test(networkpolicy): add comprehensive helm-unittest test suite
Add 20+ unit tests for NetworkPolicy template covering: Creation conditions: - Not created by default (enabled: false) - Created when enabled: true - Fails with clear error when hostNetwork + NetworkPolicy enabled - Fails when DLNA + NetworkPolicy enabled Ingress rules: - Default allowExternal behavior (no 'from' restriction) - Restricted access with podSelector/namespaceSelector - Custom ingress rules application - Automatic Prometheus ingress when metrics enabled - Prometheus namespace selector when specified Egress rules: - DNS egress with default kube-system/kube-dns - Custom DNS namespace and pod selector - AllowAllEgress default behavior - Restricted egress modes (metadata, in-cluster) - Custom CIDR blocks - Custom egress rules application - DNS disabled scenario Policy configuration: - Correct policyTypes (Ingress, Egress) - Pod selector labels matching chart labels Tests ensure NetworkPolicy works correctly across all supported configurations and fails safely when misconfigured. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
This commit is contained in:
Aleksei SviridkinandClaude committed
1 parent
32494dd1fd
commit
aaa9c91a8e
1 file changed
+297
@@ -0,0 +1,297 @@
|
||||
suite: test networkpolicy
|
||||
templates:
|
||||
- networkpolicy.yaml
|
||||
tests:
|
||||
- it: should not create NetworkPolicy by default
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 0
|
||||
|
||||
- it: should create NetworkPolicy when enabled
|
||||
set:
|
||||
networkPolicy.enabled: true
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 1
|
||||
- isKind:
|
||||
of: NetworkPolicy
|
||||
- isAPIVersion:
|
||||
of: networking.k8s.io/v1
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: RELEASE-NAME-jellyfin
|
||||
|
||||
- it: should fail when NetworkPolicy enabled with DLNA
|
||||
set:
|
||||
networkPolicy.enabled: true
|
||||
jellyfin.enableDLNA: true
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: "NetworkPolicy cannot be enabled when hostNetwork is enabled"
|
||||
|
||||
- it: should fail when NetworkPolicy enabled with hostNetwork
|
||||
set:
|
||||
networkPolicy.enabled: true
|
||||
podPrivileges.hostNetwork: true
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: "NetworkPolicy cannot be enabled when hostNetwork is enabled"
|
||||
|
||||
- it: should have both Ingress and Egress policy types by default
|
||||
set:
|
||||
networkPolicy.enabled: true
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.policyTypes
|
||||
content: Ingress
|
||||
- contains:
|
||||
path: spec.policyTypes
|
||||
content: Egress
|
||||
|
||||
- it: should allow external ingress by default
|
||||
set:
|
||||
networkPolicy.enabled: true
|
||||
asserts:
|
||||
- isNotNull:
|
||||
path: spec.ingress
|
||||
# When allowExternal is true, there should be no 'from' in first ingress rule
|
||||
- isNull:
|
||||
path: spec.ingress[0].from
|
||||
|
||||
- it: should restrict ingress when allowExternal is false
|
||||
set:
|
||||
networkPolicy.enabled: true
|
||||
networkPolicy.ingress.allowExternal: false
|
||||
networkPolicy.ingress.podSelector:
|
||||
matchLabels:
|
||||
app: test
|
||||
asserts:
|
||||
- isNotNull:
|
||||
path: spec.ingress[0].from
|
||||
- equal:
|
||||
path: spec.ingress[0].from[0].podSelector.matchLabels.app
|
||||
value: test
|
||||
|
||||
- it: should add namespace selector for ingress when specified
|
||||
set:
|
||||
networkPolicy.enabled: true
|
||||
networkPolicy.ingress.allowExternal: false
|
||||
networkPolicy.ingress.namespaceSelector:
|
||||
matchLabels:
|
||||
name: frontend
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.ingress[0].from[0].namespaceSelector.matchLabels.name
|
||||
value: frontend
|
||||
|
||||
- it: should create Prometheus ingress rule when metrics enabled
|
||||
set:
|
||||
networkPolicy.enabled: true
|
||||
metrics.enabled: true
|
||||
metrics.serviceMonitor.enabled: true
|
||||
metrics.serviceMonitor.port: 8096
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.ingress
|
||||
content:
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8096
|
||||
from:
|
||||
- podSelector:
|
||||
app.kubernetes.io/name: prometheus
|
||||
|
||||
- it: should add Prometheus namespace selector when specified
|
||||
set:
|
||||
networkPolicy.enabled: true
|
||||
metrics.enabled: true
|
||||
metrics.serviceMonitor.enabled: true
|
||||
networkPolicy.metrics.namespace: monitoring
|
||||
asserts:
|
||||
- isNotNull:
|
||||
path: spec.ingress[1].from[0].namespaceSelector
|
||||
- equal:
|
||||
path: spec.ingress[1].from[0].namespaceSelector.matchLabels.kubernetes.io/metadata.name
|
||||
value: monitoring
|
||||
|
||||
- it: should add custom ingress rules
|
||||
set:
|
||||
networkPolicy.enabled: true
|
||||
networkPolicy.ingress.customRules:
|
||||
- from:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
name: custom
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 9999
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.ingress
|
||||
content:
|
||||
from:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
name: custom
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 9999
|
||||
|
||||
- it: should allow DNS egress by default
|
||||
set:
|
||||
networkPolicy.enabled: true
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.egress
|
||||
content:
|
||||
to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: kube-system
|
||||
podSelector:
|
||||
matchLabels:
|
||||
k8s-app: kube-dns
|
||||
ports:
|
||||
- protocol: UDP
|
||||
port: 53
|
||||
- protocol: TCP
|
||||
port: 53
|
||||
|
||||
- it: should allow custom DNS namespace
|
||||
set:
|
||||
networkPolicy.enabled: true
|
||||
networkPolicy.egress.dnsNamespace: custom-dns-ns
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.egress[0].to[0].namespaceSelector.matchLabels.kubernetes.io/metadata.name
|
||||
value: custom-dns-ns
|
||||
|
||||
- it: should allow custom DNS pod selector
|
||||
set:
|
||||
networkPolicy.enabled: true
|
||||
networkPolicy.egress.dnsPodSelector:
|
||||
k8s-app: coredns
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.egress[0].to[0].podSelector.matchLabels.k8s-app
|
||||
value: coredns
|
||||
|
||||
- it: should allow all egress by default
|
||||
set:
|
||||
networkPolicy.enabled: true
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.egress
|
||||
content:
|
||||
to:
|
||||
- ipBlock:
|
||||
cidr: 0.0.0.0/0
|
||||
|
||||
- it: should not allow all egress when allowAllEgress is false
|
||||
set:
|
||||
networkPolicy.enabled: true
|
||||
networkPolicy.egress.allowAllEgress: false
|
||||
asserts:
|
||||
- notContains:
|
||||
path: spec.egress
|
||||
content:
|
||||
to:
|
||||
- ipBlock:
|
||||
cidr: 0.0.0.0/0
|
||||
|
||||
- it: should allow HTTPS when restrictedEgress.allowMetadata is true
|
||||
set:
|
||||
networkPolicy.enabled: true
|
||||
networkPolicy.egress.allowAllEgress: false
|
||||
networkPolicy.egress.restrictedEgress.allowMetadata: true
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.egress
|
||||
content:
|
||||
to:
|
||||
- ipBlock:
|
||||
cidr: 0.0.0.0/0
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 443
|
||||
|
||||
- it: should allow in-cluster communication when restrictedEgress.allowInCluster is true
|
||||
set:
|
||||
networkPolicy.enabled: true
|
||||
networkPolicy.egress.allowAllEgress: false
|
||||
networkPolicy.egress.restrictedEgress.allowInCluster: true
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.egress
|
||||
content:
|
||||
to:
|
||||
- podSelector: {}
|
||||
|
||||
- it: should add custom CIDR blocks
|
||||
set:
|
||||
networkPolicy.enabled: true
|
||||
networkPolicy.egress.allowAllEgress: false
|
||||
networkPolicy.egress.restrictedEgress.allowedCIDRs:
|
||||
- 10.0.0.0/8
|
||||
- 192.168.0.0/16
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.egress
|
||||
content:
|
||||
to:
|
||||
- ipBlock:
|
||||
cidr: 10.0.0.0/8
|
||||
- contains:
|
||||
path: spec.egress
|
||||
content:
|
||||
to:
|
||||
- ipBlock:
|
||||
cidr: 192.168.0.0/16
|
||||
|
||||
- it: should add custom egress rules
|
||||
set:
|
||||
networkPolicy.enabled: true
|
||||
networkPolicy.egress.customRules:
|
||||
- to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app: database
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 5432
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.egress
|
||||
content:
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app: database
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 5432
|
||||
|
||||
- it: should not create DNS egress when allowDNS is false
|
||||
set:
|
||||
networkPolicy.enabled: true
|
||||
networkPolicy.egress.allowDNS: false
|
||||
asserts:
|
||||
- notContains:
|
||||
path: spec.egress
|
||||
content:
|
||||
ports:
|
||||
- protocol: UDP
|
||||
port: 53
|
||||
- protocol: TCP
|
||||
port: 53
|
||||
|
||||
- it: should use correct pod selector labels
|
||||
set:
|
||||
networkPolicy.enabled: true
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.podSelector.matchLabels.app\.kubernetes\.io/name
|
||||
value: jellyfin
|
||||
- equal:
|
||||
path: spec.podSelector.matchLabels.app\.kubernetes\.io/instance
|
||||
value: RELEASE-NAME
|
||||
Reference in new issue
Block a user