RFC0055 Identity-Aware Routing

[rkoster]

Summary

Add comprehensive acceptance test coverage for the Identity-Aware Routing feature that enables mTLS-based authentication and authorization for app-to-app communication on dedicated domains (e.g., *.apps.identity).

This PR implements the CATs portion of the RFC for domain-scoped mTLS routing in GoRouter.

Changes

Test Coverage

Three test cases covering the core functionality:

1. Default-deny + access rule creation: Verifies that requests are denied by default and allowed after creating an access rule
2. Unauthorized app denial: Verifies that apps without access rules are denied even with valid mTLS certificates
3. XFCC header forwarding: Verifies that the X-Forwarded-Client-Cert header contains caller identity in Envoy format with app GUID

Infrastructure Changes

• Extended proxy app (assets/proxy/main.go):

  • Added /headers endpoint: Returns all request headers as JSON for header inspection
  • Added /mtls_proxy/<host:port>/<path> endpoint: Makes HTTPS requests using Diego instance identity certificates (CF_INSTANCE_CERT/CF_INSTANCE_KEY)

• New test suite (identity_aware_routing/identity_aware_routing.go):

  • 3 test cases following CATs patterns (similar to service_discovery tests)
  • Uses cf add-access-rule, cf remove-access-rule, and cf access-rules CLI commands
  • Validates mTLS authentication via Diego instance identity certificates

• Configuration support:

  • Added IncludeIdentityAwareRouting (bool) and IdentityAwareDomain (string, default apps.identity) config fields
  • Added IdentityAwareRoutingDescribe() wrapper for test gating
  • Added skip message constant

Requirements

• Custom CF CLI with access rule management commands (add-access-rule, remove-access-rule, access-rules)
• Cloud Foundry deployment with:
  • GoRouter configured with mTLS domain (via router.domains job property)
  • Shared domain with enforce_access_rules: true (e.g., apps.identity)
  • BOSH DNS alias for mTLS domain resolving to router instances

Testing

Tested against local CF deployment with all 3 tests passing:

Ran 3 of 282 Specs in 569.223 seconds
SUCCESS! -- 3 Passed | 0 Failed

Related Work

• RFC: community/toc/rfc/rfc-draft-domain-scoped-mtls-gorouter.md
• GoRouter implementation: routing-release (in parallel development)
• CF CLI commands: cli repository (custom commands for access rule management)