tegwick
5b5196eea7
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a025c2-407a-7a32-b40a-f37a52f03f62
26 lines
949 B
Python
26 lines
949 B
Python
from pathlib import Path
|
|
|
|
|
|
ROOT = Path(__file__).parents[1]
|
|
|
|
|
|
def test_whitehat_ingress_is_bound_to_namespace_and_target_labels():
|
|
documents = (ROOT / "deploy" / "networkpolicies.yaml").read_text().split("\n---\n")
|
|
policy = next(
|
|
document
|
|
for document in documents
|
|
if "name: audit-core-whitehat-ingress" in document
|
|
)
|
|
|
|
# Both selectors must remain in the same `from` peer. Splitting them into
|
|
# two list items changes AND to OR and would admit every pod in either set.
|
|
expected_peer = """ - namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: whitehat
|
|
podSelector:
|
|
matchLabels:
|
|
whitehat.security/plane: \"true\"
|
|
whitehat.security/target: audit-core"""
|
|
assert expected_peer in policy
|
|
assert policy.count(" - namespaceSelector:") == 1
|
|
assert " - {protocol: TCP, port: 8080}" in policy
|