+			},
+		},
+	}}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := NewContourFromConfigMap(tt.config)
+			t.Log(err)
+			if (err != nil) != tt.wantErr {
+				t.Fatalf("Test: %q; NewContourFromConfigMap() error = %v, WantErr %v", tt.name, err, tt.wantErr)
+			}
+		})
+	}
+}
+
 func TestDefaultTLSSecret(t *testing.T) {
 	cm := &corev1.ConfigMap{
 		ObjectMeta: metav1.ObjectMeta{