Skip to content

Add namespace selector changes to conformance tests #375

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
k8s-ci-robot merged 2 commits into from
May 19, 2026
+74 −0
Merged

Add namespace selector changes to conformance tests #375

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d4a027d
Add namespace selector changes to conformance tests
anthonyrtong Apr 15, 2026
371fc24
move namespace labels test to standard-egress-inline-cidr-rules
anthonyrtong May 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions conformance/tests/admin-network-policy-standard-egress-inline-cidr-rules.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,34 @@ var CNPAdminTierEgressInlineCIDRPeers = suite.ConformanceTest{
serverPod.Status.PodIP, int32(53), s.TimeoutConfig, true)
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "sctp",
serverPod.Status.PodIP, int32(9003), s.TimeoutConfig, true)

// update namespace label for slytherin to "conformance-house": "denied-namespace-label" to no longer match ingressRule at index0
namespace := kubernetes.GetNamespace(t, s.Client, "network-policy-conformance-slytherin", s.TimeoutConfig.GetTimeout)
mutateNamespace := namespace.DeepCopy()
mutateNamespace.SetLabels(map[string]string{"conformance-house": "denied-namespace-label"})
kubernetes.PatchNamespace(t, s.Client, namespace, mutateNamespace, s.TimeoutConfig.GetTimeout)

// ensure traffic is no longer allowed to slytherin since the namespace label no longer matches
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "tcp",
serverPod.Status.PodIP, int32(80), s.TimeoutConfig, false)
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "udp",
serverPod.Status.PodIP, int32(53), s.TimeoutConfig, false)
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "sctp",
serverPod.Status.PodIP, int32(9003), s.TimeoutConfig, false)

// update namespace label for slytherin back to "conformance-house": "slytherin" to match ingressRule at index0 again
namespace = kubernetes.GetNamespace(t, s.Client, "network-policy-conformance-slytherin", s.TimeoutConfig.GetTimeout)
mutateNamespace = namespace.DeepCopy()
mutateNamespace.SetLabels(map[string]string{"conformance-house": "slytherin"})
kubernetes.PatchNamespace(t, s.Client, namespace, mutateNamespace, s.TimeoutConfig.GetTimeout)

// ensure traffic is allowed to slytherin again since the namespace label matches again
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "tcp",
serverPod.Status.PodIP, int32(80), s.TimeoutConfig, true)
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "udp",
serverPod.Status.PodIP, int32(53), s.TimeoutConfig, true)
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "sctp",
serverPod.Status.PodIP, int32(9003), s.TimeoutConfig, true)
})
// To test allow CIDR rule, insert the following rule at index0
//- name: "allow-egress-to-specific-podIPs"
Expand Down
28 changes: 28 additions & 0 deletions conformance/tests/baseline-admin-network-policy-standard-egress-inline-cidr-rules.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,34 @@ var CNPBaselineTierEgressInlineCIDRPeers = suite.ConformanceTest{
serverPod.Status.PodIP, int32(53), s.TimeoutConfig, true)
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "sctp",
serverPod.Status.PodIP, int32(9003), s.TimeoutConfig, true)

// update namespace label for slytherin to "conformance-house": "denied-namespace-label" to no longer match ingressRule at index0
namespace := kubernetes.GetNamespace(t, s.Client, "network-policy-conformance-slytherin", s.TimeoutConfig.GetTimeout)
mutateNamespace := namespace.DeepCopy()
mutateNamespace.SetLabels(map[string]string{"conformance-house": "denied-namespace-label"})
kubernetes.PatchNamespace(t, s.Client, namespace, mutateNamespace, s.TimeoutConfig.GetTimeout)

// ensure traffic is no longer allowed to slytherin since the namespace label no longer matches
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "tcp",
serverPod.Status.PodIP, int32(80), s.TimeoutConfig, false)
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "udp",
serverPod.Status.PodIP, int32(53), s.TimeoutConfig, false)
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "sctp",
serverPod.Status.PodIP, int32(9003), s.TimeoutConfig, false)

// update namespace label for slytherin back to "conformance-house": "slytherin" to match ingressRule at index0 again
namespace = kubernetes.GetNamespace(t, s.Client, "network-policy-conformance-slytherin", s.TimeoutConfig.GetTimeout)
mutateNamespace = namespace.DeepCopy()
mutateNamespace.SetLabels(map[string]string{"conformance-house": "slytherin"})
kubernetes.PatchNamespace(t, s.Client, namespace, mutateNamespace, s.TimeoutConfig.GetTimeout)

// ensure traffic is allowed to slytherin again since the namespace label matches again
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "tcp",
serverPod.Status.PodIP, int32(80), s.TimeoutConfig, true)
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "udp",
serverPod.Status.PodIP, int32(53), s.TimeoutConfig, true)
kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-1", "sctp",
serverPod.Status.PodIP, int32(9003), s.TimeoutConfig, true)
})
// To test allow CIDR rule, insert the following rule at index0
//- name: "allow-egress-to-specific-podIPs"
Expand Down
18 changes: 18 additions & 0 deletions conformance/utils/kubernetes/helper.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,6 +156,24 @@ func GetPod(t *testing.T, c client.Client, namespace string, name string, timeou
return pod
}

func GetNamespace(t *testing.T, c client.Client, name string, timeout time.Duration) *v1.Namespace {
namespace := &v1.Namespace{}
ctx, cancel := context.WithTimeout(context.Background(), timeout)
defer cancel()
err := c.Get(ctx, client.ObjectKey{
Name: name,
}, namespace)
require.NoErrorf(t, err, "unable to fetch namespace %s", name)
return namespace
}

func PatchNamespace(t *testing.T, c client.Client, from *v1.Namespace, to *v1.Namespace, timeout time.Duration) {
ctx, cancel := context.WithTimeout(context.Background(), timeout)
defer cancel()
err := c.Patch(ctx, to, client.MergeFrom(from))
require.NoErrorf(t, err, "unable to patch namespace %s", from.Name)
}

func GetClusterNetworkPolicy(t *testing.T, c client.Client, name string, timeout time.Duration) *api.ClusterNetworkPolicy {
cnp := &api.ClusterNetworkPolicy{}
ctx, cancel := context.WithTimeout(context.Background(), timeout)
Expand Down
Loading