Repository: zegl/kube-score
Pull request #98 (2019-02-26 02:12:16)

parser: forward namespace names to pod template specs
Network policies start by checking namespace that is empty for pod inside deployments. Without this network policies tests that have namespace tests as the pod namespace is empty and the first comparison fails.

zegl: Hey @filintod, thanks for the patch!

There are a few cases that are not covered by your initial PR, please take this `.diff` file below and apply it (`git apply file.diff`). It will add the same fix for older versions of deployments, statefulsets, etc...

I would also like to have a test for this, that at least covers one of the kinds. The YAML below can be added to `score/testdata/networkpolicy-deployment-matching.yaml` to add the test. The diff file already contains the code to add the testcase. You can run all tests with `go test github.com/zegl/kube-score/...` if you want to verify that it's working properly.

Although not stated anywhere (I'll add proper contributing guidelines soon), this project follows a similar commit message structure as [Go](https://golang.org/doc/contribute.html#commit_messages).

Could I suggest to squash the commits into one, and change the message to

```
parser: forward namespace names to pod template specs
```

Thanks a lot for contributing!
/ Gustav

---

```diff
diff --git a/parser/internal/deamonset.go b/parser/internal/deamonset.go
index 0484036..e347a00 100644
--- a/parser/internal/deamonset.go
+++ b/parser/internal/deamonset.go
@@ -38,6 +38,7 @@ func (d Appsv1beta2DaemonSet) GetObjectMeta() metav1.ObjectMeta {
 }
 
 func (d Appsv1beta2DaemonSet) GetPodTemplateSpec() corev1.PodTemplateSpec {
+	d.Spec.Template.ObjectMeta.Namespace = d.ObjectMeta.Namespace
 	return d.Spec.Template
 }
 
@@ -54,5 +55,6 @@ func (d Extensionsv1beta1DaemonSet) GetObjectMeta() metav1.ObjectMeta {
 }
 
 func (d Extensionsv1beta1DaemonSet) GetPodTemplateSpec() corev1.PodTemplateSpec {
+	d.Spec.Template.ObjectMeta.Namespace = d.ObjectMeta.Namespace
 	return d.Spec.Template
 }
diff --git a/parser/internal/deployment.go b/parser/internal/deployment.go
index 8e8d431..0ec4568 100644
--- a/parser/internal/deployment.go
+++ b/parser/internal/deployment.go
@@ -39,6 +39,7 @@ func (d Appsv1beta1Deployment) GetObjectMeta() metav1.ObjectMeta {
 }
 
 func (d Appsv1beta1Deployment) GetPodTemplateSpec() corev1.PodTemplateSpec {
+	d.Spec.Template.ObjectMeta.Namespace = d.ObjectMeta.Namespace
 	return d.Spec.Template
 }
 
@@ -55,6 +56,7 @@ func (d Appsv1beta2Deployment) GetObjectMeta() metav1.ObjectMeta {
 }
 
 func (d Appsv1beta2Deployment) GetPodTemplateSpec() corev1.PodTemplateSpec {
+	d.Spec.Template.ObjectMeta.Namespace = d.ObjectMeta.Namespace
 	return d.Spec.Template
 }
 
@@ -71,5 +73,6 @@ func (d Extensionsv1beta1Deployment) GetObjectMeta() metav1.ObjectMeta {
 }
 
 func (d Extensionsv1beta1Deployment) GetPodTemplateSpec() corev1.PodTemplateSpec {
+	d.Spec.Template.ObjectMeta.Namespace = d.ObjectMeta.Namespace
 	return d.Spec.Template
 }
diff --git a/parser/internal/jobs.go b/parser/internal/jobs.go
index cc416e3..6ac8069 100644
--- a/parser/internal/jobs.go
+++ b/parser/internal/jobs.go
@@ -37,5 +37,6 @@ func (d Batchv1beta1CronJob) GetObjectMeta() metav1.ObjectMeta {
 }
 
 func (d Batchv1beta1CronJob) GetPodTemplateSpec() corev1.PodTemplateSpec {
+	d.Spec.JobTemplate.ObjectMeta.Namespace = d.ObjectMeta.Namespace
 	return d.Spec.JobTemplate.Spec.Template
 }
diff --git a/parser/internal/statefulset.go b/parser/internal/statefulset.go
index 3827fb8..3acd314 100644
--- a/parser/internal/statefulset.go
+++ b/parser/internal/statefulset.go
@@ -38,6 +38,7 @@ func (s Appsv1beta1StatefulSet) GetObjectMeta() metav1.ObjectMeta {
 }
 
 func (s Appsv1beta1StatefulSet) GetPodTemplateSpec() corev1.PodTemplateSpec {
+	s.Spec.Template.ObjectMeta.Namespace = s.ObjectMeta.Namespace
 	return s.Spec.Template
 }
 
@@ -54,5 +55,6 @@ func (s Appsv1beta2StatefulSet) GetObjectMeta() metav1.ObjectMeta {
 }
 
 func (s Appsv1beta2StatefulSet) GetPodTemplateSpec() corev1.PodTemplateSpec {
+	s.Spec.Template.ObjectMeta.Namespace = s.ObjectMeta.Namespace
 	return s.Spec.Template
 }
diff --git a/score/networkpolicy_test.go b/score/networkpolicy_test.go
index ab225c0..f24a327 100644
--- a/score/networkpolicy_test.go
+++ b/score/networkpolicy_test.go
@@ -31,3 +31,8 @@ func TestNetworkPolicyTargetsPodInDeployment(t *testing.T) {
 func TestNetworkPolicyTargetsPodNotMatching(t *testing.T) {
 	testExpectedScore(t, "networkpolicy-targets-pod-not-matching.yaml", "NetworkPolicy targets Pod", 1)
 }
+
+func TestNetworkPolicyNamespaceMatching(t *testing.T) {
+	testExpectedScore(t, "networkpolicy-deployment-matching.yaml", "NetworkPolicy targets Pod", 10)
+	testExpectedScore(t, "networkpolicy-deployment-matching.yaml", "Pod NetworkPolicy", 10)
+}
```

----

```yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: testapp-netpol
  namespace: testspace
spec:
  podSelector:
    matchLabels:
      app: foo
  policyTypes:
    - Egress
    - Ingress
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: statefulset-test-1
  namespace: testspace
spec:
  template:
    metadata:
      labels:
        app: foo
    spec:
      containers:
        - name: foobar
          image: foo:bar
```
filintod: done. check it and let me know if any change is needed.

Patch:
diff --git a/parser/internal/deamonset.go b/parser/internal/deamonset.go
index f90bd84..e347a00 100644
--- a/parser/internal/deamonset.go
+++ b/parser/internal/deamonset.go
@@ -21,6 +21,7 @@ func (d Appsv1DaemonSet) GetObjectMeta() metav1.ObjectMeta {
 }
 
 func (d Appsv1DaemonSet) GetPodTemplateSpec() corev1.PodTemplateSpec {
+	d.Spec.Template.ObjectMeta.Namespace = d.ObjectMeta.Namespace
 	return d.Spec.Template
 }
 
@@ -37,6 +38,7 @@ func (d Appsv1beta2DaemonSet) GetObjectMeta() metav1.ObjectMeta {
 }
 
 func (d Appsv1beta2DaemonSet) GetPodTemplateSpec() corev1.PodTemplateSpec {
+	d.Spec.Template.ObjectMeta.Namespace = d.ObjectMeta.Namespace
 	return d.Spec.Template
 }
 
@@ -53,5 +55,6 @@ func (d Extensionsv1beta1DaemonSet) GetObjectMeta() metav1.ObjectMeta {
 }
 
 func (d Extensionsv1beta1DaemonSet) GetPodTemplateSpec() corev1.PodTemplateSpec {
+	d.Spec.Template.ObjectMeta.Namespace = d.ObjectMeta.Namespace
 	return d.Spec.Template
 }
diff --git a/parser/internal/deployment.go b/parser/internal/deployment.go
index f5bced1..0ec4568 100644
--- a/parser/internal/deployment.go
+++ b/parser/internal/deployment.go
@@ -22,6 +22,7 @@ func (d Appsv1Deployment) GetObjectMeta() metav1.ObjectMeta {
 }
 
 func (d Appsv1Deployment) GetPodTemplateSpec() corev1.PodTemplateSpec {
+	d.Spec.Template.ObjectMeta.Namespace = d.ObjectMeta.Namespace
 	return d.Spec.Template
 }
 
@@ -38,6 +39,7 @@ func (d Appsv1beta1Deployment) GetObjectMeta() metav1.ObjectMeta {
 }
 
 func (d Appsv1beta1Deployment) GetPodTemplateSpec() corev1.PodTemplateSpec {
+	d.Spec.Template.ObjectMeta.Namespace = d.ObjectMeta.Namespace
 	return d.Spec.Template
 }
 
@@ -54,6 +56,7 @@ func (d Appsv1beta2Deployment) GetObjectMeta() metav1.ObjectMeta {
 }
 
 func (d Appsv1beta2Deployment) GetPodTemplateSpec() corev1.PodTemplateSpec {
+	d.Spec.Template.ObjectMeta.Namespace = d.ObjectMeta.Namespace
 	return d.Spec.Template
 }
 
@@ -70,5 +73,6 @@ func (d Extensionsv1beta1Deployment) GetObjectMeta() metav1.ObjectMeta {
 }
 
 func (d Extensionsv1beta1Deployment) GetPodTemplateSpec() corev1.PodTemplateSpec {
+	d.Spec.Template.ObjectMeta.Namespace = d.ObjectMeta.Namespace
 	return d.Spec.Template
 }
diff --git a/parser/internal/jobs.go b/parser/internal/jobs.go
index f8992b2..6ac8069 100644
--- a/parser/internal/jobs.go
+++ b/parser/internal/jobs.go
@@ -20,6 +20,7 @@ func (d Batchv1Job) GetObjectMeta() metav1.ObjectMeta {
 }
 
 func (d Batchv1Job) GetPodTemplateSpec() corev1.PodTemplateSpec {
+	d.Spec.Template.ObjectMeta.Namespace = d.ObjectMeta.Namespace
 	return d.Spec.Template
 }
 
@@ -36,5 +37,6 @@ func (d Batchv1beta1CronJob) GetObjectMeta() metav1.ObjectMeta {
 }
 
 func (d Batchv1beta1CronJob) GetPodTemplateSpec() corev1.PodTemplateSpec {
+	d.Spec.JobTemplate.ObjectMeta.Namespace = d.ObjectMeta.Namespace
 	return d.Spec.JobTemplate.Spec.Template
 }
diff --git a/parser/internal/statefulset.go b/parser/internal/statefulset.go
index c5b3920..3acd314 100644
--- a/parser/internal/statefulset.go
+++ b/parser/internal/statefulset.go
@@ -21,6 +21,7 @@ func (s Appsv1StatefulSet) GetObjectMeta() metav1.ObjectMeta {
 }
 
 func (s Appsv1StatefulSet) GetPodTemplateSpec() corev1.PodTemplateSpec {
+	s.Spec.Template.ObjectMeta.Namespace = s.ObjectMeta.Namespace
 	return s.Spec.Template
 }
 
@@ -37,6 +38,7 @@ func (s Appsv1beta1StatefulSet) GetObjectMeta() metav1.ObjectMeta {
 }
 
 func (s Appsv1beta1StatefulSet) GetPodTemplateSpec() corev1.PodTemplateSpec {
+	s.Spec.Template.ObjectMeta.Namespace = s.ObjectMeta.Namespace
 	return s.Spec.Template
 }
 
@@ -53,5 +55,6 @@ func (s Appsv1beta2StatefulSet) GetObjectMeta() metav1.ObjectMeta {
 }
 
 func (s Appsv1beta2StatefulSet) GetPodTemplateSpec() corev1.PodTemplateSpec {
+	s.Spec.Template.ObjectMeta.Namespace = s.ObjectMeta.Namespace
 	return s.Spec.Template
 }


Test patch:
diff --git a/score/networkpolicy_test.go b/score/networkpolicy_test.go
index ab225c0..f24a327 100644
--- a/score/networkpolicy_test.go
+++ b/score/networkpolicy_test.go
@@ -31,3 +31,8 @@ func TestNetworkPolicyTargetsPodInDeployment(t *testing.T) {
 func TestNetworkPolicyTargetsPodNotMatching(t *testing.T) {
 	testExpectedScore(t, "networkpolicy-targets-pod-not-matching.yaml", "NetworkPolicy targets Pod", 1)
 }
+
+func TestNetworkPolicyNamespaceMatching(t *testing.T) {
+	testExpectedScore(t, "networkpolicy-deployment-matching.yaml", "NetworkPolicy targets Pod", 10)
+	testExpectedScore(t, "networkpolicy-deployment-matching.yaml", "Pod NetworkPolicy", 10)
+}
diff --git a/score/testdata/networkpolicy-deployment-matching.yaml b/score/testdata/networkpolicy-deployment-matching.yaml
new file mode 100644
index 0000000..c041b1a
--- /dev/null
+++ b/score/testdata/networkpolicy-deployment-matching.yaml
@@ -0,0 +1,27 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: testapp-netpol
+  namespace: testspace
+spec:
+  podSelector:
+    matchLabels:
+      app: foo
+  policyTypes:
+    - Egress
+    - Ingress
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: statefulset-test-1
+  namespace: testspace
+spec:
+  template:
+    metadata:
+      labels:
+        app: foo
+    spec:
+      containers:
+        - name: foobar
+          image: foo:bar