feat(test): add authz functional test suite and rogue client helper

[sk593]

Layer 3 of the Stack 0 (Foundation) PR stack for the internal component authorization design (#13086). Stacked on #13213. No product behavior change.

Summary

• New suite test/functional-portable/authz/noncloud/
  • Test_AuthzMode_LoggedByEveryComponent (smoke): reads the installed radius Helm release values (global.rbac.enabled / global.rbac.dryRun), derives the expected mode the same way the chart helper does, checks that the ucp, applications-rp, dynamic-rp, and controller Deployments are ready, and checks that every running pod logs authz mode=<mode>. This exercises layer 1 end to end.
  • Skipped placeholders for later boundaries, each with its expected result and error code: A4 (unauthenticated call to applications-rp → PeerCertificateInvalid/InvalidAuthenticationInfo), A6 (forged x-remote-user → InvalidAuthenticationInfo), B3 (GrantScopeExceeded), B5 (OperationInputMismatch), C3 (controller mapping → AuthorizationFailed), D2 (OperationNotAssigned), D7 (template ClusterRole → AuthorizationFailed), E2 (AdmissionPolicyDenied).
• Rogue client helper test/rogue: rogue.New(t, k8s, restConfig, rogue.Options{Namespace, Image, TLSSecretName}) creates a locked-down curlimages/curl pod (non-root, no service account token, all capabilities dropped) and deletes it with t.Cleanup. Client.Do(ctx, rogue.Request{...}) runs curl through pod exec and returns the HTTP status, body, curl exit code, and stderr. If TLSSecretName is set, the Secret is mounted at /etc/radius-rogue/tls, and ClientCert/CACert present tls.crt/tls.key or verify with ca.crt, so later PRs can make calls as a component. Request building, output parsing, and the pod spec are unit tested.
• CI wiring: adds the test-functional-authz-noncloud make target (copied from test-functional-ucp-noncloud), includes it in test-functional-all-noncloud, and adds the authz-noncloud matrix leg. The workflow runs make test-functional-${MATRIX_NAME}. This leg installs with --set global.rbac.dryRun=true so the smoke test checks a non-default mode.

How to test

go test ./test/rogue/
go vet ./test/rogue/ ./test/functional-portable/authz/...
go test -run 'Test_ExpectedMode|Test_LoggedMode' ./test/functional-portable/authz/...
go test -run xxx ./test/functional-portable/authz/... ./test/rogue/   # compile check
make -n test-functional-authz-noncloud

🔍 Manual verification

On a kind cluster with Radius installed from this stack's images and --set global.rbac.dryRun=true (for example rad install kubernetes --set global.rbac.dryRun=true plus your image overrides):

make test-functional-authz-noncloud

Check that Test_AuthzMode_LoggedByEveryComponent passes for all four components and that the eight Test_Boundary_* tests show as skipped (enabled by <id>).

To use the rogue helper once, put this file in a temporary directory, for example test/rogue/manual/manual_test.go:

package manual

import (
	"testing"

	"github.com/radius-project/radius/test"
	"github.com/radius-project/radius/test/rogue"
)

func TestRogueUnauthenticated(t *testing.T) {
	o := test.NewTestOptions(t)
	c := rogue.New(t, o.K8sClient, o.K8sConfig, rogue.Options{Namespace: "default"})
	resp, err := c.Do(t.Context(), rogue.Request{
		URL: "http://applications-rp.radius-system:5443/apis/api.ucp.dev/v1alpha3/planes/radius/local/providers/Applications.Core/operations?api-version=2023-10-01-preview",
	})
	if err != nil {
		t.Fatal(err)
	}
	t.Logf("status=%d exit=%d body=%s", resp.StatusCode, resp.ExitCode, resp.Body)
}

go test -v -run TestRogueUnauthenticated ./test/rogue/manual/

The request currently succeeds without authentication (an HTTP response, exit=0). That gap is what A4 closes. Delete the file when you are done.

[github-actions]

This PR requires exactly 1 of the following labels: pr:standard, pr:important.
Currently applied labels: .

Label descriptions:

• pr:important - Major features, breaking changes, deprecations, or other high-impact changes that need special attention during release and in release notes.
• pr:standard - Ongoing maintenance, minor improvements, documentation updates, and routine development work.

@sk593, please add the appropriate label to this PR before merging.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[github-actions]

Unit Tests

    2 files  ±0    461 suites  ±0   15m 28s ⏱️ -3s
7 340 tests ±0  7 338 ✅ ±0  2 💤 ±0  0 ❌ ±0 
8 819 runs  ±0  8 817 ✅ ±0  2 💤 ±0  0 ❌ ±0 

Results for commit e709074. ± Comparison against base commit e580d4b.

♻️ This comment has been updated with latest results.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 60.48%. Comparing base (e580d4b) to head (e709074).

Additional details and impacted files

@@                   Coverage Diff                    @@
##           sk593-authz-error-codes   #13214   +/-   ##
========================================================
  Coverage                    60.48%   60.48%           
========================================================
  Files                          777      777           
  Lines                        45747    45747           
========================================================
+ Hits                         27670    27671    +1     
+ Misses                       18077    18076    -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[radius-functional-tests]

Radius functional test overview

🔍 Go to test action run

Click here to see the test run details

Name	Value
Repository	radius-project/radius
Commit ref	e709074
Unique ID	funcc91bf4a873
Image tag	pr-funcc91bf4a873

• Dapr: 1.14.4
• Azure KeyVault CSI driver: 1.4.2
• Azure Workload identity webhook: 1.3.0
• Bicep recipe location ghcr.io/radius-project/dev/test/testrecipes/test-bicep-recipes/<name>:pr-funcc91bf4a873
• Terraform recipe location http://tf-module-server.radius-test-tf-module-server.svc.cluster.local/<name>.zip (in cluster)
• applications-rp test image location: ghcr.io/radius-project/dev/applications-rp:pr-funcc91bf4a873
• dynamic-rp test image location: ghcr.io/radius-project/dev/dynamic-rp:pr-funcc91bf4a873
• controller test image location: ghcr.io/radius-project/dev/controller:pr-funcc91bf4a873
• ucp test image location: ghcr.io/radius-project/dev/ucpd:pr-funcc91bf4a873
• deployment-engine test image location: ghcr.io/radius-project/deployment-engine:latest

Test Status

⌛ Building Radius and pushing container images for functional tests...
✅ Container images build succeeded
⌛ Publishing Bicep Recipes for functional tests...
✅ Recipe publishing succeeded
⌛ Starting corerp-cloud functional tests...
⌛ Starting ucp-cloud functional tests...
✅ ucp-cloud functional tests succeeded
✅ corerp-cloud functional tests succeeded