Change:
<!-- Please only use this template for submitting enhancement requests --What would you like to be : Add missing unit test cases based on these and fair deviations when applied. - Allow Ingress traffic to an application</strike- - DENY all traffic from other namespaces (w/o NS selector)</strike- - Allow traffic from other namespaces (w/o NS selector) - Allow traffic multiple selector (OR) - DENY default-deny-egress from an app</strike- - DENY default-deny-all-egress from a namespace</strike- </strikeWhy is this needed: Increase the coverage of netpol tests Ref
/area tests /sig network
The label(s) cannot be applied, because the repository doesn't have them <detailsIn response to : /area tests /sig network Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
- Map of current netpol created by each test and it's descriptions.
hello can i take this issue?
feel free to come up with the ones in the list, just raise here the one you'll get and I update the comment.
maybe i take number 4
great, we are aiming at the new netpol e2e framework, some other examples:
/triage accepted /assign Amin, do you think this is a good first issue, with the current framework? If so we can gather some new contributors, and use your and skills for the review of the PRs :D
Can we carve this into 5 separate PRs ? I know was planning on taking a couple , but not sure which ones he was doing
YEap, this is the idea :D 1 issue, 5 or more PRs, good first issue, each people that wants pick one :)
absolutely, I think it applies since we have a lot of examples already /good-first-issue
2 other checkboxes plz :) can you add a checkbox for windows tests as well ? can you also add a checkbox for UDP coverage increases as well ? Right now we need to make sure some subset, at least , of the netpol suite will work on windows nodes, and curate the tags accordingly. Im investigating this on TKG (antrea) and AKS (calico) at the moment, and will collab w/ on the details ..
sure. LMK if you guys need more granularity on the list
Can I take up 5 - Allow traffic from other namespaces (w/o NS selector) ?
sure, LMK if you have any questions
great sounds like this is all carved up :) thanks
important note: <-- can you also please make sure your test cases arent already covered ? We have about 31 test cases in the new framework now. So, you might only need to verify that the tests exist/add a comment to them to describe them properly, in some cases. ( Lets try not to add redundant tests )
we are good to go. /remove-good-first-issue
/remove-help
- Getting the diff between the new and old suites coverage. one has one more test - one has UDP - The new ones under have more tests. This is true for . We are missing coverage of:
any progress here? I'm available on Slack if you guys want to chat.
/close Windows tests are on
Closing this issue. <detailsIn response to : /close Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/reopen
Reopened this issue. <detailsIn response to : /reopen Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Using this issue as umbrela to:
Can we add the endPort test here, just to increase this coverage?
moved the port range tests to

Discussion:
ValidateOrFail(k8s, model, &TestCase{ToPort: 80, Protocol: v1.ProtocolTCP, Reachability: reachability}) }) <ins> ginkgo.It("should enforce ingress policy allowing any port traffic to a server on a specific protocol [Feature:NetworkPolicy] [Feature:UDP]", func() { nsX, _, _, model, k8s := getK8SModel(f) policy := GetAllowIngressByProtocol("allow-ingress-by-proto", map[string]string{"pod": "a"}, &protocolTCP) CreatePolicy(k8s, policy, nsX) reachabilityTCP := NewReachability(model.AllPods(), true) ValidateOrFail(k8s, model, &TestCase{ToPort: 80, Protocol: v1.ProtocolTCP, Reachability: reachabilityTCP}) reachabilityUDP := NewReachability(model.AllPods(), true) reachabilityUDP.ExpectPeer(&Peer{}, &Peer{Namespace: nsX, Pod: "a"}, false) ValidateOrFail(k8s, model, &TestCase{ToPort: 80, Protocol: v1.ProtocolUDP, Reachability: reachabilityUDP}) }) </ins> ginkgo.It("should enforce multiple ingress policies with ingress allow-all policy taking precedence [Feature:NetworkPolicy]", func() { nsX, _, _, model, k8s := getK8SModel(f) policyAllowOnlyPort80 := GetAllowIngressByPort("allow-ingress-port-80", &intstr.IntOrString{Type: intstr.Int, IntVal: 80})

return policy } <ins> // GetAllowIngressByProtocol allows ingress for any ports on a specific protocol. func GetAllowIngressByProtocol(name string, targetLabels map[string]string, protocol *v1.Protocol) *networkingv1.NetworkPolicy { policy := &networkingv1.NetworkPolicy{ ObjectMeta: metav1.ObjectMeta{ Name: name, }, Spec: networkingv1.NetworkPolicySpec{ PodSelector: metav1.LabelSelector{ MatchLabels: targetLabels, }, Ingress: []networkingv1.NetworkPolicyIngressRule{{ Ports: []networkingv1.NetworkPolicyPort{ { Protocol: protocol, }, }, }}, }, } return policy } </ins> // GetAllowIngressByNamespaceOrPod allows ingress for pods with matching namespace OR pod labels func GetAllowIngressByNamespaceOrPod(name string, targetLabels map[string]string, peerNamespaceSelector *metav1.LabelSelector, peerPodSelector *metav1.LabelSelector) *networkingv1.NetworkPolicy { policy := &networkingv1.NetworkPolicy{