Repository: astronomer/astronomer
Pull request #2566: Introduces logic in NetworkPolicy specs to allow traffic from different namespaces
Author: login: karankhanchandani
Created: 2025-04-02T04:56:13Z | Merged: 2025-04-10T19:18:12Z

## Description

This PR adds a mechanism by which we can override the current `network.openshift.io/policy-group: ingress`
- Takes namespaces as input in the `ingressAllowedNamespaces` field. All the traffic coming from these namespaces will be whitelisted by the authSidecar.

The namespaceSelectors will be **ORed**, which means, if a namespace has the above label along with existing label, its workloads can communicate with the authSidecar.


## Related Issues
https://github.com/astronomer/issues/issues/7060

## Testing

Wrote unit test cases for the charts. Tests are passing. Also did manual testing by printing out the yaml spec for `NetworkPolicy`.

Output: 
```
Results (215.52s):
      2209 passed
        58 skipped
       420 warnings
```

Did the actual testing of the PR by deploying the changes in the GKE cluster `gke_astronomer-cloud-dev-236021_us-east4-a_kktest-cluster` and upgrading the helm chart.

The changes are reflected properly in network policies and houston config map.

I created a new image based deployment with celery executor and the [Airflow UI](https://deployments.kktest.astrodev.io/native-elliptical-1526/airflow/home) and [Flower UI](https://deployments.kktest.astrodev.io/native-elliptical-1526/flower) is accessible.

<img width="1916" alt="Screenshot 2025-04-10 at 6 50 51 AM" src="https://github.com/user-attachments/assets/e8c07c1d-a4b7-4229-b6e8-0bc2566a3ff4" />


## Merging

0.37.1 , 0.36.2



Diff:
diff --git a/charts/alertmanager/templates/alertmanager-networkpolicy.yaml b/charts/alertmanager/templates/alertmanager-networkpolicy.yaml
index d2c09abdc0..2ce33f1e5c 100644
--- a/charts/alertmanager/templates/alertmanager-networkpolicy.yaml
+++ b/charts/alertmanager/templates/alertmanager-networkpolicy.yaml
@@ -31,6 +31,13 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    {{- if .Values.global.authSidecar.ingressAllowedNamespaces }}
+    - namespaceSelector:
+        matchExpressions:
+        - key: kubernetes.io/metadata.name
+          operator: In
+          values: {{ .Values.global.authSidecar.ingressAllowedNamespaces | toJson }}
+    {{- end }}
     {{- else }}
     - podSelector:
         matchLabels:
diff --git a/charts/astronomer/templates/astro-ui/astro-ui-networkpolicy.yaml b/charts/astronomer/templates/astro-ui/astro-ui-networkpolicy.yaml
index f1b5b25581..b211dd2670 100644
--- a/charts/astronomer/templates/astro-ui/astro-ui-networkpolicy.yaml
+++ b/charts/astronomer/templates/astro-ui/astro-ui-networkpolicy.yaml
@@ -26,6 +26,13 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    {{- if .Values.global.authSidecar.ingressAllowedNamespaces }}
+    - namespaceSelector:
+        matchExpressions:
+        - key: kubernetes.io/metadata.name
+          operator: In
+          values: {{ .Values.global.authSidecar.ingressAllowedNamespaces | toJson }}
+    {{- end }}
     {{- else }}
     - podSelector:
         matchLabels:
diff --git a/charts/astronomer/templates/houston/api/houston-networkpolicy.yaml b/charts/astronomer/templates/houston/api/houston-networkpolicy.yaml
index 439350b49f..79a8e5fdef 100644
--- a/charts/astronomer/templates/houston/api/houston-networkpolicy.yaml
+++ b/charts/astronomer/templates/houston/api/houston-networkpolicy.yaml
@@ -26,6 +26,13 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    {{- if .Values.global.authSidecar.ingressAllowedNamespaces }}
+    - namespaceSelector:
+        matchExpressions:
+        - key: kubernetes.io/metadata.name
+          operator: In
+          values: {{ .Values.global.authSidecar.ingressAllowedNamespaces | toJson }}
+    {{- end }}
     {{- else }}
     - podSelector:
         matchLabels:
diff --git a/charts/astronomer/templates/houston/houston-configmap.yaml b/charts/astronomer/templates/houston/houston-configmap.yaml
index 6c258190fe..ec8e0dcaaf 100644
--- a/charts/astronomer/templates/houston/houston-configmap.yaml
+++ b/charts/astronomer/templates/houston/houston-configmap.yaml
@@ -113,6 +113,7 @@ data:
       {{- $authSidecar := include "authSidecar.image" . }}
       authSideCar:
         enabled: true
+        ingressAllowedNamespaces: {{ default (list) .Values.global.authSidecar.ingressAllowedNamespaces | toJson }}
         repository: {{ (splitList ":"  $authSidecar ) | first  }}
         tag: {{ (splitList ":"  $authSidecar ) | last  }}
         port: {{ .Values.global.authSidecar.port }}
diff --git a/charts/astronomer/templates/registry/registry-networkpolicy.yaml b/charts/astronomer/templates/registry/registry-networkpolicy.yaml
index 8169e36f3a..f8b374575e 100644
--- a/charts/astronomer/templates/registry/registry-networkpolicy.yaml
+++ b/charts/astronomer/templates/registry/registry-networkpolicy.yaml
@@ -86,6 +86,13 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    {{- if .Values.global.authSidecar.ingressAllowedNamespaces }}
+    - namespaceSelector:
+        matchExpressions:
+        - key: kubernetes.io/metadata.name
+          operator: In
+          values: {{ .Values.global.authSidecar.ingressAllowedNamespaces | toJson }}
+    {{- end }}
     {{- else }}
     - podSelector:
         matchLabels:
diff --git a/charts/grafana/templates/grafana-networkpolicy.yaml b/charts/grafana/templates/grafana-networkpolicy.yaml
index 1624a9a4e8..0e1d1678eb 100644
--- a/charts/grafana/templates/grafana-networkpolicy.yaml
+++ b/charts/grafana/templates/grafana-networkpolicy.yaml
@@ -26,6 +26,13 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    {{- if .Values.global.authSidecar.ingressAllowedNamespaces }}
+    - namespaceSelector:
+        matchExpressions:
+        - key: kubernetes.io/metadata.name
+          operator: In
+          values: {{ .Values.global.authSidecar.ingressAllowedNamespaces | toJson }}
+    {{- end }}
     {{- else }}
     - podSelector:
         matchLabels:
diff --git a/charts/kibana/templates/kibana-networkpolicy.yaml b/charts/kibana/templates/kibana-networkpolicy.yaml
index 6705ac5a8c..18897aaa3d 100644
--- a/charts/kibana/templates/kibana-networkpolicy.yaml
+++ b/charts/kibana/templates/kibana-networkpolicy.yaml
@@ -26,6 +26,13 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    {{- if .Values.global.authSidecar.ingressAllowedNamespaces }}
+    - namespaceSelector:
+        matchExpressions:
+        - key: kubernetes.io/metadata.name
+          operator: In
+          values: {{ .Values.global.authSidecar.ingressAllowedNamespaces | toJson }}
+    {{- end }}
     {{- else }}
     - podSelector:
         matchLabels:
diff --git a/charts/prometheus/templates/prometheus-networkpolicy.yaml b/charts/prometheus/templates/prometheus-networkpolicy.yaml
index a995833762..cf459611d6 100644
--- a/charts/prometheus/templates/prometheus-networkpolicy.yaml
+++ b/charts/prometheus/templates/prometheus-networkpolicy.yaml
@@ -36,6 +36,13 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    {{- if .Values.global.authSidecar.ingressAllowedNamespaces }}
+    - namespaceSelector:
+        matchExpressions:
+        - key: kubernetes.io/metadata.name
+          operator: In
+          values: {{ .Values.global.authSidecar.ingressAllowedNamespaces | toJson }}
+    {{- end }}
     {{- else }}
     - podSelector:
         matchLabels:
diff --git a/tests/chart_tests/test_authsidecar.py b/tests/chart_tests/test_authsidecar.py
index b8876f2d81..4f11f38607 100644
--- a/tests/chart_tests/test_authsidecar.py
+++ b/tests/chart_tests/test_authsidecar.py
@@ -1,4 +1,3 @@
-import jmespath
 import pytest
 import yaml
 
@@ -44,18 +43,18 @@ def test_authSidecar_alertmanager(self, kube_version):
         assert doc["metadata"]["name"] == "release-name-alertmanager"
         assert doc["spec"]["template"]["spec"]["containers"][1]["name"] == "auth-proxy"
 
-        assert jmespath.search("kind", docs[2]) == "Service"
-        assert jmespath.search("metadata.name", docs[2]) == "release-name-alertmanager"
-        assert jmespath.search("spec.type", docs[2]) == "ClusterIP"
+        assert "Service" == docs[2]["kind"]
+        assert "release-name-alertmanager" == docs[2]["metadata"]["name"]
+        assert "ClusterIP" == docs[2]["spec"]["type"]
         assert {
             "name": "auth-proxy",
             "protocol": "TCP",
             "port": 8084,
             "appProtocol": "tcp",
-        } in jmespath.search("spec.ports", docs[2])
+        } in docs[2]["spec"]["ports"]
 
         assert "NetworkPolicy" == docs[3]["kind"]
-        assert [{"port": 8084, "protocol": "TCP"}] == jmespath.search("spec.ingress[*].ports[1]", docs[3])
+        assert any(x["ports"][1] == {"protocol": "TCP", "port": 8084} for x in docs[3]["spec"]["ingress"])
 
     def test_authSidecar_houston_with_custom_resources(self, kube_version):
         """Test custom resources are applied on Houston"""
@@ -86,6 +85,7 @@ def test_authSidecar_houston_with_custom_resources(self, kube_version):
         expected_output = {
             "enabled": True,
             "repository": "someregistry.io/my-custom-image",
+            "ingressAllowedNamespaces": [],
             "tag": "my-custom-tag",
             "port": 8084,
             "pullPolicy": "IfNotPresent",
@@ -116,18 +116,18 @@ def test_authSidecar_prometheus(self, kube_version):
         assert doc["metadata"]["name"] == "release-name-prometheus"
         assert "auth-proxy" == doc["spec"]["template"]["spec"]["containers"][0]["name"]
 
-        assert "Service" == jmespath.search("kind", docs[2])
-        assert "release-name-prometheus" == jmespath.search("metadata.name", docs[2])
-        assert "ClusterIP" == jmespath.search("spec.type", docs[2])
+        assert "Service" == docs[2]["kind"]
+        assert "release-name-prometheus" == docs[2]["metadata"]["name"]
+        assert "ClusterIP" == docs[2]["spec"]["type"]
         assert {
             "name": "auth-proxy",
             "protocol": "TCP",
             "port": 8084,
             "appProtocol": "tcp",
-        } in jmespath.search("spec.ports", docs[2])
+        } in docs[2]["spec"]["ports"]
 
         assert "NetworkPolicy" == docs[3]["kind"]
-        assert [{"port": 8084, "protocol": "TCP"}] == jmespath.search("spec.ingress[*].ports[1]", docs[3])
+        assert any(x["ports"][1] == {"protocol": "TCP", "port": 8084} for x in docs[3]["spec"]["ingress"])
 
     def test_authSidecar_kibana(self, kube_version):
         """Test Kibana Service with authSidecar."""
@@ -150,21 +150,102 @@ def test_authSidecar_kibana(self, kube_version):
         assert doc["metadata"]["name"] == "release-name-kibana"
         assert "auth-proxy" == doc["spec"]["template"]["spec"]["containers"][1]["name"]
 
-        assert "Service" == jmespath.search("kind", docs[2])
-        assert "release-name-kibana" == jmespath.search("metadata.name", docs[2])
-        assert "ClusterIP" == jmespath.search("spec.type", docs[2])
+        assert "Service" == docs[2]["kind"]
+        assert "release-name-kibana" == docs[2]["metadata"]["name"]
+        assert "ClusterIP" == docs[2]["spec"]["type"]
         assert {
             "name": "auth-proxy",
             "protocol": "TCP",
             "port": 8084,
             "appProtocol": "tcp",
-        } in jmespath.search("spec.ports", docs[2])
+        } in docs[2]["spec"]["ports"]
 
         assert "NetworkPolicy" == docs[3]["kind"]
-        assert [{"namespaceSelector": {"matchLabels": {"network.openshift.io/policy-group": "ingress"}}}] == jmespath.search(
-            "spec.ingress[0].from", docs[3]
+        assert [
+            {"namespaceSelector": {"matchLabels": {"network.openshift.io/policy-group": "ingress"}}},
+        ] == docs[3]["spec"]["ingress"][0]["from"]
+        assert any(x["ports"][0] == {"protocol": "TCP", "port": 8084} for x in docs[3]["spec"]["ingress"])
+
+    def test_authSidecar_kibana_with_ingress_allowed_namespaces(self, kube_version):
+        """Test Kibana Service with authSidecar and allow some traffic namespaces."""
+        docs = render_chart(
+            kube_version=kube_version,
+            values={"global": {"authSidecar": {"enabled": True, "ingressAllowedNamespaces": ["astro", "ingress-namespace"]}}},
+            show_only=[
+                "charts/kibana/templates/kibana-deployment.yaml",
+                "charts/kibana/templates/kibana-auth-sidecar-configmap.yaml",
+                "charts/kibana/templates/kibana-service.yaml",
+                "charts/kibana/templates/kibana-networkpolicy.yaml",
+                "charts/kibana/templates/ingress.yaml",
+            ],
         )
-        assert {"port": 8084, "protocol": "TCP"} in jmespath.search("spec.ingress[*].ports[0]", docs[3])
+
+        assert len(docs) == 5
+        doc = docs[0]
+        assert doc["kind"] == "Deployment"
+        assert doc["apiVersion"] == "apps/v1"
+        assert doc["metadata"]["name"] == "release-name-kibana"
+        assert "auth-proxy" == doc["spec"]["template"]["spec"]["containers"][1]["name"]
+
+        assert "Service" == docs[2]["kind"]
+        assert "release-name-kibana" == docs[2]["metadata"]["name"]
+        assert "ClusterIP" == docs[2]["spec"]["type"]
+        assert {
+            "name": "auth-proxy",
+            "protocol": "TCP",
+            "port": 8084,
+            "appProtocol": "tcp",
+        } in docs[2]["spec"]["ports"]
+
+        assert "NetworkPolicy" == docs[3]["kind"]
+        assert [
+            {"namespaceSelector": {"matchLabels": {"network.openshift.io/policy-group": "ingress"}}},
+            {
+                "namespaceSelector": {
+                    "matchExpressions": [
+                        {"key": "kubernetes.io/metadata.name", "operator": "In", "values": ["astro", "ingress-namespace"]}
+                    ]
+                }
+            },
+        ] == docs[3]["spec"]["ingress"][0]["from"]
+        assert any(x["ports"][0] == {"protocol": "TCP", "port": 8084} for x in docs[3]["spec"]["ingress"])
+
+    def test_authSidecar_kibana_with_ingress_allowed_namespaces_empty(self, kube_version):
+        """Test Kibana Service with authSidecar and set no values in ingressAllowedNamespaces."""
+        docs = render_chart(
+            kube_version=kube_version,
+            values={"global": {"authSidecar": {"enabled": True, "ingressAllowedNamespaces": []}}},
+            show_only=[
+                "charts/kibana/templates/kibana-deployment.yaml",
+                "charts/kibana/templates/kibana-auth-sidecar-configmap.yaml",
+                "charts/kibana/templates/kibana-service.yaml",
+                "charts/kibana/templates/kibana-networkpolicy.yaml",
+                "charts/kibana/templates/ingress.yaml",
+            ],
+        )
+
+        assert len(docs) == 5
+        doc = docs[0]
+        assert doc["kind"] == "Deployment"
+        assert doc["apiVersion"] == "apps/v1"
+        assert doc["metadata"]["name"] == "release-name-kibana"
+        assert "auth-proxy" == doc["spec"]["template"]["spec"]["containers"][1]["name"]
+
+        assert "Service" == docs[2]["kind"]
+        assert "release-name-kibana" == docs[2]["metadata"]["name"]
+        assert "ClusterIP" == docs[2]["spec"]["type"]
+        assert {
+            "name": "auth-proxy",
+            "protocol": "TCP",
+            "port": 8084,
+            "appProtocol": "tcp",
+        } in docs[2]["spec"]["ports"]
+
+        assert "NetworkPolicy" == docs[3]["kind"]
+        assert [
+            {"namespaceSelector": {"matchLabels": {"network.openshift.io/policy-group": "ingress"}}},
+        ] == docs[3]["spec"]["ingress"][0]["from"]
+        assert any(x["ports"][0] == {"protocol": "TCP", "port": 8084} for x in docs[3]["spec"]["ingress"])
 
     def test_authSidecar_houston_configmap_without_annotation(self, kube_version):
         """Test Houston Configmap with authSidecar."""
@@ -190,6 +271,7 @@ def test_authSidecar_houston_configmap_without_annotation(self, kube_version):
         expected_output = {
             "enabled": True,
             "repository": "someregistry.io/my-custom-image",
+            "ingressAllowedNamespaces": [],
             "tag": "my-custom-tag",
             "port": 8084,
             "pullPolicy": "IfNotPresent",
@@ -226,6 +308,7 @@ def test_authSidecar_houston_configmap_with_annotation(self, kube_version):
         expected_output = {
             "enabled": True,
             "repository": "someregistry.io/my-custom-image",
+            "ingressAllowedNamespaces": [],
             "tag": "my-custom-tag",
             "port": 8084,
             "pullPolicy": "IfNotPresent",
@@ -260,6 +343,44 @@ def test_authSidecar_houston_configmap_with_securityContext(self, kube_version):
         prod = yaml.safe_load(docs[0]["data"]["production.yaml"])
         expected_output = {
             "enabled": True,
+            "ingressAllowedNamespaces": [],
+            "repository": "someregistry.io/my-custom-image",
+            "tag": "my-custom-tag",
+            "port": 8084,
+            "pullPolicy": "IfNotPresent",
+            "securityContext": {
+                "runAsUser": 1000,
+            },
+            "resources": default_resource,
+            "annotations": {},
+        }
+        assert expected_output == prod["deployments"]["authSideCar"]
+
+    def test_authSidecar_houston_configmap_with_ingress_allowed_namespace(self, kube_version):
+        """Test Houston Configmap with authSidecar ingressAllowedNamespaces."""
+        docs = render_chart(
+            kube_version=kube_version,
+            values={
+                "global": {
+                    "authSidecar": {
+                        "enabled": True,
+                        "ingressAllowedNamespaces": ["astronomer", "ingress"],
+                        "repository": "someregistry.io/my-custom-image",
+                        "tag": "my-custom-tag",
+                        "securityContext": {"runAsUser": 1000},
+                    },
+                }
+            },
+            show_only=[
+                "charts/astronomer/templates/houston/houston-configmap.yaml",
+            ],
+        )
+
+        common_houston_config_test_cases(docs)
+        prod = yaml.safe_load(docs[0]["data"]["production.yaml"])
+        expected_output = {
+            "enabled": True,
+            "ingressAllowedNamespaces": ["astronomer", "ingress"],
             "repository": "someregistry.io/my-custom-image",
             "tag": "my-custom-tag",
             "port": 8084,
@@ -271,3 +392,59 @@ def test_authSidecar_houston_configmap_with_securityContext(self, kube_version):
             "annotations": {},
         }
         assert expected_output == prod["deployments"]["authSideCar"]
+
+    def test_authSidecar_with_ingress_allowed_namespaces_empty(self, kube_version):
+        """Test All Services with authSidecar and set no values in ingressAllowedNamespaces.
+        Only include networkpolicies that have the network.openshift.io/policy-group: ingress label."""
+        docs = render_chart(
+            kube_version=kube_version,
+            values={"global": {"authSidecar": {"enabled": True, "ingressAllowedNamespaces": []}}},
+            show_only=[
+                "charts/alertmanager/templates/alertmanager-networkpolicy.yaml",
+                "charts/astronomer/templates/astro-ui/astro-ui-networkpolicy.yaml",
+                "charts/astronomer/templates/houston/api/houston-networkpolicy.yaml",
+                "charts/astronomer/templates/registry/registry-networkpolicy.yaml",
+                "charts/grafana/templates/grafana-networkpolicy.yaml",
+                "charts/kibana/templates/kibana-networkpolicy.yaml",
+                "charts/prometheus/templates/prometheus-networkpolicy.yaml",
+            ],
+        )
+
+        assert len(docs) == 7
+
+        for doc in docs:
+            assert "NetworkPolicy" == doc["kind"]
+            namespaceSelectors = doc["spec"]["ingress"][0]["from"]
+            assert {"namespaceSelector": {"matchLabels": {"network.openshift.io/policy-group": "ingress"}}} in namespaceSelectors
+
+    def test_authSidecar_all_services_with_ingress_allowed_namespaces(self, kube_version):
+        """Test All Services with authSidecar and allow some traffic namespaces.
+        Only include networkpolicies that have the network.openshift.io/policy-group: ingress label"""
+
+        docs = render_chart(
+            kube_version=kube_version,
+            values={"global": {"authSidecar": {"enabled": True, "ingressAllowedNamespaces": ["astro", "ingress-namespace"]}}},
+            show_only=[
+                "charts/alertmanager/templates/alertmanager-networkpolicy.yaml",
+                "charts/astronomer/templates/astro-ui/astro-ui-networkpolicy.yaml",
+                "charts/astronomer/templates/houston/api/houston-networkpolicy.yaml",
+                "charts/astronomer/templates/registry/registry-networkpolicy.yaml",
+                "charts/grafana/templates/grafana-networkpolicy.yaml",
+                "charts/kibana/templates/kibana-networkpolicy.yaml",
+                "charts/prometheus/templates/prometheus-networkpolicy.yaml",
+            ],
+        )
+
+        assert len(docs) == 7
+
+        for doc in docs:
+            assert "NetworkPolicy" == doc["kind"]
+            namespaceSelectors = doc["spec"]["ingress"][0]["from"]
+            assert {"namespaceSelector": {"matchLabels": {"network.openshift.io/policy-group": "ingress"}}} in namespaceSelectors
+            assert {
+                "namespaceSelector": {
+                    "matchExpressions": [
+                        {"key": "kubernetes.io/metadata.name", "operator": "In", "values": ["astro", "ingress-namespace"]}
+                    ]
+                }
+            } in namespaceSelectors
diff --git a/tests/chart_tests/test_houston_configmap.py b/tests/chart_tests/test_houston_configmap.py
index 15b2b20c17..6904a9dc9c 100644
--- a/tests/chart_tests/test_houston_configmap.py
+++ b/tests/chart_tests/test_houston_configmap.py
@@ -861,3 +861,39 @@ def test_houston_configmap_with_custom_airflow_ingress_annotation_disabled_with_
     doc = docs[0]
     prod_yaml = yaml.safe_load(doc["data"]["production.yaml"])
     assert not prod_yaml["deployments"]["helm"].get("ingress")
+
+
+def test_houston_configmap_with_authsidecar_ingress_allowed_namespaces_undefined():
+    """Validate the houston configmap should have empty array for ingressAllowedNamespaces."""
+    docs = render_chart(
+        values={"global": {"authSidecar": {"enabled": True}}},
+        show_only=["charts/astronomer/templates/houston/houston-configmap.yaml"],
+    )
+    assert len(docs) == 1
+    doc = docs[0]
+    prod_yaml = yaml.safe_load(doc["data"]["production.yaml"])
+    assert prod_yaml["deployments"]["authSideCar"].get("ingressAllowedNamespaces") == []
+
+
+def test_houston_configmap_with_authsidecar_ingress_allowed_namespaces_is_empty():
+    """Validate the houston configmap should have empty array for ingressAllowedNamespaces."""
+    docs = render_chart(
+        values={"global": {"authSidecar": {"enabled": True, "ingressAllowedNamespaces": []}}},
+        show_only=["charts/astronomer/templates/houston/houston-configmap.yaml"],
+    )
+    assert len(docs) == 1
+    doc = docs[0]
+    prod_yaml = yaml.safe_load(doc["data"]["production.yaml"])
+    assert prod_yaml["deployments"]["authSideCar"].get("ingressAllowedNamespaces") == []
+
+
+def test_houston_configmap_with_authsidecar_ingress_allowed_namespaces():
+    """Validate the houston configmap should have values in ingressAllowedNamespaces."""
+    docs = render_chart(
+        values={"global": {"authSidecar": {"enabled": True, "ingressAllowedNamespaces": ["astronomer", "ingress-namespace"]}}},
+        show_only=["charts/astronomer/templates/houston/houston-configmap.yaml"],
+    )
+    assert len(docs) == 1
+    doc = docs[0]
+    prod_yaml = yaml.safe_load(doc["data"]["production.yaml"])
+    assert prod_yaml["deployments"]["authSideCar"].get("ingressAllowedNamespaces") == ["astronomer", "ingress-namespace"]
diff --git a/values.yaml b/values.yaml
index f4802e03f1..aeb04a84f1 100644
--- a/values.yaml
+++ b/values.yaml
@@ -179,6 +179,7 @@ global:
     securityContext: {}
     readinessProbe: {}
     livenessProbe: {}
+    ingressAllowedNamespaces: []
     default_nginx_settings: |
       internal;
       proxy_pass_request_body     off;


Reviews:
user: login: pgvishnuram
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-02T05:06:32Z
user: login: pgvishnuram
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-02T05:06:52Z
user: login: pgvishnuram
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-02T05:06:58Z
user: login: pgvishnuram
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-02T05:07:04Z
user: login: pgvishnuram
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-02T05:07:12Z
user: login: pgvishnuram
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-02T05:07:49Z
user: login: karankhanchandani
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-02T05:36:34Z
user: login: karankhanchandani
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-02T05:39:22Z
user: login: pgvishnuram
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-02T06:47:45Z
user: login: pgvishnuram
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-02T06:51:32Z
user: login: pgvishnuram
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-02T07:04:23Z
user: login: rujhan-arora-astronomer
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-02T07:32:54Z
user: login: karankhanchandani
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-02T09:22:58Z
user: login: karankhanchandani
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-02T09:32:45Z
user: login: karankhanchandani
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-02T09:34:33Z
user: login: pgvishnuram
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-03T15:23:05Z
user: login: danielhoherd
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-04T17:41:17Z
user: login: danielhoherd
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-04T17:44:07Z
user: login: danielhoherd
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-04T17:45:49Z
user: login: danielhoherd
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-04T17:47:29Z
user: login: karankhanchandani
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-07T05:15:14Z
user: login: karankhanchandani
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-07T05:16:34Z
user: login: karankhanchandani
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-07T05:17:31Z
user: login: karankhanchandani
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-07T10:13:22Z
user: login: danielhoherd
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-08T19:44:48Z
user: login: danielhoherd
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-08T19:45:49Z
user: login: danielhoherd
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-08T19:48:30Z
user: login: karankhanchandani
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-10T05:44:10Z
user: login: karankhanchandani
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-10T07:52:03Z
user: login: rujhan-arora-astronomer
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-10T08:42:19Z
user: login: karankhanchandani
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-10T08:47:34Z
user: login: rujhan-arora-astronomer
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-10T09:08:59Z
user: login: karankhanchandani
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-10T09:16:04Z
user: login: rishkarajgi
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-10T09:27:29Z
user: login: rujhan-arora-astronomer
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-10T09:39:08Z
user: login: danielhoherd
body: During a meeting today we decided to remove `app.astronomer.io/allow-authsidecar-traffic` implementation and stick with only `ingressAllowedNamespaces` implementation. Those changes will need to be made before merging this branch.
state: CHANGES_REQUESTED
author_association: MEMBER
submitted_at: 2025-04-10T16:16:37Z
user: login: danielhoherd
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-10T18:45:34Z
user: login: rujhan-arora-astronomer
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-10T18:59:01Z
user: login: danielhoherd
body: Looks good! Great job on the tests!
state: APPROVED
author_association: MEMBER
submitted_at: 2025-04-10T19:03:49Z

Review comments:
diff_hunk: @@ -31,6 +31,14 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    - namespaceSelector:
+        matchLabels:
+          config.astronomer.io/allow-authsidecar-traffic: "true"
+    {{- range .Values.global.authSidecar.ingressAllowedNamespaces }}
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: {{ . }}
+    {{- end }}
path: charts/alertmanager/templates/alertmanager-networkpolicy.yaml
user: login: pgvishnuram
body: why do we need a range function here 
created_at: 2025-04-02T05:06:32Z
author_association: CONTRIBUTOR
diff_hunk: @@ -26,6 +26,14 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    - namespaceSelector:
+        matchLabels:
+          config.astronomer.io/allow-authsidecar-traffic: "true"
+    {{- range .Values.global.authSidecar.ingressAllowedNamespaces }}
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: {{ . }}
+    {{- end }}
path: charts/astronomer/templates/astro-ui/astro-ui-networkpolicy.yaml
user: login: pgvishnuram
body: why do we need a range function here
created_at: 2025-04-02T05:06:52Z
author_association: CONTRIBUTOR
diff_hunk: @@ -26,6 +26,14 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    - namespaceSelector:
+        matchLabels:
+          config.astronomer.io/allow-authsidecar-traffic: "true"
+    {{- range .Values.global.authSidecar.ingressAllowedNamespaces }}
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: {{ . }}
+    {{- end }}
path: charts/astronomer/templates/houston/api/houston-networkpolicy.yaml
user: login: pgvishnuram
body: why do we need a range function here
created_at: 2025-04-02T05:06:58Z
author_association: CONTRIBUTOR
diff_hunk: @@ -86,6 +86,14 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    - namespaceSelector:
+        matchLabels:
+          config.astronomer.io/allow-authsidecar-traffic: "true"
+    {{- range .Values.global.authSidecar.ingressAllowedNamespaces }}
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: {{ . }}
+    {{- end }}
path: charts/astronomer/templates/registry/registry-networkpolicy.yaml
user: login: pgvishnuram
body: why do we need a range function here
created_at: 2025-04-02T05:07:04Z
author_association: CONTRIBUTOR
diff_hunk: @@ -26,6 +26,14 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    - namespaceSelector:
+        matchLabels:
+          config.astronomer.io/allow-authsidecar-traffic: "true"
+    {{- range .Values.global.authSidecar.ingressAllowedNamespaces }}
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: {{ . }}
+    {{- end }}
path: charts/grafana/templates/grafana-networkpolicy.yaml
user: login: pgvishnuram
body: why do we need a range function here
created_at: 2025-04-02T05:07:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -86,6 +86,14 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    - namespaceSelector:
+        matchLabels:
+          config.astronomer.io/allow-authsidecar-traffic: "true"
path: charts/astronomer/templates/registry/registry-networkpolicy.yaml
user: login: pgvishnuram
body: ```suggestion
          app.astronomer.io/allow-authsidecar-traffic: "true"
```
created_at: 2025-04-02T05:07:49Z
author_association: CONTRIBUTOR
diff_hunk: @@ -31,6 +31,14 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    - namespaceSelector:
+        matchLabels:
+          config.astronomer.io/allow-authsidecar-traffic: "true"
+    {{- range .Values.global.authSidecar.ingressAllowedNamespaces }}
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: {{ . }}
+    {{- end }}
path: charts/alertmanager/templates/alertmanager-networkpolicy.yaml
user: login: karankhanchandani
body: I have added the `ingressAllowedNamespaces` as an array. That way it is extensible for any future usecases.
created_at: 2025-04-02T05:36:34Z
author_association: CONTRIBUTOR
diff_hunk: @@ -86,6 +86,14 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    - namespaceSelector:
+        matchLabels:
+          config.astronomer.io/allow-authsidecar-traffic: "true"
path: charts/astronomer/templates/registry/registry-networkpolicy.yaml
user: login: karankhanchandani
body: It was a config hence I set it to `config.astronomer.io`. Is `app.astronomer.io` a convention? What are we following in Astro?
created_at: 2025-04-02T05:39:22Z
author_association: CONTRIBUTOR
diff_hunk: @@ -31,6 +31,14 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    - namespaceSelector:
+        matchLabels:
+          config.astronomer.io/allow-authsidecar-traffic: "true"
+    {{- range .Values.global.authSidecar.ingressAllowedNamespaces }}
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: {{ . }}
+    {{- end }}
path: charts/alertmanager/templates/alertmanager-networkpolicy.yaml
user: login: pgvishnuram
body: we wont be having multiple ingress installation to the same platform from different base domains 
created_at: 2025-04-02T06:47:45Z
author_association: CONTRIBUTOR
diff_hunk: @@ -86,6 +86,14 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    - namespaceSelector:
+        matchLabels:
+          config.astronomer.io/allow-authsidecar-traffic: "true"
path: charts/astronomer/templates/registry/registry-networkpolicy.yaml
user: login: pgvishnuram
body: we already have a naming used within our app as astronomer.io/commander-sync for secret syncing 
created_at: 2025-04-02T06:51:32Z
author_association: CONTRIBUTOR
diff_hunk: @@ -31,6 +31,14 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    - namespaceSelector:
+        matchLabels:
+          config.astronomer.io/allow-authsidecar-traffic: "true"
path: charts/alertmanager/templates/alertmanager-networkpolicy.yaml
user: login: pgvishnuram
body: if we are going to rely on kubernetes.io/metadata.name for the ingress source we might not need this particular segment of the code in here 
created_at: 2025-04-02T07:04:23Z
author_association: CONTRIBUTOR
diff_hunk: @@ -31,6 +31,14 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    - namespaceSelector:
+        matchLabels:
+          config.astronomer.io/allow-authsidecar-traffic: "true"
+    {{- range .Values.global.authSidecar.ingressAllowedNamespaces }}
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: {{ . }}
+    {{- end }}
path: charts/alertmanager/templates/alertmanager-networkpolicy.yaml
user: login: rujhan-arora-astronomer
body: Yeah, I agree with @pgvishnuram . Since we have a single ingress as a source, there is no need to have a list of labels and use a range function.
created_at: 2025-04-02T07:32:28Z
author_association: CONTRIBUTOR
diff_hunk: @@ -31,6 +31,14 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    - namespaceSelector:
+        matchLabels:
+          config.astronomer.io/allow-authsidecar-traffic: "true"
+    {{- range .Values.global.authSidecar.ingressAllowedNamespaces }}
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: {{ . }}
+    {{- end }}
path: charts/alertmanager/templates/alertmanager-networkpolicy.yaml
user: login: karankhanchandani
body: @rujhan-arora-astronomer @pgvishnuram 

Ingress installation and Ingress traffic are two different things.

Ingress installation refers to setting up the necessary components, like an Ingress controller, to manage incoming traffic into a Kubernetes cluster.

"Ingress traffic" is the actual network traffic entering the cluster that is routed to specific services.

This authSidecar may receive traffic from any of the namespaces, which is why I made it configurable. As of now it is only receiving it from Kubernetes ingress. I don't see any issues with keeping it as an array. I don't see any drawback for keeping it as an array vs keeping a single value.

If you see a drawback for this approach, please let me know.
created_at: 2025-04-02T09:22:58Z
author_association: CONTRIBUTOR
diff_hunk: @@ -86,6 +86,14 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    - namespaceSelector:
+        matchLabels:
+          config.astronomer.io/allow-authsidecar-traffic: "true"
path: charts/astronomer/templates/registry/registry-networkpolicy.yaml
user: login: karankhanchandani
body: ok will change the naming.
created_at: 2025-04-02T09:32:45Z
author_association: CONTRIBUTOR
diff_hunk: @@ -31,6 +31,14 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    - namespaceSelector:
+        matchLabels:
+          config.astronomer.io/allow-authsidecar-traffic: "true"
path: charts/alertmanager/templates/alertmanager-networkpolicy.yaml
user: login: karankhanchandani
body: I kept this as fallback mechanism if customers don't specify any value in helm, they can label their namespace with this.
created_at: 2025-04-02T09:34:33Z
author_association: CONTRIBUTOR
diff_hunk: @@ -31,6 +31,14 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    - namespaceSelector:
+        matchLabels:
+          config.astronomer.io/allow-authsidecar-traffic: "true"
+    {{- range .Values.global.authSidecar.ingressAllowedNamespaces }}
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: {{ . }}
+    {{- end }}
path: charts/alertmanager/templates/alertmanager-networkpolicy.yaml
user: login: pgvishnuram
body: ingress controller src -> authSidecar( via vhosts)
created_at: 2025-04-03T15:23:05Z
author_association: CONTRIBUTOR
diff_hunk: @@ -161,9 +161,93 @@ def test_authSidecar_kibana(self, kube_version):
         } in jmespath.search("spec.ports", docs[2])
 
         assert "NetworkPolicy" == docs[3]["kind"]
-        assert [{"namespaceSelector": {"matchLabels": {"network.openshift.io/policy-group": "ingress"}}}] == jmespath.search(
-            "spec.ingress[0].from", docs[3]
+        assert [
+            {"namespaceSelector": {"matchLabels": {"network.openshift.io/policy-group": "ingress"}}},
+            {"namespaceSelector": {"matchLabels": {"app.astronomer.io/allow-authsidecar-traffic": "true"}}},
+        ] == jmespath.search("spec.ingress[0].from", docs[3])
+        assert {"port": 8084, "protocol": "TCP"} in jmespath.search("spec.ingress[*].ports[0]", docs[3])
+
+    def test_authSidecar_kibana_with_ingress_allowed_namespaces(self, kube_version):
+        """Test Kibana Service with authSidecar and allow some traffic namespaces."""
+        docs = render_chart(
+            kube_version=kube_version,
+            values={"global": {"authSidecar": {"enabled": True, "ingressAllowedNamespaces": ["astro", "ingress-namespace"]}}},
+            show_only=[
+                "charts/kibana/templates/kibana-deployment.yaml",
+                "charts/kibana/templates/kibana-auth-sidecar-configmap.yaml",
+                "charts/kibana/templates/kibana-service.yaml",
+                "charts/kibana/templates/kibana-networkpolicy.yaml",
+                "charts/kibana/templates/ingress.yaml",
+            ],
+        )
+
+        assert len(docs) == 5
+        doc = docs[0]
+        assert doc["kind"] == "Deployment"
+        assert doc["apiVersion"] == "apps/v1"
+        assert doc["metadata"]["name"] == "release-name-kibana"
+        assert "auth-proxy" == doc["spec"]["template"]["spec"]["containers"][1]["name"]
+
+        assert "Service" == jmespath.search("kind", docs[2])
+        assert "release-name-kibana" == jmespath.search("metadata.name", docs[2])
+        assert "ClusterIP" == jmespath.search("spec.type", docs[2])
+        assert {
+            "name": "auth-proxy",
+            "protocol": "TCP",
+            "port": 8084,
+            "appProtocol": "tcp",
+        } in jmespath.search("spec.ports", docs[2])
path: tests/chart_tests/test_authsidecar.py
user: login: danielhoherd
body: Yikes. We really need to stop using jmespath. I was going to suggest an alternate form here that does not use jmespath, but since this is the pattern we use elsewhere then I'll go ahead and approve this as is. We should probably rework our tests to not use jmespath wherever we don't get a huge benefit from it. Why? <https://danielhoherd.com/tech-notes/jmespath/#quotes-matter>
created_at: 2025-04-04T17:41:16Z
author_association: MEMBER
diff_hunk: @@ -271,3 +355,62 @@ def test_authSidecar_houston_configmap_with_securityContext(self, kube_version):
             "annotations": {},
         }
         assert expected_output == prod["deployments"]["authSideCar"]
+
+    def test_authSidecar_with_ingress_allowed_namespaces_empty(self, kube_version):
+        """Test All Services with authSidecar and set no values in ingressAllowedNamespaces."""
+        docs = render_chart(
+            kube_version=kube_version,
+            values={"global": {"authSidecar": {"enabled": True, "ingressAllowedNamespaces": []}}},
+            show_only=[
+                "charts/alertmanager/templates/alertmanager-networkpolicy.yaml",
+                "charts/astronomer/templates/astro-ui/astro-ui-networkpolicy.yaml",
+                "charts/astronomer/templates/houston/api/houston-networkpolicy.yaml",
+                "charts/astronomer/templates/registry/registry-networkpolicy.yaml",
+                "charts/grafana/templates/grafana-networkpolicy.yaml",
+                "charts/kibana/templates/kibana-networkpolicy.yaml",
+                "charts/prometheus/templates/prometheus-networkpolicy.yaml",
path: tests/chart_tests/test_authsidecar.py
user: login: danielhoherd
body: What is special about these templates? There are 7 listed, but we have 26 networkpolicy templates. If we can make this list dynamic that would be great. Something like `show_only=sorted([str(x.relative_to(git_root_dir)) for x in Path(git_root_dir).rglob("*networkpolicy*.yaml")])` <https://github.com/astronomer/astronomer/blob/3d62ca24da/tests/chart_tests/test_global_ingress_annotation.py#L17>
created_at: 2025-04-04T17:44:07Z
author_association: MEMBER
diff_hunk: @@ -161,9 +161,93 @@ def test_authSidecar_kibana(self, kube_version):
         } in jmespath.search("spec.ports", docs[2])
 
         assert "NetworkPolicy" == docs[3]["kind"]
-        assert [{"namespaceSelector": {"matchLabels": {"network.openshift.io/policy-group": "ingress"}}}] == jmespath.search(
-            "spec.ingress[0].from", docs[3]
+        assert [
+            {"namespaceSelector": {"matchLabels": {"network.openshift.io/policy-group": "ingress"}}},
+            {"namespaceSelector": {"matchLabels": {"app.astronomer.io/allow-authsidecar-traffic": "true"}}},
+        ] == jmespath.search("spec.ingress[0].from", docs[3])
+        assert {"port": 8084, "protocol": "TCP"} in jmespath.search("spec.ingress[*].ports[0]", docs[3])
+
+    def test_authSidecar_kibana_with_ingress_allowed_namespaces(self, kube_version):
+        """Test Kibana Service with authSidecar and allow some traffic namespaces."""
+        docs = render_chart(
+            kube_version=kube_version,
+            values={"global": {"authSidecar": {"enabled": True, "ingressAllowedNamespaces": ["astro", "ingress-namespace"]}}},
+            show_only=[
+                "charts/kibana/templates/kibana-deployment.yaml",
+                "charts/kibana/templates/kibana-auth-sidecar-configmap.yaml",
+                "charts/kibana/templates/kibana-service.yaml",
+                "charts/kibana/templates/kibana-networkpolicy.yaml",
+                "charts/kibana/templates/ingress.yaml",
+            ],
+        )
+
+        assert len(docs) == 5
+        doc = docs[0]
+        assert doc["kind"] == "Deployment"
+        assert doc["apiVersion"] == "apps/v1"
+        assert doc["metadata"]["name"] == "release-name-kibana"
+        assert "auth-proxy" == doc["spec"]["template"]["spec"]["containers"][1]["name"]
+
+        assert "Service" == jmespath.search("kind", docs[2])
+        assert "release-name-kibana" == jmespath.search("metadata.name", docs[2])
+        assert "ClusterIP" == jmespath.search("spec.type", docs[2])
path: tests/chart_tests/test_authsidecar.py
user: login: danielhoherd
body: These three uses of jmespath are especially unnecessary. These could all be simple value comparisons instead of searches, like `docs[2]['spec']['type'] == "ClusterIP"`
created_at: 2025-04-04T17:45:49Z
author_association: MEMBER
diff_hunk: @@ -271,3 +355,62 @@ def test_authSidecar_houston_configmap_with_securityContext(self, kube_version):
             "annotations": {},
         }
         assert expected_output == prod["deployments"]["authSideCar"]
+
+    def test_authSidecar_with_ingress_allowed_namespaces_empty(self, kube_version):
+        """Test All Services with authSidecar and set no values in ingressAllowedNamespaces."""
+        docs = render_chart(
+            kube_version=kube_version,
+            values={"global": {"authSidecar": {"enabled": True, "ingressAllowedNamespaces": []}}},
+            show_only=[
+                "charts/alertmanager/templates/alertmanager-networkpolicy.yaml",
+                "charts/astronomer/templates/astro-ui/astro-ui-networkpolicy.yaml",
+                "charts/astronomer/templates/houston/api/houston-networkpolicy.yaml",
+                "charts/astronomer/templates/registry/registry-networkpolicy.yaml",
+                "charts/grafana/templates/grafana-networkpolicy.yaml",
+                "charts/kibana/templates/kibana-networkpolicy.yaml",
+                "charts/prometheus/templates/prometheus-networkpolicy.yaml",
+            ],
+        )
+
+        assert len(docs) == 7
+
+        for doc in docs:
+            assert "NetworkPolicy" == doc["kind"]
+            namespaceSelectors = jmespath.search("spec.ingress[0].from", doc)
+            assert {"namespaceSelector": {"matchLabels": {"network.openshift.io/policy-group": "ingress"}}} in namespaceSelectors
+            assert {
+                "namespaceSelector": {"matchLabels": {"app.astronomer.io/allow-authsidecar-traffic": "true"}}
+            } in namespaceSelectors
+
+    def test_authSidecar_all_services_with_ingress_allowed_namespaces(self, kube_version):
+        """Test All Services with authSidecar and allow some traffic namespaces."""
+        docs = render_chart(
+            kube_version=kube_version,
+            values={"global": {"authSidecar": {"enabled": True, "ingressAllowedNamespaces": ["astro", "ingress-namespace"]}}},
+            show_only=[
+                "charts/alertmanager/templates/alertmanager-networkpolicy.yaml",
+                "charts/astronomer/templates/astro-ui/astro-ui-networkpolicy.yaml",
+                "charts/astronomer/templates/houston/api/houston-networkpolicy.yaml",
+                "charts/astronomer/templates/registry/registry-networkpolicy.yaml",
+                "charts/grafana/templates/grafana-networkpolicy.yaml",
+                "charts/kibana/templates/kibana-networkpolicy.yaml",
+                "charts/prometheus/templates/prometheus-networkpolicy.yaml",
path: tests/chart_tests/test_authsidecar.py
user: login: danielhoherd
body: Same comment as above, urging this list to be made dynamically.
created_at: 2025-04-04T17:47:29Z
author_association: MEMBER
diff_hunk: @@ -161,9 +161,93 @@ def test_authSidecar_kibana(self, kube_version):
         } in jmespath.search("spec.ports", docs[2])
 
         assert "NetworkPolicy" == docs[3]["kind"]
-        assert [{"namespaceSelector": {"matchLabels": {"network.openshift.io/policy-group": "ingress"}}}] == jmespath.search(
-            "spec.ingress[0].from", docs[3]
+        assert [
+            {"namespaceSelector": {"matchLabels": {"network.openshift.io/policy-group": "ingress"}}},
+            {"namespaceSelector": {"matchLabels": {"app.astronomer.io/allow-authsidecar-traffic": "true"}}},
+        ] == jmespath.search("spec.ingress[0].from", docs[3])
+        assert {"port": 8084, "protocol": "TCP"} in jmespath.search("spec.ingress[*].ports[0]", docs[3])
+
+    def test_authSidecar_kibana_with_ingress_allowed_namespaces(self, kube_version):
+        """Test Kibana Service with authSidecar and allow some traffic namespaces."""
+        docs = render_chart(
+            kube_version=kube_version,
+            values={"global": {"authSidecar": {"enabled": True, "ingressAllowedNamespaces": ["astro", "ingress-namespace"]}}},
+            show_only=[
+                "charts/kibana/templates/kibana-deployment.yaml",
+                "charts/kibana/templates/kibana-auth-sidecar-configmap.yaml",
+                "charts/kibana/templates/kibana-service.yaml",
+                "charts/kibana/templates/kibana-networkpolicy.yaml",
+                "charts/kibana/templates/ingress.yaml",
+            ],
+        )
+
+        assert len(docs) == 5
+        doc = docs[0]
+        assert doc["kind"] == "Deployment"
+        assert doc["apiVersion"] == "apps/v1"
+        assert doc["metadata"]["name"] == "release-name-kibana"
+        assert "auth-proxy" == doc["spec"]["template"]["spec"]["containers"][1]["name"]
+
+        assert "Service" == jmespath.search("kind", docs[2])
+        assert "release-name-kibana" == jmespath.search("metadata.name", docs[2])
+        assert "ClusterIP" == jmespath.search("spec.type", docs[2])
path: tests/chart_tests/test_authsidecar.py
user: login: karankhanchandani
body: I copy pasted from the previously written test cases. Do you think we should open a new PR for the changes that you are suggesting or do it in the same PR? I think it (code cleanup) is beyond the scope of this PR .
created_at: 2025-04-07T05:15:14Z
author_association: CONTRIBUTOR
diff_hunk: @@ -271,3 +355,62 @@ def test_authSidecar_houston_configmap_with_securityContext(self, kube_version):
             "annotations": {},
         }
         assert expected_output == prod["deployments"]["authSideCar"]
+
+    def test_authSidecar_with_ingress_allowed_namespaces_empty(self, kube_version):
+        """Test All Services with authSidecar and set no values in ingressAllowedNamespaces."""
+        docs = render_chart(
+            kube_version=kube_version,
+            values={"global": {"authSidecar": {"enabled": True, "ingressAllowedNamespaces": []}}},
+            show_only=[
+                "charts/alertmanager/templates/alertmanager-networkpolicy.yaml",
+                "charts/astronomer/templates/astro-ui/astro-ui-networkpolicy.yaml",
+                "charts/astronomer/templates/houston/api/houston-networkpolicy.yaml",
+                "charts/astronomer/templates/registry/registry-networkpolicy.yaml",
+                "charts/grafana/templates/grafana-networkpolicy.yaml",
+                "charts/kibana/templates/kibana-networkpolicy.yaml",
+                "charts/prometheus/templates/prometheus-networkpolicy.yaml",
path: tests/chart_tests/test_authsidecar.py
user: login: karankhanchandani
body: Let me check this and get back to you. I did a search of usage of old label `network.openshift.io/policy-group: ingress` and made changes where ever they were being used. I need to check if the other network policies require my change or not.
created_at: 2025-04-07T05:16:34Z
author_association: CONTRIBUTOR
diff_hunk: @@ -161,9 +161,93 @@ def test_authSidecar_kibana(self, kube_version):
         } in jmespath.search("spec.ports", docs[2])
 
         assert "NetworkPolicy" == docs[3]["kind"]
-        assert [{"namespaceSelector": {"matchLabels": {"network.openshift.io/policy-group": "ingress"}}}] == jmespath.search(
-            "spec.ingress[0].from", docs[3]
+        assert [
+            {"namespaceSelector": {"matchLabels": {"network.openshift.io/policy-group": "ingress"}}},
+            {"namespaceSelector": {"matchLabels": {"app.astronomer.io/allow-authsidecar-traffic": "true"}}},
+        ] == jmespath.search("spec.ingress[0].from", docs[3])
+        assert {"port": 8084, "protocol": "TCP"} in jmespath.search("spec.ingress[*].ports[0]", docs[3])
+
+    def test_authSidecar_kibana_with_ingress_allowed_namespaces(self, kube_version):
+        """Test Kibana Service with authSidecar and allow some traffic namespaces."""
+        docs = render_chart(
+            kube_version=kube_version,
+            values={"global": {"authSidecar": {"enabled": True, "ingressAllowedNamespaces": ["astro", "ingress-namespace"]}}},
+            show_only=[
+                "charts/kibana/templates/kibana-deployment.yaml",
+                "charts/kibana/templates/kibana-auth-sidecar-configmap.yaml",
+                "charts/kibana/templates/kibana-service.yaml",
+                "charts/kibana/templates/kibana-networkpolicy.yaml",
+                "charts/kibana/templates/ingress.yaml",
+            ],
+        )
+
+        assert len(docs) == 5
+        doc = docs[0]
+        assert doc["kind"] == "Deployment"
+        assert doc["apiVersion"] == "apps/v1"
+        assert doc["metadata"]["name"] == "release-name-kibana"
+        assert "auth-proxy" == doc["spec"]["template"]["spec"]["containers"][1]["name"]
+
+        assert "Service" == jmespath.search("kind", docs[2])
+        assert "release-name-kibana" == jmespath.search("metadata.name", docs[2])
+        assert "ClusterIP" == jmespath.search("spec.type", docs[2])
+        assert {
+            "name": "auth-proxy",
+            "protocol": "TCP",
+            "port": 8084,
+            "appProtocol": "tcp",
+        } in jmespath.search("spec.ports", docs[2])
path: tests/chart_tests/test_authsidecar.py
user: login: karankhanchandani
body: Thanks @danielhoherd for pointing this out. Let's create a ticket for it?
created_at: 2025-04-07T05:17:31Z
author_association: CONTRIBUTOR
diff_hunk: @@ -271,3 +355,62 @@ def test_authSidecar_houston_configmap_with_securityContext(self, kube_version):
             "annotations": {},
         }
         assert expected_output == prod["deployments"]["authSideCar"]
+
+    def test_authSidecar_with_ingress_allowed_namespaces_empty(self, kube_version):
+        """Test All Services with authSidecar and set no values in ingressAllowedNamespaces."""
+        docs = render_chart(
+            kube_version=kube_version,
+            values={"global": {"authSidecar": {"enabled": True, "ingressAllowedNamespaces": []}}},
+            show_only=[
+                "charts/alertmanager/templates/alertmanager-networkpolicy.yaml",
+                "charts/astronomer/templates/astro-ui/astro-ui-networkpolicy.yaml",
+                "charts/astronomer/templates/houston/api/houston-networkpolicy.yaml",
+                "charts/astronomer/templates/registry/registry-networkpolicy.yaml",
+                "charts/grafana/templates/grafana-networkpolicy.yaml",
+                "charts/kibana/templates/kibana-networkpolicy.yaml",
+                "charts/prometheus/templates/prometheus-networkpolicy.yaml",
path: tests/chart_tests/test_authsidecar.py
user: login: karankhanchandani
body: I don't think all of the network policy files require this change @danielhoherd 
created_at: 2025-04-07T10:13:22Z
author_association: CONTRIBUTOR
diff_hunk: @@ -161,9 +161,93 @@ def test_authSidecar_kibana(self, kube_version):
         } in jmespath.search("spec.ports", docs[2])
 
         assert "NetworkPolicy" == docs[3]["kind"]
-        assert [{"namespaceSelector": {"matchLabels": {"network.openshift.io/policy-group": "ingress"}}}] == jmespath.search(
-            "spec.ingress[0].from", docs[3]
+        assert [
+            {"namespaceSelector": {"matchLabels": {"network.openshift.io/policy-group": "ingress"}}},
+            {"namespaceSelector": {"matchLabels": {"app.astronomer.io/allow-authsidecar-traffic": "true"}}},
+        ] == jmespath.search("spec.ingress[0].from", docs[3])
+        assert {"port": 8084, "protocol": "TCP"} in jmespath.search("spec.ingress[*].ports[0]", docs[3])
+
+    def test_authSidecar_kibana_with_ingress_allowed_namespaces(self, kube_version):
+        """Test Kibana Service with authSidecar and allow some traffic namespaces."""
+        docs = render_chart(
+            kube_version=kube_version,
+            values={"global": {"authSidecar": {"enabled": True, "ingressAllowedNamespaces": ["astro", "ingress-namespace"]}}},
+            show_only=[
+                "charts/kibana/templates/kibana-deployment.yaml",
+                "charts/kibana/templates/kibana-auth-sidecar-configmap.yaml",
+                "charts/kibana/templates/kibana-service.yaml",
+                "charts/kibana/templates/kibana-networkpolicy.yaml",
+                "charts/kibana/templates/ingress.yaml",
+            ],
+        )
+
+        assert len(docs) == 5
+        doc = docs[0]
+        assert doc["kind"] == "Deployment"
+        assert doc["apiVersion"] == "apps/v1"
+        assert doc["metadata"]["name"] == "release-name-kibana"
+        assert "auth-proxy" == doc["spec"]["template"]["spec"]["containers"][1]["name"]
+
+        assert "Service" == jmespath.search("kind", docs[2])
+        assert "release-name-kibana" == jmespath.search("metadata.name", docs[2])
+        assert "ClusterIP" == jmespath.search("spec.type", docs[2])
path: tests/chart_tests/test_authsidecar.py
user: login: danielhoherd
body: If you're copy/pasting, it might be a good idea to do this one test case right, merge it, then we can circle back and refactor those other test cases. I don't think we should fix the other test cases in this PR.

If you want to leave it as is then that's fine too, since it was copy/pasted. I think it's more important for us to be consistent and have the same implementation for similar test cases than have different implementations for test cases that are doing similar things. So if we're not going to take the time to circle back and fix the other test cases, it's probably best to just leave it as is.
created_at: 2025-04-08T19:44:47Z
author_association: MEMBER
diff_hunk: @@ -271,3 +355,62 @@ def test_authSidecar_houston_configmap_with_securityContext(self, kube_version):
             "annotations": {},
         }
         assert expected_output == prod["deployments"]["authSideCar"]
+
+    def test_authSidecar_with_ingress_allowed_namespaces_empty(self, kube_version):
+        """Test All Services with authSidecar and set no values in ingressAllowedNamespaces."""
+        docs = render_chart(
+            kube_version=kube_version,
+            values={"global": {"authSidecar": {"enabled": True, "ingressAllowedNamespaces": []}}},
+            show_only=[
+                "charts/alertmanager/templates/alertmanager-networkpolicy.yaml",
+                "charts/astronomer/templates/astro-ui/astro-ui-networkpolicy.yaml",
+                "charts/astronomer/templates/houston/api/houston-networkpolicy.yaml",
+                "charts/astronomer/templates/registry/registry-networkpolicy.yaml",
+                "charts/grafana/templates/grafana-networkpolicy.yaml",
+                "charts/kibana/templates/kibana-networkpolicy.yaml",
+                "charts/prometheus/templates/prometheus-networkpolicy.yaml",
path: tests/chart_tests/test_authsidecar.py
user: login: danielhoherd
body: Can we put a comment in that says what is special about these? Like "only include networkpolicies that have the network.openshift.io/policy-group: ingress label" ?
created_at: 2025-04-08T19:45:49Z
author_association: MEMBER
diff_hunk: @@ -161,9 +161,93 @@ def test_authSidecar_kibana(self, kube_version):
         } in jmespath.search("spec.ports", docs[2])
 
         assert "NetworkPolicy" == docs[3]["kind"]
-        assert [{"namespaceSelector": {"matchLabels": {"network.openshift.io/policy-group": "ingress"}}}] == jmespath.search(
-            "spec.ingress[0].from", docs[3]
+        assert [
+            {"namespaceSelector": {"matchLabels": {"network.openshift.io/policy-group": "ingress"}}},
+            {"namespaceSelector": {"matchLabels": {"app.astronomer.io/allow-authsidecar-traffic": "true"}}},
+        ] == jmespath.search("spec.ingress[0].from", docs[3])
+        assert {"port": 8084, "protocol": "TCP"} in jmespath.search("spec.ingress[*].ports[0]", docs[3])
+
+    def test_authSidecar_kibana_with_ingress_allowed_namespaces(self, kube_version):
+        """Test Kibana Service with authSidecar and allow some traffic namespaces."""
+        docs = render_chart(
+            kube_version=kube_version,
+            values={"global": {"authSidecar": {"enabled": True, "ingressAllowedNamespaces": ["astro", "ingress-namespace"]}}},
+            show_only=[
+                "charts/kibana/templates/kibana-deployment.yaml",
+                "charts/kibana/templates/kibana-auth-sidecar-configmap.yaml",
+                "charts/kibana/templates/kibana-service.yaml",
+                "charts/kibana/templates/kibana-networkpolicy.yaml",
+                "charts/kibana/templates/ingress.yaml",
+            ],
+        )
+
+        assert len(docs) == 5
+        doc = docs[0]
+        assert doc["kind"] == "Deployment"
+        assert doc["apiVersion"] == "apps/v1"
+        assert doc["metadata"]["name"] == "release-name-kibana"
+        assert "auth-proxy" == doc["spec"]["template"]["spec"]["containers"][1]["name"]
+
+        assert "Service" == jmespath.search("kind", docs[2])
+        assert "release-name-kibana" == jmespath.search("metadata.name", docs[2])
+        assert "ClusterIP" == jmespath.search("spec.type", docs[2])
+        assert {
+            "name": "auth-proxy",
+            "protocol": "TCP",
+            "port": 8084,
+            "appProtocol": "tcp",
+        } in jmespath.search("spec.ports", docs[2])
path: tests/chart_tests/test_authsidecar.py
user: login: danielhoherd
body: Good call. I thought we already had one, but we don't. I created one. https://github.com/astronomer/issues/issues/7156
created_at: 2025-04-08T19:48:30Z
author_association: MEMBER
diff_hunk: @@ -86,6 +86,14 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    - namespaceSelector:
+        matchLabels:
+          config.astronomer.io/allow-authsidecar-traffic: "true"
+    {{- range .Values.global.authSidecar.ingressAllowedNamespaces }}
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: {{ . }}
+    {{- end }}
path: charts/astronomer/templates/registry/registry-networkpolicy.yaml
user: login: karankhanchandani
body: Removed the range functions and used IN operator and matchExpressions in namespaceSelectors. Refer the new change.
created_at: 2025-04-10T05:44:10Z
author_association: CONTRIBUTOR
diff_hunk: @@ -161,9 +161,93 @@ def test_authSidecar_kibana(self, kube_version):
         } in jmespath.search("spec.ports", docs[2])
 
         assert "NetworkPolicy" == docs[3]["kind"]
-        assert [{"namespaceSelector": {"matchLabels": {"network.openshift.io/policy-group": "ingress"}}}] == jmespath.search(
-            "spec.ingress[0].from", docs[3]
+        assert [
+            {"namespaceSelector": {"matchLabels": {"network.openshift.io/policy-group": "ingress"}}},
+            {"namespaceSelector": {"matchLabels": {"app.astronomer.io/allow-authsidecar-traffic": "true"}}},
+        ] == jmespath.search("spec.ingress[0].from", docs[3])
+        assert {"port": 8084, "protocol": "TCP"} in jmespath.search("spec.ingress[*].ports[0]", docs[3])
+
+    def test_authSidecar_kibana_with_ingress_allowed_namespaces(self, kube_version):
+        """Test Kibana Service with authSidecar and allow some traffic namespaces."""
+        docs = render_chart(
+            kube_version=kube_version,
+            values={"global": {"authSidecar": {"enabled": True, "ingressAllowedNamespaces": ["astro", "ingress-namespace"]}}},
+            show_only=[
+                "charts/kibana/templates/kibana-deployment.yaml",
+                "charts/kibana/templates/kibana-auth-sidecar-configmap.yaml",
+                "charts/kibana/templates/kibana-service.yaml",
+                "charts/kibana/templates/kibana-networkpolicy.yaml",
+                "charts/kibana/templates/ingress.yaml",
+            ],
+        )
+
+        assert len(docs) == 5
+        doc = docs[0]
+        assert doc["kind"] == "Deployment"
+        assert doc["apiVersion"] == "apps/v1"
+        assert doc["metadata"]["name"] == "release-name-kibana"
+        assert "auth-proxy" == doc["spec"]["template"]["spec"]["containers"][1]["name"]
+
+        assert "Service" == jmespath.search("kind", docs[2])
+        assert "release-name-kibana" == jmespath.search("metadata.name", docs[2])
+        assert "ClusterIP" == jmespath.search("spec.type", docs[2])
path: tests/chart_tests/test_authsidecar.py
user: login: karankhanchandani
body: @danielhoherd I have removed the usage of jmespec from this test file wherever necessary. You can link this PR as reference to the issue you have created. 
created_at: 2025-04-10T07:52:03Z
author_association: CONTRIBUTOR
diff_hunk: @@ -31,6 +31,16 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    - namespaceSelector:
path: charts/alertmanager/templates/alertmanager-networkpolicy.yaml
user: login: rujhan-arora-astronomer
body: Why do we have 2 different namespaceSelectors for this? Both app.astronomer.io/allow-authsidecar-traffic and ingressAllowedNamespaces
created_at: 2025-04-10T08:42:15Z
author_association: CONTRIBUTOR
diff_hunk: @@ -31,6 +31,16 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    - namespaceSelector:
path: charts/alertmanager/templates/alertmanager-networkpolicy.yaml
user: login: karankhanchandani
body: @rujhan-arora-astronomer 
This was already discussed and resolved here
https://github.com/astronomer/astronomer/pull/2566#discussion_r2024460873
https://github.com/astronomer/astronomer/pull/2566#discussion_r2024100764
created_at: 2025-04-10T08:47:34Z
author_association: CONTRIBUTOR
diff_hunk: @@ -31,6 +31,16 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    - namespaceSelector:
path: charts/alertmanager/templates/alertmanager-networkpolicy.yaml
user: login: rujhan-arora-astronomer
body: I still think it's un-needed and more code which we need to maintain. Sorry, I didn't pick it up in the draft PR but this is what I think.
created_at: 2025-04-10T09:08:59Z
author_association: CONTRIBUTOR
diff_hunk: @@ -31,6 +31,16 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    - namespaceSelector:
path: charts/alertmanager/templates/alertmanager-networkpolicy.yaml
user: login: karankhanchandani
body: @rujhan-arora-astronomer If we go with the single label approach `astronomer.io/allow-authsidecar-traffic` we have to **ASK** the customer to label their namespaces with this label. There might be some resistance (approvals, delays, etc) vs a CRE person (or us) updating the helm chart and adding customer's namespace in a field WE own.

I felt it would be wise to keep both approaches in urgent situations.
created_at: 2025-04-10T09:16:04Z
author_association: CONTRIBUTOR
diff_hunk: @@ -31,6 +31,16 @@ spec:
     - namespaceSelector:
         matchLabels:
           network.openshift.io/policy-group: ingress
+    - namespaceSelector:
path: charts/alertmanager/templates/alertmanager-networkpolicy.yaml
user: login: rujhan-arora-astronomer
body: I am suggesting only to use this - ingressAllowedNamespaces
created_at: 2025-04-10T09:39:01Z
author_association: CONTRIBUTOR
diff_hunk: @@ -150,20 +151,101 @@ def test_authSidecar_kibana(self, kube_version):
         assert doc["metadata"]["name"] == "release-name-kibana"
         assert "auth-proxy" == doc["spec"]["template"]["spec"]["containers"][1]["name"]
 
-        assert "Service" == jmespath.search("kind", docs[2])
-        assert "release-name-kibana" == jmespath.search("metadata.name", docs[2])
-        assert "ClusterIP" == jmespath.search("spec.type", docs[2])
+        assert "Service" == docs[2]["kind"]
+        assert "release-name-kibana" == docs[2]["metadata"]["name"]
+        assert "ClusterIP" == docs[2]["spec"]["type"]
         assert {
             "name": "auth-proxy",
             "protocol": "TCP",
             "port": 8084,
             "appProtocol": "tcp",
-        } in jmespath.search("spec.ports", docs[2])
+        } in docs[2]["spec"]["ports"]
 
         assert "NetworkPolicy" == docs[3]["kind"]
-        assert [{"namespaceSelector": {"matchLabels": {"network.openshift.io/policy-group": "ingress"}}}] == jmespath.search(
-            "spec.ingress[0].from", docs[3]
+        assert [
+            {"namespaceSelector": {"matchLabels": {"network.openshift.io/policy-group": "ingress"}}},
+        ] == docs[3]["spec"]["ingress"][0]["from"]
+        assert {"port": 8084, "protocol": "TCP"} in jmespath.search("spec.ingress[*].ports[0]", docs[3])
path: tests/chart_tests/test_authsidecar.py
user: login: danielhoherd
body: Let switch this type of check to
```suggestion
        assert any([x['ports'] == [{'protocol': 'TCP', 'port': 8084}] for x in docs[3]['spec']['ingress']])
```
then we can get rid of jmespath in this test.
created_at: 2025-04-10T18:45:34Z
author_association: MEMBER

PR comments:
user: login: rujhan-arora-astronomer
created_at: 2025-04-02T07:33:46Z
body: @karankhanchandani There's an option in the PR itself, to mark it as DRAFT. No need to add it in the title :)
author_association: CONTRIBUTOR
user: login: pgvishnuram
created_at: 2025-04-10T16:41:47Z
body: i still feel ingressAllowedNamespaces vs ingressNamespace is quite different 

```
authSidecar:
   enabled: true
   # this context is to define where is src installed ingress
   ingressAllowedNamespaces: ingressns1, ingressns1
```

```
authSidecar:
   enabled: true
   # this context is to define where is src installed ingress
   ingressNamespaces: ingressns1, ingressns1
```
this is not a blocker just thought of getting some naming clarification on this - can be ignored if not relevant
author_association: CONTRIBUTOR