test(networkpolicy): add comprehensive helm-unittest test suite
Add 20+ unit tests for NetworkPolicy template covering: Creation conditions: - Not created by default (enabled: false) - Created when enabled: true - Fails with clear error when hostNetwork + NetworkPolicy enabled - Fails when DLNA + NetworkPolicy enabled Ingress rules: - Default allowExternal behavior (no 'from' restriction) - Restricted access with podSelector/namespaceSelector - Custom ingress rules application - Automatic Prometheus ingress when metrics enabled - Prometheus namespace selector when specified Egress rules: - DNS egress with default kube-system/kube-dns - Custom DNS namespace and pod selector - AllowAllEgress default behavior - Restricted egress modes (metadata, in-cluster) - Custom CIDR blocks - Custom egress rules application - DNS disabled scenario Policy configuration: - Correct policyTypes (Ingress, Egress) - Pod selector labels matching chart labels Tests ensure NetworkPolicy works correctly across all supported configurations and fails safely when misconfigured. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
This commit is contained in:
Aleksei SviridkinandClaude committed
1 parent
32494dd1fd
commit
aaa9c91a8e
1 file changed
+297
@@ -0,0 +1,297 @@
|
|||||||
|
suite: test networkpolicy
|
||||||
|
templates:
|
||||||
|
- networkpolicy.yaml
|
||||||
|
tests:
|
||||||
|
- it: should not create NetworkPolicy by default
|
||||||
|
asserts:
|
||||||
|
- hasDocuments:
|
||||||
|
count: 0
|
||||||
|
|
||||||
|
- it: should create NetworkPolicy when enabled
|
||||||
|
set:
|
||||||
|
networkPolicy.enabled: true
|
||||||
|
asserts:
|
||||||
|
- hasDocuments:
|
||||||
|
count: 1
|
||||||
|
- isKind:
|
||||||
|
of: NetworkPolicy
|
||||||
|
- isAPIVersion:
|
||||||
|
of: networking.k8s.io/v1
|
||||||
|
- equal:
|
||||||
|
path: metadata.name
|
||||||
|
value: RELEASE-NAME-jellyfin
|
||||||
|
|
||||||
|
- it: should fail when NetworkPolicy enabled with DLNA
|
||||||
|
set:
|
||||||
|
networkPolicy.enabled: true
|
||||||
|
jellyfin.enableDLNA: true
|
||||||
|
asserts:
|
||||||
|
- failedTemplate:
|
||||||
|
errorMessage: "NetworkPolicy cannot be enabled when hostNetwork is enabled"
|
||||||
|
|
||||||
|
- it: should fail when NetworkPolicy enabled with hostNetwork
|
||||||
|
set:
|
||||||
|
networkPolicy.enabled: true
|
||||||
|
podPrivileges.hostNetwork: true
|
||||||
|
asserts:
|
||||||
|
- failedTemplate:
|
||||||
|
errorMessage: "NetworkPolicy cannot be enabled when hostNetwork is enabled"
|
||||||
|
|
||||||
|
- it: should have both Ingress and Egress policy types by default
|
||||||
|
set:
|
||||||
|
networkPolicy.enabled: true
|
||||||
|
asserts:
|
||||||
|
- contains:
|
||||||
|
path: spec.policyTypes
|
||||||
|
content: Ingress
|
||||||
|
- contains:
|
||||||
|
path: spec.policyTypes
|
||||||
|
content: Egress
|
||||||
|
|
||||||
|
- it: should allow external ingress by default
|
||||||
|
set:
|
||||||
|
networkPolicy.enabled: true
|
||||||
|
asserts:
|
||||||
|
- isNotNull:
|
||||||
|
path: spec.ingress
|
||||||
|
# When allowExternal is true, there should be no 'from' in first ingress rule
|
||||||
|
- isNull:
|
||||||
|
path: spec.ingress[0].from
|
||||||
|
|
||||||
|
- it: should restrict ingress when allowExternal is false
|
||||||
|
set:
|
||||||
|
networkPolicy.enabled: true
|
||||||
|
networkPolicy.ingress.allowExternal: false
|
||||||
|
networkPolicy.ingress.podSelector:
|
||||||
|
matchLabels:
|
||||||
|
app: test
|
||||||
|
asserts:
|
||||||
|
- isNotNull:
|
||||||
|
path: spec.ingress[0].from
|
||||||
|
- equal:
|
||||||
|
path: spec.ingress[0].from[0].podSelector.matchLabels.app
|
||||||
|
value: test
|
||||||
|
|
||||||
|
- it: should add namespace selector for ingress when specified
|
||||||
|
set:
|
||||||
|
networkPolicy.enabled: true
|
||||||
|
networkPolicy.ingress.allowExternal: false
|
||||||
|
networkPolicy.ingress.namespaceSelector:
|
||||||
|
matchLabels:
|
||||||
|
name: frontend
|
||||||
|
asserts:
|
||||||
|
- equal:
|
||||||
|
path: spec.ingress[0].from[0].namespaceSelector.matchLabels.name
|
||||||
|
value: frontend
|
||||||
|
|
||||||
|
- it: should create Prometheus ingress rule when metrics enabled
|
||||||
|
set:
|
||||||
|
networkPolicy.enabled: true
|
||||||
|
metrics.enabled: true
|
||||||
|
metrics.serviceMonitor.enabled: true
|
||||||
|
metrics.serviceMonitor.port: 8096
|
||||||
|
asserts:
|
||||||
|
- contains:
|
||||||
|
path: spec.ingress
|
||||||
|
content:
|
||||||
|
ports:
|
||||||
|
- protocol: TCP
|
||||||
|
port: 8096
|
||||||
|
from:
|
||||||
|
- podSelector:
|
||||||
|
app.kubernetes.io/name: prometheus
|
||||||
|
|
||||||
|
- it: should add Prometheus namespace selector when specified
|
||||||
|
set:
|
||||||
|
networkPolicy.enabled: true
|
||||||
|
metrics.enabled: true
|
||||||
|
metrics.serviceMonitor.enabled: true
|
||||||
|
networkPolicy.metrics.namespace: monitoring
|
||||||
|
asserts:
|
||||||
|
- isNotNull:
|
||||||
|
path: spec.ingress[1].from[0].namespaceSelector
|
||||||
|
- equal:
|
||||||
|
path: spec.ingress[1].from[0].namespaceSelector.matchLabels.kubernetes.io/metadata.name
|
||||||
|
value: monitoring
|
||||||
|
|
||||||
|
- it: should add custom ingress rules
|
||||||
|
set:
|
||||||
|
networkPolicy.enabled: true
|
||||||
|
networkPolicy.ingress.customRules:
|
||||||
|
- from:
|
||||||
|
- namespaceSelector:
|
||||||
|
matchLabels:
|
||||||
|
name: custom
|
||||||
|
ports:
|
||||||
|
- protocol: TCP
|
||||||
|
port: 9999
|
||||||
|
asserts:
|
||||||
|
- contains:
|
||||||
|
path: spec.ingress
|
||||||
|
content:
|
||||||
|
from:
|
||||||
|
- namespaceSelector:
|
||||||
|
matchLabels:
|
||||||
|
name: custom
|
||||||
|
ports:
|
||||||
|
- protocol: TCP
|
||||||
|
port: 9999
|
||||||
|
|
||||||
|
- it: should allow DNS egress by default
|
||||||
|
set:
|
||||||
|
networkPolicy.enabled: true
|
||||||
|
asserts:
|
||||||
|
- contains:
|
||||||
|
path: spec.egress
|
||||||
|
content:
|
||||||
|
to:
|
||||||
|
- namespaceSelector:
|
||||||
|
matchLabels:
|
||||||
|
kubernetes.io/metadata.name: kube-system
|
||||||
|
podSelector:
|
||||||
|
matchLabels:
|
||||||
|
k8s-app: kube-dns
|
||||||
|
ports:
|
||||||
|
- protocol: UDP
|
||||||
|
port: 53
|
||||||
|
- protocol: TCP
|
||||||
|
port: 53
|
||||||
|
|
||||||
|
- it: should allow custom DNS namespace
|
||||||
|
set:
|
||||||
|
networkPolicy.enabled: true
|
||||||
|
networkPolicy.egress.dnsNamespace: custom-dns-ns
|
||||||
|
asserts:
|
||||||
|
- equal:
|
||||||
|
path: spec.egress[0].to[0].namespaceSelector.matchLabels.kubernetes.io/metadata.name
|
||||||
|
value: custom-dns-ns
|
||||||
|
|
||||||
|
- it: should allow custom DNS pod selector
|
||||||
|
set:
|
||||||
|
networkPolicy.enabled: true
|
||||||
|
networkPolicy.egress.dnsPodSelector:
|
||||||
|
k8s-app: coredns
|
||||||
|
asserts:
|
||||||
|
- equal:
|
||||||
|
path: spec.egress[0].to[0].podSelector.matchLabels.k8s-app
|
||||||
|
value: coredns
|
||||||
|
|
||||||
|
- it: should allow all egress by default
|
||||||
|
set:
|
||||||
|
networkPolicy.enabled: true
|
||||||
|
asserts:
|
||||||
|
- contains:
|
||||||
|
path: spec.egress
|
||||||
|
content:
|
||||||
|
to:
|
||||||
|
- ipBlock:
|
||||||
|
cidr: 0.0.0.0/0
|
||||||
|
|
||||||
|
- it: should not allow all egress when allowAllEgress is false
|
||||||
|
set:
|
||||||
|
networkPolicy.enabled: true
|
||||||
|
networkPolicy.egress.allowAllEgress: false
|
||||||
|
asserts:
|
||||||
|
- notContains:
|
||||||
|
path: spec.egress
|
||||||
|
content:
|
||||||
|
to:
|
||||||
|
- ipBlock:
|
||||||
|
cidr: 0.0.0.0/0
|
||||||
|
|
||||||
|
- it: should allow HTTPS when restrictedEgress.allowMetadata is true
|
||||||
|
set:
|
||||||
|
networkPolicy.enabled: true
|
||||||
|
networkPolicy.egress.allowAllEgress: false
|
||||||
|
networkPolicy.egress.restrictedEgress.allowMetadata: true
|
||||||
|
asserts:
|
||||||
|
- contains:
|
||||||
|
path: spec.egress
|
||||||
|
content:
|
||||||
|
to:
|
||||||
|
- ipBlock:
|
||||||
|
cidr: 0.0.0.0/0
|
||||||
|
ports:
|
||||||
|
- protocol: TCP
|
||||||
|
port: 443
|
||||||
|
|
||||||
|
- it: should allow in-cluster communication when restrictedEgress.allowInCluster is true
|
||||||
|
set:
|
||||||
|
networkPolicy.enabled: true
|
||||||
|
networkPolicy.egress.allowAllEgress: false
|
||||||
|
networkPolicy.egress.restrictedEgress.allowInCluster: true
|
||||||
|
asserts:
|
||||||
|
- contains:
|
||||||
|
path: spec.egress
|
||||||
|
content:
|
||||||
|
to:
|
||||||
|
- podSelector: {}
|
||||||
|
|
||||||
|
- it: should add custom CIDR blocks
|
||||||
|
set:
|
||||||
|
networkPolicy.enabled: true
|
||||||
|
networkPolicy.egress.allowAllEgress: false
|
||||||
|
networkPolicy.egress.restrictedEgress.allowedCIDRs:
|
||||||
|
- 10.0.0.0/8
|
||||||
|
- 192.168.0.0/16
|
||||||
|
asserts:
|
||||||
|
- contains:
|
||||||
|
path: spec.egress
|
||||||
|
content:
|
||||||
|
to:
|
||||||
|
- ipBlock:
|
||||||
|
cidr: 10.0.0.0/8
|
||||||
|
- contains:
|
||||||
|
path: spec.egress
|
||||||
|
content:
|
||||||
|
to:
|
||||||
|
- ipBlock:
|
||||||
|
cidr: 192.168.0.0/16
|
||||||
|
|
||||||
|
- it: should add custom egress rules
|
||||||
|
set:
|
||||||
|
networkPolicy.enabled: true
|
||||||
|
networkPolicy.egress.customRules:
|
||||||
|
- to:
|
||||||
|
- podSelector:
|
||||||
|
matchLabels:
|
||||||
|
app: database
|
||||||
|
ports:
|
||||||
|
- protocol: TCP
|
||||||
|
port: 5432
|
||||||
|
asserts:
|
||||||
|
- contains:
|
||||||
|
path: spec.egress
|
||||||
|
content:
|
||||||
|
to:
|
||||||
|
- podSelector:
|
||||||
|
matchLabels:
|
||||||
|
app: database
|
||||||
|
ports:
|
||||||
|
- protocol: TCP
|
||||||
|
port: 5432
|
||||||
|
|
||||||
|
- it: should not create DNS egress when allowDNS is false
|
||||||
|
set:
|
||||||
|
networkPolicy.enabled: true
|
||||||
|
networkPolicy.egress.allowDNS: false
|
||||||
|
asserts:
|
||||||
|
- notContains:
|
||||||
|
path: spec.egress
|
||||||
|
content:
|
||||||
|
ports:
|
||||||
|
- protocol: UDP
|
||||||
|
port: 53
|
||||||
|
- protocol: TCP
|
||||||
|
port: 53
|
||||||
|
|
||||||
|
- it: should use correct pod selector labels
|
||||||
|
set:
|
||||||
|
networkPolicy.enabled: true
|
||||||
|
asserts:
|
||||||
|
- equal:
|
||||||
|
path: spec.podSelector.matchLabels.app\.kubernetes\.io/name
|
||||||
|
value: jellyfin
|
||||||
|
- equal:
|
||||||
|
path: spec.podSelector.matchLabels.app\.kubernetes\.io/instance
|
||||||
|
value: RELEASE-NAME
|
||||||
Reference in new issue
Block a user