Layer 3 of the Stack 0 (Foundation) PR stack for the internal component authorization design (#13086). Stacked on #13213. No product behavior change.

Summary

• New suite test/functional-portable/authz/noncloud/
  • Test_AuthzMode_LoggedByEveryComponent (smoke): reads the installed radius Helm release values (global.rbac.enabled / global.rbac.dryRun), derives the expected mode the same way the chart helper does, checks that the ucp, applications-rp, dynamic-rp, and controller Deployments are ready, and checks that every running pod logs authz mode=<mode>. This exercises layer 1 end to end.
  • Skipped placeholders for later boundaries, each with its expected result and error code: A4 (unauthenticated call to applications-rp → PeerCertificateInvalid/InvalidAuthenticationInfo), A6 (forged x-remote-user → InvalidAuthenticationInfo), B3 (GrantScopeExceeded), B5 (OperationInputMismatch), C3 (controller mapping → AuthorizationFailed), D2 (OperationNotAssigned), D7 (template ClusterRole → AuthorizationFailed), E2 (AdmissionPolicyDenied).
• Rogue client helper test/rogue: rogue.New(t, k8s, restConfig, rogue.Options{Namespace, Image, TLSSecretName}) creates a locked-down curlimages/curl pod (non-root, no service account token, all capabilities dropped) and deletes it with t.Cleanup. Client.Do(ctx, rogue.Request{...}) runs curl through pod exec and returns the HTTP status, body, curl exit code, and stderr. If TLSSecretName is set, the Secret is mounted at /etc/radius-rogue/tls, and ClientCert/CACert present tls.crt/tls.key or verify with ca.crt, so later PRs can make calls as a component. Request building, output parsing, and the pod spec are unit tested.
• CI wiring: adds the test-functional-authz-noncloud make target (copied from test-functional-ucp-noncloud), includes it in test-functional-all-noncloud, and adds the authz-noncloud matrix leg. The workflow runs make test-functional-${MATRIX_NAME}. This leg installs with --set global.rbac.dryRun=true so the smoke test checks a non-default mode.

How to test

go test ./test/rogue/
go vet ./test/rogue/ ./test/functional-portable/authz/...
go test -run 'Test_ExpectedMode|Test_LoggedMode' ./test/functional-portable/authz/...
go test -run xxx ./test/functional-portable/authz/... ./test/rogue/   # compile check
make -n test-functional-authz-noncloud

🔍 Manual verification

On a kind cluster with Radius installed from this stack's images and --set global.rbac.dryRun=true (for example rad install kubernetes --set global.rbac.dryRun=true plus your image overrides):

make test-functional-authz-noncloud

Check that Test_AuthzMode_LoggedByEveryComponent passes for all four components and that the eight Test_Boundary_* tests show as skipped (enabled by <id>).

To use the rogue helper once, put this file in a temporary directory, for example test/rogue/manual/manual_test.go:

package manual

import (
	"testing"

	"github.com/radius-project/radius/test"
	"github.com/radius-project/radius/test/rogue"
)

func TestRogueUnauthenticated(t *testing.T) {
	o := test.NewTestOptions(t)
	c := rogue.New(t, o.K8sClient, o.K8sConfig, rogue.Options{Namespace: "default"})
	resp, err := c.Do(t.Context(), rogue.Request{
		URL: "http://applications-rp.radius-system:5443/apis/api.ucp.dev/v1alpha3/planes/radius/local/providers/Applications.Core/operations?api-version=2023-10-01-preview",
	})
	if err != nil {
		t.Fatal(err)
	}
	t.Logf("status=%d exit=%d body=%s", resp.StatusCode, resp.ExitCode, resp.Body)
}

go test -v -run TestRogueUnauthenticated ./test/rogue/manual/

The request currently succeeds without authentication (an HTTP response, exit=0). That gap is what A4 closes. Delete the file when you are done.