Skip to content

Commit df0d129

Browse files
tssuryatssurya
committed
ANP: Add conformance for gress rules
This commit adds conformance tests for mix of ingress and egress rules in same CRD, which mixes up protocols and ports in same rules. They should behave in an idempotent manner with regards to each other. Signed-off-by: Surya Seetharaman <[email protected]>
1 parent 1de4e71 commit df0d129

File tree

2 files changed

+658
-0
lines changed

2 files changed

+658
-0
lines changed

‎conformance/base/admin_network_policy/core-gress-rules-combined.yaml

Lines changed: 170 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,170 @@
1+
apiVersion: policy.networking.k8s.io/v1alpha1
2+
kind: AdminNetworkPolicy
3+
metadata:
4+
name: gress-rules
5+
spec:
6+
priority: 15
7+
subject:
8+
namespaces:
9+
matchLabels:
10+
kubernetes.io/metadata.name: network-policy-conformance-gryffindor
11+
egress:
12+
- name: "allow-to-ravenclaw-everything"
13+
action: "Allow"
14+
to:
15+
- namespaces:
16+
namespaceSelector:
17+
matchLabels:
18+
kubernetes.io/metadata.name: network-policy-conformance-ravenclaw
19+
- name: "deny-to-ravenclaw-everything"
20+
action: "Deny"
21+
to:
22+
- namespaces:
23+
namespaceSelector:
24+
matchLabels:
25+
kubernetes.io/metadata.name: network-policy-conformance-ravenclaw
26+
- name: "pass-to-ravenclaw-everything"
27+
action: "Pass"
28+
to:
29+
- namespaces:
30+
namespaceSelector:
31+
matchLabels:
32+
kubernetes.io/metadata.name: network-policy-conformance-ravenclaw
33+
- name: "deny-to-slytherin-at-ports-80-53-9003"
34+
action: "Deny"
35+
to:
36+
- namespaces:
37+
namespaceSelector:
38+
matchLabels:
39+
kubernetes.io/metadata.name: network-policy-conformance-slytherin
40+
ports:
41+
- portNumber:
42+
protocol: TCP
43+
port: 80
44+
- portNumber:
45+
protocol: UDP
46+
port: 53
47+
- portNumber:
48+
protocol: SCTP
49+
port: 9003
50+
- name: "pass-to-slytherin-at-port-80-53-9003"
51+
action: "Pass"
52+
to:
53+
- namespaces:
54+
namespaceSelector:
55+
matchLabels:
56+
kubernetes.io/metadata.name: network-policy-conformance-slytherin
57+
ports:
58+
- portNumber:
59+
protocol: TCP
60+
port: 80
61+
- portNumber:
62+
protocol: UDP
63+
port: 53
64+
- portNumber:
65+
protocol: SCTP
66+
port: 9003
67+
- name: "allow-to-hufflepuff-at-ports-8080-5353"
68+
action: "Allow"
69+
to:
70+
- namespaces:
71+
namespaceSelector:
72+
matchLabels:
73+
kubernetes.io/metadata.name: network-policy-conformance-hufflepuff
74+
ports:
75+
- portNumber:
76+
protocol: TCP
77+
port: 8080
78+
- portNumber:
79+
protocol: UDP
80+
port: 5353
81+
- portNumber:
82+
protocol: SCTP
83+
port: 9003
84+
- name: "deny-to-hufflepuff-everything-else"
85+
action: "Deny"
86+
to:
87+
- namespaces:
88+
namespaceSelector:
89+
matchLabels:
90+
kubernetes.io/metadata.name: network-policy-conformance-hufflepuff
91+
ingress:
92+
- name: "allow-from-ravenclaw-everything"
93+
action: "Allow"
94+
from:
95+
- namespaces:
96+
namespaceSelector:
97+
matchLabels:
98+
kubernetes.io/metadata.name: network-policy-conformance-ravenclaw
99+
- name: "deny-from-ravenclaw-everything"
100+
action: "Deny"
101+
from:
102+
- namespaces:
103+
namespaceSelector:
104+
matchLabels:
105+
kubernetes.io/metadata.name: network-policy-conformance-ravenclaw
106+
- name: "pass-from-ravenclaw-everything"
107+
action: "Pass"
108+
from:
109+
- namespaces:
110+
namespaceSelector:
111+
matchLabels:
112+
kubernetes.io/metadata.name: network-policy-conformance-ravenclaw
113+
- name: "deny-from-slytherin-at-port-80-53-9003"
114+
action: "Deny"
115+
from:
116+
- namespaces:
117+
namespaceSelector:
118+
matchLabels:
119+
kubernetes.io/metadata.name: network-policy-conformance-slytherin
120+
ports:
121+
- portNumber:
122+
protocol: TCP
123+
port: 80
124+
- portNumber:
125+
protocol: UDP
126+
port: 53
127+
- portNumber:
128+
protocol: SCTP
129+
port: 9003
130+
- name: "pass-from-slytherin-at-port-80-53-9003"
131+
action: "Pass"
132+
from:
133+
- namespaces:
134+
namespaceSelector:
135+
matchLabels:
136+
kubernetes.io/metadata.name: network-policy-conformance-slytherin
137+
ports:
138+
- portNumber:
139+
protocol: TCP
140+
port: 80
141+
- portNumber:
142+
protocol: UDP
143+
port: 53
144+
- portNumber:
145+
protocol: SCTP
146+
port: 9003
147+
- name: "allow-from-hufflepuff-at-port-80-5353-9003"
148+
action: "Allow"
149+
from:
150+
- namespaces:
151+
namespaceSelector:
152+
matchLabels:
153+
kubernetes.io/metadata.name: network-policy-conformance-hufflepuff
154+
ports:
155+
- portNumber:
156+
protocol: TCP
157+
port: 80
158+
- portNumber:
159+
protocol: UDP
160+
port: 5353
161+
- portNumber:
162+
protocol: SCTP
163+
port: 9003
164+
- name: "deny-from-hufflepuff-everything-else"
165+
action: "Deny"
166+
from:
167+
- namespaces:
168+
namespaceSelector:
169+
matchLabels:
170+
kubernetes.io/metadata.name: network-policy-conformance-hufflepuff

0 commit comments

Comments
 (0)