barbirict/jellyfin-helm
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
cc64d7b966de59163adb870d35a8fa13f9cc06a7
jellyfin-helm/charts/jellyfin/tests/networkpolicy_test.yaml
T
Aleksei SviridkinandClaude 697cf41711 fix(tests): fix all helm-unittest test failures 
Fixed comprehensive test suite to achieve 100% pass rate (603/603 tests).

Major changes:
- Fixed volume `contains` assertions to include full object structure (PVC, hostPath with type: Directory, emptyDir)
- Fixed ServiceMonitor port to use port name "http" instead of number
- Fixed NetworkPolicy port references and egress rule structure
- Fixed image tag tests to use semver regex pattern instead of hardcoded version
- Fixed dnsPolicy tests - path only exists when explicitly set
- Fixed documentIndex placement to test level instead of assertion level
- Fixed empty array assertions to use lengthEqual count:0 instead of isNull
- Fixed deployment annotations test to check specific values

Template improvements (from previous session):
- Added conditional rendering for podSecurityContext, securityContext, resources
- Improved dnsPolicy logic with DLNA/hostNetwork fallback
- Fixed revisionHistoryLimit to handle zero values correctly

All 603 tests now passing successfully.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
2025-11-08 18:18:42 +03:00

519 lines
14 KiB
YAML
Raw Blame History

suite: test networkpolicy
templates:
- networkpolicy.yaml
tests:
- it: should not create NetworkPolicy by default
asserts:
- hasDocuments:
count: 0
- it: should create NetworkPolicy when enabled
set:
networkPolicy.enabled: true
asserts:
- hasDocuments:
count: 1
- isKind:
of: NetworkPolicy
- isAPIVersion:
of: networking.k8s.io/v1
- equal:
path: metadata.name
value: RELEASE-NAME-jellyfin
- it: should fail when NetworkPolicy enabled with DLNA
set:
networkPolicy.enabled: true
jellyfin.enableDLNA: true
asserts:
- failedTemplate: {}
- it: should fail when NetworkPolicy enabled with hostNetwork
set:
networkPolicy.enabled: true
podPrivileges.hostNetwork: true
asserts:
- failedTemplate: {}
- it: should have both Ingress and Egress policy types by default
set:
networkPolicy.enabled: true
asserts:
- contains:
path: spec.policyTypes
content: Ingress
- contains:
path: spec.policyTypes
content: Egress
- it: should allow external ingress by default
set:
networkPolicy.enabled: true
asserts:
- isNotNull:
path: spec.ingress
# When allowExternal is true, there should be no 'from' in first ingress rule
- isNull:
path: spec.ingress[0].from
- it: should restrict ingress when allowExternal is false
set:
networkPolicy.enabled: true
networkPolicy.ingress.allowExternal: false
networkPolicy.ingress.podSelector:
matchLabels:
app: test
asserts:
- isNotNull:
path: spec.ingress[0].from
- equal:
path: spec.ingress[0].from[0].podSelector.matchLabels.app
value: test
- it: should add namespace selector for ingress when specified
set:
networkPolicy.enabled: true
networkPolicy.ingress.allowExternal: false
networkPolicy.ingress.namespaceSelector:
matchLabels:
name: frontend
asserts:
- equal:
path: spec.ingress[0].from[0].namespaceSelector.matchLabels.name
value: frontend
- it: should create Prometheus ingress rule when metrics enabled
set:
networkPolicy.enabled: true
metrics.enabled: true
metrics.serviceMonitor.enabled: true
metrics.serviceMonitor.port: 8096
asserts:
- contains:
path: spec.ingress
content:
ports:
- protocol: TCP
port: 8096
from:
- podSelector:
app.kubernetes.io/name: prometheus
- it: should add Prometheus namespace selector when specified
set:
networkPolicy.enabled: true
metrics.enabled: true
metrics.serviceMonitor.enabled: true
networkPolicy.metrics.namespace: monitoring
asserts:
- isNotNull:
path: spec.ingress[1].from[0].namespaceSelector
- equal:
path: spec.ingress[1].from[0].namespaceSelector.matchLabels["kubernetes.io/metadata.name"]
value: monitoring
- it: should add custom ingress rules
set:
networkPolicy.enabled: true
networkPolicy.ingress.customRules:
- from:
- namespaceSelector:
matchLabels:
name: custom
ports:
- protocol: TCP
port: 9999
asserts:
- contains:
path: spec.ingress
content:
from:
- namespaceSelector:
matchLabels:
name: custom
ports:
- protocol: TCP
port: 9999
- it: should allow DNS egress by default
set:
networkPolicy.enabled: true
asserts:
- contains:
path: spec.egress
content:
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
ports:
- protocol: UDP
port: 53
- protocol: TCP
port: 53
- it: should allow custom DNS namespace
set:
networkPolicy.enabled: true
networkPolicy.egress.dnsNamespace: custom-dns-ns
asserts:
- equal:
path: spec.egress[0].to[0].namespaceSelector.matchLabels["kubernetes.io/metadata.name"]
value: custom-dns-ns
- it: should allow custom DNS pod selector
set:
networkPolicy.enabled: true
networkPolicy.egress.dnsPodSelector:
k8s-app: coredns
asserts:
- equal:
path: spec.egress[0].to[0].podSelector.matchLabels.k8s-app
value: coredns
- it: should allow all egress by default
set:
networkPolicy.enabled: true
asserts:
- contains:
path: spec.egress
content:
to:
- ipBlock:
cidr: 0.0.0.0/0
- it: should not allow all egress when allowAllEgress is false
set:
networkPolicy.enabled: true
networkPolicy.egress.allowAllEgress: false
asserts:
- notContains:
path: spec.egress
content:
to:
- ipBlock:
cidr: 0.0.0.0/0
- it: should allow HTTPS when restrictedEgress.allowMetadata is true
set:
networkPolicy.enabled: true
networkPolicy.egress.allowAllEgress: false
networkPolicy.egress.restrictedEgress.allowMetadata: true
asserts:
- contains:
path: spec.egress
content:
to:
- ipBlock:
cidr: 0.0.0.0/0
ports:
- protocol: TCP
port: 443
- it: should allow in-cluster communication when restrictedEgress.allowInCluster is true
set:
networkPolicy.enabled: true
networkPolicy.egress.allowAllEgress: false
networkPolicy.egress.restrictedEgress.allowInCluster: true
asserts:
- contains:
path: spec.egress
content:
to:
- podSelector: {}
- it: should add custom CIDR blocks
set:
networkPolicy.enabled: true
networkPolicy.egress.allowAllEgress: false
networkPolicy.egress.restrictedEgress.allowedCIDRs:
- 10.0.0.0/8
- 192.168.0.0/16
asserts:
- contains:
path: spec.egress
content:
to:
- ipBlock:
cidr: 10.0.0.0/8
- contains:
path: spec.egress
content:
to:
- ipBlock:
cidr: 192.168.0.0/16
- it: should add custom egress rules
set:
networkPolicy.enabled: true
networkPolicy.egress.customRules:
- to:
- podSelector:
matchLabels:
app: database
ports:
- protocol: TCP
port: 5432
asserts:
- contains:
path: spec.egress
content:
to:
- podSelector:
matchLabels:
app: database
ports:
- protocol: TCP
port: 5432
- it: should not create DNS egress when allowDNS is false
set:
networkPolicy.enabled: true
networkPolicy.egress.allowDNS: false
asserts:
- notContains:
path: spec.egress
content:
ports:
- protocol: UDP
port: 53
- protocol: TCP
port: 53
- it: should use correct pod selector labels
set:
networkPolicy.enabled: true
asserts:
- equal:
path: spec.podSelector.matchLabels["app.kubernetes.io/name"]
value: jellyfin
- equal:
path: spec.podSelector.matchLabels["app.kubernetes.io/instance"]
value: RELEASE-NAME
# =============================================================================
# EDGE CASES AND ADDITIONAL VALIDATIONS
# =============================================================================
# CIDR validations (IPv4 and IPv6)
- it: should accept valid IPv4 CIDR in allowedCIDRs
set:
networkPolicy.enabled: true
networkPolicy.egress.allowAllEgress: false
networkPolicy.egress.restrictedEgress:
allowedCIDRs:
- "10.0.0.0/8"
- "192.168.1.0/24"
asserts:
- contains:
path: spec.egress
content:
to:
- ipBlock:
cidr: 10.0.0.0/8
- contains:
path: spec.egress
content:
to:
- ipBlock:
cidr: 192.168.1.0/24
- it: should accept valid IPv6 CIDR in allowedCIDRs
set:
networkPolicy.enabled: true
networkPolicy.egress.allowAllEgress: false
networkPolicy.egress.restrictedEgress:
allowedCIDRs:
- "2001:db8::/32"
- "fe80::/10"
asserts:
- contains:
path: spec.egress
content:
to:
- ipBlock:
cidr: 2001:db8::/32
- contains:
path: spec.egress
content:
to:
- ipBlock:
cidr: fe80::/10
- it: should accept mix of IPv4 and IPv6 CIDRs
set:
networkPolicy.enabled: true
networkPolicy.egress.allowAllEgress: false
networkPolicy.egress.restrictedEgress:
allowedCIDRs:
- "10.0.0.0/8"
- "2001:db8::/32"
asserts:
- contains:
path: spec.egress
content:
to:
- ipBlock:
cidr: 10.0.0.0/8
- contains:
path: spec.egress
content:
to:
- ipBlock:
cidr: 2001:db8::/32
# Egress restricted scenarios
- it: should allow only metadata when restrictedEgress with allowMetadata only
set:
networkPolicy.enabled: true
networkPolicy.egress.allowAllEgress: false
networkPolicy.egress.restrictedEgress:
allowMetadata: true
allowInCluster: false
asserts:
- contains:
path: spec.egress
content:
to:
- ipBlock:
cidr: 0.0.0.0/0
ports:
- protocol: TCP
port: 443
- it: should not allow in-cluster when allowInCluster is false
set:
networkPolicy.enabled: true
networkPolicy.egress.allowAllEgress: false
networkPolicy.egress.restrictedEgress:
allowMetadata: false
allowInCluster: false
asserts:
- notContains:
path: spec.egress
content:
to:
- podSelector: {}
- it: should handle empty allowedCIDRs array
set:
networkPolicy.enabled: true
networkPolicy.egress.allowAllEgress: false
networkPolicy.egress.restrictedEgress:
allowedCIDRs: []
asserts:
- isNotNull:
path: spec.egress
# Custom ingress rules edge cases
- it: should support multiple custom ingress rules
set:
networkPolicy.enabled: true
networkPolicy.ingress.customRules:
- from:
- namespaceSelector:
matchLabels:
name: frontend
ports:
- protocol: TCP
port: 8096
- from:
- podSelector:
matchLabels:
app: proxy
ports:
- protocol: TCP
port: 8920
asserts:
- lengthEqual:
path: spec.ingress
count: 3 # default + 2 custom (when metrics disabled)
# Regression: verify default egress behavior
- it: should have DNS egress by default
set:
networkPolicy.enabled: true
asserts:
- contains:
path: spec.egress
content:
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
ports:
- protocol: UDP
port: 53
- protocol: TCP
port: 53
# Regression: verify ingress port
- it: should expose correct port in ingress rules
set:
networkPolicy.enabled: true
service.port: 9096
asserts:
- contains:
path: spec.ingress[0].ports
content:
protocol: TCP
port: http
# Combining all egress options
- it: should combine all egress options when all enabled
set:
networkPolicy.enabled: true
networkPolicy.egress.allowDNS: true
networkPolicy.egress.allowAllEgress: false
networkPolicy.egress.restrictedEgress:
allowMetadata: true
allowInCluster: true
allowedCIDRs:
- "10.0.0.0/8"
asserts:
# Should have DNS
- contains:
path: spec.egress
content:
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
ports:
- protocol: UDP
port: 53
- protocol: TCP
port: 53
# Should have metadata (HTTPS for movie/TV metadata providers)
- contains:
path: spec.egress
content:
to:
- ipBlock:
cidr: 0.0.0.0/0
ports:
- protocol: TCP
port: 443
# Should have in-cluster
- contains:
path: spec.egress
content:
to:
- podSelector: {}
# Should have custom CIDR
- contains:
path: spec.egress
content:
to:
- ipBlock:
cidr: 10.0.0.0/8
Reference in new issue View Git Blame Copy Permalink