Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: add ingress network policy with generic sandbox label #1086

Merged
merged 6 commits into from
Dec 17, 2024
Merged

feat: add ingress network policy with generic sandbox label #1086

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
8cbac1c
allow from dev sandbox managed NS
Dec 16, 2024
4f54f92
move check to common
Dec 16, 2024
98246c3
update nr of np
Dec 16, 2024
7a65fcc
remove space
Dec 16, 2024
4e0c372
add np for tenant and env namespaces
Dec 17, 2024
562832f
more fixes
Dec 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion testsupport/tiers/checks.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,7 +161,7 @@ func (a *baseTierChecks) GetNamespaceObjectChecks(nsType string) []namespaceObje
case "stage":
otherNamespaceKind = "dev"
}
checks = append(checks, networkPolicyAllowFromCRW(), networkPolicyAllowFromVirtualizationNamespaces(), networkPolicyAllowFromRedHatODSNamespaceToModelMesh(), networkPolicyAllowFromRedHatODSNamespaceToMariaDB(), networkPolicyAllowFromOtherNamespace(otherNamespaceKind), numberOfNetworkPolicies(10))
checks = append(checks, networkPolicyAllowFromCRW(), networkPolicyAllowFromVirtualizationNamespaces(), networkPolicyAllowFromRedHatODSNamespaceToModelMesh(), networkPolicyAllowFromRedHatODSNamespaceToMariaDB(), networkPolicyAllowFromOtherNamespace(otherNamespaceKind), networkPolicyIngressAllowFromDevSandboxPolicyGroup(), numberOfNetworkPolicies(11))

return checks
}
Expand Down Expand Up @@ -1242,6 +1242,10 @@ func networkPolicyIngressFromPolicyGroup(name, group string) namespaceObjectsChe
return assertNetworkPolicyIngressForNamespaces(name, metav1.LabelSelector{}, "network.openshift.io/policy-group", group)
}

func networkPolicyIngressAllowFromDevSandboxPolicyGroup() namespaceObjectsCheck {
return assertNetworkPolicyIngressForNamespaces("allow-from-dev-sandbox-managed-ns", metav1.LabelSelector{}, " dev-sandbox/policy-group", "ingress")
}
mfrancisc marked this conversation as resolved.
Show resolved Hide resolved

func assertNetworkPolicyIngressForNamespaces(name string, podSelector metav1.LabelSelector, labelNameValuePairs ...string) namespaceObjectsCheck {
return func(t *testing.T, ns *corev1.Namespace, memberAwait *wait.MemberAwaitility, userName string) {
require.Equal(t, 0, len(labelNameValuePairs)%2, "labelNameValuePairs must be a list of key-value pairs")
Expand Down
Loading