traefik-config_test.yaml

suite: Traefik configuration
templates:
  - deployment.yaml
tests:
  - it: should have no custom arguments when specified by default
    set:
      additionalArguments:
        - --the.force.is.with.me=true
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--the.force.is.with.me=true"

  - it: should have namespace restriction if rbac is namespaced
    set:
      rbac:
        namespaced: true
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesingress.namespaces=NAMESPACE"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetescrd.namespaces=NAMESPACE"
  - it: should have a custom string of watched namespaces when specified in configuration
    set:
      rbac:
        namespaced: true
      providers:
        kubernetesCRD:
          enabled: true
          allowCrossNamespace: true
          namespaces:
            - "foo"
            - "bar"
        kubernetesIngress:
          enabled: true
          namespaces:
            - "foo"
            - "bar"
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesingress.namespaces=foo,bar"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetescrd.allowCrossNamespace=true"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetescrd.namespaces=foo,bar"
  - it: should not have the watched namespace when provider is disabled
    set:
      providers:
        kubernetesCRD:
          enabled: false
          namespaces:
            - "foo"
            - "bar"
        kubernetesIngress:
          enabled: false
          namespaces:
            - "foo"
            - "bar"
    asserts:
      - notContains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesingress.namespaces"
      - notContains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesingress"
      - notContains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetescrd.namespaces"
      - notContains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetescrd"

  - it: should have enabled published Kubernetes service when default configuration
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesingress.ingressendpoint.publishedservice=NAMESPACE/RELEASE-NAME-traefik"
  - it: should be possible to disable published Kubernetes service when specified in configuration
    set:
      providers:
        kubernetesIngress:
          publishedService:
            enabled: false
    asserts:
      - notContains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesingress.ingressendpoint.publishedservice=NAMESPACE/RELEASE-NAME-traefik"
  - it: should have a custom string in published Kubernetes service when specified in configuration
    set:
      providers:
        kubernetesIngress:
          publishedService:
            enabled: true
            pathOverride: foo/bar
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesingress.ingressendpoint.publishedservice=foo/bar"
  - it: should be possible to set statusAddress fields
    set:
      providers:
        kubernetesGateway:
          enabled: true
          statusAddress:
            ip: 1.2.3.4
            hostname: example.net
            service:
              name: foo
              namespace: default
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesgateway.statusaddress.ip=1.2.3.4"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesgateway.statusaddress.hostname=example.net"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesgateway.statusaddress.service.name=foo"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesgateway.statusaddress.service.namespace=default"
  - it: should allow cross namespace services when specified in configuration
    set:
      providers:
        kubernetesCRD:
          allowCrossNamespace: true
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetescrd.allowCrossNamespace=true"
  - it: should allow external name services when specified in configuration
    set:
      providers:
        kubernetesIngress:
          allowExternalNameServices: true
        kubernetesCRD:
          allowExternalNameServices: true
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetescrd.allowExternalNameServices=true"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesingress.allowExternalNameServices=true"
  - it: should allow empty services when specified in configuration
    set:
      providers:
        kubernetesIngress:
          allowEmptyServices: true
        kubernetesCRD:
          allowEmptyServices: true
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesingress.allowEmptyServices=true"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetescrd.allowEmptyServices=true"
  - it: should match ingresses based on input label
    set:
      providers:
        kubernetesIngress:
          labelSelector: environment=devel
        kubernetesCRD:
          labelSelector: environment=devel
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesingress.labelSelector=environment=devel"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetescrd.labelSelector=environment=devel"
  - it: should match ingresses based on ingressClass
    set:
      providers:
        kubernetesIngress:
          ingressClass: foo
        kubernetesCRD:
          ingressClass: foo
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetescrd.ingressClass=foo"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesingress.ingressClass=foo"
  - it: should be possible to set nativeLBByDefault
    set:
      providers:
        kubernetesIngress:
          nativeLBByDefault: true
        kubernetesCRD:
          nativeLBByDefault: true
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetescrd.nativeLBByDefault=true"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesingress.nativeLBByDefault=true"
  - it: should not set nativeLBByDefault by default
    asserts:
      - notContains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetescrd.nativeLBByDefault=true"
      - notContains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesingress.nativeLBByDefault=true"

  - it: should have a plugin storage and args if the experimental feature is enabled
    set:
      experimental:
        plugins:
          demo:
            moduleName: github.com/traefik/plugindemo
            version: v0.2.1
    asserts:
      - equal:
          path: spec.template.spec.volumes[2]
          value:
            name: plugins
            emptyDir: {}
      - contains:
          path: spec.template.spec.containers[0].volumeMounts
          content:
            name: plugins
            mountPath: "/plugins-storage"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--experimental.plugins.demo.moduleName=github.com/traefik/plugindemo"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--experimental.plugins.demo.version=v0.2.1"

  - it: should be possible to configure a customized plugin storage
    set:
      experimental:
        plugins:
          demo:
            moduleName: github.com/traefik/plugindemo
            version: v0.2.1
      deployment:
        additionalVolumes:
          - name: plugins
            hostPath:
              path: /data/
              type: Directory
      additionalVolumeMounts:
        - name: plugins
          mountPath: /plugins-storage
    asserts:
      - equal:
          path: spec.template.spec.volumes[2]
          value:
            hostPath:
              path: /data/
              type: Directory
            name: plugins
      - contains:
          path: spec.template.spec.containers[0].volumeMounts
          content:
            name: plugins
            mountPath: "/plugins-storage"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--experimental.plugins.demo.moduleName=github.com/traefik/plugindemo"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--experimental.plugins.demo.version=v0.2.1"
  - it: should fail gracefully when using old syntax
    set:
      experimental:
        plugins:
          test:
            foo: bar
    asserts:
      - failedTemplate:
          errorMessage: "ERROR: plugin test is missing moduleName/version keys !"

  - it: should fail gracefully on missing plugins information
    set:
      experimental:
        plugins:
          demo:
            moduleName: github.com/traefik/plugindemo
    asserts:
      - failedTemplate:
          errorMessage: "ERROR: plugin demo is missing moduleName/version keys !"

  - it: should have tls configuration args when specified in values.yaml for port
    set:
      ports:
        websecure:
          tls:
            enabled: true
            options: "foo"
            certResolver: "certResolverFoo"
            domains:
              - main: "sub.domain.tld"
                sans:
                  - "alt1.domain.tld"
                  - "alt2.domain.tld"
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--entryPoints.websecure.http.tls=true"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--entryPoints.websecure.http.tls.options=foo"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--entryPoints.websecure.http.tls.certResolver=certResolverFoo"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--entryPoints.websecure.http.tls.domains[0].main=sub.domain.tld"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--entryPoints.websecure.http.tls.domains[0].sans=alt1.domain.tld,alt2.domain.tld"

  - it: should have additional volumeMounts
    set:
      additionalVolumeMounts:
        - name: foo-logs
          mountPath: /var/log/traefik
    asserts:
      - equal:
          path: spec.template.spec.containers[0].volumeMounts[2].name
          value: foo-logs
      - equal:
          path: spec.template.spec.containers[0].volumeMounts[2].mountPath
          value: /var/log/traefik

  - it: should set custom probe port
    set:
      additionalArguments:
        - --ping
        - --ping.entrypoint=web
      deployment:
        healthchecksPort: 9001
      ports:
        traefik:
          port: 9000
          exposedPort: 9000
    asserts:
      - equal:
          path: spec.template.spec.containers[0].livenessProbe.httpGet.port
          value: 9001
      - equal:
          path: spec.template.spec.containers[0].livenessProbe.httpGet.path
          value: "/ping"
      - equal:
          path: spec.template.spec.containers[0].readinessProbe.httpGet.port
          value: 9001
      - equal:
          path: spec.template.spec.containers[0].readinessProbe.httpGet.scheme
          value: "HTTP"
      - equal:
          path: spec.template.spec.containers[0].readinessProbe.httpGet.path
          value: "/ping"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--ping"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--ping.entrypoint=web"
  - it: should set custom probe scheme
    set:
      additionalArguments:
        - --ping
        - --ping.entrypoint=websecure
      deployment:
        healthchecksScheme: HTTPS
        healthchecksPort: 8443
      ports:
        traefik:
          port: 9000
          exposedPort: 9000
    asserts:
      - equal:
          path: spec.template.spec.containers[0].livenessProbe.httpGet.port
          value: 8443
      - equal:
          path: spec.template.spec.containers[0].readinessProbe.httpGet.port
          value: 8443
      - equal:
          path: spec.template.spec.containers[0].readinessProbe.httpGet.scheme
          value: "HTTPS"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--ping"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--ping.entrypoint=websecure"
  - it: should set custom probe paths
    set:
      additionalArguments:
        - --ping
      deployment:
        readinessPath: /ready
        livenessPath: /alive
    asserts:
      - equal:
          path: spec.template.spec.containers[0].livenessProbe.httpGet.path
          value: /alive
      - equal:
          path: spec.template.spec.containers[0].readinessProbe.httpGet.path
          value: /ready
  - it: should enable tls on websecure entrypoints by default
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--entryPoints.websecure.http.tls=true"
  - it: should be possible to disable tls on websecure entrypoint
    set:
      ports:
        websecure:
          tls:
            enabled: false
    asserts:
      - notContains:
          path: spec.template.spec.containers[0].args
          content: "--entryPoints.websecure.http.tls=true"
  - it: should allow to set namespace on providers by default, without rbac.namespaced
    set:
      rbac:
        namespaced: false
      providers:
        kubernetesCRD:
          enabled: true
          namespaces: [ns1, ns2]
        kubernetesIngress:
          enabled: true
          namespaces: [ns3, ns4]
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetescrd.namespaces=ns1,ns2"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesingress.namespaces=ns3,ns4"
  - it: should not set namespace on providers by default
    asserts:
      - notContains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetescrd.namespaces=NAMESPACE"
      - notContains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesingress.namespaces=NAMESPACE"
  - it: should have forwardedHeaders and proxyProtocol trustedIPs configuration args when specified in values.yaml for port
    set:
      ports:
        websecure:
          forwardedHeaders:
            trustedIPs:
              - 127.0.0.1/32
              - 192.168.1.7
          proxyProtocol:
            trustedIPs:
              - 127.0.0.1/32
              - 192.168.1.8
        web:
          forwardedHeaders:
            trustedIPs:
              - 127.0.0.1/32
              - 192.168.1.9
          proxyProtocol:
            trustedIPs:
              - 127.0.0.1/32
              - 192.168.1.10
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--entryPoints.websecure.forwardedHeaders.trustedIPs=127.0.0.1/32,192.168.1.7"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--entryPoints.websecure.proxyProtocol.trustedIPs=127.0.0.1/32,192.168.1.8"
      - notContains:
          path: spec.template.spec.containers[0].args
          content: "--entryPoints.websecure.forwardedHeaders.insecure"
      - notContains:
          path: spec.template.spec.containers[0].args
          content: "--entryPoints.websecure.proxyProtocol.insecure"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--entryPoints.web.forwardedHeaders.trustedIPs=127.0.0.1/32,192.168.1.9"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--entryPoints.web.proxyProtocol.trustedIPs=127.0.0.1/32,192.168.1.10"
      - notContains:
          path: spec.template.spec.containers[0].args
          content: "--entryPoints.web.forwardedHeaders.insecure"
      - notContains:
          path: spec.template.spec.containers[0].args
          content: "--entryPoints.web.proxyProtocol.insecure"
  - it: should have forwardedHeaders and proxyProtocol insecure configuration args when specified in values.yaml for port
    set:
      ports:
        websecure:
          forwardedHeaders:
            insecure: true
          proxyProtocol:
            insecure: true
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--entryPoints.websecure.forwardedHeaders.insecure"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--entryPoints.websecure.proxyProtocol.insecure"
  - it: should have multiple transport configuration args when specified in values.yaml for port
    set:
      ports:
        websecure:
          transport:
            respondingTimeouts:
              readTimeout: 60
              writeTimeout: 0
              idleTimeout: 180
            lifeCycle:
              requestAcceptGraceTimeout: 0
              graceTimeOut: 10
            keepAliveMaxRequests: 0
            keepAliveMaxTime: 0
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--entryPoints.websecure.transport.respondingTimeouts.readTimeout=60"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--entryPoints.websecure.transport.respondingTimeouts.writeTimeout=0"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--entryPoints.websecure.transport.respondingTimeouts.idleTimeout=180"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--entryPoints.websecure.transport.lifeCycle.requestAcceptGraceTimeout=0"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--entryPoints.websecure.transport.lifeCycle.graceTimeOut=10"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--entryPoints.websecure.transport.keepAliveMaxRequests=0"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--entryPoints.websecure.transport.keepAliveMaxTime=0"
  - it: should have a single transport configuration arg when specified in values.yaml for port
    set:
      ports:
        websecure:
          transport:
            respondingTimeouts:
              readTimeout: 42s
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--entryPoints.websecure.transport.respondingTimeouts.readTimeout=42s"
  - it: should be possible to configure access logs
    set:
      logs:
        access:
          enabled: true
          format: json
          filePath: "/data/log"
          bufferingSize: 100
          addInternals: true
          filters:
            statuscodes: "200,300-302"
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--accesslog=true"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--accesslog.format=json"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--accesslog.filepath=/data/log"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--accesslog.bufferingsize=100"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--accesslog.addinternals"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--accesslog.filters.statuscodes=200,300-302"
  - it: should set custom startupProbe
    set:
      startupProbe:
        exec:
          command:
            - mycommand
            - foo
        initialDelaySeconds: 5
        periodSeconds: 5
    asserts:
      - equal:
          path: spec.template.spec.containers[0].startupProbe.exec.command
          value: ["mycommand", "foo"]
      - equal:
          path: spec.template.spec.containers[0].startupProbe.initialDelaySeconds
          value: 5
      - equal:
          path: spec.template.spec.containers[0].startupProbe.periodSeconds
          value: 5
  - it: should set disableIngressClassLookup if version is v3 and disableIngressClassLookup is true
    set:
      rbac:
        namespaced: true
      providers:
        kubernetesIngress:
          disableIngressClassLookup: true
      image:
        tag: v3.0.0-beta3
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesingress.disableIngressClassLookup=true"
  - it: should not set disableIngressClassLookup if version is >= v3.1.5+ and rbac are namespaced
    set:
      rbac:
        namespaced: true
      image:
        tag: v3.1.5
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesingress.disableClusterScopeResources=true"

      - notContains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesingress.disableIngressClassLookup=true"
  - it: should set disableIngressClassLookup if version is < v3.1.5+ and rbac are namespaced
    set:
      rbac:
        namespaced: true
      image:
        tag: v3.1.4
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesingress.disableClusterScopeResources=true"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesingress.disableIngressClassLookup=true"
  - it: should set disableClusterScopeResources when version > v3.1.2+ on both providers
    set:
      rbac:
        namespaced: true
      image:
        tag: v3.1.2
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesingress.disableClusterScopeResources=true"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetescrd.disableClusterScopeResources=true"
  - it: should set disableClusterScopeResources when version > v3.1.2+ only on crd enabled provider
    set:
      rbac:
        namespaced: true
      providers:
        kubernetesIngress:
          enabled: false
      image:
        tag: v3.1.2
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetescrd.disableClusterScopeResources=true"
  - it: should set disableClusterScopeResources when version > v3.1.2+ only on ingress enabled provider
    set:
      rbac:
        namespaced: true
      providers:
        kubernetesCRD:
          enabled: false
      image:
        tag: v3.1.2
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesingress.disableClusterScopeResources=true"
  - it: kubernetesGateway should be able to watch specified namespaces
    set:
      providers:
        kubernetesGateway:
          enabled: true
          namespaces:
            - "foo"
            - "bar"
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesgateway.namespaces=foo,bar"
  - it: kubernetesGateway should add specified configuration
    set:
      providers:
        kubernetesGateway:
          enabled: true
          experimentalChannel: true
          nativeLBByDefault: true
          labelselector: "app=traefik"
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesgateway.experimentalchannel=true"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesgateway.labelselector=app=traefik"
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--providers.kubernetesgateway.nativeLBByDefault=true"
  - it: should be possible to allow ACME bypass
    set:
      ports:
        websecure:
          allowACMEByPass: true
    asserts:
      - contains:
          path: spec.template.spec.containers[0].args
          content: "--entryPoints.websecure.allowACMEByPass=true"
  - it: should fail when setting ACME bypass with Proxy v3.1.0
    set:
      image:
        tag: v3.1.0
      ports:
        websecure:
          allowACMEByPass: true
    asserts:
      - failedTemplate:
          errorMessage: "ERROR: allowACMEByPass has been introduced with Traefik v3.1.3+"