allow path patterns in --allow-paths and --ignore-paths

main.go

@@ -27,6 +27,7 @@ import (
 	"net/url"
 	"os"
 	"os/signal"
+	"path"
 	"strings"
 	"syscall"
 	"time"
@@ -217,14 +218,31 @@ func main() {
 		klog.Fatal("Cannot use --allow-paths and --ignore-paths together.")
 	}
 
+	for _, pathAllowed := range cfg.allowPaths {
+		_, err := path.Match(pathAllowed, "")
+		if err != nil {
+			klog.Fatalf("Failed to verify allow path: %s", pathAllowed)
+		}
+	}
+
+	for _, pathIgnored := range cfg.ignorePaths {
+		_, err := path.Match(pathIgnored, "")
+		if err != nil {
+			klog.Fatalf("Failed to verify ignored path: %s", pathIgnored)
+		}
+	}
+
 	proxy := httputil.NewSingleHostReverseProxy(upstreamURL)
 	proxy.Transport = upstreamTransport
 	mux := http.NewServeMux()
 	mux.Handle("/", http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
 		found := len(cfg.allowPaths) == 0
-		for _, path := range cfg.allowPaths {
-			if req.URL.Path == path {
-				found = true
+		for _, pathAllowed := range cfg.allowPaths {
+			found, err = path.Match(pathAllowed, req.URL.Path)
+			if err != nil {
+				return
+			}
+			if found {
 				break
 			}
 		}
@@ -234,9 +252,12 @@ func main() {
 		}
 
 		ignorePathFound := false
-		for _, path := range cfg.ignorePaths {
-			if req.URL.Path == path {
-				ignorePathFound = true
+		for _, pathIgnored := range cfg.ignorePaths {
+			ignorePathFound, err = path.Match(pathIgnored, req.URL.Path)
+			if err != nil {
+				return
+			}
+			if ignorePathFound {
 				break
 			}
 		}

test/e2e/allowpaths/deployment.yaml

@@ -20,7 +20,7 @@ spec:
           args:
             - "--secure-listen-address=0.0.0.0:8443"
             - "--upstream=http://127.0.0.1:8081/"
-            - "--allow-paths=/metrics"
+            - "--allow-paths=/metrics,/api/v1/label/*/values"
             - "--logtostderr=true"
             - "--v=10"
           ports:

test/e2e/basics.go

@@ -355,6 +355,11 @@ func testAllowPathsRegexp(s *kubetest.Suite) kubetest.TestSuite {
 					fmt.Sprintf(command, "/", 404, 404),
 					nil,
 				),
+				ClientSucceeds(
+					s.KubeClient,
+					fmt.Sprintf(command, "/api/v1/label/name", 404, 404),
+					nil,
+				),
 			),
 		}.Run(t)
 
@@ -394,6 +399,11 @@ func testAllowPathsRegexp(s *kubetest.Suite) kubetest.TestSuite {
 					fmt.Sprintf(command, "/metrics", 200, 200),
 					nil,
 				),
+				ClientSucceeds(
+					s.KubeClient,
+					fmt.Sprintf(command, "/api/v1/label/job/values", 200, 200),
+					nil,
+				),
 			),
 		}.Run(t)
 	}
@@ -439,6 +449,11 @@ func testIgnorePaths(s *kubetest.Suite) kubetest.TestSuite {
 					fmt.Sprintf(commandWithoutAuth, "/metrics", 200, 200),
 					nil,
 				),
+				ClientSucceeds(
+					s.KubeClient,
+					fmt.Sprintf(commandWithoutAuth, "/api/v1/labels", 200, 200),
+					nil,
+				),
 			),
 		}.Run(t)
 
@@ -478,6 +493,11 @@ func testIgnorePaths(s *kubetest.Suite) kubetest.TestSuite {
 					fmt.Sprintf(commandWithoutAuth, "/", 401, 401),
 					nil,
 				),
+				ClientSucceeds(
+					s.KubeClient,
+					fmt.Sprintf(commandWithoutAuth, "/api/v1/label/job/values", 401, 401),
+					nil,
+				),
 			),
 		}.Run(t)
 	}

test/e2e/ignorepaths/deployment.yaml

@@ -20,7 +20,7 @@ spec:
           args:
             - "--secure-listen-address=0.0.0.0:8443"
             - "--upstream=http://127.0.0.1:8081/"
-            - "--ignore-paths=/metrics"
+            - "--ignore-paths=/metrics,/api/v1/*"
             - "--logtostderr=true"
             - "--v=10"
           ports: