27 lines
949 B
Python
27 lines
949 B
Python
|
from pathlib import Path
|
||
|
|
|
||
|
|
|
||
|
|
ROOT = Path(__file__).parents[1]
|
||
|
|
|
||
|
|
|
||
|
|
def test_whitehat_ingress_is_bound_to_namespace_and_target_labels():
|
||
|
|
documents = (ROOT / "deploy" / "networkpolicies.yaml").read_text().split("\n---\n")
|
||
|
|
policy = next(
|
||
|
|
document
|
||
|
|
for document in documents
|
||
|
|
if "name: audit-core-whitehat-ingress" in document
|
||
|
|
)
|
||
|
|
|
||
|
|
# Both selectors must remain in the same `from` peer. Splitting them into
|
||
|
|
# two list items changes AND to OR and would admit every pod in either set.
|
||
|
|
expected_peer = """ - namespaceSelector:
|
||
|
|
matchLabels:
|
||
|
|
kubernetes.io/metadata.name: whitehat
|
||
|
|
podSelector:
|
||
|
|
matchLabels:
|
||
|
|
whitehat.security/plane: \"true\"
|
||
|
|
whitehat.security/target: audit-core"""
|
||
|
|
assert expected_peer in policy
|
||
|
|
assert policy.count(" - namespaceSelector:") == 1
|
||
|
|
assert " - {protocol: TCP, port: 8080}" in policy
|