RFC0055 Identity-Aware Routing

[rkoster]

Summary

Add comprehensive acceptance test coverage for the Identity-Aware Routing feature that enables mTLS-based authentication and authorization for app-to-app communication on dedicated domains (e.g., *.apps.identity).

This PR implements the CATs portion of RFC0055 for domain-scoped mTLS routing in GoRouter.

Changes

Test Coverage

Four test cases across two suites:

Identity-Aware Routing (identity_aware_routing/identity_aware_routing.go):

1. Default-deny + route policy creation: Verifies requests are denied by default and allowed after running cf add-route-policy; confirms the policy appears in cf route-policies --domain
2. Unauthorized app denial: Verifies that apps without a route policy are denied even when they hold a valid Diego mTLS certificate; uses Consistently to confirm the denial persists
3. XFCC header forwarding: Verifies that the X-Forwarded-Client-Cert header is forwarded to the backend in Envoy format, containing the frontend app GUID (OU=app:<guid>)

Route Policy Domain Management (identity_aware_routing/identity_aware_routing.go):
4. Domain creation: Verifies that cf create-shared-domain <name> --enforce-route-policies --scope space succeeds and the resulting domain appears in cf domains

Infrastructure Changes

• Extended proxy app (assets/proxy/main.go):

  • Added /headers endpoint: Returns all incoming request headers as JSON — used by tests to inspect what the backend receives
  • Added /mtls_proxy/<host.domain>/<path> endpoint: Dials <host.domain>:443 and performs an HTTPS request using the Diego instance identity certificate (CF_INSTANCE_CERT / CF_INSTANCE_KEY) for mTLS client auth; returns status code, body, and headers as JSON

• New test suite (identity_aware_routing/identity_aware_routing.go):

  • 4 test cases following existing CATs patterns
  • Uses cf add-route-policy, cf route-policies, and cf create-shared-domain --enforce-route-policies --scope space
  • Retryable curl helper: parse failures during Eventually/Consistently polling return a StatusCode: -1 sentinel instead of hard-failing, preventing flakiness during route convergence

• Configuration support (helpers/config/):

  • Added IncludeIdentityAwareRouting bool and IdentityAwareDomain string (default: apps.identity) config fields
  • Added IdentityAwareRoutingDescribe() wrapper for test gating
  • Added skip message constant

Requirements

• Custom CF CLI with route policy and domain management commands:
  • cf add-route-policy <domain> --source-app <app> --hostname <host>
  • cf route-policies --domain <domain>
  • cf create-shared-domain <name> --enforce-route-policies --scope space
• Cloud Foundry deployment with:
  • GoRouter configured with an mTLS domain (via router.domains job property)
  • A shared domain with route policy enforcement enabled (e.g., apps.identity)
  • BOSH DNS alias for the mTLS domain resolving to router instances

Testing

Tested against a local CF deployment with all 4 tests passing:

Ran 4 of 283 Specs in 582.609 seconds
SUCCESS! -- 4 Passed | 0 Failed | 2 Pending | 277 Skipped

Related Work

• RFC: community/toc/rfc/rfc-draft-domain-scoped-mtls-gorouter.md
• GoRouter implementation: routing-release (in parallel development)
• CF CLI commands: cli repository (custom commands for route policy management)