test(oidc-opa): Improve NiFi node check

Author: siegfriedweber

tests/templates/kuttl/oidc-opa/25-install-opa-rego.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - script: >
+      envsubst '$NAMESPACE' < 25_opa-rego.yaml |
+      kubectl apply -n $NAMESPACE -f -

…emplates/kuttl/oidc-opa/25-opa-rego.yaml …emplates/kuttl/oidc-opa/25_opa-rego.yamltests/templates/kuttl/oidc-opa/25-opa-rego.yaml renamed to tests/templates/kuttl/oidc-opa/25_opa-rego.yaml tests/templates/kuttl/oidc-opa/25-opa-rego.yaml renamed to tests/templates/kuttl/oidc-opa/25_opa-rego.yaml

@@ -9,8 +9,26 @@ data:
   my_nifi_package.rego: |
     package my_nifi_package
 
-    # TODO Parse or use a regular expression to validate the DN
-    nifi_node_proxy := "DC=local, DC=cluster, DC=svc, DC=test, DC=test-nifi-node-default-headless, DC=test-nifi-node-default-0, CN=generated certificate for pod"
+    # FQDN of the NiFi nodes as regular expressions
+    nodes_fqdn := [
+      `local`,
+      `cluster`,
+      `svc`,
+      `$NAMESPACE`,
+      `test-nifi-node-default-headless`,
+      `test-nifi-node-default-[0-9]+`,
+    ]
+
+    domain_components = [concat("", [`DC=`, dc]) | some dc in nodes_fqdn]
+    common_name = `CN=generated certificate for pod`
+    subject_dn_fields = array.concat(domain_components, [common_name])
+    node_subject_dn_pattern := concat("", ["^", concat(", ", subject_dn_fields), "$"])
+
+    is_nifi_node := regex.match(
+      node_subject_dn_pattern,
+      input.identity.name,
+    )
+
     nifi_reporting_task_user := "admin"
 
     # Setting "resourceNotFound" to true results in the parent resource being evaluated for authorization,
@@ -82,7 +100,7 @@ data:
       "allowed": true,
       "dumpCache": true
     } if {
-      input.identity.name == nifi_node_proxy
+      is_nifi_node
       input.resource.id == "/proxy"
     }
 
@@ -91,7 +109,7 @@ data:
       "allowed": true,
       "dumpCache": true
     } if {
-      input.identity.name == nifi_node_proxy
+      is_nifi_node
       startswith(input.resource.id, "/data/processors/")
     }
 
@@ -100,12 +118,12 @@ data:
     user_groups := get_user_groups(input.identity.name)
 
     get_user_groups(name) = groups if {
-      not startswith(name, nifi_node_proxy)
+      not is_nifi_node
       groups_raw := data.stackable.opa.userinfo.v1.userInfoByUsername(name).groups
       groups := [trim(g, "/") | g := groups_raw[_]]
     }
 
     # filter nifi_node_proxy calls to UIF
     get_user_groups(name) := [] if {
-      startswith(name, nifi_node_proxy)
+      is_nifi_node
     }