ci: update helm chart for testing netpol enforcement

test-netpol-enforcement/Chart.yaml

@@ -0,0 +1,4 @@
+apiVersion: v2
+name: test-netpol-enforcement
+version: 0.1.0
+appVersion: 1.16.0

test-calico/templates/deployment.yaml → test-netpol-enforcement/templates/deployment.yaml

@@ -2,33 +2,24 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
- name: test-calico
- labels:
- app.kubernetes.io/name: test-calico
+ name: protected-webserver
 spec:
  replicas: 1
  selector:
  matchLabels:
- app.kubernetes.io/name: test-calico
+ app.kubernetes.io/name: protected-webserver
  template:
  metadata:
  labels:
- app.kubernetes.io/name: test-calico
- test-calico-access: protected
+ app.kubernetes.io/name: protected-webserver
  spec:
- serviceAccountName: test-calico
  containers:
- - name: test-calico
+ - name: nginx
  image: "nginx:{{ .Chart.AppVersion }}"
- imagePullPolicy: IfNotPresent
  ports:
  - name: http
  containerPort: 80
  protocol: TCP
- livenessProbe:
- httpGet:
- path: /
- port: http
  readinessProbe:
  httpGet:
  path: /

test-netpol-enforcement/templates/networkpolicy.yaml

@@ -0,0 +1,22 @@
+# This network policy targets the protected-webserver pod with regards to
+# ingress, thereby disallowing all inbound network connections unless allowed by
+# a rule. We provide one such rule, allowing access to the protected-webserer
+# from pods with a certain label.
+#
+# Two different pods will attempt to connect to the protected-webserver, one
+# with the label and one without, and we expect different results based on this
+# network policy.
+#
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+ name: allow-ingress-from-labelled-pods
+spec:
+ podSelector:
+ matchLabels:
+ app.kubernetes.io/name: protected-webserver
+ ingress:
+ - from:
+ - podSelector:
+ matchLabels:
+ access-to-protected-webserver: "true"

test-netpol-enforcement/templates/tests/test-netpol-enforcement.yaml

@@ -0,0 +1,42 @@
+---
+apiVersion: v1
+kind: Pod
+metadata:
+ name: "test-allowed-access"
+ labels:
+ access-to-protected-webserver: "true"
+ annotations:
+ helm.sh/hook: test-success
+spec:
+ restartPolicy: Never
+ containers:
+ - name: busybox
+ image: busybox
+ command:
+ - sh
+ - -c
+ - |
+ if ! wget -T5 test-calico:80; then
+ echo "FAIL: was not allowed, but should be allowed"
+ exit 1
+ fi
+---
+apiVersion: v1
+kind: Pod
+metadata:
+ name: "test-not-allowed-access"
+ annotations:
+ helm.sh/hook: test-success
+spec:
+ restartPolicy: Never
+ containers:
+ - name: busybox
+ image: busybox
+ command:
+ - sh
+ - -c
+ - |
+ if wget -T5 test-calico:80; then
+ echo "FAIL: was allowed, and shouldn't be allowed"
+ exit 1
+ fi